Cyber Threat Report: W/C July 27, 2026
282
Threat Clusters
1705
Articles Analyzed
54.3
Avg Threat Score
136
Rising Entities
Top threats
Critical Command Injection Vulnerability in Arista VeloCloud Orchestrator Under Active Exploitation
84.3
Critical RCE Vulnerability in Rails Active Storage Disclosed
79.5
Critical SQL Injection Vulnerability in UMAI Vision Traffic Analysis System (CVE-2026-4978)
78.0
Critical Vulnerabilities in FortiOS and Arista VeloCloud Under Active Exploitation
78.0
North Korean Hackers Target Open Source Software Supply Chain via npm Packages
77.1
Coordinated Cyberattack Disrupts Water Utilities in Minnesota
77.0
Russian Intelligence Exploits Signal Backup Flaw, Cryptographic Fix Proposed
77.0
North Korea's Lazarus Group Exploits Crypto Gaps, $6.75 Billion Stolen
76.2
Operation Double Barrel: State-Sponsored Exploitation of Korean Financial Software
75.5
Mirage Kitten Malware Targets Middle East and Africa with New Toolset
75.5
Cross-Border Disinformation Campaign Disrupts CJP Protests in India
75.2
Multiple Critical Vulnerabilities Exploited in SonicWall and SharePoint Systems
74.6
Ransomware leak sites this week
245 victim listings across 39 groups, from ThreatCluster's own collection of ransomware leak sites. Listings are claims by the groups, not confirmed breaches. Most-listed sectors: Manufacturing (51), Technology (31), Professional Services (27), Healthcare (22), Other (22).
| Group | Listings |
|---|---|
| thegentlemen | 43 |
| qilin | 32 |
| crpxo | 31 |
| safepay | 18 |
| incransom | 12 |
| nightspire | 12 |
| lockbit5 | 9 |
| deadlock | 6 |
| dragonforce | 6 |
| krybit | 6 |
Ransomware tracker · Dark web API
Rising entities
Apt Group
- Ta488+33%
- Night Dragon+100%
- Sapphire SleetNEW
- ShinyHuntersNEW
- Stardust ChollimaNEW
Attack Type
- Supply Chain Attack+52%
- Botnet+240%
- Brute Force+450%
- Worm+500%
- Remote Code Execution+150%
Campaign
Cve
- CVE-2026-21858+200%
- CVE-2026-15392+50%
- CVE-2026-56164+50%
- CVE-2026-60081+50%
- CVE-2026-56155+50%
Cwe
Industry
- ServicesNEW
- IT ServicesNEW
- Construction And EngineeringNEW
- BankingNEW
- SpaceNEW
Malware
- FinSpy+1400%
- XMRig+50%
- CastleLoader+100%
- TenguNEW
- SparkKittyNEW
Mitre Attack
Platform
- Android+60%
- IOS+129%
- Kubernetes+800%
- ExploitGym+38%
- WhatsApp+43%
Ransomware Group
- Chaos Ransomware+100%
- LockbitNEW
- World LeaksNEW
- GunraNEW
- Anubis Ransomware GroupNEW
Tool
- Hugging Face+34%
- Npm+333%
- Dropbox+333%
- Gmail+233%
- Microsoft Teams+167%
Vulnerability
- CosmosEscapeNEW
- Citrix NetScalerNEW
- RufRootNEW
- PleaseFixNEW
- BreachNEW
Entity type distribution
| Entity type | Count |
|---|---|
| Cve | 751 |
| Platform | 410 |
| Company | 233 |
| Tool | 196 |
| Mitre Attack | 109 |
| Country | 95 |
| Malware | 80 |
| Campaign | 49 |
| Vulnerability | 49 |
| Apt Group | 43 |
| Cwe | 36 |
| Attack Type | 29 |
| Industry | 27 |
| Ransomware Group | 19 |