CTO at NCSC Summary: week ending July 19th

"A national public awareness campaign will be launched to help the public prepare for emergencies like extreme weather and cyber attacks"

Jul 18, 2026

Welcome to the weekly highlights and analysis of the blueteamsec (and my wider reading). Not everything makes it in, but the best bits do. A community member is doing daily AI generated podcast of the last 24hours of posts.

Operationally this week nothing of note but there was a allied response to Russian cyber activity which you will see through the below.

In the high-level this week:

UK and Allies urge critical sectors to improve defences against Russian intelligence targeting - UK NCSC and allies urge - “Alongside 18 agencies from 12 countries, the National Cyber Security Centre (NCSC) – a part of GCHQ – has published a new advisory highlighting the methods of Federal Security Service (FSB) Centre 16 cyber actors, who are exploiting vulnerable routers and opportunistically targeting networks belonging to critical national infrastructure (CNI) globally.”
UK and EU strike Russian cyber networks with new sanctions - Foreign, Commonwealth & Development Office and The Rt Hon Yvette Cooper MP announce - “UK and EU hit back with first joint cyber sanctions package, as they attribute Russia’s cyber-attack on Poland.  “ … “UK sanctions and exposes Russian state and cybercriminal proxies carrying out malicious attacks across Europe and sanctions those deliberately spreading deceptive anti-Ukraine narratives.  “
- Profile: GRU cyber and hybrid threat operations - Foreign, Commonwealth & Development Office, Home Office, Cabinet Office and National Cyber Security Centre update
Helping small businesses with free, hands-on cyber consultancy - UK NCSC announce - “Cyber Advisors are offering free 30-minute consultations to help small businesses get started with cyber security.”
National Risk Register 2026 - UK Cabinet Office publishes - various cyber risk..
- Risk of democratic interference added to National Risk Register - Cabinet Office, Dame Angela Eagle DBE MP, Louise Sandher-Jones MP and The Rt Hon Darren Jones MP announce - “Interference in democratic process and cyber attacks have been added to the National Risk Register”
Model Action Plan for Responding to Significant Data Breaches - UK Cabinet Office publishes - “The Model Action Plan is a cross-government framework for all departments and arms-length bodies to follow when responding to significant personal data breaches”
UK action against Russian foreign information warfare - UK Foreign, Commonwealth & Development Office detail - “We are scaling cooperation with European partners on hybrid and information threats, including through the UK-EU Security and Defence Partnership, and through deep cooperation between teams in the UK, in France, Germany, Poland and Brussels, to deliver a pan-European response to a pan-European threat.”
Telecommunications Security Code of Practice 2026 (version 1.1) - UK Department for Science, Innovation & Technology publishes - revised version published
- Change log
How NHS England improved sign-in times and saved over £1m with passkeys - Yu Tsuno, Darren Hutton and Pelin Dem publish - “Key results
- Reduced sign-in time: Users authenticate 8x faster using passkeys. Median sign-in times dropped from 43 seconds (password + SMS OTP) to just 5 seconds using Conditional UI.
- High adoption and scale: 6.7 million passkeys created by users since the feature launched two years ago, driving 6 million passkey sign-ins every month.
- Lower transaction costs: Up to £1.2M saved on OTP costs since launch.”
Open call for evidence Data flows you can trust - UK Department for
Science, Innovation & Technology calls for evidence - “This work will help us to shape how data is used so that we can maximise its potential, drive growth and improve lives across the UK. This Call for Evidence seeks practical, experience-based insight into whether the UK’s data regime is enabling data flows you can trust. We want to understand: does the UK’s approach to international data transfers achieve this as effectively as it can do? Where should we preserve the current system, and what parts of it are most suitable for reform? “
Forging the Arsenal of Freedom: Department of War Suspends CMMC Phase II Requirements - US Department of War announces - “The Department of War today announces the immediate suspension of the Cybersecurity Maturity Model Certification (CMMC) Phase II requirements, which were originally scheduled to come into effect on November 10, 2026. All Phase I self-assessment requirements remain firmly in place.”
US military smartphones targeted through roaming and ad tech - Financial Times reports - “The data, shared with the FT by the Mobile Surveillance Monitor research project, shows regional telecom networks fending off a wave of requests, called SS7 pings. These sought to pin down the locations of specific phones roaming outside their home networks, in what two cyber security experts who reviewed the data said suggested a co-ordinated campaign. Officials in the Gulf suspected Iran or its allies of exploiting roaming agreements with local phone providers to try to locate US personnel, one person familiar with the matter said.”
National Defense Authorization Act for Fiscal Year 2027 - US Congress publishes subject to vote- “In general.--Not later than March 1, 2027, the Secretary may establish a pilot program under the operational authority of the Commander of United States Cyber Command, to assess the feasibility and advisability of conducting cyber operations limited to access generation and maintenance through contractor owned, contractor operated means, subject to the limitations in subsection b”
CERT-UA Handled 3,309 Cyber Incidents in the First Half of 2026 - Service of Special Communications and Information Protection of Ukraine detail - “the highest concentration of cyber incidents targeted local self-government bodies, government organisations, the security and defence sector, and the energy industry.”
July 2026 SFI progress report - Microsoft detail - “Phishing-resistant MFA enforcement has reached broad maturity with 99.97% user and device coverage.“
- 𝟳𝟯𝟮,𝟬𝟬𝟬+ resources have had public access revoked
- 𝟭.𝟰 𝗺𝗶𝗹𝗹𝗶𝗼𝗻 unused apps decommissioned
- 𝟱𝟱𝟬,𝟬𝟬𝟬+ critical and high risk open source vulnerabilities remediated
- ~𝟯 𝗺𝗶𝗹𝗹𝗶𝗼𝗻 container vulnerabilities patched per month through automation
What’s in a Norm? - Institute for Security + Security asks - “Policymakers regularly talk about “norms of responsible state behavior in cyberspace”—for good reason. The norms, articulated by the Group of Governmental Experts (GGE) convened under the auspices of the United Nations and affirmed by all UN members for over a decade, reflect a global consensus about what should and should not be allowable in peacetime cyber operations.”
Reporting on/from China
- Chinese lidar maker with Nvidia ties accused of being cyber risk for U.S. - CNBC reports - “Craig Singleton is a senior director for the China Program at the Foundation for Defense of Democracies, a conservative Washington-based think tank known for being critical of the Chinese government. His research has concluded that there are security risks in Chinese-made sensors operating in U.S. systems, including that lidar sensors could enable Beijing “to access sensitive U.S. data or disrupt critical operations.” - the component debate is interesting and it depends how far you want to go down the rabbit hole coupled with the complexity of operationalisation of the opportunity in reality.
- Lawmakers probe growing use of Chinese AI models in U.S. companies - CNBC reports - “The Committees are also examining whether the United States has a sufficient open-weight AI strategy to ensure American companies and cyber defenders are not forced to choose between expensive or restricted U.S. models and cheap, capable PRC-developed alternatives,” a Committee aide, who asked not to be named as they were not authorized to discuss the ongoing probe, told CNBC.”
- State of AI Safety in China - Concordia publishes - “The arrival of autonomous agents reoriented Chinese governance from controlling what AI says to controlling what it does. After the open source agent OpenClaw proliferated in early 2026, multiple cybersecurity authorities issued warnings, and in May 2026 the Cyberspace Administration of China (CAC) and two other agencies issued dedicated guidance on agentic AI, devoting a full chapter to safety and proposing risk-based governance. Several major AI standard-setting bodies are now drafting agent-related security standards.”
- One Game, Two Strategies: China and Russia’s Divergent Approaches to Micro-Cyber Sovereignty - Xi’an Jiaotong University re-examines - “This study re-examines the assumption that China and Russia have adopted similar strategies for advancing cyber sovereignty. Drawing on two-level game theory, it argues that China has adopted a two-level model, where domestic regulation and international engagement operate in parallel through norm diffusion. In contrast, Russia pursues a one-level model in which domestic cybersecurity concerns are aligned with its international legal initiatives, emphasising consistency between internal regulation and its advocacy for binding global norms.”
- New NSF policy would ban almost all collaborations with Chinese scientists - Science reports - “The U.S. National Science Foundation (NSF) has decided to ban collaborations between every U.S. scientist it funds and nearly all Chinese research institutions and their employees. The new policy abandons NSF’s earlier attempt to balance the potential risks and benefits of such collaborations. But it puts the agency in step with actions taken earlier this year by the much larger Department of Defense (DOD) and with congressional Republicans, who assert that any interactions with China threaten national security.”
- China’s Xi Jinping calls for innovation system overhaul to beat global tech rivals - South China Morning Post reports - “President Xi Jinping has called for stronger efforts to draw overseas talent and address flaws in China’s innovation ecosystem, as intensifying tech rivalry pushes Beijing to bolster its global competitiveness.”
AI
- Artificial intelligence for cyber resilience - UK Parliament published in June - “AI may be able to improve cyber resilience by:
  - identifying unusual activity in a computer network and addressing threats in real time
  - detecting evolving fraud patterns and flag AI-generated phishing emails
  - performing ‘predictive maintenance’, including anticipating system failures and detecting software vulnerabilities
  - summarising incidents and recommend responses to security operations centres
  - analysing third-party risks to vendor and supply chains using public data”
- How Far Behind the Frontier are Leading Open Weight Models on Cyber? - UK AI Security Institute publish - “We evaluated the cyber capabilities of leading open and closed weight AI models, and found that recent open models GLM-5.2 and DeepSeek V4-Pro perform similarly to frontier closed models released 4 to 7 months before them – a narrower gap than the 6 to 10 months we measured through most of 2025.”
- Co-RedTeam: Orchestrated Security Discovery and Exploitation with LLM Agents - Google publish - “Extensive evaluations on challenging security benchmarks demonstrate that Code-RedTeam consistently outperforms strong baselines across diverse backbone models, achieving over 60% attack success rate in vulnerability exploitation and up to 10% absolute improvement in vulnerability detection.”
- Navigating Security in the Machine Learning and AI Supply Chain: What Policymakers Need to Know - Max Smeets, Anna Sophie den Ouden, and James Shires think tanks - “the report breaks the machine learning and AI supply chain into three levels: the data level, the model level, and the deployment level. Across these levels, malicious actors exploit trust, complexity, and limited visibility.”
- Former ONCD official Rajan sees opportunity for White House-led push utilizing formal methods to verify security of frontier AI models - Inside Cyber Security reports - “The Office of the National Cyber Director should play a larger role in working with other agencies to establish formal methods that mathematically prove software used by frontier AI models is secure from vulnerabilities, according to former tech security lead Anjana Rajan.”
- The next frontier of AI: how ‘world models’ are simulating reality and virtual spaces - South China Morning Post reports - “The renewed interest reflects the rapid rise of AI agents and robotics, where simply generating text or video is no longer enough. Increasingly, AI systems are expected to predict how environments will respond to actions before they are taken. Unlike conversational AI like ChatGPT, which predicts the next word in a sentence, a world model predicts the next state of a physical environment. What makes the current wave distinct is that companies are building their products based on fundamentally different interpretations of what a “world” should be.”
- AIDE²: The First Evidence of Recursive Self-Improvement - Weco assert - “We built a recursive self-improvement (RSI) system by running autoresearch on autoresearch. The system, AIDE², took eight days to discover a better autoresearch harness than the one we built over the last two years. Fully autonomously, AIDE² designed a novel search algorithm, reduced the prompt size by 16×, and built a layered system against reward hacking.”
- The Future of Meta Superintelligence: A 1 Year Progress Update - Semi Analysis analyses - “Data is the new oil (for real this time) - We’ll start with data because it’s Meta’s newest advantage and probably the most underappreciated of the three. In 2024, Ilya famously said that “data is the fossil fuel of AI.” While this analogy correctly highlights the importance of data for training AI models, it incorrectly assumes that the amount of good data is finite. In reality, if demand is strong enough, market forces will find a way.”
- Huawei’s plan to achieve the escape velocity: Applying Tau Scaling to entire AI datacenters - Polymath707 breaks down - “The bet this essay has described is not a one-generation trick that a rival node shrink erases. It is a claim that for the next decade the binding constraint on AI hardware is topological: about how memory, power, and fabric reach the compute; and that Huawei has organized its entire roadmap, from the Unified Bus outward to the folded package, around winning on that axis rather than the transistor axis western companies are able to race down.”
- AI 2040 Plan A - Thomas Larsen, Romeo Dean, Brendan Halstead, Eli Lifland, Ryan Greenblatt and Daniel Kokotajlo propose - something which largely is in impractical but interesting nevertheless that one would consider - that is an agree slowdown between China and the US
Cyber proliferation
- Moroccan intelligence insider reveals widespread use of Pegasus hacking software - The Guardian reports - “A Spanish mobile number belonging to Aminatou Haidar, a prominent human rights activist from Western Sahara, was included in the leaked database and found to have been targeted by Pegasus dating back to 2018.”
Bounty Hunting
- Two sentenced for hacking Transport for London in UK’s biggest ever cyber crime case - UK National Crime Agency announce - “All 27,000 of TfL’s employees were forced to attend a TfL office for a password reset and a total of 148 systems became inoperable, including critical ones that required significant manual workarounds and delays. The organisation, which reported the incident to CoLP’s Report Fraud service, suffered a reported £29 million in loss and recovery costs.”
- Three Russian Nationals Indicted for International Cybercrimes Resulting in More Than $62M in Losses to Victims - US Department of Justice announce - “The U.S. Attorney’s Office for the Northern District of Ohio has announced the unsealing of an indictment charging three Russian nationals for their roles in malicious cyber activities against U.S. critical infrastructure affecting victims in 21 states and in several countries, with losses amounting to tens of millions of dollars. These charges are the result of a seven-year-long investigation.”
- Man Serving Federal Prison Sentence Charged with Theft of Forfeited Cryptocurrency - US Department of Justice announce - “Having been convicted of a widespread online auction fraud scheme targeting U.S. victims, Iossifov is now charged with moving cryptocurrency that he obtained from that crime, in violation of a court’s forfeiture order,”
- Russian man pleads not guilty in US cyber espionage case - Reuters reports - “A Russian man whom U.S. prosecutors say previously worked for Russia's ‌FSB intelligence agency pleaded not guilty on Thursday to a charge that he participated in a cyber espionage campaign that a technology company conducted against Western organizations.”
  - Alleged Russian cyber spy in Boston case previously worked for Kaspersky, source says and documents show - Reuters reports - “Although the alleged hacking activity took place after he left Kaspersky, Obrezko’s background is likely to draw further attention to the company’s relationship with the Russian government.”
- Teen accused of using ChatGPT to delete 46,000 anime accounts - The Ashai Shimbun report - “Tokyo police on July 6 arrested a 15-year-old boy who has admitted to using AI-powered ChatGPT to build a program that forcibly deleted 46,000 accounts on anime streaming service “Bandai Channel,” sources said.”
- Apple sues OpenAI, its employees claiming theft of trade secrets - BBC reports - “At least two long-time Apple workers who left the company to join OpenAI allegedly took part in this pattern by, in part, emailing themselves internal Apple information.”
  - Court papers
- ..
Market Incentives
- Novel Autonomy & Robotics Competition Document - UK Defence Innovation publishes - “On receipt of a FUND decision, successful innovators (and their sub-contractors) must prove cyber resilience before the contract is awarded.”

Reflections this week are read the headlines of the footnotes section on AI applied to cyber security. The level of investment grows each week, volume of papers increase - so even if they’re not there today it is clear we are going to get workable solutions which mean humans can be removed from in and on the loop.

Not getting this via email? Subscribe:

Think someone else would benefit? Share:

All attribution is by others and not the UK Government unless specifically stated as such, please see the legal text at the end.

Have a lovely Saturday…

Ollie

Cyber threat intelligence

Who is doing what to whom and how allegedly.

Reporting on Russia

Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting

United States National Security Agency (NSA), United States Cybersecurity and Infrastructure Security Agency (CISA), United States Federal Bureau of Investigation (FBI), United States Department of Defense Cyber Crime Center (DC3), Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC), Communications Security Establishment Canada’s (CSE’s) Canadian Centre for Cyber Security (Cyber Centre), New Zealand National Cyber Security Centre (NCSC-NZ), United Kingdom National Cyber Security Centre (NCSC-UK), Czech Republic National Cyber and Information Security Agency (NÚKIB), Danish Defence Intelligence Service (DDIS), Estonian Foreign Intelligence Service (EFIS), Estonian Information System Authority (RIA), Finnish Defence Intelligence (FDI), Finnish Security and Intelligence Service (SUPO), French National Cybersecurity Agency (ANSSI), Italian External Intelligence and Security Agency (AISE), Italian Internal Intelligence and Security Agency (AISI), The Military Counterintelligence Service of Poland (SKW) and Sweden National Cyber Security Centre (NCSC-SE) assemble like the avengers with this release focusing on the need to improve router hygiene. Also a reminder that all vendors should implement our guidance on digital forensics and protective monitoring specifications for producers of network devices and appliances - for device vendors.

Russian Federal Security Service (FSB) Center 16 cyber actors continue to exploit poorly configured and vulnerable networking devices worldwide, opportunistically compromising multiple critical infrastructure sector networks. This joint Cybersecurity Advisory (CSA) builds on FBI’s Russian Government Cyber Actors Targeting Networking Devices, Critical Infrastructure Public Service Announcement of the decadeplus FSB Center 16 cyber activity by providing additional tactics, techniques, and procedures (TTPs) to enable defenders to more fully understand and counter the threat.

https://media.defense.gov/2026/Jul/09/2003959498/-1/-1/1/CSA_IMPROVE_ROUTER_HYGIENE.PDF

Targeting and Compromise of French Entities Using the Turla Intrusion Set

Government of France attributes and detail this alleged Russian operation against French entities. The government targeting will be of note as will the stated purpose.

Members of the Cyber Crisis Coordination Centre (C4) have observed the targeting and compromise of French entities using the Turla intrusion set operated by the 16th Centre of the Federal Security Service of the Russian Federation (FSB). Since at least 2004, this intrusion set has been implemented for intelligence-gathering purposes against strategic entities and individuals worldwide, including in France. The French intermediate and final victimology of the Turla intrusion set notably includes ministries, entities in the diplomatic, defence, justice, and technology sectors. Espionage campaigns associated with the Turla intrusion set against Ukraine, NATO countries, and EU member states continue in the context of Russia’s war of aggression launched on February 24, 2022.

https://cert.ssi.gouv.fr/cti/CERTFR-2026-CTI-005/

https://www.diplomatie.gouv.fr/fr/presse-et-ressources/decouvrir-et-informer/actualites/attribution-a-la-russie-d-activites-cyber-malveillantes-a-des-fins-d-espionnage-en-france

Advisory Russian state actors are compromising IP cameras

Netherlands General Intelligence and Security Service (AIVD) and the Netherlands Defence Intelligence and Security Service (MIVD) disclose and detail this alleged Russian operation against IP cameras. This should serve as a warning to focus on the cyber security of such infrastructure which can be repurposed for cyber-physical intelligence gain.

illustrates that Russian state actors are systematically conducting digital espionage operations via IP cameras (cameras with internet access). At least one Russian intelligence and security service is responsible for these operations that are taking place in the Netherlands, various other EU and NATO member states and Ukraine. This cybersecurity advisory concludes with actionable recommendations to mitigate the risks of espionage via IP cameras.

https://english.aivd.nl/documents/2026/07/10/brochure-cybersecurity-advisory-russian-state-actors-are-compromising-ip-cameras

UAC-0145 Primary Compromise Vectors as of July 2026

Ukraine CERT detail the alleged initial access tradecraft of this alleged Russian threat actor. The detection opportunities here are strong..

As a rule, the implementation of the malicious plan was carried out using the already known software tools KALAMBUR , SUMBUR , TAMBUR , and unauthorized remote access was primarily provided using legitimate programs OPENSSH and TOR, which provided forwarding of local network ports (in particular, 445, 3389, 22) to a remote server, actually publishing them within the infrastructure controlled by the attackers. In addition, software tools for stealing keys and data of the messengers Signal, WhatsApp, for the exfiltration of which RSYNC could be used, became widespread.

https://cert.gov.ua/article/6318437

Burnt by Burgers: Highlighting Void Blizzard’s Russian State Links

Ctrl-Alt-Intel conduct open source intelligence and alleged further links to the Rusian state than stated in indictment and affidavit.

Identifiers attributed to Obrezko by the FBI appear alongside an IAC EMERCOM-associated work number and repeated weekday food deliveries to EMERCOM facilities during 2021. Taken together, these findings support our high-confidence assessment that Obrezko worked at, or regularly operated from, IAC EMERCOM.
Public records add further context around Yutek-NN: an FSB-issued licence for surveillance-adjacent equipment, and publicly declared personnel movements in both directions between Yutek-NN and IAC EMERCOM. None of these findings independently proves that Yutek-NN conducted cyberespionage. Collectively, however, they show that the company has deeper connections to Russian state and security institutions than its public-facing website suggests.

https://ctrlaltintel.com/research/VoidBlizzard/

OkoBot: new sophisticated malware framework targets cryptocurrency users

Yaroslav Kikel details an alleged Russian-nexus campaign which lays down SSH. Allegedly criminally linked..

TookPS is a downloader used for retrieving malicious commands and scripts from attacker-controlled servers to further propagate attacks. The first campaign using TookPS was discovered in March 2025. At that time, malicious scripts delivered a Python‑based infostealer along with a script that installed and configured an SSH tunnel on the victim’s machine. The next wave appeared in April 2025: the payload was changed, and TookPS was used to deliver the TeviRAT malware with the same SSH installer.

https://securelist.com/okobot-framework-targets-cryptocurrency-wallets/120660/

Reporting on China

Suspected Chinese Operators Use Claude Code and DeepSeek to Target Government and Financial Systems Across Four Countries

Hunt.io detail the use of AI by alleged Chinese operators in their intrusion campaign along with victimology. It is however of note this is not autonomous end to end - yet. But rather knowledge and productivity enhancement for discrete parts of the workflow.

The open directory on 112.213.124[.]132 exposed a full operational toolkit, including payloads, operator files and scripts, and victim-specific folders.
Infrastructure pivots identified 13 Hong Kong-based servers spanning four separate ASNs, three with shared SSH keys and TLS certificates, serving in a redundancy capacity.
Active exploitation of government systems in Afghanistan, Thailand, and Taiwan, with reconnaissance and phishing staging against U.S. government portals.
Scanning of 5,890+ government hosts across 10 countries with a Python-developed automated scoring scale.
Claude Code handled execution and session persistence while DeepSeek-v4-pro drove the reasoning, a two-model split documented across the recovered log files.

https://hunt.io/blog/chinese-operators-claude-deepseek-government-intrusion

Daxin Returns: Stealthy Malware Resurfaces in Taiwan Alongside a New Backdoor

Symantec and Carbon Black detail alleged Chinese regional targeting which surfaced a new implant. The novel keyboard-layout DLL implant mechanism will be of note.

Backdoor.Daxin, the China-linked kernel-mode rootkit that Symantec first uncovered and exposed in 2022, is still operational. It was found running on a compromised host in Taiwan in 2026, more than four years after it was first uncovered.
On the same machine, the Symantec Threat Hunter Team discovered a previously unknown backdoor, Backdoor.Stupig, whose novel tradecraft may link it to the Daxin operation, though no code-level connection has been confirmed.
Stupig uses a technique not documented in any known malware family. A Trojanized keyboard-layout DLL loaded by winlogon.exe lets an attacker run commands as System directly from the Windows logon screen, before anyone signs in and without raising a logon audit event.
Both samples carry compile timestamps from early 2013, but the host was not reporting telemetry until May 2026. Combined with the actor’s known pattern of long-term, stealthy persistence, this suggests the intrusion may have gone undetected on the network for 13 years.
The victim was a Taiwan-based subsidiary of a multinational high-tech manufacturer.

https://www.security.com/threat-intelligence/daxin-returns-stupig

Introducing CylindricalCanine: The GoldenEyeDog subgroup responsible for the April DigiCert incident

Aaron Walton details the other end of the alleged Chinese cyber spectrum but also the fact they managed to allegedly compromise of a certificate authority. This is the alleged capability and intent of Chinese cyber crime in 2026.

Chinese cybercrime group, GoldenEyeDog, has been regularly updating their malware and tactics since 2015. We’ve observed them regularly leveraging code-signing certificates to bypass Windows’s SmartScreen since 2024.
They leverage several malware, including one we’ve seen primarily documented in Chinese language publications, and are calling it “Golden Gh0st RAT”.
In April 2026, GoldenEyeDog used their malware to access a support member’s device at DigiCert, a code-signing certificate provider, and leveraged their access to steal certificates intended for DigiCert customers. This attack highlighted the capability of the malware and operators.

https://expel.com/blog/introducing-cylindricalcanine/

Reporting on North Korea

Analysis of attack actions suspected to be from the APT-C-26 (Lazarus) group upgrading its monitoring program

360 Threat Intelligence Centre from China detail an alleged North Korean operation which is noteworthy for the monitoring they ended up laying down.

In the attack process, various components of the organization worked together to not only build a covert remote desktop environment but also integrate keylogging capabilities, forming a comprehensive monitoring and control platform. This provided attackers with the ability to conduct multi-dimensional and continuous monitoring and control of the compromised host, significantly enhancing the efficiency of their data theft and intelligence gathering.

https://mp.weixin.qq.com/s/6hjjsEuuOTk8_FJrXWe9Ew

BirdCall: ScarCruft Malware Masquerading as Zangi Messenger

S2W detail alleged North Korean use of repackaged application to gain initial access. Of note to those organisations who support APK side loading etc or application stores without controls / observability.

Another malicious app identified is the BirdCall malware, which masquerades as the Zangi messenger app.
It has been confirmed that the attacker repackaged the legitimate app to alter its entry point.
The BirdCall malware app uses dual Zoho WorkDrive accounts (cmdCloud and dataCloud) as C2 channels.
It steals information about infected devices and collected sensitive data, and supports a total of eight types of remote commands, enabling it to control devices, steal files, and re-collect data.
The stolen data is structured according to a sophisticated packet format defined within the malware and is encrypted and obfuscated using AES-256-CBC + zlib multi-layer encryption.
Additionally, when uploaded to Zoho WorkDrive, filenames are obfuscated through Base-26 encoding and packed into an 11-base structure.

https://s2w.inc/en/resource/detail/1096

https://s2w.medium.com/detailed-analysis-of-birdcall-malware-marsqurading-as-zangi-messenger-b80db8f5c320

Operation Capsule Vault: RokRAT Attack Chain Analysis Using EMBED_PAYLOAD_v2

Genians details this alleged North Korean operation which uses well understood tradecraft which any moderately capable organisation should be able to defend against.

Initial access was carried out through spear-phishing emails disguised as materials for actual academic events and seminars.
Although the file was disguised as a PDF, it actually delivered a malicious ISO file through a cloud storage link.
The ISO contained an executable disguised as a PDF document, using the “.pdf”, “.pif” extension to induce the user to run it.
The attack loaded the shellcode payload into memory and injected a RokRAT variant into a process.
EDR and threat hunting policies should be strengthened to detect correlated ISO and PIF execution behaviors.

https://www.genians.co.kr/en/blog/threat_intelligence/rokrat_capsule_vault

Reporting on Iran

Threat Intelligence Report: The Pro-Iran Hacktivist Ecosystem 2026

Domain Tools provides their overview and assessment of this alleged hacktivist eco-system.

The ecosystem operates through Telegram channels and websites, shared target lists, DDoS-for-hire tools, recycled breach data and leak-amplification campaigns. Attack claims and propaganda often appear within hours of kinetic events. This gives actors a deniable auxiliary role while keeping them separate from formal state structures.
Most activity remains technically unsophisticated. DDoS attacks, website defacements, and hack & leak extortion-style messaging with exaggerated claims are more common than verified advanced intrusions. The strategic effect comes less from technical capability than from speed, visibility, and ideological framing that make it into news cycles. In practice these actors use cyber activity as scalable asymmetric information warfare. Even with limited high-end capability, loosely aligned ideological and state-adjacent networks can impose psychological, political, and economic pressure on adversaries during periods of regional crisis.

https://dti.domaintools.com/research/threat-intelligence-report-the-pro-iran-hacktivist-ecosystem-2026

Reporting on Other Actors

SharpViewStateKing: The stealthy implant framework

Canadian Centre for Cyber Security detail this unattributed by streatly implant framework which defence teams will want to assess if they have coverage of.

In late December 2025, the Cyber Centre detected what appeared to be a web shell on a public-facing Microsoft Internet Information Services (IIS) server running a commercially available ASP.NET application. Incident response activities were initiated and analysis revealed that this web shell was part of a stealthy implant framework called SharpViewStateKing. This technical article aims to raise awareness, provide detection guidance, and highlight remediation actions associated with the malicious modules. What follows is derived from endpoint telemetry and process memory captured during the incident.

https://www.cyber.gc.ca/en/news-events/sharpviewstateking-stealthy-implant-framework

Hidden Exfiltration Capability Discovered in a Trusted, 900,000-User Chrome Web store Extension

Charlie Kelly, Joss Moor, Sebastian Lacatusu and Silas Bryant detail this campaign which is noteworthy due to its scale and capability.

We found dormant surveillance functionality in a trusted Chrome Web Store extension with around 900,000 users, including the ability to collect, encrypt and potentially exfiltrate browsing-domain data.
Underneath this genuine and functional header-editing tool, version 7.0.18 contains:
A browsing history collection engine that fingerprints the device, encrypts each visited domain with a hardcoded AES-GCM key, and stages the data in a local database.
A prebuilt exfiltration channel designed to upload that encrypted history, roughly once per day, to a likely attacker-controlled endpoint api.stanfordstudies.com.
Install, update, and uninstall telemetry beaconed to a second third-party domain extensions-hub.com.
A content script that injects into every website visited and logs request metadata to a local store.
In the version analysed, the exfiltration trigger is currently gated off by an empty allow-list, meaning that browsing-history upload is dormant in this build. Every other component (the encryption key, the endpoint, the scheduler, the storage) is present and functional.

https://stripeolt.com/knowledge-hub/threat-research/chrome-extension-hidden-data-exfiltration-900k-users/

One Misconfigured Server, Three Active Campaigns: Full exposure of three AiTM Phishing Operators

Lexfo CTI team detail this Adversary in The Middle phishing operator who further reenforce the business case for pervasive passkeys.

A single misconfigured Python HTTP server exposed the complete operational stack of a live phishing operator, configs, logs, RMM installers, combolists, and Telegram session files.
Three distinct threat actors were identified from one entry point: codemado, mail-argenta, and saroula01, each running independent campaigns on custom Evilginx forks sourced from the same public GitHub repositories.
codemado is an Egyptian operator with roots in the hacking underground dating back to 2018, operating a full AiTM platform with a seven-tool RMM arsenal on a Budapest VPS.
saroula01‘s Device Code Flow campaign ran undetected for over a year, accumulating 218 confirmed victims across 12 countries, with tokens silently auto-refreshed in the background.
mail-argenta is a Nigerian operator who was identified through infostealer logs containing his own credentials, including the MySQL password hardcoded in his phishing panel, reused across personal accounts.
Both AiTM proxying and Device Code Flow abuse bypass MFA entirely.
codemado’s MaDoO Blaster is promoted within RockyBelling’s The Quarry ecosystem, reported by SOCRadar’s investigation.
All three operators built functional MFA-bypass infrastructure from public GitHub repositories with minimal customization, using AI-assisted development.

https://blog.lexfo.fr/opendir-to-phishing-operator.html

OAuth Client ID Spoofing: Why Fake Client IDs Are Gaining Traction for Stealthy Enumeration

Rachel Rabin details this technique which one can imagine Microsoft will look to tighten up.

Proofpoint has observed OAuth client ID spoofing emerging as a novel technique, increasingly leveraged in cloud campaigns.
Microsoft Entra ID returns different responses depending on whether a supplied OAuth client ID is valid and whether it corresponds to a registered application.
This behavior enables account enumeration without a registered OAuth application and allows attackers to infer password validity or account state without generating a successful sign‑in event.
Researchers observed multiple campaigns at scale abusing spoofed OAuth application identifiers, with distinct tooling, infrastructure, and execution patterns indicating independent adoption by multiple threat actors.
To detect similar activity, defenders should monitor sign-in logs for events without an application name, which may indicate spoofed client IDs.

https://www.proofpoint.com/us/blog/threat-insight/oauth-client-id-spoofing-why-fake-client-ids-are-gaining-traction-stealthy

Software Supply Chain Incursions

A reminder we issued guidance a number of weeks ago in Software supply chain attacks: check your dependencies for software developers

A related interesting academic paper this week too ProfMalPlus: Agent-Coordinated Detection of Malicious NPM Packages via Static-Dynamic Analysis Synergy

Discovery

How we find and understand the latent compromises within our environments.

Use Unified Sign-In logs in Advanced Hunting

Fabian Bader is back with this master class..

One thing that always makes analyzing Sign-In logs for Entra ID (Azure AD) users a bit complicated is the different types of Sign-In logs available.
..
This is where my KQL query comes in handy. It joines the two tables as one, renames the column to the original name and converts all to the same data type. And when you save it as a function, you can use it as if it where a built-in table.

https://cloudbrothers.info/en/unified-sign-logs-advanced-hunting/

Stinger

Adel Ka provides cyber deception capability uplift this with this release. Speaking to other cyber deception vendors it is clear that the lure of tokens is too much..

Stinger is an experimental endpoint deception tool for individual macOS and Linux workstations. It places decoy resources at likely collection points and records when a process interacts with them.
Malicious packages, compromised extensions, and infostealers can collect tokens, keys, browser data, or wallet material in a single run. On personal workstations, EDR and privileged file-access monitoring are often absent, while many canary tokens do not signal until collected bait is later rendered, fetched, resolved, or used. Stinger targets an earlier point: local interaction with the decoy during collection.

https://github.com/0x4D31/stinger

tempolocus

Alexandre Dulaunoy releases this interesting solution to reduce the need to look at a time zone map and public holiday list.

Tempolocus is a time-series activity patterns and approximate location inference

https://github.com/ail-project/tempolocus

Detections for LegacyHive exploitation

Kevin Beaumont releases this detection for this unpatched vulnerability..

https://github.com/GossiTheDog/ThreatHunting/blob/master/AdvancedHuntingQueries/LegacyHive.kql

Defence

How we proactively defend our environments.

Writing Intune Endpoint Privilege Management rules for the real world: File hash, certificate, and when each one is the wrong choice

Mattias Melkersen and Simon Skotheimsvik provide defensive wisdom and a practical implementation approach for those in the Microsoft eco-system.

But the underlying discipline is consistent. Identify files as precisely as the situation allows. Never rely on a weak attribute alone. Control what an elevated process is allowed to spawn. Test on a real standard user before you trust a rule. And structure your assignments so that conflict resolution works for you rather than surprising you.

https://msendpointmgr.com/2026/07/03/epm-part-3-writing-intune-endpoint-privilege-management-rules-for-the-real-world-file-hash-certificate-and-when-each-one-is-the-wrong-choice/

Incident Writeups & Disclosures

How they got in and what they did.

Lessons from CISA’s Cyber Incident

Preston Werntz, Acting Chief Information Officer and Brad Libbey, Acting Chief Information Security Officer at CISA show world-leading transparency here.

On Friday, May 15, CISA began an internal incident response when an investigative reporter inquired about internal CISA Amazon AWS GovCloud Keys and other information being made available in a public repository. The reporter received this information from a security researcher whose company continuously scans public code repositories.

https://www.cisa.gov/news-events/news/lessons-cisas-cyber-incident

Security incident disclosure — July 2026

Hugging Face disclose

Earlier this week, we detected and responded to an intrusion into part of our production infrastructure. This one was different from anything we had handled before in one important way: it was driven, end to end, by an autonomous AI agent system - and we detected and dissected it largely with AI of our own.
We identified unauthorized access to a limited set of internal datasets and to several credentials used by our services. We are still completing our assessment of whether any partner or customer data was affected, and we will contact any affected parties directly as required. We have found no evidence of tampering with public, user-facing models, datasets, or Spaces, and our software supply chain (container images and published packages) was verified clean.

https://huggingface.co/blog/security-incident-july-2026

Vulnerability

Our attack surface.

Establishing a Coordinated Vulnerability Disclosure Program to Work With Security Researchers

U.S. Cybersecurity and Infrastructure Security Agency, U.S. National Security Agency, Japan Computer Emergency Response Team Coordination Center, Netherlands’ National Cyber Security Centre and United Kingdom’s National Cyber Security Centre detail what good looks like

This guide is authored by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and National Security Agency (NSA), the Japan Computer Emergency Response Team Coordination Center (JPCERT/CC), the Netherlands’ National Cyber Security Centre (NCSC-NL), and the United Kingdom’s National Cyber Security Centre (NCSC-UK)—hereafter referred to as the “authoring organizations”—and provides best practices for suppliers to design and implement a CVD program to effectively work with security researchers. The authoring organizations recommend suppliers, especially software manufacturers, develop a CVD program aligned with the best practices outlined in this joint guide.

https://media.defense.gov/2026/Jul/14/2003961238/-1/-1/0/260714-D-AB123-1001.PDF

VulnHunter

Vinay Vira, Scott Schenkein and Ieribo publish

VulnHunter is an open-source, agentic AI security tool that applies proactive, attacker-first analysis directly to source code.
Unlike traditional, passive SAST scanners that flag suspicious patterns and often cause false positives, VulnHunter reasons like an adversary. It identifies which defects are actually exploitable, maps prospective attack paths, and proposes targeted, evidence-backed fixes.

https://github.com/capitalone/vulnhunter

Zimbra 10.1.19

Patch patch patch..

The update fixes a security issue in the Classic Web Client where a specially crafted email could run malicious code when the email is opened. If exploited, it could allow access to mailbox information, session data, or account settings.

https://blog.zimbra.com/2026/07/patch-release-update-zimbra-10-1-19/

Semantics Over Syntax: Uncovering Pre-Authentication 5G Baseband Vulnerabilities

Craig S. Blackie and Darren McDonald

Dell stores its BIOS administrator and user passwords as XOR-encrypted plaintext in the DVAR (Dell Variable) region of the SPI flash chip, not as a one-way hash. The scheme encrypts a 32-byte password field with a 20-byte key, and the first character is not encrypted at all. For any password up to 12 characters, the unused tail of the field leaks the entire key, so the password can be recovered directly from a flash dump with no brute force and no known plaintext. Longer passwords leave a small blind zone in a single record, which a quirk of the key derivation then closes (more below). Recovery is deterministic and completes in milliseconds. An attacker who can read the SPI flash, which is possible with a clip and a cheap programmer or by booting an operating system they control, can recover the password and gain full BIOS access. We found this jointly by chance while working on something entirely different. The affected scheme is used across a range of older Dell platforms, a large number of which are now near or past end of support, whereas newer platforms have moved to a more secure password-protection mechanism. It is not, however, limited to legacy hardware: it is confirmed on the current-generation Wyse 5070 thin client, which remains supported and unpatched, and it is implemented in the SystemPwSmm SMM driver common to Dell client platforms.

https://arxiv.org/abs/2604.04283

Forgotten UEFI shims undermining Secure Boot

Martin Smolár highlights this knotty attack surface but also why roots of trust need to be comprehensive in their mitigations.

ESET researchers identified 11 old and forgotten UEFI shim bootloaders at versions 0.9 and below that can be used to bypass UEFI Secure Boot on any UEFI-based machine that trusts Microsoft’s Microsoft Corporation UEFI CA 2011 third-party UEFI certificate authority (CA) certificate, regardless of the installed operating system (OS). Reported shims can be exploited to execute untrusted code during system boot, enabling attackers to deploy malicious UEFI bootkits (such as Bootkitty, HybridPetya, or BlackLotus) even on systems with UEFI Secure Boot enabled.
We reported our findings to CERT/CC in February 2026, and the vulnerable UEFI applications were revoked on Microsoft’s June 9^th, 2026 Patch Tuesday.

https://www.welivesecurity.com/en/eset-research/forgotten-uefi-shims-undermining-secure-boot/

Unfit to Boot: Breaking U-Boot’s FIT Signature Verification

Anton Ivanov surfaces some technical debt which will be interesting to see how pervasive the impact is in reality.

For most of these vulnerabilities, the affected code has been present in U-Boot since version v2013.07. This means that they potentially affect over 50 stable releases of the U-Boot project. Counting many downstream vendor forks, these vulnerabilities have a significant impact on the industry.

https://www.binarly.io/blog/unfit-to-boot-breaking-u-boots-fit-signature-verification

Dell BIOS Passwords: Weak XOR Encryption Allows Recovery from SPI Flash (CVE-2026-40639)

Craig S. Blackie and Darren McDonald detail and the fact some remain unpached.

The affected scheme is used across a range of older Dell platforms, a large number of which are now near or past end of support, whereas newer platforms have moved to a more secure password-protection mechanism. It is not, however, limited to legacy hardware: it is confirmed on the current-generation Wyse 5070 thin client, which remains supported and unpatched, and it is implemented in the SystemPwSmm SMM driver common to Dell client platforms.

https://blog.amberwolf.com/blog/2026/july/dell-bios-passwords-weak-xor-encryption-allows-recovery-from-spi-flash-cve-2026-40639/

Offense

Attack capability, techniques and trade-craft.

Bind Link Abuse: One Windows Feature, Many Ways to Blind Your EDR

Martin Zugec highlights a technique that defensive teams will want to develop detection tradecraft or at least a source of signal for.

Windows includes a file-system virtualization feature that can redirect one local path to another without modifying the original file or leaving a persistent filesystem artifact. It is implemented by bindflt.sys, the Bind Filter minifilter driver, and used legitimately by Store apps, Windows Sandbox, and Windows containers. Bitdefender Labs documented and named three new techniques that an attacker running as a local administrator can use to blind EDR sensors and bypass built-in Windows defenses such as AMSI and AppLocker.

https://www.bitdefender.com/en-us/blog/businessinsights/bind-link-abuses-windows-feature-edr-evasion-technique

There and Back Again: An Operators Guide on NTLM Relaying Egress

Logan Goins breaks down a technique which has historically been used by a range of adversaries. Again developing capability to detect would be wise.

What’s old is new again. Remember coercing SMB NTLM egress tradecraft to crack challenge response back in the day? We see a lot of situations in our assessments where relaying NTLM from coerced network egress is ideal when escalating locally over C2 is unattainable or firewall rules are in play preventing WebDav relays to LDAP. This technique involves NTLM authentication coercion outbound to the internet, catching that traffic with a cloud host, and forwarding that traffic back to our red team infrastructure where it will be proxied back into the target environment to a service which will allow identity or computer takeover.

https://specterops.io/blog/2026/07/15/there-and-back-again-an-operators-guide-on-ntlm-relaying-egress/

BingusLdr

Bingus attempts to blind some EDR capabilities with this release.

CET compatible stack spoofing
EAF compatible API resolution
Heap masking
Image masking

https://github.com/Sizeable-Bingus/BingusLdr

UnwindRaven

Tom O'Neill drops this which similarly tries to blind some EDR capabilities..

UnwindRaven is a Windows x64 offensive research framework that constructs fully synthetic call stacks at thread startup time, making a newly created thread appear — to stack-walking debuggers, EDR sensors, and kernel callbacks — as though it was legitimately invoked by a chain of known, trusted system frames.

https://github.com/toneillcodes/UnwindRaven

Exploitation

What is being exploited..

Nothing overly of note this week…

Tooling and Techniques

Low level tooling and techniques for attack and defence researchers

CET-Compliant Callstack Spoofing via Thread Pool Enum Callback Trampolining

Tiziano Marra walks through how shadow stack call stack spoofing can be achieved through this excellent write-up.

https://mrtiz.github.io/cet-callstack-spoofing-thread-pool-trampoline

AutoTrace

Arastoo Zibaeirad, Marco Vieira and Thomas Zimmermann provides a capability uplift here which will compress exploitation.

We present AutoTrace, an agentic pipeline that localizes vulnerability triggers by exploring a code property graph layer by layer, with LLM agents deciding where to look next and deterministic admissibility gates deciding what evidence is required before a trigger can be reported. Agents never accept a trigger on their own authority; every reported trigger is backed by explicit evidence drawn from the graph, so the pipeline covers both intra- and interprocedural vulnerabilities without relying on ungrounded model judgment. On the full InterPVD benchmark, AutoTrace reaches 75.0% VulnHit and 80.8% FuncHit, surpassing the prior state of the art on the same corpus. Building on the same machinery, we construct SinkTrace-Bench, a dataset that exposes each vulnerability as a source-to-sink (S2S) causal chain from attacker-controlled input through propagation to the dangerous operation, drawn from matched vulnerable and patched program states. It comprises 1,542 verifier-confirmed, perfectly balanced vulnerable/safe samples whose label fidelity we audit against expert annotations.

https://arxiv.org/abs/2607.12058

Footnotes

Some other small (and not so small) bits and bobs which might be of interest.

Finally finally the NCSC’s podcast series.

Unless stated otherwise, linked or referenced content does not necessarily represent the views of the NCSC and reference to third parties or content on their websites should not be taken as endorsement of any kind by the NCSC. The NCSC has no control over the content of third party websites and consequently accepts no responsibility for your use of them.

This newsletter is subject to the NCSC website terms and conditions which can be found at https://www.ncsc.gov.uk/section/about-this-website/terms-and-conditions and you can find out more about how will treat your personal information in our privacy notice at https://www.ncsc.gov.uk/section/about-this-website/privacy-statement.

CTO at NCSC - Cyber Defence Analysis

Ready for more?