eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
Exploitation for SharePoint Vulnerability Observed After PoC Release
Bottom Line: Following Proof-of-Concept (PoC) exploit code release for the SharePoint vulnerability CVE-2026-55040, in-the-wild exploitation of the flaw has been identified. Impacted organizations must apply relevant patches as soon as possible.
On August 11th, 2026, Rapid7 published a technical report and Proof-of-Concept (PoC) exploit code for CVE-2026-55040 (CVSS: 9.1), an authentication bypass vulnerability impacting Microsoft Office SharePoint. The vulnerability was initially disclosed on July 14th, during Microsoft’s July 2026 Patch Tuesday release. Rapid7 notes that the vulnerability is due to a flaw within the JSON Web Token (JWT) validation pipeline, where exploitation can allow an unauthenticated attacker to forge a valid JWT and “impersonate any SharePoint site user”, including administrators.
Along with the technical analysis of CVE-2026-55040, Rapid7 released a Python-based PoC exploit script on GitHub, demonstrating the attack. Less than 24 hours following the publication of Rapid7’s report, Defused identified exploitation of CVE-2026-55040 against their SharePoint honeypots. In their observations, Defused specifically noted that Rapid7’s PoC was being operationalized within the attempts, suggesting that the exploit has quickly become weaponized by threat actors. Details on real-world exploitation, including post-compromise activity, have not been shared publicly at the time of writing.
eSentire Threat Intelligence Analysis:
In a separate report that Rapid7 also published on August 11th, they confirmed the disclosure of another vulnerability in SharePoint, tracked as CVE-2026-63520 (CVSS: 8.1), which could lead an unauthorized attacker to execute code over a network. Rapid7 highlighted a potential exploit chain involving this flaw and CVE-2026-55040, where an attacker could leverage it to bypass authentication, followed by exploiting CVE-2026-63520 to achieve unauthenticated Remote Code Execution (RCE). Microsoft released a patch to address CVE-2026-63520 during its August 2026 Patch Tuesday release, and at the time of writing, there are no reports of exploitation involving this vulnerability.
Rapid7 highlights the timeline of the discovery of both vulnerabilities, noting that technical details regarding CVE-2026-63520 will be published sometime in September 2026. Based on precedent set by the report on CVE-2026-55040, it is likely that Rapid7 will also publish PoC exploit code for the vulnerability. As demonstrated by CVE-2026-55040, as well as another example in which exploitation was observed shortly after Rapid7 released PoC exploit code for the SonicWall vulnerability CVE-2026-15409, threat actors will likely quickly adopt these exploit scripts shortly after release.
As exploitation of CVE-2026-55040 has been reported, and PoC will likely be published for CVE-2026-63520 in the coming weeks, organizations should ensure that relevant security patches for SharePoint contained within the July and August Patch Tuesday releases are applied as soon as possible. eSentire's Managed Vulnerability Service (MVS) has plugins in place to identify both vulnerabilities. eSentire's Threat Response Unit (TRU) is continuing to track this topic for additional information and detection opportunities.
CISA #StopRansomware Report: Gunra Ransomware
Bottom Line: A joint report from the United States and South Korea was released warning of Gunra Ransomware, a RaaS offering being used to target critical infrastructure sectors around the globe through the exploitation of vulnerabilities in Internet-facing software.
On August 10th, 2026, CISA, the FBI, U.S. Department of Defense Cyber Crime Center (DC3), NSA, U.S. Secret Service, and South Korea’s National Police Agency (KNPA) released a joint advisory, on Gunra ransomware (AA26-222A), providing detailed technical guidance on threat, as well as actionable recommendations. Gunra first emerged in April 2025 and is derived from the leaked source code of the now-defunct Conti ransomware gang. The group initially targeted Windows environments before developing a Linux variant and formalizing a Ransomware-as-a-Service (RaaS) affiliate program in January 2026. They advertise on dark web forums and offer access to a management panel, a ransomware builder, cross-platform payloads, and structured documentation.
As of early 2026, the group began operating under additional aliases, including Golden Community, and expanded recruitment efforts to include penetration testers and ethical hackers to act as initial access brokers. Gunra has listed 51 victims on its Dedicated Leak Site (DLS). The group’s activity is concentrated in South Korea, Brazil, Spain, Thailand, and Hong Kong, though targeting spans North and South America, Europe, the Middle East, Africa, and the Asia-Pacific region. Attacks do not appear to target any single industry, with victims across healthcare, financial services, critical manufacturing, transportation, government services, utilities, academia, media, retail, and professional/nonprofit services.
Gunra affiliates have been observed exploiting two known vulnerabilities in Fortinet FortiOS and FortiProxy to obtain privileged initial access to victim environments:
CVE-2024-55591 (CVSS: 9.8): An authentication bypass vulnerability in FortiOS and FortiProxy that allows a remote, unauthenticated attacker to achieve “super admin” privileges via crafted requests to the Node.js websocket module
CVE-2025-24472 (CVSS: 8.1): A second authentication bypass affecting FortiOS and FortiProxy, exploitable via crafted CSF proxy requests when Security Fabric is enabled
Following initial access, the threat actors have been observed compromising SSL-VPN appliances using default credentials, then exploiting the traffic control functionality to intercept credentials and session cookies for users authenticating to corporate virtual desktop infrastructure (VDI) portals. These stolen cookies are leveraged for session hijacking to access the internal network. To bypass Multi-Factor Authentication (MFA), Gunra actors modify authentication processing files on VDI portals so that a specific, Gunra-designated One-Time Password (OTP) value would authenticate successfully at any time, effectively providing a persistent backdoor that bypasses MFA. To limit forensic visibility, Gunra routinely deletes system and network access logs, clears command history, and confines malicious activity to the late evening and early morning. Lastly, the threat actors exfiltrate victim data, delete volume shadow copies, and encrypt systems.
eSentire Threat Intelligence Analysis:
CISA does not provide attribution for the group, but in a past report, Ahnlab notes technical and strategic overlaps between Gunra and the North Korean APT Lazarus Group. As Lazarus Group is known to conduct financially motivated campaigns on behalf of the North Korean state, it is possible that they have worked either directly or indirectly with Gunra. North Korean threat actors have also previously employed ransomware for financial gain in an affiliate role, including Play, Qilin, and Medusa.
To combat this threat, CISA recommends that organizations prioritize the patching of Known Exploited Vulnerabilities (KEV) including CVE-2024-55591 and CVE-2025-24472. As well as implementing network segmentation to limit compromise spread and reviewing domain controllers, services, workstations, and active directories for new and unrecognized accounts. Additional recommendations can be found in the full report.
In response to this disclosure, eSentire's Threat Intelligence team has added the relevant Indicators of Compromise (IoCs) to the Threat Intelligence Platform (TIP) for automated threat hunting. The eSentire Managed Vulnerability Service (MVS) has plugins in place to identify devices vulnerable to CVE-2024-55591 and CVE-2025-24472, and an advisory for CVE-2024-55591 was published in January 2025, following confirmation of real-world exploitation.
Operation Dream Job: Lazarus Leveraging SecurityPDF, Troy Backdoor, and CVE-2026-68820
Bottom Line: A North Korean state-sponsored threat actor has been identified exploiting a Windows zero-day privilege escalation vulnerability (CVE-2026-68820) through fake job offer lures, targeting organizations in the defense industry.
On August 11th, 2026, Check Point Research published findings on a new wave of the Democratic People’s Republic of Korea (DPRK)-linked Lazarus Group’s long-running Operation Dream Job campaign. Attacks primarily targeted defense, aerospace, aviation, and military technology organizations worldwide, with particular emphasis on Europe and India.
The campaign typically begins with a threat actor posing as a recruiter and approaching a target with a role at a well-known company, accompanied by a PDF describing the position in convincing detail. Victims have been lured with fake roles at recognizable companies, such as Lockheed Martin, and directed toward malicious files disguised as legitimate recruitment material. Check Point identified two parallel infection chains: one relying on DLL sideloading, and a second, observed in July, that impersonated the privacy technology company Enveil, directing targets to download a trojanized PDF viewer called SecurityPDF. Check Point noted it was unable to confirm the initial contact vector for this wave but assessed, based on prior Dream Job activity, that targets were likely approached via platforms like LinkedIn or direct messaging apps.
The most significant element of this campaign is a previously unknown Windows vulnerability that had been exploited since at least early July, which Check Point reported to Microsoft. The vulnerability was patched on August 11th, 2026, as part of that month’s Patch Tuesday release. The flaw, tracked as CVE-2026-68820, was exploited by a new version of the FudModule rootkit to obtain SYSTEM privileges and disable EDR visibility. The upgraded FudModule variant broadened its evasion capabilities, suppressing security products generically, and tampering with Smart App Control state. Following privilege escalation, the threat actor deployed Troy, a newly documented backdoor, alongside Command-and-Control (C2) infrastructure that was built almost entirely from legitimate servers the attackers compromised rather than infrastructure they built themselves. Researchers also found evidence that vulnerable Roundcube instances were exploited through CVE-2025-49113, resulting in deployment of RelayShell.
Check Point reported that at least one compromised organization headquartered in France was subsequently leveraged by Lazarus to conduct spear-phishing attacks against additional targets worldwide, abusing the trust and reputation of a real victim organization to improve the credibility of follow-on lures.
eSentire Threat Intelligence Analysis:
Operation Dream Job is one of Lazarus’s longest-running campaigns, and its recruiting-lure approach has remained an effective initial access technique for years. This wave shows Lazarus continuing to invest heavily in that approach rather than retiring it. The core lure (a convincing job offer at a recognizable company) has barely changed over the years; what continues to evolve is the delivery mechanism and the tooling deployed after compromise.
The shift toward SEO-poisoned impersonation websites and search-visible trojanized applications, rather than relying solely on direct messaging or email, reflects state-sponsored actors making their lures more convincing by placing them where a cautious user would naturally go to verify a download.
The use of a Windows zero-day (CVE-2026-68820) to deploy an upgraded FudModule rootkit is particularly significant. Use of a zero-day vulnerability shows continued investment and research, enabling compromises. Additionally, FudModule has been a hallmark of Lazarus’s most sophisticated intrusions, and its ability to neutralize dozens of Event Tracing for Windows (ETW) providers and suppress security tooling at the kernel level means that once an endpoint is compromised, traditional EDR telemetry may become unreliable for detecting subsequent attacker activity. This reinforces the importance of detecting the initial infection stages before privilege escalation occurs, since detection opportunities narrow considerably once SYSTEM-level rootkit access is achieved.
Employees who may be approached by recruiters on platforms like LinkedIn should treat unsolicited job offers accompanied by document download or software installs as a potential initial access vector. Recommended mitigations include ensuring Windows systems are patched to address CVE-2026-68820, restricting or closely monitoring the use of third-party PDF viewers and productivity tools, deploying endpoint detection capable of identifying suspicious behavior, and providing employees with awareness training on recruitment-themed social engineering. In response to the release of this report, eSentire's Threat Intelligence team is actively tracking this topic for additional details and detection opportunities. IP addresses associated with this campaign have been added to the eSentire Global Block List, and the Threat Response Unit (TRU) is conducting threat hunts across customer environments.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
