Threat Intelligence Brief - Saturday, July 18, 2026

Operational threat reporting for defenders who need signal, not noise.

By DevSecOpsDad
Posted on July 18, 2026

Threat Radar

  • IMMEDIATE: Inc ransomware is actively chaining two SonicWall SMA zero-days to achieve root-level access on remote access appliances — patch or isolate now.

  • IMMEDIATE: A public proof-of-concept exists for wp2shell, a WordPress core RCE flaw exploitable by unauthenticated HTTP requests — mass exploitation is likely already underway.

  • The NadMesh botnet is systematically harvesting AWS keys and Kubernetes tokens from internet-exposed AI services; the operator’s dashboard reportedly holds over 3,800 unique AWS keys.

  • Seven malicious npm packages (ViteVenom campaign) targeting the Vite ecosystem deliver a RAT via blockchain-based C2, complicating traditional network-based blocking.

  • APT-linked threat cluster CylindricalCanine (GoldenEyeDog / APT-Q-27) stole code-signing certificates from DigiCert in April 2026 — software signed with potentially compromised certificates warrants immediate scrutiny.

  • Abbott Laboratories is investigating two concurrent incidents involving unauthorized access and alleged data theft, with active extortion claims — healthcare sector targeting remains elevated.



Immediate Action Required

  • SonicWall SMA — Zero-Day Exploitation in Progress: Inc ransomware is actively exploiting two chained vulnerabilities (T1190) to gain root on SMA appliances. Treat any internet-facing SonicWall SMA device as a breach-in-progress scenario. Apply vendor patches immediately; if patches are unavailable, restrict access and review logs for indicators of compromise.

  • WordPress — Unauthenticated RCE (wp2shell): A working public exploit exists for a WordPress core flaw enabling unauthenticated code execution. Patch all internet-facing WordPress instances immediately. Confirm your hosting provider or WAF has applied mitigations — do not defer to a scheduled maintenance window.

  • AWS / Kubernetes — Credential Exposure via AI Services: If your organization runs ComfyUI, Ollama, Langflow, n8n, Open WebUI, or Gradio with any internet exposure, audit immediately for credential leakage. Rotate any AWS keys or Kubernetes tokens accessible from those environments. Verify Shodan does not index your AI service endpoints.



High-Impact Developments

Inc Ransomware Exploits Chained SonicWall SMA Zero-Days

  • What happened: Inc ransomware operators are exploiting two chained zero-day vulnerabilities in SonicWall Secure Mobile Access (SMA) appliances. Chained, the flaws allow attackers to escalate to root-level access, providing a direct foothold into the network perimeter.

  • Why it matters: Edge appliance compromises are among the fastest paths to enterprise-wide ransomware deployment. Root access on an SMA device means full control over remote access infrastructure — VPN sessions, credentials in transit, and network segmentation boundaries.

  • Who should care: Executive leadership, IT operations, network security, SOC teams managing SonicWall infrastructure.

  • Recommended action: Apply SonicWall patches immediately. If patches are unavailable, take SMA devices offline or restrict to trusted IP ranges. Audit authentication logs for anomalous sessions. Confirm incident response readiness.

  • Confidence: High — active exploitation confirmed.

  • Search metadata: T1190, SonicWall SMA, Inc ransomware, zero-day, Ransomware, Privilege Escalation

Intelligence Context



WordPress Core RCE (wp2shell) — Public Exploit, Active Exploitation

  • What happened: A critical vulnerability in WordPress core, dubbed wp2shell, allows unauthenticated attackers to execute arbitrary code via a standard HTTP request. CVE IDs have been assigned, the full exploitation mechanism has been published, and a working proof-of-concept is publicly available. A persistent-object-cache condition is part of the attack surface.

  • Why it matters: Unauthenticated RCE with a public PoC means automated mass exploitation is not a future risk — it is a present one. Any unpatched instance is open to full compromise.

  • Who should care: Application security teams, web platform owners, IT operations, anyone responsible for WordPress-based properties.

  • Recommended action: Patch all WordPress core installations immediately. Verify WAF rules are active and blocking exploit patterns. Audit web server logs for anomalous POST requests. Confirm managed hosting providers have applied updates.

  • Confidence: High — exploitation confirmed, public PoC available.

  • Search metadata: T1190, WordPress, wp2shell, RCE, unauthenticated, Remote Code Execution

Intelligence Context



NadMesh Botnet Targets Exposed AI Services for Cloud Credential Harvesting

  • What happened: A Go-based botnet called NadMesh, active since early July 2026, uses Shodan to identify internet-exposed AI services — including ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio — and harvests AWS keys and Kubernetes tokens from them. The operator’s dashboard reportedly contains over 3,800 unique AWS keys.

  • Why it matters: AI tooling is frequently deployed by engineering and data science teams outside standard security review processes, often with broad cloud permissions attached. Compromised AWS keys or Kubernetes tokens enable lateral movement, data exfiltration, and resource abuse at scale.

  • Who should care: Cloud security, DevOps, platform engineering, AI/ML engineering teams, SOC.

  • Recommended action: Inventory all internet-facing AI service deployments. Verify none are indexed by Shodan. Rotate AWS keys and Kubernetes tokens associated with those environments. Restrict AI service exposure to internal networks or VPNs.

  • Confidence: High — active botnet operation with documented credential collection confirmed.

  • Search metadata: T1592, T1526, NadMesh, AWS, Kubernetes, ComfyUI, Ollama, Langflow, Credential Theft, Botnet

Intelligence Context



ViteVenom Supply Chain Campaign Delivers RAT via Blockchain C2

  • What happened: Checkmarx identified seven malicious npm packages targeting the Vite frontend tooling ecosystem as part of a campaign called ViteVenom — an expansion of the previously observed ChainVeil operation. The packages install a remote access trojan (RAT) that uses blockchain-based command and control infrastructure, rendering traditional domain-based blocking ineffective.

  • Why it matters: Developers installing Vite-adjacent packages are the target. A RAT in a developer environment exposes source code, secrets, build pipelines, and potentially downstream production deployments. Blockchain C2 significantly raises the bar for severing attacker communications.

  • Who should care: Application security, software engineering, DevOps, and SOC teams with JavaScript/Node.js build pipelines.

  • Recommended action: Audit npm dependencies for the seven identified malicious packages. Review recent package installs in Vite-based projects. Enforce software composition analysis (SCA) in CI/CD pipelines. Treat any developer workstation that installed affected packages as potentially compromised.

  • Confidence: High — active campaign confirmed by Checkmarx research.

  • Search metadata: T1195, ViteVenom, ChainVeil, npm, Vite, RAT, Supply Chain Attack, Remote Access Trojan

Intelligence Context



GoldenEyeDog APT Subgroup Attributed to DigiCert Code-Signing Certificate Theft

  • What happened: Expel has attributed the April 2026 DigiCert breach to CylindricalCanine, a subgroup of GoldenEyeDog (also tracked as APT-Q-27, Dragon Breath, and Miuuti Group). The breach resulted in the theft of code-signing certificates from DigiCert’s infrastructure.

  • Why it matters: Stolen code-signing certificates from a major CA allow threat actors to sign malware with trusted credentials, bypassing endpoint controls that rely on certificate validation. This signals a sophisticated APT actively targeting PKI infrastructure — a supply chain trust problem that does not resolve with a single patch.

  • Who should care: Executive leadership, PKI and certificate management teams, security operations, software supply chain owners.

  • Recommended action: Confirm with DigiCert whether certificates issued to your organization may be affected. Review your certificate inventory for anomalous issuances around April 2026. Re-verify recently signed software where warranted. Monitor DigiCert’s revocation notices.

  • Confidence: Medium — attribution is researcher-assessed; full scope of stolen certificates not yet public.

  • Search metadata: GoldenEyeDog, CylindricalCanine, APT-Q-27, DigiCert, code-signing, Certificate Theft, Breach

Intelligence Context



Monitor Only



Analyst Observation

Today’s brief reflects a threat environment where attackers are outpacing patch cycles on multiple fronts simultaneously. The SonicWall and WordPress items are not theoretical — both have confirmed exploitation, and the WordPress PoC lowers the bar for any competent attacker. NadMesh is a direct consequence of AI tooling deployed without the security rigor applied to traditional infrastructure; 3,800-plus harvested AWS keys is not a research finding, it is an operational crisis for whoever owns those credentials. The DigiCert attribution warrants the most sustained attention: a nation-state-linked group targeting a root CA for code-signing certificates is a supply chain trust problem with a long tail. PKI teams should be auditing certificate inventories now, not after a signed malware sample surfaces in their environment.





Generated by DevSecOpsDadAttack cyber threat intelligence.

Tags:  Cyber-Security-News  T1190  T1195  T1592  T1526  LabCentral  Linux  AWS  Kubernetes  WordPress  wp2shell  RCE
DevSecOpsDadAttack!
Share: X (Twitter) LinkedIn