Weekly Situation Report — 7/27/26

Ernst & Young (EY) is investigating a data breach that may have exposed sensitive corporate information.
Attackers are abusing Microsoft 365 calendars as a covert command-and-control channel in the Hollowgraph malware campaign.
The Wp2Shell vulnerability is now being actively exploited in the wild to compromise vulnerable WordPress sites.
The SharePoint remote code execution vulnerability CVE-2026-50522 has reportedly been exploited in real-world attacks.
The Chaos ransomware group is deploying msaRAT using covert browser-based command-and-control communications over WebRTC and TURN relay servers.

1. Ernst & Young (EY) Investigates Data Breach

Summary

Ernst & Young (EY) disclosed a breach of a third-party IT support system holding client tax information. An unauthorized party accessed the system between March 28 and April 12, 2026, and downloaded multiple documents. So far, no misuse of the exposed files has been detected.

Category: Confirmed Breach

Industry: Financial and Fintech, Technology, Public Sector and Government Administration

Sources

Analyst comments

EY identified a breach linked to unauthorized access of a third-party IT support system between March 28 and April 12, 2026, which exposed documents containing client tax information. EY first detected the incident on April 23, 2026, and engaged an independent cybersecurity firm, which confirmed the unauthorized access had already stopped by the time of its response. The number of affected clients remains unclear. As sensitive personal and financial data may have been exposed, EY is providing two years of identity monitoring and restoration services through Experian.

This activity fits the victimology and tradecraft of COM-affiliated actors, though no definitive attribution has been made and the intrusion may not be the work of the same threat actor. The pattern of abuse detailed by other researchers includes abuse of valid accounts, exploitation of publicly served software, abuse of trust relationships, and automated exfiltration, all of which match past intrusions of ticketing systems. EY’s size also fits the profile of targets favored by these actors, who rely heavily on social engineering in their campaigns, as the SLSH (Scattered Lapsus$ Shiny Hunters) campaigns did last year. Emerging extortion groups have since adopted the same approach, running a string of breaches against third-party support and support portal systems, including this year’s LastPass compromise via Klue, Hims & Hers, and Discord in 2025. So far, no group has claimed responsibility for the EY breach, and we have seen no related posts on the underground forums and dark web resources available to us.

Update: This has been claimed by ShinyHunters.

Actionable guidance

Organizations should assess what sensitive documents they have shared with EY through the affected support portals and ticketing systems, and determine the resulting risk to employees and to the business where tax and financial information is involved. Any organization using third-party support and related portals, particularly those serving large customers, should audit those providers, review how much access support staff hold to confidential data, and establish a documented process for vetting support personnel and their credentials to limit abuse through social engineering. Data classification and restriction policies should be fully enforced so that sensitive and confidential information is not shared over insecure channels. At the user level, MFA should be required for all accounts, and service accounts not associated with a human employee should comply with hardened security policies and be barred from interactive login functions normally reserved for users. Affected users and customers should monitor their credit reports, bank accounts, and other financial assets for signs of abuse.

2. Microsoft 365 calendars used in Hollowgraph Campaign

Summary

HOLLOWGRAPH is malware that hides commands and stolen data in future-dated appointments on compromised Microsoft 365 calendars, blending into legitimate traffic and evading detection of a targeted espionage operation.

Category: State-Sponsored Espionage

Industry: Technology, Public Sector and Government Administration, Healthcare (primarily locations in Israel and allies)

Sources

Analyst comments

Researchers have uncovered HOLLOWGRAPH, an espionage malware component that uses Microsoft 365 calendars for command-and-control, storing instructions and stolen data in encrypted calendar events dated May 13, 2050. The malware retrieves tasking from one event and uploads stolen files to another via legitimate Graph API requests, blending into regular traffic and periodically refreshing credentials through DNS tunneling to maintain connectivity. It is associated with the Cavern framework with high confidence, and the operation appears highly targeted rather than widespread.

Operationally, the threat actor uses the Microsoft 365 calendar through the Graph API once the loader and implant are established on a victim workstation. The actor creates calendar items far in the future, such as the 2050 dates in the reported examples, so the user does not notice them. Each event carries an attachment named File<number>.txt whose contents are encrypted with AES-256-GCM using the C2 server’s public key. This is the primary channel for both tasking and exfiltration. DNS tunneling serves as a fallback when the Graph API calendar channel fails, and known samples use cloudlanecdn[.]com as its hosting domain. Those domains still resolve successfully and so appear to remain in use, though we identified no further samples for analysis.

The technique is currently tied this threat actor alone, but public reporting could popularize it and lead other groups to adopt it in the future

Actionable guidance

Administrators should review audit trails for calendar events created with dates set beyond the current year. Access records, OAuth2 registrations, and user device logs should also be audited, since findings there would indicate an intrusion. All user accounts should have MFA applied, and credentials for both users and services accounts should be rotated regularly.

3. LabubaRAT malware infiltrates Windows systems while posing as NVIDIA software

Summary

LabubaRAT is a Rust-based remote access tool that poses as NVIDIA software and gives operators broad post-compromise capability on Windows systems, with multiple communication channels and configuration supplied at runtime.

Category: Threat Actor Activities

Industry: Finance, Technology

Sources

Analyst comments

LabubaRAT is a Rust-based remote access tool that disguises itself as NVIDIA software to support post-compromise operations on Windows systems, including host profiling, identifying security tooling, receiving commands, transferring files, capturing screenshots, and proxying network traffic through compromised systems. It receives its configuration at runtime via command-line arguments or environment variables, which allows flexible deployment across campaigns and infrastructure. It supports HTTPS polling, Microsoft Edge WebView2, and DNS tunneling to maintain connectivity, and establishes persistence by creating a registry key that runs it automatically after reboot.

The malware is likely an emerging campaign and malware-as-a-service (MaaS) offering in a slow ramp up, and we identified additional IOCs after the original source report was published. We pivoted on page titles matching “LabubaPanel” and on favicon matches to the “Labubu” monster collectible, popularized by K-pop idols and created by Hong Kong illustrator Kasing Lung. The campaign hosts most of its infrastructure on Cloudflare (AS13335), and the locations of that infrastructure suggest targets in North America and the EU. The initial infection vector may be ClickFix tactics, using Google sites for hosting and iframes to display the primary landing page (sharing-file[.]com in the samples analyzed). Persistence artifacts are fairly typical, relying on the user-land Run and RunOnce registry keys (HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run, RunOnce]). The ClickFix samples analyzed were heavily obfuscated with a few identifiable code blocks separated by newline-delimited strings of mostly lowercase and uppercase letters.

ClickFix was identified as the vector for initial contact with victims, but the threat actor’s use of NVIDIA themed file names suggests watering hole tactics as well, and a plan to trojanize or serve fake tooling to infect users at scale rather than run a highly targeted campaign. If the operator attracts more affiliates, its behavior and tactics are likely to evolve further, as they have with other MaaS service offerings.

Actionable guidance

The threat actor uses ClickFix and likely watering hole methods, users should be alert to unsolicited communications from unknown third-parties, particularly lures involving salary or finance related documents. To counter watering hole tactics, users should download software only from vetted official locations, and administrators should consider denying most downloads and software installation outright to prevent infection of a user’s workstation. Command-line tools such as cmd.exe and powershell.exe should be restricted for users who do not need them for their duties. Threat hunting for unknown entries in start folders and current-user Run keys, together with the file artifacts noted above, will help identify infections, as will callouts to unknown addresses from non-browser processes using a web-associated user agent.

4. Wp2shell Now exploited in the Wild

Summary

A critical pre-authentication remote code execution (RCE) vulnerability in WordPress Core affects versions 6.9.0-6.9.4 and 7.0.0-7.0.1, and is now known to be exploited in the wild. Organizations should update to a patched version immediately, or apply temporary mitigations such as disabling the REST API for unauthenticated users until they can update.

Category: Critical Vulnerabilities

Industry: Multiple

Sources

https://wp2shell.com/
Internal OSec Research

Analyst comments

Researchers discovered a pre-authentication Remote Code Execution (RCE) vulnerability in WordPress Core affecting versions 6.9.0-6.9.4 and 7.0.0-7.0.1, remediated in versions 6.9.5 and 7.0.2 respectively. Anonymous users can exploit the bug against stock installations with no plugins, which poses significant risk given that over 500 million websites run WordPress.

The exploit chains two SQL injection vulnerabilities: one affecting the batch endpoint (CVE-2026-63030) and one abusing the WP_Query parameter author_not_in (CVE-2026-60137). In our testing, the timing-based SQL injection required multiple requests to the vulnerable endpoints for successful exploitation:

/wp-json/batch/v1

?rest_route=/batch/v1



Monitoring for excess traffic to these endpoints is a strong detection opportunity and should identify most exploitation attempts.

Actionable guidance

Organizations should upgrade their WordPress installations to a currently fixed version. Restricting access to the WPAPI or to the vulnerable endpoints will also reduce exposure. Detection should look for repeated requests containing SQL strings sent to /wp-json/batch/v1 and ?rest_route=/batch/v1, particularly where they resemble the examples above; this activity is a high-signal indicator of attempted exploitation. The patched versions are listed below

# Affected

WordPress 6.9.0–6.9.4

WordPress 7.0.0–7.0.1

# Fixed

WordPress 6.9.5

WordPress 7.0.2



5. SharePoint RCE CVE-2026-50522 Reported to have been Exploited in the Wild

Summary

Attackers are exploiting a critical unpatched SharePoint RCE vulnerability (CVE-2026-50522) to steal IIS machine keys for sustained access.

Category: Known Exploited Vulnerabilities

Industry: Multiple

Sources

Analyst comments

Attackers are exploiting a critical vulnerability (CVE-2026-50522) in Microsoft SharePoint to steal IIS machine keys for long-term server access. Researchers observed these attacks, but we could not correlate the activity in public honeypots or in our own internally hosted honeypot, which may indicate that exploitation is limited overall. Given the trustworthiness of more than one source, we still assess this as a credible threat. The vulnerability allows unauthenticated remote code execution (RCE) through deserialization attacks against the following endpoint:

/_trust/Default.aspx



We analyzed a copy of the PoC disclosed. When run, the exploit sends a POST request to the vulnerable endpoint. The body carries a serialized command for the underlying OS of the vulnerable SharePoint server, placed in the Cookie XML parameter that sets SecurityContextToken, and is used to construct a forged WS-Trust RequestSecurityTokenResponse containing the malicious token.

Actionable guidance

A patch is available that remediates this vulnerability, and SharePoint Online is likely protected already through automatically applied updates. Additional measures are necessary to prevent persistent attacker access after exploitation: enable AMSI integration and rotate IIS machine keys. Disable legacy WS-TRUST if the environment does not use it. Requests to the targeted endpoint carrying “wa=wsignin1.0” from unfamiliar locations with unusually large wresult parameters may also indicate abuse, especially when correlated with outbound connections from the SharePoint server itself to unknown destinations.

6. Chaos ransomware deploys msaRAT using Covert Browser C2 Communication through WebRTC and TURN Relay Servers

Summary

The Chaos ransomware group has introduced “msaRAT,” a sophisticated remote access trojan. It bypasses network detection by tunneling all command-and-control (C2) traffic through headless Chrome or Edge browsers using WebRTC, masking malicious activity as legitimate web browsing.

Category: Threat Actor Activities

Industry: Multiple, Technology, Healthcare, Professional Services, Agriculture and Food Production

Sources

Analyst comments

msaRAT is a Rust-based malware tool used by the Chaos ransomware-as-a-service group to establish covert communications in highly monitored enterprise environments. Unlike traditional RATs that open direct network sockets, msaRAT operates exclusively through the Chrome DevTools Protocol (CDP). It searches for installed browsers such as Chrome or Edge, launches it in headless mode with debugging enabled, and injects JavaScript to create a WebRTC DataChannel. The browser process then acts as a proxy, which hides the malware from traditional network monitoring that would otherwise flag suspicious outbound connections from an executable file.

The infection begins when an attacker delivers a deceptive installer named update_ms.msi, (downloaded via curl), which impersonates a Windows update and drops a malicious dynamic link library (lib.dll) into the %ProgramData% directory. Once executed, the malware utilizes the Tokio async runtime to manage multiple concurrent tasks. It locates the browser executable path through environment variables or registry keys and launches it with specific CDP flags. It then negotiates a secure WebRTC connection through legitimate infrastructure, specifically Cloudflare Workers for signaling and Twilio’s TURN servers for relaying, so the malware binary never connects to the attacker’s server directly.

The technical stealth of this approach is significantly enhanced by a double-layer encryption strategy. msaRAT first relies on the standard DTLS encryption provided by the browser’s WebRTC implementation, then encrypts the data payloads with ChaCha-Poly1305 using keys derived from an Elliptic-curve Diffie-Hellman (ECDH) key exchange. Even if defenders capture the network traffic, the content remains encrypted and the source appears to be a standard browser communicating with Google or Twilio services, which makes the activity extremely difficult to distinguish from normal web traffic.

The new variant may be used against sectors with stronger security requirements, particularly Healthcare and Technology. Professional Services organizations may also be at increased risk, especially cybersecurity firms and IT support providers.

Actionable guidance

Based on the threat actor’s initial access methods, organizations should provide security awareness training on vishing and social engineering through Microsoft Teams, enforce multifactor authentication for all users, and alert on unauthorized software installations or remote monitoring and management tool deployments.

Organizations should also monitor for unusual browser processes, such as Chrome or Edge, launching with headless flags or Chrome DevTools Protocol remote debugging ports from unexpected locations, including ProgramData.

Monitor for high-volume WebSocket connections or WebRTC streams originating from browser processes and communicating with unexpected destinations, such as *.workers.dev or STUN or TURN servers. These destinations often include “STUN” or “TURN” in the domain name. Activity involving services not normally used within the environment, particularly by users outside development roles, should be investigated.

Weekly Situation Report — 7/27/26

1. Ernst & Young (EY) Investigates Data Breach

2. Microsoft 365 calendars used in Hollowgraph Campaign

3. LabubaRAT malware infiltrates Windows systems while posing as NVIDIA software

4. Wp2shell Now exploited in the Wild

5. SharePoint RCE CVE-2026-50522 Reported to have been Exploited in the Wild

6. Chaos ransomware deploys msaRAT using Covert Browser C2 Communication through WebRTC and TURN Relay Servers

Want this turned into action, not just awareness? Talk to the team.