eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
SonicWall Discloses Two Zero-Day Vulnerabilities
Bottom Line: SonicWall disclosed two zero-day vulnerabilities (CVE-2026-15409 and CVE-2026-15410) impacting its SMA1000 series firewalls, which are under active in-the-wild exploitation.
On July 14th, 2026, SonicWall disclosed two zero-day vulnerabilities that impact its Secure Mobile Access (SMA) 1000 series firewalls, while also confirming that exploitation of both flaws has been identified. The first of the vulnerabilities, tracked as CVE-2026-15409 (CVSS: 10) is a Server-Side Request Forgery (SSRF) flaw within the SMA1000 Appliance Work Place interface, which can allow a remote, unauthenticated attacker to cause the appliance to make requests to unintended locations. CVE-2026-15410 (CVSS: 7.2) is the other vulnerability, which impacts the SMA1000 Appliance Management Console (AMC), and can allow a remote authenticated attacker to execute arbitrary commands. SonicWall stated that they had investigated “multiple cases” involving exploitation of the flaws, while also confirming that patches are available.
Following SonicWall’s disclosure, CISA added both flaws to its Known Exploited Vulnerabilities (KEV) catalog, providing Federal Civilian Executive Branch (FCEB) agencies a deadline of July 17th to apply relevant patches. On July 15th, Rapid7 published further details on the flaws, while also confirming that exploitation was identified. Rapid7 highlighted that the vulnerabilities could be chained together, with CVE-2026-15409 providing unauthenticated access, followed by CVE-2026-15410 to execute commands, resulting in privilege elevation or credential extraction. Rapid7 states that the observed attacks were “designed to ensure long-term, persistent access” to the targeted environment. Along with their report, Rapid7 published Proof-of-Concept (PoC) exploit code for CVE-2026-15409.
eSentire Threat Intelligence Analysis:
Although SonicWall and Rapid7 confirmed exploitation of both flaws prior to their disclosure, neither share specific details on the threat actors behind the campaigns. Given that exploitation involved zero-day vulnerabilities, and Rapid7’s suggestion that the attacks were designed to establish long-term persistence, it is possible that the attacks may be related, and involve a highly skilled threat actor, but this is unconfirmed. Rapid7’s publication of PoC exploit code for CVE-2026-15409 is notable, as it lowers the technical barrier for threat actors to make use of the exploit within their attacks, and may be an early warning sign for more widespread exploitation. Rapid7 also confirmed that a Metasploit module is in development for the exploit chain, which would also simplify its use within attacks. Following CVE-2026-15409’s PoC release, eSentire has observed exploitation attempts targeting the flaw, demonstrating how the weaponization of PoC shrinks the exploitation window.
Due to confirmed in-the-wild exploitation of the vulnerabilities, organizations that utilize SonicWall SMA1000 series firewalls within their environments should ensure that relevant patches are applied as soon as possible. Organizations should also review the logs outlined by SonicWall within their advisory for any relevant artifacts to determine if they are impacted; if so, firewalls should be reimaged or rebuilt, and credentials and Time-Based One-Time Passwords (TOTP) should be reset. eSentire’s Managed Vulnerability Service (MVS) has plugins in place to identify devices vulnerable to both CVE-2026-15409 and CVE-2026-15410. eSentire’s Threat Response Unit (TRU) has developed MDR for Network detections to identify exploitation of the flaws. eSentire also published an advisory for the vulnerabilities on July 15th and is continuing to track this topic for additional information and detection opportunities.
Microsoft July 2026 Patch Tuesday
Bottom Line: Microsoft’s July 2026 Patch Tuesday addressed a record-breaking 570 vulnerabilities, including two actively exploited zero-day vulnerabilities. On the same day, NightmareEclipse released an exploit for a separate unpatched Windows privilege escalation vulnerability.
On July 14th, 2026, Microsoft released its July 2026 Patch Tuesday update, addressing a total of 570 vulnerabilities, the largest single Patch Tuesday release on record. The update includes fixes for 59 Critical-rated vulnerabilities, 48 of which are Remote Code Execution (RCE) flaws. This figure does not include 468 Microsoft Edge/Chromium vulnerabilities patched by Google this month that were separately incorporated into Edge.
Two of the vulnerabilities patched this month are confirmed as actively exploited zero-days. CVE-2026-56155 (CVSS: 7.8) is an Elevation of Privilege vulnerability in Active Directory Federation Services (AD FS) that allows a local attacker to gain administrator privileges. CVE-2026-56164 (CVSS: 5.3) is an Elevation of Privilege vulnerability in Microsoft SharePoint Server caused by a missing authentication check for a critical function, enabling an unauthorized remote attacker to elevate privileges over a network. Microsoft has not disclosed specific details on how either flaw has been exploited in the wild, and no public Indicators of Compromise (IoCs) are available at this time. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added both CVEs to its Known Exploited Vulnerabilities (KEV) catalog on July 14th, with Federal Civilian Executive Branch (FCEB) agencies required to apply the fix for CVE-2026-56155 by July 17th and CVE-2026-56164 by July 28th, 2026.
On the same day as the Patch Tuesday release, security researcher NightmareEclipse (also known as Chaotic Eclipse) published a functional Proof-of-Concept (PoC) exploit called LegacyHive, targeting a Windows User Profile Service (ProfSvc) arbitrary hive load elevation of privilege vulnerability. The flaw has no CVE designation and remains unpatched. LegacyHive works on all supported desktop and server versions of Windows, including systems running the latest July 2026 update. The publicly released PoC was deliberately stripped down; it requires a standard user credential plus a third username to run and is limited to loading the 'usrclass.dat' hive. The researcher noted that the original exploit did not require additional user credentials and can load any hive file. NightmareEclipse has been in an ongoing public dispute with Microsoft since at least April 2026, repeatedly releasing vulnerability details before patches are available. Three prior Defender vulnerabilities disclosed in this manner subsequently came under active exploitation.
eSentire Threat Intelligence Analysis:
The surge in patch volume is directly linked to Microsoft’s recent adoption of an AI-powered vulnerability discovery system applied across its Windows codebase. The company pre-warned of increased patch volumes earlier this month as a result of further AI adoption. To compare with previous releases, in June 2026, Microsoft addressed 200 vulnerabilities, and other recent releases have been as low as 58. The increase in July is an indicator of what IT and security teams should expect going forward. Microsoft’s adoption of AI-assisted vulnerability discovery is accelerating the identification of latent flaws across its codebase, and organizations need to develop strategies to enable the rapid actioning of large vulnerability releases.
LegacyHive’s risk is currently limited by the PoC’s additional credential requirement, which represents a deliberate barrier to opportunistic exploitation. However, the researcher has explicitly stated that a more capable version of the exploit exists and does not carry this limitation, and has hinted at future releases via their blog. NightmareEclipse’s past willingness to release full-capability exploits means this situation should be monitored closely; a more capable PoC could materially change the risk profile. The eSentire Threat Intelligence team assesses that NightmareEclipse will continue to develop and release exploit code for unpatched vulnerabilities, although the impact is unclear, as only three of the seven past exploit releases have been observed in real world attacks.
eSentire’s Threat Response Unit is tracking both the Patch Tuesday release and LegacyHive for additional details and detection opportunities. Organizations are strongly encouraged to apply all relevant security patches as soon as possible.
Suspected Chinese APT Uses AI to Target Government and Financial Systems
Bottom Line: A suspected intrusion campaign linked to China was uncovered, which involved the malicious use of Claude Code and DeepSeek to compromise government systems.
On July 14th, 2026, Hunt.io disclosed a suspected China-linked intrusion campaign discovered in June 2026 in which operators used two Artificial Intelligence (AI) tools, Claude Code and DeepSeek-v4-pro, as active components of the attack chain, targeting government systems in Afghanistan, Thailand, and Taiwan while staging reconnaissance against U.S. government portals. The investigation revealed a substantial collection of attacker resources, including malware samples, victim data, exploit code, phishing infrastructure, and operational logs that provided visibility into the group’s targeting priorities and operational methods.
The investigation began when researchers pivoted from known TencShell infrastructure and identified an exposed server. Analysis revealed that the server hosted an open directory containing more than 2,400 files and 80 subdirectories, as well as several frameworks and services commonly associated with reconnaissance and Command-and-Control (C2) functions. These services included Asset Reconnaissance Lighthouse (ARL), DeepAudit vulnerability scanning software, Vshell C2 infrastructure, and malware delivery mechanisms associated with the broader campaign.
One of the most significant findings of the investigation was the integration of Large Language Models (LLM) into the attackers’ operational workflow. According to recovered logs and configuration files, Claude Code was used as the campaign’s execution platform, while DeepSeek-v4-pro served as the primary reasoning engine.
The campaign demonstrated extensive interest in Taiwan’s manufacturing, telecommunications, logistics, robotics, and defense-related sectors. Researchers identified reconnaissance activity against at least eight organizations, including shipping companies, semiconductor manufacturers, robotics firms, and industrial technology providers.
Researchers identified a successful intrusion against a Thai government administrative platform. The attackers exploited a SQL injection vulnerability using SQLMap, allowing them to bypass authentication controls and gain administrative access to the system. The attackers extracted databases containing government employee information, including names, national identification numbers, and employment positions. The threat actors also compromised an Afghan government application that processed citizen complaints and government communications.
Researchers found no evidence of successful intrusions into U.S. government organizations; however, they did identify reconnaissance activities targeting NASA systems and phishing infrastructure that impersonated local government entities. Specifically, the threat actors created cloned web pages designed to imitate the website of the Washington, D.C. Council and the government services of Delaware County, Pennsylvania.
eSentire Threat Intelligence Analysis:
The report provides compelling evidence of a sophisticated cyber espionage campaign that combined traditional intrusion techniques with emerging AI capabilities. The threat actors have embedded these tools directly into the attack lifecycle to support reconnaissance, exploit development, phishing page creation, task automation, and operational decision-making. This demonstrates how advanced threat actors are increasingly leveraging AI technologies to improve efficiency, scalability, and adaptability during cyber operations.
Anthropic previously reported a large-scale cyber espionage campaign using agentic AI to perform 80–90% of intrusion operations. The activity had impacted at least thirty separate organizations. It was attributed to a Chinese state-sponsored threat actor, GTG-1002. Threat actors developed an attack framework via Claude Code, that would autonomously compromise a chosen target with minimal human involvement. Multiple security vendors indicate that AI adoption is already being actively leveraged by both state-sponsored actors and cybercriminal groups. Google and Microsoft have documented real-world cases where adversaries use AI to improve operational efficiency, refine phishing content, and accelerate malware development.
Recorded Future had proposed the AI Malware Maturity Model (AIM3), which aims to better track changes and improvements of AI-generated malware and abuse by threat actors in real-world attacks. Based on Recorded Future’s AIM3 model, the activity described by Hunt.io is assessed to align most closely with Level 3 (Optimizing) and Level 4 (Transforming) maturity. The campaign demonstrates the use of AI agents as operational components within the attack lifecycle. While human operators remained involved in campaign management, the reported integration of Claude Code and DeepSeek extends beyond traditional AI-assisted tradecraft and reflects an emerging model of AI-orchestrated cyber operations.
Organizations, particularly those within government, critical infrastructure, manufacturing, telecommunications, and financial services sectors, should expect increasingly automated and adaptive attacks and must strengthen their defenses accordingly. The findings serve as an early indicator of how generative AI may transform future cyber operations and reinforce the need for proactive detection, vulnerability management, credential protection, and continuous threat monitoring.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
