Weekly Digest — Issue #31

Welcome to Issue #31 of the CosmicBytez Labs Weekly Digest — your curated rundown of what mattered in cybersecurity this week.

This was a breach-heavy week with enterprise-scale consequences. A threat actor called TheHatman used infostealer-harvested Azure credentials to export Entra ID directories from Fortune 500 companies — 3.5 million records pulled from McDonald's, Vodafone, TCS, and others using nothing more exotic than the platform's own administrative tools. Meanwhile, a suspected China-nexus APT exploited a critical VMware vCenter flaw five days after public disclosure, compromising 361 systems in 47 countries and deploying a Babuk-derived wiper not to extort victims, but to destroy forensic evidence of espionage access.

CISA had a busy week too — flagging an actively exploited RCE in Anyscale Ray's unauthenticated dashboard (a persistent thorn in AI/ML security), a critical double-free in Microsoft's IKE service, and a wave of new advisories spanning healthcare data theft, ransomware supply-chain targeting, and financial sector breaches.

The throughline: attackers are moving faster than patch cycles, and cloud-native authentication assumptions are failing at scale.

Top Stories

Fortune 500 Hit in Azure Entra ID Mass-Exfiltration Campaign

Read full article →

Threat actor "TheHatman" exfiltrated over 3.5 million enterprise employee records from McDonald's (1.7M), Tata Consultancy Services (800K), Vodafone (425K), IHG, Kyndryl, Gap, and others — all through compromised Microsoft Azure Entra ID tenants. The attack vector wasn't a platform vulnerability: infostealer malware harvested live session tokens and credentials from employee endpoints, which the attacker then used to log into the Azure portal and trigger native bulk directory exports.

The stolen directories — full names, corporate emails, phone numbers, office locations, org hierarchy — are now circulating on cybercrime forums. They're premium raw material for BEC, spear phishing, and account takeover. Hudson Rock confirmed infostealer-linked credential exposure at TCS, Gap, HCL Technologies, and Kyndryl specifically.

This follows the May 2026 Storm-2949 campaign (SSPR social engineering into cloud tenants) — a second major Azure identity exfiltration pattern in three months. The common thread: once an attacker holds valid Entra credentials, Azure's own tooling becomes the breach mechanism.

What to do: Enforce MFA across all Entra portals. Revoke sessions — not just passwords — immediately on confirmed infostealer infections. Restrict bulk directory export permissions. Subscribe to infostealer credential monitoring feeds and correlate alerts against Entra sign-in logs.

China-Nexus APT Exploits VMware vCenter Zero-Day — 361 Systems Compromised in 10 Days

Read full article →

A suspected China-nexus APT began exploiting CVE-2026-59310 — a CVSS 9.8 unauthenticated RCE in VMware vCenter's Syslog component — just five days after Broadcom published VMSA-2026-0006 on July 29. By August 7, researchers at German IR firm QUIRSO had confirmed 361 compromised systems across 47 countries, with 95% assessed as fully compromised.

The attack chain: exploit vCenter for root-level access → deploy a malicious cron job for persistence → install the reverse_ssh framework for outbound C2 → establish durable access to the ESXi hypervisor management plane. On a subset of victims, the actor deployed a Babuk-derived ESXi locker that encrypted log files — not production VMs — assessed as a forensic countermeasure triggered when QUIRSO's detection was noticed, not a ransomware play. No ransom notes were left.

vCenter is the central nervous system of VMware environments. Owning it means owning every VM running on those hosts. If your vCenter was exposed between July 29 and August 14, treat it as fully compromised.

What to do: Apply VMSA-2026-0006 immediately — there is no workaround. Hunt for unauthorized cron jobs and reverse_ssh processes on vCenter appliances. Segment vCenter management interfaces from untrusted networks permanently.

CISA Flags Actively Exploited Ray Framework RCE — AI/ML Infrastructure at Risk

Read full article →

CISA added an Anyscale Ray vulnerability to its Known Exploited Vulnerabilities catalog — an unauthenticated RCE reachable through Ray's browser-accessible dashboard on port 8265. Attackers scan for exposed Ray Dashboard ports, submit malicious Python jobs through the unauthenticated job submission endpoint, and use initial access to steal model weights, training data, and cloud credentials — or to establish persistence for cryptomining.

Ray's wide adoption in AI and ML pipelines makes this high impact. The authentication gap has been flagged since 2023; Anyscale's original position was that unauthenticated access was intentional for trusted internal use. Reality — exposed clusters on the public internet — has caught up with that assumption.

What to do: Restrict ports 8265, 6379, and 10001 to trusted internal IP ranges only. Deploy an authentication proxy in front of the Ray Dashboard for any externally accessible deployment. Audit existing clusters for unauthorized job submissions.

Heights Finance Breach: 1.2 Million Customers Exposed via Third-Party Platform

Read full article →

Consumer lender Heights Finance disclosed a data breach affecting at least 1.2 million individuals, originating through a third-party platform the company used to manage customer information. Stolen data includes full names, home addresses, phone numbers, Social Security Numbers, and financial account information — a combination that creates severe identity theft risk for affected customers.

The unnamed third-party vendor illustrates the persistent supply chain problem: organizations with strong internal controls can still be compromised through partners with access to the same sensitive data. Heights Finance is expected to offer credit monitoring to affected customers.

Affected? Place credit freezes at all three major bureaus (Equifax, Experian, TransUnion), set up fraud alerts, and watch for phishing attempts using the breached data.

Cavern C2 Tunnels Commands Through DNS and Google Apps Script

Read full article →

Iranian nation-state hackers evolved the Cavern (Cav3rn) C2 framework to use a dual covert channel: DNS tunneling with throttled query cadence to mimic organic traffic, and Google Apps Script as a trusted relay — routing commands through script.google.com infrastructure that enterprises cannot realistically block. Documented by Kaspersky against Israeli targets.

The Google Apps Script channel is particularly difficult to address: traffic blends with legitimate Workspace activity, benefits from Google's TLS, and requires no attacker-controlled infrastructure at the network layer. Defenders cannot block it by IP or domain. Detection shifts entirely to behavioral endpoint analytics and DNS query anomaly analysis.

This is part of a broader trend of threat actors abusing legitimate cloud platforms — OneDrive, Slack, Discord, Telegram — as C2 relay infrastructure to sidestep perimeter blocking.

Security Corner

Critical advisories published this week:

• CVE-2026-33824 — CVSS Critical. Double free RCE in Microsoft IKE Service Extensions — unauthenticated remote attacker can achieve code execution against any Windows system with IPsec/VPN enabled via crafted IKE packets to UDP/500. Added to CISA KEV. Apply August 2026 Patch Tuesday updates immediately; block UDP 500/4500 externally as an interim measure.

• CVE-2026-47698, CVE-2026-47686 — Review full advisories for scope and remediation. Published this week.

• CVE-2026-71566, CVE-2026-55674 — Additional advisories published this week. See the Security archive for full writeups.

• CVE-2026-74800, CVE-2026-74799 — Review full advisories for scope and remediation.

• CVE-2026-19977, CVE-2026-19961, CVE-2026-19959 — Additional advisories from this week's release cycle.

Browse the full Security Advisories archive for all active CVEs.

Quick Takes

• Forminator WordPress RCE — A critical flaw in the Forminator WordPress plugin (500K+ installs) allows unauthenticated attackers to upload malicious PHP files and achieve server-side RCE. Patch immediately if running Forminator (read more).

• Critical GitLab GraphQL flaw — An unauthenticated GraphQL vulnerability in GitLab could allow attackers to delete public projects without authentication. If running self-hosted GitLab, apply the patch immediately (read more).

• Hacker claims 36M Azure account records — Separate from the TheHatman campaign, a threat actor is claiming to hold 36 million Azure account records stolen from major enterprises. The claim is unverified but aligns with the ongoing wave of Azure identity targeting (read more).

• Poland investigates myDr healthcare breach — Polish authorities are probing a breach of the myDr healthcare software platform, potentially affecting up to 19 million patients. The scale would make it one of the largest healthcare data breaches in European history (read more).

• Philips and GE probing Clop claims — Both Philips and GE HealthCare are investigating data theft claims from the Clop ransomware group, which has been systematically targeting medical device and healthcare technology vendors (read more).

• French tax authority breach — France's tax authority suffered a data breach affecting 678,000 individuals, including tax identification numbers and financial data — a high-value target for identity fraud in a country with centralized tax infrastructure (read more).

• Pokémon Center breach — The Pokémon Center e-commerce platform disclosed a customer data breach exposing account information and causing some orders to be cancelled as a precaution. Low severity individually, worth noting as part of the week's consumer breach pattern (read more).

• SafePal crypto wallet breach — Hardware wallet company SafePal disclosed a breach affecting 39,798 customers, with stolen customer information reportedly for sale. A reminder that even security-focused products carry vendor-side data risk (read more).

• Trezor customers hit via Shipmonk — 14,000 Trezor customers had their shipment data exposed through a breach at fulfillment partner Shipmonk — names, addresses, and order details. Third-party logistics providers remain a consistent weak link for hardware wallet companies (read more).

• macOS screen sharing cryptominer — Attackers exploited a macOS screen sharing flaw to deploy a Monero cryptominer, leveraging trusted system functionality to gain persistence on compromised hosts (read more).

• Microsoft August Patch Tuesday — Microsoft's August 2026 Patch Tuesday cycle addressed a large volume of vulnerabilities. Prioritize patches for systems with IKE/IPsec enabled given CVE-2026-33824's KEV status (read more).

• Anthropic AI watermarking — Anthropic published details on plans to watermark Claude's AI-generated text, embedding detectable signals to help identify AI-authored content at scale (read more).

• $30M bank fraud via service provider — A group of hackers was arrested for orchestrating $30 million in bank fraud by exploiting a vulnerability in a financial services provider shared across multiple institutions — a classic supply chain compromise for financial gain (read more).

• CISOs break their silence — A newly declassified docuseries features sitting and former CISOs speaking candidly about breach response, boardroom dynamics, and the realities of security leadership that rarely make it into public discourse (read more).

• Salesforce and ServiceNow portals scraped — A single attacker has been systematically scraping both Salesforce and ServiceNow customer portals since 2025, harvesting publicly exposed data from misconfigured tenant instances (read more).

Upcoming

Next issue (Issue #32): The Azure identity targeting pattern is accelerating — expect follow-on reporting as additional affected organizations confirm breach status and regulatory notifications begin landing. QUIRSO's vCenter campaign timeline extends to mid-August, so further compromise confirmations are likely. We'll be watching the VMware patch adoption curve and whether the China-nexus actor pivots to new infrastructure post-exposure.

On the Labs: The tools library and study section continue to expand with new content. Check the training index for the latest modules and the howto library for practical hardening guides tied to this week's headlines — particularly around Azure Entra ID security and VMware network segmentation.

Stay sharp. This week's stories share a structural problem: the gap between when patches drop and when organizations apply them is a window attackers are actively exploiting, often in hours, not weeks. The vCenter campaign started five days post-disclosure. The Ray KEV status reflects years of known exposure. Speed of response now matters as much as depth of controls.

Issue #31 — August 19, 2026. Published weekly by CosmicBytez Labs. To receive this digest by email, subscribe here.