Weekly Situation Report — 8/3/26

The Certighost proof-of-concept exploit has been released, suggesting active exploitation is imminent.
Russian APT group Laundry Bear is actively exploiting a Zimbra zero-day vulnerability to steal sensitive email data.
vBulletin has patched a critical pre-authentication remote code execution vulnerability that already has public exploits available.
A suspected Russian actor’s exposed infrastructure reveals details of ongoing cyber espionage operations.
Iranian cyber actors are targeting critical infrastructure, including a confirmed breach of Minnesota water utilities systems.

1. Certighost PoC Disclosed, Exploitation in the Wild Likely Imminent

Summary

Security researchers have released a proof-of-concept exploit for CVE-2026-54121, a critical privilege escalation vulnerability in Microsoft’s Active Directory Certificate Services. The vulnerability enables attackers to manipulate directory lookup processes to impersonate domain controllers and fully compromise an organization’s infrastructure.

Category: Critical Vulnerabilities

Industry: Technology

Sources

Analyst comments

Security researchers disclosed CVE-2026-54121 (“Certighost”), a critical privilege escalation flaw in Microsoft’s Active Directory Certificate Services. The flaw is an optional certificate enrollment directory lookup fallback known as chase lookups. By manipulating the cdc and rmd request attributes, attackers redirect the Certification Authority to a rogue endpoint. Default machine account quotas then allow the attacker to bypass authentication checks and forge a DC-signed certificate. That forged credential enables PKINIT Kerberos authentication as a Domain Controller. This grants DCSync access to extract the krbtgt master secret and achieve complete domain compromise.

We verified the disclosed PoC through code review and lab testing. We assess it is likely a credible threat and likely to be exploited in the short term. We are not aware of exploitation in the wild as of yet. However, it is very likely to be adopted by multiple threat actors in their campaigns, especially ransomware and extortion groups. The primary evidence of potential abuse will be a certificate request originating from a user.

Exploitation will look like new certificate enrollment over SMB/RPC (TCP ports 139, 445) and LDAP (TCP port 389). The cdc attribute in the certificate request will point to an attacker-controlled server. In the PoC, that server is a rogue SMB2 and LDAP listener on the attacker host. This is the primary detection opportunity for this vulnerability. Successful exploitation leaks the machine keys used to compromise domains. In the research example, this produced the krbtgt keys used to sign Kerberos tickets. This is post-exploitation activity, used after initial access once the attacker holds a domain user credential.

Actionable guidance

Applying the July 2026 updates is the most effective strategy to remediate this vulnerability. If patching cannot be applied immediately, disabling chase lookups will mitigate this issue until a patch can be applied. If compromise is suspected, review event IDs for certificate requests (4886) and certificate approvals (4887). Audit the cdc attribute contents for unknown servers, which is a high signal of exploitation. Kerberos ticket requests are also a notable identifier, as they are typical after abuse of this vulnerability.

2. Russian LAUNDRY BEAR Hackers Exploit Zimbra Zero-Day to Steal 90 Days of Emails

Summary

Russian state-sponsored threat actors known as LAUNDRY BEAR are exploiting a critical Zimbra zero-day vulnerability to silently harvest large volumes of email data. They establish persistent access via stolen credentials and exfiltrate sensitive information from Western organizations using advanced malware and obfuscated infrastructure.

Category: State-Sponsored Espionage

Industry: Technology, Public Sector and Government Administration, Education, Defense, Energy

Sources

Analyst comments

Russian state-sponsored LAUNDRY BEAR actors exploited CVE-2025-66376, an XSS flaw in Zimbra webmail caused by unsanitized CSS @import directives. The attack triggers on view, using Base64-encoded and XOR-obfuscated SVG payloads that carry the Ulej JavaScript framework. The script harvests up to 909,090 days of mailbox data through SOAP requests. It also attempts to maintain persistent access by enumerating Global Address Lists, harvesting browser-stored passwords, extracting 2FA scratch codes, and programmatically enabling IMAP with application-specific passcodes. Exfiltrated credentials and email archives are routed to a containerized Python infrastructure named Flowerbed. Flowerbed uses HTTPS with Let’s Encrypt certificates for bulk data transfer, and DNS-based encoding for sensitive metadata such as account addresses and Zimbra versions.

Since the advisory, the threat actor has shifted tactics in order to exploit “half-click” vulnerabilities in Microsoft OWA, where viewing the email is enough to trigger exploitation. We investigated a sample uploaded to VirusTotal this week (seen on July 12th). The sample primarily uses the asecdns[.]com and acocdn[.]com domains, which may indicate it is actually a sample from March. Current lookups on those domains resolve to VPS providers, which is common for threat actor infrastructure. We saw the same pattern across IoCs for both campaigns, with each resolution landing on VPS providers commonly abused by threat actors. This indicates these domains are likely still active and in use for this campaign, or have potentially been recycled by other threat actors.

The threat actor uses generic lures designed to draw enough interest for the recipient to open and read the email. Themes usually relate to supply chain analysis, research foundations, tourism, or gas and energy markets.

Actionable guidance

Patching CVE-2025-66376 and CVE-2026-42897 will remediate exploitation by this and similar threat actors. Add detection for large Base64 blocks and onload=eval(atob(base64)) blocks in emails on OWA. For Zimbra, code blocks construct similar JS strings using @import, such as the following, which form a similar onload=eval(atob()) string:

scr@import ... ;ipt      - script
onlo@import ... ;ad=ev@import ... ;al   - onload=eval
at@import ... ;ob        - atob

Also look for excessive callouts to image proxies in unfamiliar locations, which may indicate command-and-control (C2) activity. This is especially relevant when paired with other OWA and Zimbra indicators of exploitation.

3. vBulletin fixes critical pre-auth RCE flaw with public exploit

Summary

A critical unauthenticated remote code execution vulnerability (CVE-2026-61511) in vBulletin’s template rendering allows attackers to execute arbitrary PHP code through unsanitized input. Its disclosure by security researchers has prompted urgent security patches.

Category: Critical Vulnerabilities

Industry: Technology

Sources

Analyst comments

CVE-2026-61511 is a critical unauthenticated remote code execution flaw in vBulletin 5.x up to 5.7.5 and 6.x up to 6.2.1. It originates in the runMaths() function, which fails to properly sanitize user input before passing it to PHP’s eval() function. Attackers exploit it by sending specially crafted requests to the ajax/render/[template] endpoint. Templates such as pagenav are abused to bypass built-in restrictions through the “phpfuck” technique and execute arbitrary system commands. The researcher who released this PoC also disclosed a previous vBulletin flaw in May 2025 that threat actors have exploited in the wild.

The largest concentration of vBulletin servers is in the US, followed by the UK, Germany, Canada, and Japan, according to statistics from Shodan.io. The forum software has largely fallen out of favor for more modern solutions. It still holds significant market share among technology sector forums and discussion boards, including those used by Steam and Sony.

This is currently not exploited in the wild. However previous vBulletin vulnerabilities have been and are still used to exploit exposed vBulletin instances. This is likely to see exploitation in the coming weeks. Technology sector organizations are likely at a heightened risk, in part due to its use within these sectors and to recent targeting priorities for major ransomware and extortion related groups based on recent statistics.

Actionable guidance

vBulletin remediated the issue by releasing fixed version 6.2.2 on July 1, 2026. It also distributed backported “Patch Level 1” updates for earlier releases, including v6.2.1, v6.2.0, and v6.1.6. Cloud versions will be updated as a priority. Self-hosted instances should apply the necessary updates directly.

4. Suspected Russian Actor Exposed Infrastructure Reveals Operation Details

Summary

Russian threat actor infrastructure was recently publicly exposed, which gave insight into their operation, including tools and potential targets.

Category: Threat Actor Activities

Industry: Public Administration and Government, Defense, Aerospace, Aviation (Primarily against Ukraine and allied territories), Multiple (in multiple regions for opportunistic exploitation)

Sources

https://socradar.io/blog/operation-talked-russia-ukraine-defense-industry/
Internal OSec Research

Analyst comments

A customer shared data with us on a Russian threat actor, including an exposed server with file indexing enabled that leaked aspects of the campaign. We were only able to obtain the file listing, as the server is no longer exposed. External researchers who had been investigating this privately released a public report at the time of this writing, and it covers these gaps.

The threat actor is very likely Russian, based on several artifacts in the exposed files and on keyboard artifacts as detailed by researchers. However, full attribution is not available at this time. The primary targets are Ukrainian and surrounding regions. The threat actor engages in both mass exploitation and targeted intrusion against prioritized assets. The former is likely for target acquisition, and for the potential resale value of exploited assets outside the actor’s primary target scope. However, the latter remains to be verified. At least one of our US-based customers was likely affected by the mass exploitation that we know of. According to external reports, this actor’s TTPs overlap with Saint Bear/UAC-0056 and WinterVivern/UAC-0114.

Based on the data available to us, the threat actor gains initial entry using pre-auth vulnerabilities to deploy webshells such as Godzilla ASPx, r57, suo5, or other web-related vulnerabilities. They also brute-force both SSH and RDP, based on files listed in the server. Otherwise, they deploy a Sliver C2 implant and run post-exploitation tools: PowerView, MimiKatz, Impacket (likely used Kerberos ticket relay), evil-winrm, DonPAPI (for DPAPI exploitation), and layered proxy tunnels (Neo-reGeorg, Chisel, suo5, Gost SOCKS5). The proxy tunnels are used to exfiltrate data to FTP or S3 storage.

Many of the CVEs used are older, and all of the entries have public PoC code available. We verified the C2 servers as still active as of this writing (July 28). This indicates a still-active campaign using the currently known IoCs. Based on our own external threat hunting, there is no evidence at this time that the threat actor has pivoted infrastructure away from what is currently known. The release of the external researchers’ report may force the actor to pivot infrastructure in the short term. However, we do not think the current toolset and playbook are likely to change greatly, especially given the 14-month operational timeline of the campaign stated in the external report. The primary scope is Ukraine and surrounding territories. Other regions are likely at low risk of full exploitation by this threat actor, with the majority of the risk tied to potential access resale of compromised assets.

Actionable guidance

Patching should be applied to the CVEs noted above, with priority to WordPress, VPNs, firewalls, and mailservers, where exploitations would have greater impact. Block suspicious traffic on ports 11008 and 11009 which are typical for Sliver C2 implants, especially where requests occur at a regular interval such as 60 seconds. If compromise is suspected, affected assets should be threat hunted for known ASPX and PHP webshell files (Godzilla ASPx, r57, suo5). Kerberos ticketing accounts such as krbtgt should be rotated, along with credentials on assets known to be compromised through the vulnerabilities noted above. WinRM and SMB should be disabled if not in use. Additionally, disable browser password storage and restrict local administrator privileges.

5. Iran Targeting Critical Infrastructure, Minnesota Water Utilities Breached

Summary

A coordinated cyberattack targeted operational technology across more than 30 Minnesota community water utilities between July 26 and 27. It disabled automated controls at Braham’s treatment facility for approximately two hours, until backup procedures restored normal operations. This attack came days after an advisory on Iranian actors conducting attacks against PLC devices.

Category: Confirmed Breach

Industry: Water, Energy, Defense, Public Administration and Government, Manufacturing, Agriculture and Food Production

Sources

Analyst comments

A coordinated cyberattack targeted operational technology across more than 30 Minnesota community water utilities between July 26 and 27. Automated controls at Braham’s treatment facility were disabled for approximately two hours, until backup procedures restored normal operations. Plymouth isolated cellular-connected equipment at two water towers as a precaution, but the most affected sites maintained continuous service through contingency plans and manual overrides. Minnesota IT Services (MNIT) activated a statewide incident response, coordinating with federal partners like the FBI, CISA, and EPA to contain the breach and assess damage. No compromise to drinking water safety has been reported. Authorities continue to investigate the unattributed attack. Its timing coincides with a recent CISA advisory warning of Iranian-linked actors exploiting internet-facing programmable logic controllers from Rockwell Automation, Siemens, and Schneider Electric.

This activity is highly likely related to Iranian campaigns targeting critical infrastructure, similar to those attributed to CyberAv3ngers (aka Shahid Kaveh Group), an IRGC-linked threat actor. These actors primarily gain access to exposed and misconfigured PLC devices by exploiting authentication vulnerabilities and leveraging PLC programming software. During external threat hunting, we identified VPS infrastructure hosting open PLC ports such as 44818, which supports this assessment.

Once access is gained, the attackers typically use legitimate tools such as Dropbear SSH for remote access and C2 communication, and may also use it to extract configurations from compromised devices. These attacks are primarily destructive, designed to disable critical alerts and notifications essential to system functionality.

The following PLC models are known targets, though the list is not exhaustive:

Rockwell Automation: CompactLogix and Micro850 PLCs
Schneider Electric: BMX P34/Modicon M340 PLCs
Siemens: S7-1200 series PLCs

Targets in the water, energy, defense, and government sectors are most likely to be hit first. Other industries that heavily rely on PLCs, such as manufacturing and agriculture and food production, are also at risk of opportunistic targeting.

Actionable guidance

PLC devices should not be publicly exposed to the internet. Access should be heavily restricted at the network level to internal staff, with restrictive privileges and change control policies. Devices should run the latest available software and be hardened to security best practices with strong authentication, and should not use default users or passwords. If compromise is suspected, the devices should be restricted to the internal LAN only and kept off any network with external remote connectivity. Configurations should then be audited and compared with older configurations to identify potential malicious changes in programming logic and configuration. If Dropbear SSH is not preinstalled with a PLC, its presence may signal potential compromise. Network connection logs should then be investigated for unknown or suspicious IP addresses, especially those identified as VPS hosting and using the following ports, particularly 44818:

22    - SSH
102   - ISO-TSAP
502   - Modbus
2222  - EtherNet/IP
44818 - EtherNet/IP

Weekly Situation Report — 8/3/26

1. Certighost PoC Disclosed, Exploitation in the Wild Likely Imminent

2. Russian LAUNDRY BEAR Hackers Exploit Zimbra Zero-Day to Steal 90 Days of Emails

3. vBulletin fixes critical pre-auth RCE flaw with public exploit

4. Suspected Russian Actor Exposed Infrastructure Reveals Operation Details

5. Iran Targeting Critical Infrastructure, Minnesota Water Utilities Breached

Want this turned into action, not just awareness? Talk to the team.