Weekly Threat Intel Report — 2026-W23

TL;DR

The first week of June 2026 was defined by two parallel storms. On the perimeter, Check Point disclosed CVE-2026-50751, a critical authentication flaw in its Remote Access VPN and Mobile Access products that had been exploited as a zero-day since early May; Check Point and BleepingComputer link at least one intrusion to a Qilin ransomware affiliate, and CISA added the bug to its Known Exploited Vulnerabilities (KEV) catalog within hours of disclosure. On the developer-tooling side, the Shai-Hulud supply-chain saga continued to mutate: Microsoft detailed the 'Red Hat npm Miasma' compromise of 90+ package versions, DarkReading covered a Rust-written 'IronWorm' worm on npm, and a 'Hades' variant trojanized 19 science-focused PyPI packages and 37 PyPI wheels. Espionage news included a SentinelLabs/ESET deep-dive on operational cooperation between Russia's Gamaredon and Turla against Ukrainian targets. ShinyHunters leaked roughly 2.6 million records from U.S. dental benefits administrator DentaQuest, Silent Ransom Group escalated vishing-led extortion against U.S. law firms, and Meta confirmed 20,225 Instagram accounts were hijacked through abuse of its AI-powered support system.

Notable Activity by Actor

Qilin — VPN zero-day operationalized. BleepingComputer and DarkReading reported on 8 June that Check Point patched CVE-2026-50751, a critical flaw in Remote Access VPN and Mobile Access deployments. According to Check Point, exploitation predates early May, and at least one observed intrusion is linked to a Qilin ransomware affiliate. The pattern — edge device, authentication bypass class, rapid ransomware adoption — is now familiar, but the speed from disclosure to KEV listing (CISA added it the same day) underscores how compressed the patch window has become for perimeter gear.

ShinyHunters — DentaQuest leak. Check Point Research's 8 June bulletin reports that ShinyHunters leaked exfiltrated data from DentaQuest, a U.S. dental benefits administrator owned by Sun Life. Analysts assess approximately 2.6 million accounts were exposed, including names and email addresses. The disclosure is consistent with the group's pattern of large-scale identity-data theft followed by public leak as extortion leverage.

Turla and Gamaredon — confirmed operational handoff. SentinelLabs' LABScon25 replay, summarizing ESET research, documents how Russia's Gamaredon group facilitated Turla access to Ukrainian targets in 2025. Gamaredon's high-volume spearphishing seeded the access; Turla followed with quieter espionage tooling. Public, well-evidenced cooperation between two FSB-linked clusters is rare and has tradecraft implications: defenders should treat Gamaredon prevalence in a network as a possible indicator of Turla follow-on, not just commodity Russian noise.

Silent Ransom Group — vishing into U.S. law firms. Per Mandiant reporting (covered by BleepingComputer and DarkReading on 7–8 June), Silent Ransom Group is escalating social-engineering attacks against U.S. law firms and professional-services organizations. Operators impersonate IT support over the phone, coax users into installing legitimate remote-access tooling, and exfiltrate data within hours. DarkReading notes some incidents have included in-person intrusions at office premises — a sharp departure from purely remote tradecraft.

Emerging Threats

Edge-device zero-days continue to dominate. Beyond the Check Point VPN flaw, Unit 42 published a threat brief on 5 June detailing active exploitation of PAN-OS CVE-2026-0257, and Gogs patched a critical zero-day enabling remote code execution against internet-facing self-hosted Git instances. CISA's KEV catalog grew by at least four entries this week (Check Point, BerriAI LiteLLM, SolarWinds Serv-U, plus an earlier Mirasvit add). Recorded Future's Insikt Group flagged 41 'Very Critical' vulnerabilities in May 2026, an 11% increase month-over-month.

The npm/PyPI ecosystem is under sustained, worm-like assault. Three distinct waves landed this week:

• Microsoft Threat Intelligence detailed the 'Red Hat Miasma' campaign that trojanized 90+ versions of @redhat-cloud-services npm packages. The malicious code ran at preinstall, harvested GitHub, cloud, and local credentials in CI/CD environments, and then republished additional trusted packages using stolen maintainer credentials.
• DarkReading covered 'IronWorm,' a Rust-written worm on npm that — like Shai-Hulud before it — steals developer credentials and reuses them to propagate.
• BleepingComputer and DarkReading reported a 'Hades' Shai-Hulud variant that trojanized 19 science-focused PyPI packages and 37 PyPI wheels.

Unit 42 published an updated npm threat landscape on 2 June, and the UK NCSC issued guidance the same week urging organizations to inventory and pin dependencies. The cumulative picture is that package registries are now a contested operational environment, not a passive software-distribution channel.

Identity-recovery abuse and AI-themed lures. Meta confirmed that 20,225 Instagram accounts were hijacked when attackers manipulated Meta's AI-powered support system to trigger password resets. WhatsApp said it disrupted a fresh round of NSO Group spear-phishing/spyware attempts. Microsoft separately documented threat actors using AI brand names and AI-product themes as social-engineering lures. The common thread: the human and automated layers around identity recovery are the soft underbelly, not the cryptography.

Critical infrastructure exposure. CISA, the FBI, the NSA and partner agencies jointly urged hardening of internet-exposed Automatic Tank Gauge (ATG) systems after attacks on U.S. fuel sites; DarkReading separately covered active intrusions against exposed tank gauges. CISA also published a slate of ICS advisories covering Hitachi Energy MACH HiDraw, ITT600 Explorer and RTU500, B&R PPT30, and NAVTOR NavBox — a reminder that the OT vulnerability stream continues even when the headlines are about npm.

Unpatched NTLM coercion in Windows. Huntress reported that the same NTLM coercion primitive previously patched in the Snipping Tool exists in Windows Explorer's search: URI handler — with no CVE assigned and no fix available. Organizations that gate patching solely off CVE feeds have a blind spot here.

Defender Takeaways

• Treat CVE-2026-50751 (Check Point Remote Access VPN / Mobile Access) as actively exploited. Patch immediately, review VPN authentication logs back to early May, and assume compromise where indicators are absent but exposure was high. Ransomware adoption by a Qilin affiliate means dwell times will be short.
• Patch PAN-OS CVE-2026-0257 and review the latest KEV additions. Don't wait for vendor pressure cycles; KEV is now the de facto floor.
• Lock down your software supply chain. Pin dependencies, require provenance/attestation for critical packages, isolate CI/CD secrets so a compromised preinstall script cannot lift production credentials, and rotate any developer tokens that may have touched a trojanized @redhat-cloud-services build. Audit PyPI usage in research and data-science teams specifically.
• Harden help-desk and identity-recovery workflows. Silent Ransom Group's vishing playbook and the Meta/Instagram support-system abuse converge on the same lesson: any path that resets credentials or grants remote access without strong, out-of-band verification is now a primary attack surface.
• Don't rely on CVE feeds alone. The unpatched Windows search: NTLM coercion has no CVE; coercion-class attacks should be mitigated structurally (SMB signing, EPA, blocking outbound NTLM where possible).
• For OT operators, prioritize the week's CISA ICS advisories (Hitachi Energy MACH HiDraw, ITT600, RTU500; B&R PPT30; NAVTOR NavBox) and remove internet exposure from ATG systems per the joint U.S. government guidance.

Sources

• BleepingComputer, Check Point links VPN zero-day attacks to Qilin ransomware gang (2026-06-08) — https://www.bleepingcomputer.com/news/security/check-point-links-vpn-zero-day-attacks-to-qilin-ransomware-gang/
• DarkReading, Check Point VPN Flaw Exploited Since Early May (2026-06-08) — https://www.darkreading.com/vulnerabilities-threats/check-point-vpn-flaw-exploited-early-may
• CISA, CISA Adds Two Known Exploited Vulnerabilities to Catalog (2026-06-08) — https://www.cisa.gov/news-events/alerts/2026/06/08/cisa-adds-two-known-exploited-vulnerabilities-catalog
• Check Point Research, 8th June Threat Intelligence Report (2026-06-08) — https://research.checkpoint.com/2026/8th-june-threat-intelligence-report/
• SentinelLabs, LABScon25 Replay | Gamaredon x Turla: Unveiling a 2025 Espionage Alliance Targeting Ukraine (2026-06-02) — https://www.sentinelone.com/labs/labscon25-replay-gamaredon-x-turla-unveiling-a-2025-espionage-alliance-targeting-ukraine/
• Microsoft Threat Intelligence, Preinstall to persistence: Inside the Red Hat npm Miasma credential-stealing campaign (2026-06-03) — https://www.microsoft.com/en-us/security/blog/2026/06/02/preinstall-persistence-inside-red-hat-npm-miasma-credential-stealing-campaign/
• Unit 42, The npm Threat Landscape: Attack Surface and Mitigations (Updated June 2) (2026-06-02) — https://unit42.paloaltonetworks.com/monitoring-npm-supply-chain-attacks/
• Unit 42, Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (2026-06-05) — https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/
• DarkReading, Rust-Written IronWorm Hits NPM Supply Chain (2026-06-04) — https://www.darkreading.com/cyberattacks-data-breaches/rust-written-ironworm-npm-supply-chain
• BleepingComputer, New Shai-Hulud attack trojanizes 19 science-focused PyPI packages (2026-06-08) — https://www.bleepingcomputer.com/news/security/new-shai-hulud-attack-trojanizes-19-science-focused-pypi-packages/
• DarkReading, 'Hades' Campaign Against PyPI Puts New Spin on Shai-Hulud (2026-06-08) — https://www.darkreading.com/application-security/hades-campaign-pypi-shai-hulud
• UK NCSC, Software supply chain attacks: check your dependencies (2026-06-04) — https://www.ncsc.gov.uk/blogs/software-supply-chain-attacks-check-your-dependencies
• BleepingComputer, Silent Ransom Group targets law firms with fake IT support calls (2026-06-07) — https://www.bleepingcomputer.com/news/security/silent-ransom-group-targets-law-firms-with-fake-it-support-calls/
• DarkReading, Silent Ransom Group Hits US Law Firms in Escalating Extortion Attacks (2026-06-08) — https://www.darkreading.com/cyberattacks-data-breaches/silent-ransom-us-law-firms-extortion-attacks
• BleepingComputer, Over 20,000 Instagram accounts stolen in Meta AI support hack (2026-06-08) — https://www.bleepingcomputer.com/news/security/meta-ai-support-data-breach-affects-20-000-instagram-accounts/
• BleepingComputer, WhatsApp says it disrupted new NSO spyware phishing attacks (2026-06-08) — https://www.bleepingcomputer.com/news/security/whatsapp-says-it-disrupted-new-nso-spyware-phishing-attacks/
• BleepingComputer, Gogs patches critical zero-day enabling remote code execution (2026-06-08) — https://www.bleepingcomputer.com/news/security/gogs-patches-critical-zero-day-enabling-remote-code-execution/
• Huntress, Unpatched NTLM Coercion in Windows search: URI Handler (2026-06-02) — https://www.huntress.com/blog/unpatched-ntlm-coercion-windows-search-uri-handler
• CISA, CISA and Partners Urge Hardening Automatic Tank Gauge Systems (2026-06-02) — https://www.cisa.gov/resources-tools/resources/cisa-and-partners-urge-hardening-automatic-tank-gauge-systems
• Recorded Future, May 2026 CVE Landscape (2026-06-08) — https://www.recordedfuture.com/blog/may-2026-cve-landscape