eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
PoC Exploit Code Published for Critical SmartConsole Vulnerability
Bottom Line: Proof-of-Concept exploit code has been released for a recently disclosed critical vulnerability in Check Point SmartConsole login process. Limited exploitation has already been confirmed, and eSentire's Threat Intelligence team assesses with medium confidence that widespread exploitation of CVE-2026-16232 will be seen in the near term.
On July 28th, 2026, Rapid7 Labs published a technical report and Proof-of-Concept (PoC) exploit code for CVE-2026-16232 (CVSS: 9.1), a critical authentication bypass vulnerability impacting the SmartConsole login process of Check Point's Security Management Server and Multi-Domain Security Management Server. Successful exploitation of the vulnerability can allow a remote, unauthenticated attacker to login with full administrative privileges, and modify security policies and configurations. CVE-2026-16232 was first disclosed by Check Point on July 22nd, where they indicated that the vulnerability had been exploited prior to patch release, “impacting a very small number of customers”. Check Point confirmed that patches were available to address the vulnerability, and that exploitation requires an attacker to have Internet access to the Management Server IP address, with a Trusted Clients configuration that does not restrict GUI clients.
Rapid7's report provides in-depth technical analysis on the flaw, confirming that the root cause is a broken trust boundary in the application authentication path. An unauthenticated attacker can leverage CVE-2026-16232 to obtain an application login token, use this token to log in through SmartConsole with full administrative privileges, and modify security policies. Along with their technical report, Rapid7 published PoC exploit code to demonstrate the exploit and the “level of access” it can achieve. Rapid7 highlights that the PoC does not work on patched systems, indicating that the hotfix provided by Check Point successfully mitigates the flaw.
eSentire Threat Intelligence Analysis:
Although Check Point indicates that exploitation of CVE-2026-16232 was observed prior to patch release, making it a zero-day, no details are provided on the reported attacks. Check Point states that a small number of their customers were impacted, which suggests that the attacks may have been targeted rather than opportunistic. The usage of a zero-day could suggest a highly skilled threat actor was involved and may have had specific objectives, but this is unconfirmed. However, with Rapid7's release of PoC exploit code, threat actors of all skill levels can now operationalize CVE-2026-16232 within attacks, which is a trend often seen following PoC release. As such, eSentire's Threat Intelligence team assesses with medium confidence that further exploitation of CVE-2026-16232 will be identified in the coming weeks and months.
Following Check Points initial disclosure of CVE-2026-16232, CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on July 22nd, and provided a deadline of July 25th for Federal Civilian Executive Branch (FCEB) agencies to ensure patches were applied, underscoring the critical nature of the flaw. As there have been reports of exploitation, and now publicly available PoC, organizations should ensure that the relevant patches to address CVE-2026-16232 are applied. Organizations should also restrict access to the Management Server IP address, as per Check Point's guidance within the advisory, and follow their Hardening Best Practices guide.
eSentire MDR for Network has detections in place to monitor for exploitation of CVE-2026-16232, and eSentire's Managed Vulnerability Service (MVS) has plugins in place to identify vulnerable assets. eSentire published an advisory for the vulnerability on July 29th and is continuing to track this topic for additional information and detection opportunities.
STAC4749 Microsoft Teams Vishing Campaign Leading to Chaos Ransomware RAT
Bottom Line: The financially motivated threat actor STAC4749 has been identified compromising organizations in North America via Email Bombing and Microsoft Teams phishing, with attacks resulting in the deployment of Chaos ransomware.
On July 28th, 2026, Sophos published research documenting a social engineering campaign in which threat actors, tracked as STAC4749, abused Microsoft Teams to conduct voice phishing (vishing) attacks, tricking targets into installing remote management tools and subsequently delivering malware payloads. Analysis of observed incidents indicates that STAC4749 primarily targeted organizations located in North America. Approximately 50 percent of victims were based in Canada, while 44 percent were located in the United States. The remaining victims were distributed across other regions.
The threat actors contacted users directly through Teams, posing as helpdesk or technical support personnel. The attackers used professional-looking accounts and IT-themed domains to build credibility and persuade employees to participate in remote support sessions. The threat actors initially deployed Microsoft Quick Assist as their remote access tool of choice. However, when Quick Assist was restricted, they deployed the RemSupp Remote Monitoring and Management (RMM) application as an alternative means of obtaining remote access. Once access was obtained, the attackers attempted to enable Remote Desktop Protocol (RDP) services on compromised hosts to facilitate future access and lateral movement.
STAC4749 operators launched PowerShell commands to download and execute malicious payloads hosted on attacker-controlled infrastructure. Early versions of the attack chain relied on a custom malware loader that conducted system discovery, established persistence, and retrieved additional components from Command-and-Control (C2) servers. By April 2026, the attackers had streamlined their process and began deploying their backdoor directly, eliminating the need for a separate loader stage.
The malware employed by STAC4749 included a PyInstaller-based Python backdoor, Golang implants, and a custom reverse SOCKS proxy tool. In some incidents, Sophos observed the deployment of additional remote administration tools such as DWAgent and AnyDesk. Sophos linked at least three STAC4749 intrusions directly to the deployment of Chaos ransomware. In these cases, ransomware execution occurred after the attackers established broader access within the victim environment and, in some instances, likely exfiltrated data before encryption. Victims received ransom notes, and encryption activity occurred nearly simultaneously across affected systems.
eSentire Threat Intelligence Analysis:
The STAC4749 incident highlights a trend eSentire's Threat Response Unit (TRU) has tracked throughout 2026: Microsoft Teams has become a preferred initial access vector precisely because it exploits the implicit trust employees place in internal-looking communications. This mirrors tactics previously observed from groups such as Silent Ransom Group and UNC6692, as well as the deployment of ModeloRAT via Teams-based lures suggesting IT-impersonation vishing is being broadly adopted across the threat actor ecosystem rather than remaining a single-actor technique.
The speed of the attacks was particularly noteworthy. In one incident, the time between initial compromise and ransomware deployment was less than seventeen hours. This rapid progression indicates a highly efficient intrusion workflow. eSentire has observed a similar pattern in Microsoft Teams vishing activity leading to the deployment of Nimbus RAT, where attackers progressed from initial Teams contact to RAT execution in less than 20 minutes. Other attacks that have been observed following this same tradecraft include an UNC6692 intrusion that led to deployment of the Edgecution browser backdoor, and a separate campaign that delivered the DenoGate backdoor, both of which also began with email bombing followed by Microsoft Teams-based IT impersonation. Taken together, these cases indicate that the email bombing-to-Teams-vishing kill chain is being adopted broadly across the threat landscape.
To defend against such attacks, it is critical that users are trained to identify and report social engineering attempts. Additionally, organizations can prevent the abuse of Microsoft teams in this context, by blocking external Microsoft tenants, if not required for legitimate business purposes. Similarly, organizations should consider blocking all RMM tools that are not used for legitimate purposes. Email spam filtering will help minimize the impact, decreasing the likelihood of successful social engineering via Microsoft Teams or malicious phone calls (vishing).
For additional insights into how threat actors are gaining initial access and exploiting legitimate RMM tools, the eSentire Threat Intelligence team has released an advisory on email bombing and will be discussing this topic in more details in the upcoming August TRU Intelligence Briefing.
Cyber-Attack Impacting Minnesota Water Utility Systems
Bottom Line: A coordinated OT cyberattack against over 30 Minnesota water utilities has prompted renewed warnings from CISA regarding ongoing attempts to target industrial control systems and PLCs in critical infrastructure environments.
This week, Minnesota IT Services (MNIT) issued two consecutive advisories and coordinated with CISA following a confirmed campaign targeting Operational Technology (OT) systems at more than 30 water utilities across the state. The first MNIT advisory confirmed that cyber-attacks impacting community water systems occurred on July 26th and 27th but did not result in unsafe drinking water. In at least once case, the attack caused a water plant to go “offline”, prompting city officials to urge residents to minimize water use. The second MNIT advisory confirmed that attacks impacted Programmable Logic Controllers (PLCs) and the Human-Machine Interfaces (HMIs) used to access them. Minnesota officials also disclosed that attribution efforts are ongoing, but no specific threat actor group or state is currently confirmed as involved.
On July 30th, CISA released an alert urging the Water and Wastewater systems sector to implement security controls for OT systems. CISA states that, “threat actors are targeting water entities of all sizes”. Attacks have involved Internet exposed OT systems and, in some cases, have resulted in boil water notices and sustained manual operations. To prevent similar activity, organizations are recommended to disconnect PLCs from the Internet, ensure default credentials are changed, and create IP allow lists for any critical OT systems that require remote access.
eSentire Threat Intelligence Analysis:
This wide spanning campaign impacting dozens of water plants highlights the current risk of cyber-attacks against critical infrastructure organizations. In certain scenarios, attacks may result in the disruption of services, physical damage to equipment, and the shutdown of monitoring applications enabling unsafe drinking water. Critical infrastructure organizations need to take immediate steps to ensure prevention and mitigation controls are in place. Additionally, all organizations should establish and regularly test disaster recovery plans, in the event that an attack is successful.
While no attribution has been provided for the campaign at the time of writing, there is widespread speculation that the activity is related to Iranian threat actors. As the physical conflict between Iran and the United States continues, there is an increased risk of cyberattacks against organizations in the United States and allied nations. Iran has previously targeted Water and Wastewater treatment facilities. In June 2026, Iranian APTs operating under the hacktivist persona Handala, claimed to have breached multiple California water systems, although actual impact was minimal. On July 22nd, 2026, CISA released an advisory warning that Iranian affiliated cyber actors are actively targeting PLCs.
While past activity points to Iran as the likely culprit, this has not been confirmed, and notably, unlike similar attacks in the past, Iranian hacktivist personas have not publicly taken credit for the attacks at the time of writing. It is possible that unrelated threat actors are using known Iranian Tactics, Techniques, and Procedures (TTPs) to carry out attacks while limiting the likelihood of attribution back to them. At this time, it is unlikely that the attacks were financially motivated, as there are no reports of extortion or data theft. Additionally, no groups have claimed responsibility for the attack, which is common for hacktivists as they are attempting to raise awareness for their specific cause. These factors leave state-affiliated threat actors as the most likely culprit, with possible motivations including testing capabilities and demonstrating the impact of potential future attacks.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
