Applied Cybernetics Group
Threat intel → detection pipeline
thrunt.me
Friday, September 18, 2026
Data as of 13:09 UTC

July 22, 2026 · Applied Cybernetics Group

Morning Brief — July 22, 2026

Morning Brief — 2026-07-22

2 material breach disclosures, 4 federal patching priority, 10 emerging critical cves, 11 supply chain, 19 ransomware activity, 1340 ioc volume, 1 recent osint events, 17 active malware families, 22 multi-source iocs, 4 intel feeds, 5 hand-authored sigma, and 17 detection gaps. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.

Material Breach Disclosures

River Financial Corp (RVRF)

As set forth in its Form 8-K filed July 10, 2026, two class action lawsuits were filed relating to the unauthorized threat actor gaining access to the network environment of River Financial Corporation, including River Bank & Trust (together, “River”). A third class action was filed against River on July 10, 2026 and a fourth class action was filed against River on July 16, 2026.

 

The principal…

River Financial Corp (RVRF)

Since the date of the original filing, River’s investigation has progressed. River has determined that an unauthorized threat actor accessed portions of its network and removed certain data from its environment. River is working to determine the nature and scope of the information involved, including whether any personally identifiable information was affected. To date, River is not aware of any r…

Federal Patching Priority

CVE-2026-0770 — Langflow Langflow

Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability

Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected installations.

Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the exec_globals parameter provided to the validate endpoint. The…

CVE-2026-63030 — WordPress Core

WordPress Core Interpretation Conflict Vulnerability

WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.

CVE-2021-27137 — DD-WRT DD-WRT

DD-WRT Stack-Based Buffer Overflow Vulnerability

DD-WRT contains a stack-based buffer overflow vulnerability that could allow an unauthenticated attacker to overflow an internal buffer used by UPnP and trigger a code execution vulnerability.

An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticated remote attacker to send a request that would overflow an internal fixed buffer. Exploitation requires the DD-WRT user to enable UPnP (which is off by default, and only listens on internal interfaces by default). This occurs in ssdp_msearch…

CVE-2026-60137 — WordPress Core

WordPress Core SQL Injection Vulnerability

WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.

Exploit Probability Movers

No CVEs with ≥0.20 EPSS movement in this window.

Emerging Critical CVEs

Supply Chain

GHSA-v2hh-gcrm-f6hx · CVE-2026-16221 (npm)

fast-uri vulnerable to host confusion via literal backslash authority delimiter

GHSA-f88m-g3jw-g9cj (npm)

sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591

GHSA-8r6m-32jq-jx6q (npm)

fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits

GHSA-rwj8-pgh3-r573 (pip)

GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL

GHSA-hrxh-6v49-42gf (go)

gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

GHSA-r7wm-3cxj-wff9 (maven)

jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)

GHSA-gx3v-q759-g323 · CVE-2026-20779 (go)

Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth X-Gitea-OTP surface

GHSA-g9g6-qhrc-p3qc · CVE-2026-58422 (go)

Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts

GHSA-44qc-pgvp-wx7v · CVE-2026-58419 (go)

Gitea: Notification API leaks private issue metadata after access revocation

GHSA-v73x-hx65-6pf4 · CVE-2026-25038 (go)

Gitea: Unauthorized Access to Labels of Private Organizations

Exploitation evidence, 7-day window (severity-agnostic — evidence trumps labels):

Ransomware Activity

19 new victim postings across 10 groups.

GroupVictimsSample
nova5Marpatech, Canal 9 Litoral, La Financière d’Orion (finorion), Tèrra Aventura, Ko…
akira2Novasport s.r.o., Finer & Finer
chaos2issvc.com, argonautms.com
dragonforce2Koshkaryan Law Group, One Community FCU
play2Tax MT, Kreysler & Associates
qilin2Evergreen Title, RehaVital Gesundheitsservice GmbH
morpheus1Kyowa Singapore Pte Ltd
ransomhouse1Nichirei
settra1downies.com
titan1PERTINENT HEALTHCARE BUSINESS SOLUTIONS PRIVATE LIMITED

IOC Volume

1340 new IOCs in this window. By source:

SourceCount
misp807
urlhaus533

Recent OSINT Events

MoustachedBouncer: Espionage against foreign diplomats in Belarus

Active Malware Families

17 malware families active this week (2 corroborated across ≥2 sources), exercising 20 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.

FamilyTypeCorrob.IOCsTechniques (✗ = coverage gap)
ClearFakedelivery →✓1,185T1059.001, T1189, T1204
ClickFixdelivery →✓22T1059.001, T1204
Miraibotnet—516T1110, T1498, T1499, T1584.005
PhantomStealerstealer—16T1005, T1555
CoinMinerminer—14T1496
AgentTeslastealer—11T1056.001, T1071, T1114, T1555
XWormrat—11T1056.001, T1071
GuLoaderloader →—6T1027, T1071, T1105
AsyncRATrat—4T1056.001, T1059.001, T1071, T1219
Formbookstealer—4T1005, T1056.001, T1071, T1555
Stealcstealer—4T1005, T1071, T1555
ConnectWise ScreenConnect (abuse)rmm-abuse—3T1219
ACRStealerstealer—2T1005, T1071, T1555
MassLoggerstealer—2T1056.001, T1071, T1555
Phorpiexbotnet—2T1071, T1486, T1566
Amadeyloader →—1T1071, T1105, T1547
njRATrat—1T1056.001, T1059.003, T1071, T1219

Families marked ”→” are delivery/social-engineering clusters (ClearFake, ClickFix, GuLoader, Amadey). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.

Multi-Source IOCs

22 IOCs flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.

IOCTypeSourcesLast seen
46.183.25.232ip-dstmisp + urlhaus2026-07-22
193.41.226.161ip-dstmisp + urlhaus2026-07-22
2.59.133.148ip-dstmisp + urlhaus2026-07-22
23.27.180.36ip-srcmisp + urlhaus2026-07-22
31.76.252.47ip-dstmisp + urlhaus2026-07-22
45.135.193.114ip-dstmisp + urlhaus2026-07-22
95.216.64.240ip-srcmisp + urlhaus2026-07-22
cdn.defenders.workers.devdomainmisp + urlhaus2026-07-22
datastream-hub.christmasdomainmisp + urlhaus2026-07-22
gardenworkflowhub.gardendomainmisp + urlhaus2026-07-22
impur-treacheryperepelitsa.wikidomainmisp + urlhaus2026-07-22
leconto.loldomainmisp + urlhaus2026-07-22
nexrogcapital.xyzdomainmisp + urlhaus2026-07-22
nextjs2385.ngrok.iodomainmisp + urlhaus2026-07-22
recaptcha.boit.clouddomainmisp + urlhaus2026-07-22
subterranean-mineral-map.gardendomainmisp + urlhaus2026-07-22
svganchordev.netdomainmisp + urlhaus2026-07-22
zapier-logos.s3.amazonaws.comdomainmisp + urlhaus2026-07-22
103.101.85.173ip-dstmisp + urlhaus2026-07-17
dev1-revitavive.comdomainmisp + urlhaus2026-07-17
slotmy-send.techdomainmisp + urlhaus2026-07-17
stg1-swaggrhockey.comdomainmisp + urlhaus2026-07-17

MISP × KEV Correlation

No MISP events in this window referenced a CVE.

Cross-Reference

No SEC × KEV vendor token matches in this window. (This is a heuristic surface, absence is expected most days.)

Intel Feeds

4 IOC feeds updated this run (6,890 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.

FeedSourceTypeCountDownloads
MISP — Suspicious Domainsmispdomain2,853CSV · MISP · STIX
MISP — Flagged IPsmispip130CSV · MISP · STIX
URLhaus — Malware Distribution URLsurlhausurl3,297CSV · MISP · STIX
URLhaus — Malware Distribution Domainsurlhausdomain610CSV · MISP · STIX

Hand-Authored Sigma

3 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.

RuleStatusYAML
T1037 Boot or Logon Initialization Scripts — Linux Init Script Modificationexperimentalhttps://thrunt.me/sigma/t1037-linux-init-script-modification.yml
T1098.004 Account Manipulation — SSH Authorized Keys File Modificationexperimentalhttps://thrunt.me/sigma/t1098-004-ssh-authorized-keys-write.yml
T1566.002 Spearphishing Link — Luxembourg Hospitality SMS Phishing Campaignexperimentalhttps://thrunt.me/sigma/t1566-002-luxembourg-hospitality-sms-phish.yml
T1003.008 OS Credential Dumping — /etc/shadow and /etc/gshadow Accessdrafthttps://thrunt.meundefined
T1530 Data from Cloud Storage — Detectiondrafthttps://thrunt.meundefined

Detection Gaps

17 of 155 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.

TechniqueNameActive familiesMISPKEV
T1011Exfiltration Over Other Network Medium—04
T1497Virtualization/Sandbox Evasion—04
T1562——03
T1573.001Symmetric Cryptography—03
T1001Data Obfuscation—02
T1499.002Service Exhaustion Flood—02
T1530Data from Cloud Storage—02
T1562.001——02
T1003.008/etc/passwd and /etc/shadow—01
T1070.001——01

…and 7 more below the cut — full list on the rollup.

Pipeline Health

All feeds healthy.

Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).

Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.