Cybersecurity Intelligence Report  03 July 2026

CRITICAL SECTION

• [11] CISA Warns of Actively Exploited Microsoft SharePoint Vulnerability (SecurityWeek)  CVEs: CVE-2026-45659
  CISA says threat actors are exploiting a recently patched SharePoint remote code execution vulnerability (CVE-2026-45659). The post CISA Warns of Actively Exploited Microsoft SharePoint Vulnerability appeared first on SecurityWeek.
• [10] CISA: Microsoft SharePoint RCE flaw now actively exploited (BleepingComputer)
  CISA warned on Wednesday that attackers have begun exploiting a high-severity Microsoft SharePoint remote code execution vulnerability patched in May. [...]

CISA KEV (last 14 days)

RANSOMWARE VICTIMS (DLS Monitoring)

• apt73: flazio.com, holidaypalace.com, ritavo.com
• incransom: oakparkmi.gov, tambasa.com, tricountyhs.org, acworth-ga.gov, carvalima.com.br, ezortea.com.br, hamilton-eye.com
• anubis: Ferrum AG, Quest Healthcare Solutions, Northeast Pediatrics & Adolescent Medicine
• worldleaks: Service IT, Treet Group of Companies
• moneymessage: X-Copper Professional
• qilin: Pennant Hills Golf Club
• payload: Tofutown
• spacebears: Salters propane

NEWS

• [8] Ransomware Groups Turn to Citrix Bleed 2, BYOVD, and Supply Chain Credentials  source
  Threat actors associated with the Anubis ransomware operation have been observed exploiting the Citrix Bleed 2 (CVE-2025-5777) vulnerability to obtain initial access. "Although tactics differ between affiliates, common patterns emerged in tradecraft through use of legitimate Remote Management and Monitoring (RMM) tooling, credential access, and hands-on-keyboard procedures used for lateral
• [7] AI Agent Exploits Langflow RCE to Automate Database Ransomware Attack  source
  Security firm Sysdig says it has found what it believes is the first ransomware attack run from start to finish by an AI agent. Its Threat Research Team calls the operator JADEPUFFER and says a large language model handled the whole job: breaking in, stealing credentials, moving deeper into the network, then encrypting and wiping a company's production database. Ransomware has always
• [6] Cisco Confirms In-the-Wild Exploitation of Unified CM Vulnerability  source
  A PoC exploit has been available since public disclosure, and the first exploitation attempts were observed last week. The post Cisco Confirms In-the-Wild Exploitation of Unified CM Vulnerability appeared first on SecurityWeek.
• [6] New iboss platform gives organizations instant visibility into AI tools and usage  source
  iboss has launched the AI Security Platform, a new service that gives any organization visibility into the AI tools its people are using, free of charge. Signup is instant, deployment takes an afternoon, and a complete AI footprint appears within hours. Organizations that want to go beyond visibility can upgrade on the same platform to enforce AI policy, prevent data leaks, and govern AI agents. As AI adoption accelerates, security teams have struggled to keep &#8230; <a href="https://www.hel
• [6] [RANSOMWARE] apt73 leaked flazio.com  source
  Victim: flazio.com | Group: apt73 | Website: flazio.com | Country: BR | Details: lazio.com — this is a company from Italy. Flazio is a website builder platform that allows use...
• [6] [RANSOMWARE] apt73 leaked holidaypalace.com  source
  Victim: holidaypalace.com | Group: apt73 | Website: holidaypalace.com | Country: MO | Details: Holiday Palace Hotel in Spain. Guest information, internal documents, reports, photos, videos, an...
• [6] [RANSOMWARE] apt73 leaked ritavo.com  source
  Victim: ritavo.com | Group: apt73 | Website: ritavo.com | Country: AT | Details: ritavo.com is the website of Rita Võ Group, a private multidisciplinary holding company from Vie...
• [5] SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation  source
  The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a high-severity flaw impacting Microsoft SharePoint Server to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability, tracked as CVE-2026-45659 (CVSS score: 8.8), is a case of remote code execution arising from the deserialization of untrusted data. The issue
• [5] Scattered Spider suspect extradited over $8 million ransom scheme  source
  A suspected Scattered Spider member has been extradited to the United States to face charges linked to cyberattacks against U.S. companies, including the breach of a luxury jewelry retailer that led to an $8 million cryptocurrency ransom demand after attackers stole company data. The retailer&#8217;s security team removed the attackers from its network before any ransom was paid. The company still incurred at least $2 million in losses from business disruption, incident response, and recovery
• [5] Review: CTRL+ALT+PWN  source
  Hacking gear that once sat in well-funded labs now ships to anyone with a credit card and a video tutorial. Frank Riccardi builds his consumer guide, CTRL+ALT+PWN: The Hacker&#8217;s Playbook (And How to Beat It), on that one condition. He spent twenty-five years in healthcare compliance and privacy, leading the response to breaches and ransomware, and he writes for readers he calls non-geeks. The book reads like a tour of the criminal toolkit, narrated by &#8230; <a href="https://www.helpnet
• [5] Catching ransomware on the wire before it locks the file server  source
  Corporate networks keep sensitive files off individual workstations and store them on shared servers that staff reach through mapped network drives. That arrangement hands ransomware operators a target worth chasing. A single compromised laptop can begin encrypting files that live on a server across the building, and the encryption travels over the network as ordinary file-sharing traffic. Endpoint detection tools watch the machine they run on. When the encryption lands on a remote file serve
• [5] [RANSOMWARE] incransom leaked oakparkmi.gov  source
  Victim: oakparkmi.gov | Group: incransom | Website: oakparkmi.gov | Country: US | Details: Oak Park, Michigan, is a vibrant, diverse inner-ring suburb of Metro Detroit located in Oakland County. Incorporated as a city in 1945, it spans 5.5 square miles and is home to roughly 30,000 residents. The city is currently experiencing a renaissance, transforming areas like the 11 Mile Road corrid
• [5] [RANSOMWARE] anubis leaked Ferrum AG  source
  Victim: Ferrum AG | Group: anubis | Country: CH | Details: Data breach at one of the largest family-owned manufacturing businesses in Switzerland.
• [5] [RANSOMWARE] incransom leaked tambasa.com  source
  Victim: tambasa.com | Group: incransom | Website: tambasa.com | Country: BR | Details: Tambasa Atacadistas is one of the largest wholesale distributors in Brazil, operating primarily in the B2B marketplace. Founded in 1949, the company supplies retail stores, supermarkets, and construction shops across the entire national territory.
• [5] [RANSOMWARE] incransom leaked tricountyhs.org  source
  Victim: tricountyhs.org | Group: incransom | Website: tricountyhs.org | Country: US | Details: Flowers Early Learning (formerly known as Tri-County Head Start) is a non-profit 501(c)(3) organization providing free, high-quality early childhood education and family support services across Berrien, Cass, and Van Buren counties in Southwest Michigan. Funded by a federal grant through the Office
• [5] [RANSOMWARE] incransom leaked acworth-ga.gov  source
  Victim: acworth-ga.gov | Group: incransom | Website: acworth-ga.gov | Country: US | Details: Acworth is located in the foothills of the North Georgia mountains and is nestled along the banks of Lake Acworth and Lake Allatoona, hence its nickname “The Lake City.” The city boasts a rich history, a charming downtown, abundant outdoor recreational activities, a vibrant restaurant scene, and an
• [5] [RANSOMWARE] incransom leaked carvalima.com.br  source
  Victim: carvalima.com.br | Group: incransom | Website: carvalima.com.br | Country: BR | Details: Carvalima Transportes is a specialized freight transportation company with over 35 years of experience, headquartered in Cuiabá, MT. The company operates in multiple regions, including Mato Grosso, Mato Grosso do Sul, Rondônia, Acre, and parts of Pará, as well as providing reverse logistics services
• [5] [RANSOMWARE] incransom leaked ezortea.com.br  source
  Victim: ezortea.com.br | Group: incransom | Website: ezortea.com.br | Country: BR | Details: Estrutural Zortea is a Brazilian company founded in 1995, specializing in the design, fabrication, and assembly of large-scale metal structures. ISO 9001-2015 certified, they provide industrial, logistics, and port solutions throughout the country. Specialties include: roofing for grain warehouses a
• [5] [RANSOMWARE] incransom leaked hamilton-eye.com  source
  Victim: hamilton-eye.com | Group: incransom | Website: hamilton-eye.com | Country: US | Details: Hamilton Eye Institute is a comprehensive vision care practice operating out of two Pennsylvania locations: Allentown and Easton. They provide routine eye exams, medical/surgical eye treatments, and an in-house MediSpa.
• [5] [RANSOMWARE] worldleaks leaked Service IT  source
  Victim: Service IT | Group: worldleaks | Website: www.service.com.br | Country: BR | Details: [AI generated] N/A
• [5] [RANSOMWARE] worldleaks leaked Treet Group of Companies  source
  Victim: Treet Group of Companies | Group: worldleaks | Website: treetcorp.com | Country: PK | Details: [AI generated] Treet Group of Companies is a Pakistani conglomerate headquartered in Lahore, Pakistan. It operates across multiple industries including razor blades and personal care products, textile manufacturing, and power generation. The group is best known for producing Treet razor blades, one
• [5] [RANSOMWARE] anubis leaked Quest Healthcare Solutions  source
  Victim: Quest Healthcare Solutions | Group: anubis | Details: Employee data, internal files, and a few unexpected discoveries.
• [5] [RANSOMWARE] moneymessage leaked X-Copper Professional  source
  Victim: X-Copper Professional | Group: moneymessage | Details: [AI generated] X-Copper Professional is a Canadian legal and paralegal services firm specializing in traffic ticket defense and driving-related legal matters. Based in Ontario, Canada, the company represents clients facing speeding tickets, careless driving charges, and other Highway Traffic Act vio
• [5] [RANSOMWARE] qilin leaked Pennant Hills Golf Club  source
  Victim: Pennant Hills Golf Club | Group: qilin | Website: www.pennanthillsgolfclub.com.au | Country: AU | Details: N/A
• [5] [RANSOMWARE] payload leaked Tofutown  source
  Victim: Tofutown | Group: payload | Country: DE | Details: TOFUTOWN is a traditional organic manufacturer specializing in plant-based foods, founded in 1981. The company offers a diverse range of products including vegan spreads, tofu, and seitan, all made from high-quality organic ingredients. With a commitment to sustainability and natural ingredients, TO
• [5] [RANSOMWARE] spacebears leaked Salters propane  source
  Victim: Salters propane | Group: spacebears | Website: salterspropane.com | Country: US | Details: Salter’s Propane is excited and proud to be joining the Salter’s Family of businesses with competitive pricing, excellent customer service, and 65 combined years of industry experience. We are ready and more than capable to service all of your propane needs.From residential to commercial and everyth
• [5] [RANSOMWARE] anubis leaked Northeast Pediatrics & Adolescent Medicine  source
  Victim: Northeast Pediatrics & Adolescent Medicine | Group: anubis | Details: Data breach exposes employees and patients of a pediatric clinic.

SUMMARY

Total new items: 57; Critical: 2; Ransomware victims today: 19.

Top CVEs to patch: CVE-2025-5777, CVE-2026-45659

Sources: BleepingComputer, TheHackerNews, SecurityWeek, HelpNetSecurity, KrebsOnSecurity, CISA KEV, ransomware.live