SOCRadar has tied the 86,644-credential FortiGate harvest to the Lynx ransomware crew, cracked offline against legacy FortiOS passwords never re-hashed to PBKDF2. A SharePoint code-execution deadline falls today under CISA's new triage regime, Cisco leads a five-vendor KEV batch, and the BlueHammer Defender flaw is now weaponised for SYSTEM access. Spring's disclosures are being cashed in as the federal machine that forced prioritisation is dismantled.
Spring's disclosures are turning into live intrusions just as CISA swaps fixed deadlines for untested triage.
SOCRadar tied the 86,644-credential FortiGate harvest to the Lynx ransomware crew, which cracked legacy passwords offline on a 45-GPU rig rather than exploiting any flaw.
SOCRadar linked the theft of 86,644 FortiGate remote-access passwords to the ransomware group Lynx. British and US agencies had flagged the set privately back in June.
The gang cracked the passwords using 45 chained graphics cards. Fortinet never modernised its old hashing method, leaving logins open to anyone holding the list.
CISA gave federal agencies three days to remediate an actively exploited SharePoint code-execution flaw, with today's deadline the tightest on the catalogue.
Washington's cyber-defence agency added a SharePoint Server flaw to its must-patch list on 1 July. Federal agencies got just three days to fix it, even though ransomware use is unconfirmed.
The tight deadline comes from a new risk-based patching rule. It moves fastest on internet-facing bugs, echoing 2025's SharePoint ToolShell attacks that spread within weeks.
CISA confirmed ransomware gangs are weaponising BlueHammer, the April Windows Defender flaw, to seize SYSTEM rights before deploying their encryptors.
US officials confirmed ransomware gangs are exploiting a 2026 Windows Defender flaw known as BlueHammer. It was disclosed by a researcher using the handle Chaotic Eclipse.
Gangs use the bug to grab full system-level access before locking victims' files. The flaw sits inside Microsoft's own security software, the very tool meant to stop attacks like this.
CISA drew two more Cisco flaws into its catalogue this fortnight, alongside a SimpleHelp bypass that reopens the managed-service-provider route used by DragonForce in 2025.
America's cyber-defence agency added five bugs to its must-patch list over two batches this fortnight. One is a login-bypass flaw in SimpleHelp, a remote-support tool used by many IT service companies.
SimpleHelp manages many clients from one server, so a single break-in there could reach every business it supports. That echoes the 2021 Kaseya ransomware attack on managed service providers.
River Financial told the SEC on 25 June that ransomware had hit its Alabama bank subsidiary, with customer-data exposure still undetermined.
River Financial Corporation, parent of a small Alabama bank, disclosed a ransomware attack to US regulators on 25 June. The intrusion reached its systems around 16 June and was caught three days later.
River Financial has not confirmed whether hackers actually stole customer data. That gap matters because banks face extra legal costs once personal information is confirmed exposed.
World Leaks dumped 630GB stolen from Tata Electronics, including purported Apple and Tesla design files, while Blackfield demanded $2m from Japan's Nidec.
IndiaA criminal group called World Leaks says it stole more than 200,000 files from Tata Electronics. The haul, around 630 gigabytes, includes drawings it claims belong to Apple and Tesla.
Separately, a gang called Blackfield demanded $2 million from Nidec after breaching one of its suppliers. Criminals increasingly target the weaker links in a brand's supply chain.
BlackFog's June report kept Qilin at the top of ransomware activity for a second month, despite Europol's Operation Saffron hitting 25 gangs in May.
BlackFog's June ransomware tracker again ranked Qilin the most active gang worldwide. It was behind 16% of unreported attacks and 8% of disclosed ones, a second month on top.
The lead came a month after Europol's Operation Saffron disrupted around 25 rival gangs. Shutting down competitors, it turns out, does not cut overall ransomware activity.
CISA added six exploited CVEs in the first fortnight under BOD 26-04's triage model, and let the Splunk and Ubiquiti deadlines pass without naming anyone non-compliant.
The same US agency added six actively exploited software flaws to its list this fortnight. That works out to close to one a day, under a new risk-based patching rule.
Deadlines for separate Splunk and Ubiquiti flaws passed in the same period. Unlike before, the agency did not say publicly whether any federal agency missed them.
Sideways for now. The two dated arcs, FortiBleed to Lynx and BlueHammer to SYSTEM access, are real, but six KEV additions in a fortnight at 0.86 a day sits below the roughly two-a-day pace the catalogue held through mid-June, against a proposed $707m FY27 cut to CISA itself, so there is no volume signal yet of a widening disclosure-to-exploitation gap. It tips up if CISA names an agency non-compliant on the SharePoint or SimpleHelp deadlines, the first live test of BOD 26-04's enforcement teeth. It tips down if the FortiBleed set never surfaces beyond SOCRadar's attribution and stays confined to the seven named blue-chips without a confirmed Lynx deployment.
AI-assisted, human-edited under the editorial responsibility of Bannermedia Ltd. Reviewed by Ed Woodcock on 4 July 2026. Editorial standards.
