The Anubis ransomware operation has grown into a structured cybercriminal ecosystem that combines public branding, affiliate recruitment, and multi-platform extortion services. Researchers linked the group’s leak sites, onion infrastructure, forum accounts, and the recurring "Anubis Media" persona into a unified operation that promoted ransomware and data-extortion offerings across underground communities including XSS, BreachForums, ReHub, and RAMP, as well as X. The group reportedly listed 83 victims between February 2025 and June 2026, sought corporate access in the United States, Canada, Europe, and Australia, and advertised support for Windows, Linux, NAS, and ESXi environments with capabilities such as privilege escalation, shadow copy removal, network-wide deployment, and multiple encryption modes.

Separate incident reporting tied Anubis-linked intrusions to practical affiliate tradecraft centered on stolen VPN credentials and exploitation of CitrixBleed 2 (CVE-2025-5777) on Citrix NetScaler appliances. In observed attacks, operators blended into normal administration by deploying legitimate remote-management tools including ScreenConnect, Zoho Assist, MeshAgent, Remotely, UltraVNC, Total Software Deployment, and mRemoteNG, then moved laterally with RDP, SMB, and PsExec. They also harvested credentials with Mimikatz, browser password exports, and ntds.dit theft, used tools such as S3 Browser, rclone, s5cmd, WinSCP, and PuTTY for exfiltration staging, and in some cases established fallback access through cloudflared, authenticated proxies, and SSH SOCKS tunnels, including activity involving Synology NAS devices.

Researchers reported an active Silent Swap campaign that distributes a fake "Google Notes" browser extension to steal cryptocurrency by replacing copied wallet addresses with attacker-controlled ones during transactions. The operation uses unsigned .NET and Golang installers to silently sideload the malicious extension into Chromium-based browsers including Chrome, Edge, Brave, and Opera, where it monitors clipboard activity and browser input for wallet strings across multiple blockchains and swaps them in real time.

The malware reportedly abuses Chromium trust mechanisms by altering Secure Preferences and related settings files, recalculating integrity values so the extension appears legitimately installed without user approval. Researchers said the campaign also uses EtherHiding-style blockchain-based command-and-control, querying a smart contract through public RPC infrastructure to resolve active C2 domains such as devops-offensive[.]cc and Zebregts[.]com, complicating detection and takedown. The activity has been linked to the CountLoader threat actor, with infections observed globally and a heavier concentration in India, while dynamic per-victim wallet mapping and published hashes, domains, payload URLs, and Bitcoin wallet indicators suggest a broad effort to monetize consumer cryptocurrency transactions.

Adobe has released Priority 1 security updates for ColdFusion and Adobe Campaign Classic to fix multiple high-severity vulnerabilities, including seven flaws rated CVSS 10.0. In ColdFusion, the patched issues affect versions 2025.9, 2023.20, and earlier, and include improper input validation (CVE-2026-48281, CVE-2026-48277), unrestricted file upload (CVE-2026-48276, CVE-2026-48283), and path traversal (CVE-2026-48282) bugs that could allow unauthenticated remote code execution without user interaction. Additional ColdFusion flaws include a path traversal issue with arbitrary file read and limited write access (CVE-2026-48313), an SSRF bug (CVE-2026-48285), and user-interaction issues such as reflected XSS (CVE-2026-48307) and improper input validation tied to malicious files (CVE-2026-48315).

Adobe also patched CVE-2026-48286 in Adobe Campaign Classic, an incorrect authorization flaw affecting version 7.4.3 and earlier that can lead to arbitrary code execution on on-premises instances. Adobe said it is not aware of in-the-wild exploitation of the specific vulnerabilities, but assigned the updates a Priority 1 rating, indicating they are being targeted or are at high risk of being targeted, and urged administrators to patch within 72 hours. Recommended versions include ColdFusion 2025 Update 10, ColdFusion 2023 Update 21, and Campaign Classic 7.4.4 / build 9397 or later.

Citrix published a security advisory for NetScaler ADC and NetScaler Gateway, warning that multiple high-severity vulnerabilities can be exploited remotely in specific deployments and configurations. The advisory, highlighted by the Canadian Centre for Cyber Security, affects the 14.1 and 13.1 release lines as well as certain NetScaler FIPS and NDcPP editions, and references six CVEs including CVE-2026-8451, CVE-2026-8452, CVE-2026-8655, and CVE-2026-13474. Administrators were urged to review Citrix’s bulletin and move affected systems to fixed versions.

The disclosed flaws include a malformed HTTP/2 request issue that can trigger denial of service when HTTP/2 is enabled on affected LB, CS, VPN virtual servers or services (CVE-2026-13474); multiple memory overflow vulnerabilities tied to Oracle load balancer, DNS proxy, and DNS recursive resolver deployments (CVE-2026-8655); a memory overread caused by insufficient input validation when NetScaler is configured as a SAML Identity Provider (CVE-2026-8451); and a separate memory overflow vulnerability affecting Gateway or AAA virtual servers, including SSL VPN, ICA Proxy, CVPN, and RDP Proxy deployments (CVE-2026-8452). Recommended mitigations include applying Citrix security updates, disabling HTTP/2 or vulnerable Gateway features where not required, reviewing exposed virtual server and HTTP profile configurations, and monitoring for anomalous behavior.

A large-scale password spray campaign targeted Microsoft 365 environments through Azure CLI logins, generating more than 81 million authentication attempts and compromising at least 78 accounts across 64 organizations, according to Huntress. The attackers abused the deprecated OAuth Resource Owner Password Credentials (ROPC) flow to validate stolen username-password pairs and obtain user-delegated tokens, relying on previously breached credentials that had not been rotated.

The activity was observed between mid and late June and in some cases succeeded even where MFA and Conditional Access were enabled, because policies were misconfigured or did not fully cover Azure CLI ROPC authentication. Huntress said most attempts originated from the IPv6 range 2a0a:d683::/32, associated with LSHIY LLC (AS32167), and reported a more than 155-fold increase in credential-spray volume across its customer base over six months. Defenders were urged to enforce MFA for all users, cloud apps, and client app types, and to restrict Azure CLI access for non-admin users.