Weekly Threat Intel Report — 2026-W32

TL;DR

Week 32 of 2026 was defined by three converging trends: aggressive supply chain worms, sustained exploitation of remote management platforms, and a continued shift toward identity-first attacks. Microsoft and Palo Alto Networks Unit 42 disclosed ChainDrop, a self-propagating npm worm that has already compromised more than 400 packages and uses Ethereum smart contracts for command-and-control routing. Sophos and DarkReading tracked continuing exploitation of N-able N-central (CVE-2026-18577), including a new authentication-bypass vector disclosed over the weekend. A newly identified extortion cluster tracked as UNC6671 was tied to intrusions across hedge funds and private-equity firms, while a hacktivist group called Head Mare trojanized TrueConf client installers after compromising unpatched servers. On the enforcement side, the U.S. Department of Justice notched two significant wins: a guilty plea from Connor Riley Moucka for the 2024 Snowflake extortion spree and a 16-year prison sentence for Ransom Cartel administrator Maksim Silnikau.

Notable Activity by Actor

ChainDrop — npm supply chain worm

Microsoft Threat Intelligence and Unit 42 both published deep-dive analyses of ChainDrop on August 4 and August 6 respectively. The worm hides inside compromised npm packages — more than 400 identified so far — and self-propagates by using stolen maintainer credentials to publish poisoned updates. Once installed in a developer environment or CI pipeline, ChainDrop extracts GitHub Actions runner secrets, which the operators use to seize control of additional package repositories. Command-and-control routing uses Ethereum smart contracts, giving the operation resilience against traditional domain and IP takedowns. Attribution has not been publicly established.

UNC6671 — financial sector extortion

BleepingComputer, citing incident responder telemetry, reported on August 6 that a wave of intrusions targeting hedge funds, private-equity firms, and other financial services organizations has been linked to a cluster tracked as UNC6671. The group is reportedly associated with the BlackFile threat actor. Detail on tooling and initial-access techniques remains sparse in public reporting.

Head Mare — TrueConf supply chain compromise

On August 8, BleepingComputer reported that a hacktivist group called Head Mare had exploited vulnerabilities in unpatched, internet-facing TrueConf video conferencing servers to replace legitimate client installers with backdoored versions. Any user who downloaded a fresh client from a compromised server received malware. This is a textbook downstream supply chain scenario and is a useful reminder that self-hosted collaboration tools require the same patch discipline as any other perimeter service.

N-able N-central exploitation continues

Sophos and DarkReading reported on August 3–4 that threat actors are actively exploiting CVE-2026-18577 in N-able N-central. Post-exploitation activity includes deploying additional RMM tools and establishing network tunnels for persistent remote access. Over the weekend, N-able disclosed a second authentication-bypass vector for the same CVE that also grants administrator-level access. Any organization running N-central should treat both patches as urgent and hunt for unauthorized RMM installations.

Snowflake and Ransom Cartel — enforcement outcomes

KrebsOnSecurity reported on August 6 that Connor Riley Moucka, 26, of Kitchener, Ontario, pleaded guilty to computer fraud and conspiracy for his role in the 2024 Snowflake extortion campaign, which affected more than 165 organizations and included the theft of call and text history records for over 100 million AT&T customers. Separately, BleepingComputer reported that Maksim Silnikau, creator and administrator of the Ransom Cartel ransomware operation, was sentenced to 16 years in prison in connection with attacks on at least 18 companies worldwide.

Emerging Threats

Metabase zero-day. BleepingComputer reported on August 7 that a critical SQL injection vulnerability in Metabase has been exploited as a zero-day to steal customer data. Confirmed victims include Framework and Tally. Any organization exposing Metabase to the internet should patch immediately and review query logs for anomalous SQL activity.

Swiss federal SharePoint breach. The Swiss federal IT office confirmed on August 6 that attackers exploited SharePoint vulnerabilities to compromise approximately 200 government accounts. The incident is consistent with the broader wave of SharePoint on-premises exploitation observed through 2025 and 2026.

Angola telco outage during IPO. DarkReading reported on August 5 that Unitel, Angola's dominant mobile operator, suffered a disruptive cyberattack causing outages the same day as the government-owned telco's public offering. The timing is notable regardless of whether it was coincidental.

Levi Strauss social engineering. BleepingComputer reported on August 7 that Levi Strauss & Co. was breached via social engineering targeting three specific employees, with corporate data stolen from their machines. The vector fits the broader identity-first pattern of 2026 intrusions.

Passkey implementation flaws. Unit 42 published research on August 3 showing that passkey implementations that fail to validate the WebAuthn User Verified (UV) flag effectively degrade multi-factor authentication back to a single factor. Relying parties should audit their WebAuthn implementations.

Device-code phishing and vishing surge. DarkReading reported on August 4 that device-code phishing has grown roughly 1,500% year-over-year in 2026 and that voice phishing has doubled. Both techniques evade many traditional email-based controls and leave sparse forensic evidence.

macOS ClickFix evolution. Microsoft reported on August 5 that a macOS ClickFix infostealer campaign has shifted from open lure delivery to browser-fingerprinting gates, making the infrastructure harder to enumerate. BleepingComputer separately reported that the payload steals cryptocurrency assets, browser passwords, Apple Keychain data, and cached credentials.

TONTOU CPU side channel. BleepingComputer reported on August 6 that researchers have developed TONTOU, a new attack that bypasses recent Spectre v2 mitigations to leak Linux password hashes via speculative execution. Practical impact will depend on vendor mitigations.

Cloudflare workerd bugs. Check Point Research disclosed on August 6 five memory-corruption vulnerabilities in Cloudflare's workerd runtime, which underpins both Cloudflare Workers and the new Code Mode feature. Cloudflare has remediated the issues.

AI-adjacent risks. Multiple vendors highlighted AI-specific attack surfaces this week: Unit 42 documented "token jacking" — theft of developer AI API keys to fuel gray-market resale — and Recorded Future examined the recent Hugging Face incident in which autonomous AI agents breached a real environment during misconfigured testing. Meta separately confirmed its own AI model breached a company during a similar misconfigured test. DarkReading reported that AI-generated patches fail roughly half the time, with some working patches introducing new bugs or bypass conditions.

Defender Takeaways

• Patch N-able N-central twice. Apply the original CVE-2026-18577 patch and the new authentication-bypass patch disclosed over the weekend. Hunt for unauthorized RMM installations and tunneling utilities.
• Lock down developer supply chains. ChainDrop demonstrates that npm-borne worms can spread autonomously. Pin dependencies, require signed publishes where possible, rotate npm and GitHub PATs, and inspect GitHub Actions runners for secret exfiltration.
• Patch Metabase and SharePoint. Both are being actively exploited. Prioritize any internet-exposed instances and review authentication and query logs.
• Audit passkey implementations. Confirm that relying parties validate the WebAuthn UV flag. Without that check, passkey MFA can silently degrade to single-factor.
• Prepare for identity-centric social engineering. Device-code phishing and vishing are the growth vectors of 2026. Restrict device-code flows where feasible, require step-up for high-value actions, and rehearse help-desk verification procedures.
• Treat self-hosted collaboration tools as perimeter. The Head Mare/TrueConf incident is a reminder that any server distributing binaries to your users is a supply chain node.
• Watch macOS endpoints. ClickFix-style attacks against macOS are maturing and now include anti-analysis gates. Ensure macOS EDR coverage and hunt for suspicious clipboard-executed shell activity.

Sources

• Microsoft Threat Intelligence, "ChainDrop supply chain compromise: Anatomy of a self-propagating worm" (2026-08-04) — https://www.microsoft.com/en-us/security/blog/2026/08/04/chaindrop-supply-chain-compromise-anatomy-self-propagating-worm/
• Unit 42, "ChainDrop: Inside a Self-Propagating npm Worm" (2026-08-06) — https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/
• Sophos, "N-able N-central exploitation results in RMM tool deployment" (2026-08-04) — https://www.sophos.com/en-us/blog/nable-ncentral-exploitation-results-in-rmm-tool-deployment
• DarkReading, "Attackers Exploit N-able Patch Bypass Flaw on RMM Servers" (2026-08-03) — https://www.darkreading.com/vulnerabilities-threats/attackers-exploit-n-able-patch-bypass-flaw
• BleepingComputer, "Hedge fund cyberattacks tied to BlackFile-linked UNC6671 extortion group" (2026-08-06) — https://www.bleepingcomputer.com/news/security/hedge-fund-cyberattacks-tied-to-blackfile-linked-unc6671-extortion-group/
• BleepingComputer, "Hackers breach TrueConf to trojanize client installers with backdoors" (2026-08-08) — https://www.bleepingcomputer.com/news/security/hackers-breach-trueconf-to-trojanize-client-installers-with-backdoors/
• BleepingComputer, "Metabase SQLi zero-day exploited in customer data-theft attacks" (2026-08-07) — https://www.bleepingcomputer.com/news/security/framework-tally-disclose-metabase-data-theft-attacks/
• BleepingComputer, "Swiss government SharePoint breach compromised 200 accounts" (2026-08-06) — https://www.bleepingcomputer.com/news/security/swiss-government-sharepoint-breach-compromised-200-accounts/
• BleepingComputer, "Levi Strauss & Co. says hackers stole corporate data in cyberattack" (2026-08-07) — https://www.bleepingcomputer.com/news/security/levi-strauss-and-co-says-hackers-stole-corporate-data-in-cyberattack/
• BleepingComputer, "Ransom Cartel ransomware creator sentenced to 16 years in prison" (2026-08-05) — https://www.bleepingcomputer.com/news/security/ransom-cartel-ransomware-creator-sentenced-to-16-years-in-prison/
• KrebsOnSecurity, "Canadian Man Pleads Guilty in Snowflake Extortions" (2026-08-06) — https://krebsonsecurity.com/2026/08/canadian-man-pleads-guilty-in-snowflake-extortions/
• DarkReading, "Angola's Largest Telco Breached Hours Before IPO" (2026-08-05) — https://www.darkreading.com/cyberattacks-data-breaches/angolas-largest-telco-breached-hours-before-ipo
• DarkReading, "Device Code Phishing Up 1,500% in 2026; Vishing Doubles" (2026-08-04) — https://www.darkreading.com/cybersecurity-analytics/device-code-phishing-vishing-doubles
• Unit 42, "Pass the Passkey: A Novel Attack Surface in Passwordless Authentication" (2026-08-03) — https://unit42.paloaltonetworks.com/passwordless-authentication-security-risks/
• Microsoft Threat Intelligence, "From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide" (2026-08-05) — https://www.microsoft.com/en-us/security/blog/2026/08/05/macos-clickfix-campaign-learned-hide/
• Check Point Research, "When Agentic Glue Melts: Exploiting Cloudflare Code Mode and Workers" (2026-08-06) — https://research.checkpoint.com/2026/when-agentic-glue-melts/
• BleepingComputer, "New TONTOU CPU attack bypasses Spectre v2 fixes" (2026-08-06) — https://www.bleepingcomputer.com/news/security/new-tontou-cpu-attack-bypasses-spectre-v2-fixes-leaks-linux-password-hashes/
• Recorded Future, "July 2026 CVE Landscape" (2026-08-07) — https://www.recordedfuture.com/blog/july-2026-cve-landscape