Cybersecurity Intelligence Report  2026-07-11

CRITICAL SECTION

No critical items today.

CISA KEV (Known Exploited Vulnerabilities)

RANSOMWARE VICTIMS (DLS Monitoring)

[RANSOMWARE]: [RANSOMWARE] dragonforce leaked The Schuett Companies, [RANSOMWARE] Deadlock leaked BARCELONA URBAN PROPERTY CHAMBER, [RANSOMWARE] Deadlock leaked ONE Contact, [RANSOMWARE] Deadlock leaked ADM Value Barcelona, [RANSOMWARE] Deadlock leaked CH Paper, [RANSOMWARE] Deadlock leaked Zhangjiagang Fortune Chemical Co. Ltd. Singapore, [RANSOMWARE] qilin leaked Eurodefi, [RANSOMWARE] interlock leaked Borger ISD, [RANSOMWARE] akira leaked Vandalia Rental, [RANSOMWARE] qilin leaked Hilo, [RANSOMWARE] qilin leaked Promotora Zacapu, [RANSOMWARE] qilin leaked Navana Real Estate, [RANSOMWARE] Deadlock leaked Catcorp, [RANSOMWARE] Deadlock leaked Weinberg ''93 Építő Kft., [RANSOMWARE] Deadlock leaked The Morton Grove Park District, [RANSOMWARE] Deadlock leaked LA SEVILLANITA SRL, [RANSOMWARE] Deadlock leaked Schlenker and Cantwell, P.A., [RANSOMWARE] Deadlock leaked WiBeats S.r.l., [RANSOMWARE] Deadlock leaked Grupo Vanguardia, [RANSOMWARE] Deadlock leaked WH Müller, [RANSOMWARE] Deadlock leaked DOCTUS USA Inc, [RANSOMWARE] Deadlock leaked ACU - The Automobile Club of Uruguay, [RANSOMWARE] Deadlock leaked CIATI, [RANSOMWARE] Deadlock leaked Quetzal Química, [RANSOMWARE] Deadlock leaked Abhay Prabhavana, [RANSOMWARE] Deadlock leaked Güven Mühendislik Makina, [RANSOMWARE] Deadlock leaked 3Gi Solutions, is an IT Services Provider located in Montreal, Quebec., [RANSOMWARE] Deadlock leaked Werken Química Brasil S.A., [RANSOMWARE] Deadlock leaked Židlochovice city, [RANSOMWARE] Deadlock leaked Optimal Care SA, [RANSOMWARE] Deadlock leaked Anidaport - Investimentos Imobiliários Lda., Lisbon, Portugal, [RANSOMWARE] Deadlock leaked LIVISTO, [RANSOMWARE] Deadlock leaked Industrie Tecnologiche it, [RANSOMWARE] Deadlock leaked VBW Makelaars and Taxateurs, [RANSOMWARE] Deadlock leaked Eko-Flor Plus d.o.o., [RANSOMWARE] Deadlock leaked Zaffrani Srl, [RANSOMWARE] Deadlock leaked Grupo Mercurio, [RANSOMWARE] Deadlock leaked Maxplast AND Senoco, [RANSOMWARE] Deadlock leaked Gerusia S.L., [RANSOMWARE] Deadlock leaked Elmoris, [RANSOMWARE] Deadlock leaked Consulting Valladolid, [RANSOMWARE] Deadlock leaked Ring Textile Production RTP SRL, [RANSOMWARE] Deadlock leaked Bombas Ideal, [RANSOMWARE] Deadlock leaked SH Hoteles (Spain), [RANSOMWARE] Deadlock leaked Bridgeport S.p.A., [RANSOMWARE] Deadlock leaked AKSV, [RANSOMWARE] Deadlock leaked EFCA, [RANSOMWARE] Deadlock leaked Starconn, [RANSOMWARE] Deadlock leaked Picassent, [RANSOMWARE] Deadlock leaked UFL, [RANSOMWARE] Deadlock leaked FIRESTA, [RANSOMWARE] Deadlock leaked GEOPARTNER Sp. z o.o. and GEOPARTNER GEOMATICS Sp. z o.o., [RANSOMWARE] Deadlock leaked JOSO, [RANSOMWARE] Deadlock leaked Integra and Operosa, [RANSOMWARE] Deadlock leaked 8.2 Group e.V., [RANSOMWARE] Deadlock leaked PB Sprinkler Engineering Sp. z o.o. and PLISZKA Fire Protection Engineering, [RANSOMWARE] Deadlock leaked SKK Networks Sp. z o.o. and UNICARD Systems Sp. z o. o. and SKK SA, [RANSOMWARE] Deadlock leaked Dyhrberg AG Switzerland, [RANSOMWARE] Deadlock leaked Grupolider | Grupo Actual, [RANSOMWARE] Deadlock leaked Bär Cargolift Polska Sp. z o.o., [RANSOMWARE] Deadlock leaked EXPRESOKNA SP. Z O.O., [RANSOMWARE] Deadlock leaked TPToys, [RANSOMWARE] Deadlock leaked IFC Eur, [RANSOMWARE] Deadlock leaked Noega and Esnova, [RANSOMWARE] Deadlock leaked iASK, [RANSOMWARE] Deadlock leaked Finam Gabon, [RANSOMWARE] Deadlock leaked AFWorkshop, [RANSOMWARE] Deadlock leaked NXIT and Franco Vago S.p.a. and Traconf Srl, [RANSOMWARE] Deadlock leaked bERS, [RANSOMWARE] Deadlock leaked Muzeum Valassko, [RANSOMWARE] Deadlock leaked Breda Energia, [RANSOMWARE] Deadlock leaked EDISA and INVERTIGE, [RANSOMWARE] Deadlock leaked Direção Estacionamentos S.A., [RANSOMWARE] Deadlock leaked La ville de Ouangani, [RANSOMWARE] qilin leaked SPACElogic, [RANSOMWARE] qilin leaked Global Strategic Business Process Solutions, [RANSOMWARE] qilin leaked CRZ Construcciones, [RANSOMWARE] qilin leaked Red Planet Hotels, [RANSOMWARE] payload leaked Roofinox, [RANSOMWARE] blackwater leaked txdkj.com, [RANSOMWARE] Doommageddon leaked Hospital Di Camp, [RANSOMWARE] gunra leaked New Tiles S.L., [RANSOMWARE] akira leaked Stone Ridge Payments, [RANSOMWARE] Deadlock leaked SECiL, [RANSOMWARE] Deadlock leaked CAD93, [RANSOMWARE] Deadlock leaked Fidelity Pension Managers, [RANSOMWARE] Deadlock leaked Nobani Co, [RANSOMWARE] Deadlock leaked donjon, [RANSOMWARE] Deadlock leaked TeleFinity, [RANSOMWARE] Deadlock leaked Hornavan Hotell, [RANSOMWARE] Deadlock leaked Summa4

NEWS

• [9] Turning software supply chain security into a daily habit (HelpNetSecurity)

  In this Help Net Security video, Anastasia Tikhonova, Global Threat Research Lead at Group-IB, explains how to operationalize software supply chain risk. Instead of filing an SBOM away as a compliance document, she argues teams should use it every day for vulnerability triage, vendor access reviews, identity monitoring, and incident response. Drawing on Group-IB’s High-Tech Crime Trend Report 2026, she shows how supply chain attacks now link phishing, ransomware, and data breaches throu

• [8] Researcher Details WhatsApp-to-Host Attack Chain Using Three OpenClaw Flaws (TheHackerNews)
  Details have emerged about three now-patched security flaws in the OpenClaw personal artificial intelligence (AI) assistant that, if successfully exploited, could enable credential theft, privilege escalation, and arbitrary code execution on the host. A brief description of the high-severity vulnerabilities is as follows - GHSA-hjr6-g723-hmfm (CVSS score: 8.8) - An operating system
• [7] Hackers exploit critical auth bypass in Gitea Docker image (BleepingComputer)
  Hackers are actively exploiting a critical vulnerability in the official Docker image for the Gitea self-hosted Git service that allows attackers to impersonate any user, including administrators. [...]
• [6] Injective Labs GitHub Compromise Pushes Wallet-Key-Stealing npm Packages (TheHackerNews)
  Unknown threat actors compromised the Injective Labs SDK project's GitHub repository and leveraged it to publish a malicious package on the npm registry to steal cryptocurrency wallet private keys and mnemonic seed phrases. The compromised version, @injectivelabs/sdk-ts@1.20.21, came embedded with fake telemetry functionality that exfiltrated data from cryptocurrency wallets. The version was
• [6] ‘HalluSquatting’ Turns AI Hallucinations Into Botnet Delivery Mechanism (SecurityWeek)

  Researchers demonstrate adversarial hallucination squatting against popular AI assistants to achieve remote code execution.

  The post ‘HalluSquatting’ Turns AI Hallucinations Into Botnet Delivery Mechanism appeared first on SecurityWeek.

• [5] In Other News: DHS Database Hacked, Adobe Boosts Patch Cadence, Canada Disrupts Ransomware Ops (SecurityWeek)

  Other noteworthy stories that might have slipped under the radar: Abnormal AI sued by Anthropic, AssuranceAmerica data breach affects 7 million people, NSA brings back TAO.

  The post In Other News: DHS Database Hacked, Adobe Boosts Patch Cadence, Canada Disrupts Ransomware Ops appeared first on SecurityWeek.

SUMMARY

Total new items: 132. Critical: 0. Ransomware groups active today: 1. Top CVEs to patch: CVE-2026-56291, CVE-2026-48939.

Sources: BleepingComputer, TheHackerNews, SecurityWeek, HelpNetSecurity, KrebsOnSecurity, CISA KEV, ransomware.live