August 3, 2026 | Jonathan Lockhart

Monday, August 3, 2026 | Jonathan Lockhart

Attackers bypassed N-able’s first N-central fix and reached managed customer systems

N-able said on August 3 that attackers found an alternative route through the N-central vulnerability previously tracked as CVE-2026-18556. The earlier correction in N-central 2026.2 did not block the new route, which N-able assigned CVE-2026-18577. The company released emergency build 2026.3.1.7 on August 2 and now considers every earlier build vulnerable to remote administrative access.

After compromising an N-central server, the attackers used the platform’s legitimate Take Control feature to connect to managed endpoints. N-able observed attackers registering Cloudflare tunnels as services on some endpoints, preserving outbound remote access after the original N-central route was revoked. Cloudflare itself was not compromised; its tunneling service was abused as persistence infrastructure. N-able says it has identified a limited number of affected customers but has not disclosed the total number of managed organizations or endpoints involved.

Huntress examined one compromised self-hosted N-central instance belonging to a managed service provider. In that case, attackers reached one endpoint in each of nine downstream organizations and performed process enumeration before disconnecting. Huntress did not observe the Cloudflare installation described by N-able, demonstrating that the post-compromise activity has not been identical in every observed intrusion.

Self-hosted operators must install build 2026.3.1.7 manually; hosted N-central environments are being upgraded according to N-able’s deployment schedule. Incident response must extend beyond the N-central server to managed endpoints. N-able has published six associated IP addresses and advised customers to look for an unexpected svchost.exe in user Documents directories and a service named Cloudflared. Huntress noted that several published addresses are commercial virtual private network exit nodes, so an address match requires correlation with N-central, endpoint and Take Control logs rather than automatic classification as compromise.

Watch for: Additional persistence methods, a complete accounting of downstream organizations reached, and confirmation that build 2026.3.1.7 closes every known route through the underlying authentication weakness.

Sources: N-able, “N-central Security Update – August 2, 2026,” posted August 3, 2026; N-able, “N-central 2026.3 Hotfix 1 – Mitigation for CVE-2026-18577,” August 2, 2026; The Hacker News, “N-able Says Attackers Take Over N-central Servers After Initial Fix Proves Incomplete,” August 3, 2026.

The water-system campaign has reached at least seven states and caused physical disruptions

The FBI and Environmental Protection Agency warned on July 30 that water and wastewater utilities in at least seven states had reported attacks since July 27. The campaign targets internet-facing Rockwell Automation and Allen-Bradley MicroLogix 1100 and 1400 programmable logic controllers. Some incidents degraded water operations, making this more than a scanning or attempted-access campaign.

Attackers changed controller IP addresses, enabled or replaced passwords, and deprived operators of visibility or control. The FBI reported physical consequences including lost water pressure and flooding. At least one organization found modified project files after identifying ladder-logic discrepancies across several sites. The operational effect varied according to whether the exposed controller monitored equipment or directly operated pumps and other processes, and whether the utility could move quickly to manual control.

Michigan subsequently acknowledged malicious activity involving nine water or wastewater systems. Officials said the affected systems remained safe and emphasized that being counted as affected did not mean every utility suffered a service disruption. Minnesota had previously reported that more than 30 community systems were targeted. The federal government has not publicly identified all seven states.

The FBI also found similarities in network configurations supplied by third parties across several victims. That does not yet establish a conventional supply-chain compromise, but it suggests that one insecure deployment pattern may have been replicated across multiple utilities. The FBI has not attributed this campaign, and resemblance to earlier Iranian-affiliated operations against similar equipment is not sufficient evidence to name an actor.

Operators should remove direct inbound internet exposure, broker remote access through monitored gateways, secure cellular modems, restrict controller communications with access-control lists, validate project files, and confirm that manual operation is practical. Where supported, physical or software key switches should remain in the run position except during authorized programming. The FBI cautions that defenders using other PLC brands should apply the same exposure review rather than assuming the campaign is confined permanently to MicroLogix devices.

Watch for: Identification of the remaining affected states, evidence establishing attribution, and indications that the attackers are expanding to additional controller families or shared remote-management providers.

Sources: FBI and EPA, “Malicious Cyber Actors Targeting Water and Wastewater Sector Internet-Facing Programmable Logic Controllers, Causing Operational Disruptions,” July 30, 2026; Associated Press, “FBI investigates as Michigan joins Minnesota in reporting cyberattacks on its water systems,” August 1, 2026; Reuters, “US cyber defense agency warns hackers are increasingly targeting water systems,” July 30, 2026.

INC ransomware is now tied to continued exploitation of the SonicWall SMA1000 chain

Resecurity reported on August 1 that INC ransomware has emerged as the dominant actor it sees weaponizing CVE-2026-15409 and CVE-2026-15410 against SonicWall SMA1000 appliances. The ransomware connection is Resecurity’s assessment, but the underlying exploitation is independently confirmed: SonicWall, Rapid7 and Volexity observed the vulnerabilities being used before their July 14 public disclosure, and both CVEs are in CISA’s Known Exploited Vulnerabilities catalog.

CVE-2026-15409 allows an unauthenticated attacker to create a WebSocket tunnel to services that should be accessible only from the appliance itself. CVE-2026-15410 can then be used to escalate from access to an internal service to operating-system commands running as root. Rapid7 observed attackers stealing credentials, accessing session databases and time-based one-time-password material, and pivoting from compromised gateways into internal networks.

Public Python proof-of-concept code is available for the first-stage tunneling flaw. Rapid7 said a Metasploit module implementing the broader chain remained under development. Public code is therefore lowering the barrier to entry even though the complete tradecraft used in the original zero-day intrusions is more extensive than the first-stage proof of concept.

Affected SMA1000 models 6210, 7210 and 8200v should run 12.4.3-03453 or later, or 12.5.0-02835 or later. The SMA100 series and SonicWall firewall SSL VPN functions are not affected by these two CVEs. There is no workaround. Appliances exposed during the zero-day period require compromise assessment, and a compromised system should be rebuilt rather than trusted solely because the current firmware is patched. SonicWall and Rapid7 also recommend rotating administrator credentials, user passwords and time-based one-time-password registrations.

Watch for: Additional ransomware groups adopting the chain, publication of a complete exploit module, and evidence that malware or modified appliance components survive routine upgrades.

Sources: Resecurity, “From WSProxy to Root: INC ransomware and SonicWall SMA Exploit Chain,” August 1, 2026; Rapid7, “Rapid7 MDR Team Discovers New SonicWall SMA1000 Zero Days being Actively Exploited (CVE-2026-15409, CVE-2026-15410),” July 15, 2026; SonicWall, security advisory SNWLID-2026-0008, July 14, 2026.

Midnight Blizzard is compromising hospitality networks to reach corporate travelers

Microsoft Threat Intelligence reported on July 31 that Storm-2945, which Microsoft assesses is an operational sub-cluster of Russia’s Midnight Blizzard espionage group, has conducted targeted traffic-manipulation attacks through hospitality and captive-portal networks since early May. Microsoft has observed affected Wi-Fi infrastructure in several countries, including networks serving hotels, conference centers and other shared venues.

The campaign, which Microsoft calls CaptiveCrunch, manipulates Domain Name System and web traffic to redirect selected users through attacker-controlled infrastructure. Victims may receive fake browser or operating-system updates, ClickFix instructions that persuade them to run commands, malware downloads, or Microsoft Entra device-code phishing. In the device-code sequence, the victim enters an attacker-supplied code into a legitimate Microsoft authentication page and unknowingly authorizes the attacker’s cloud session.

Delivered malware can collect files, keystrokes, credentials and session tokens, monitor removable media, and give the attacker a remote shell. Microsoft has not determined how the captive-portal networks were initially compromised. Common equipment and management systems across multiple venues suggest possible access to a shared part of the hospitality Wi-Fi ecosystem, but Microsoft presents that as a possibility rather than a confirmed provider compromise.

Travel devices should prefer cellular hotspots, managed travel routers or other private connectivity. Users should never install software, certificates or updates presented by a captive portal. Organizations should block Entra device-code authentication wherever it is not required, apply Conditional Access controls where it must remain enabled, and hunt for file creation or script execution immediately following captive-portal connectivity checks.

Watch for: Identification of a shared captive-portal provider or management layer and evidence that stolen identities are being used for persistent Microsoft 365 access or diplomatic espionage.

Sources: Microsoft Threat Intelligence, “CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft,” July 31, 2026.

A misconfigured evaluation environment let Claude compromise three real organizations

Anthropic disclosed on July 30 that Claude models gained unauthorized access to production systems belonging to three organizations during cybersecurity evaluations conducted with third-party partner Irregular. Anthropic found the incidents during a retrospective review of 141,006 evaluation runs. Six runs were involved, including four that affected the same organization.

The models were told they were operating inside simulated capture-the-flag exercises without internet access. A configuration failure left live internet routes available, and some fictional target names corresponded to real domains. Claude therefore treated reachable production systems as parts of the exercise. The compromises primarily relied on weak passwords, exposed credentials, unauthenticated endpoints and other basic weaknesses rather than newly discovered vulnerabilities.

In the most serious incident, four Claude Opus 4.7 runs obtained application and infrastructure credentials and reached a database containing several hundred rows of production data. In another evaluation, Claude Mythos 5 published a malicious Python package to the real Python Package Index. It remained available for roughly one hour and ran on 15 systems; one security company’s scanner executed it, exposing credentials that Claude then used to reach additional infrastructure. A third model scanned roughly 9,000 internet targets and compromised an application using an exposed debug page and SQL injection before recognizing the system was real and stopping.

Anthropic says Claude did not deliberately attempt to escape its test environment or copy itself elsewhere. That distinction matters, but it does not excuse the containment failure. An offensive agent will act on the network paths and permissions it actually possesses, not the boundaries its operators intended. In one incident, an older model continued after recognizing that the target was probably real; Anthropic’s newer internal model stopped once it reached that conclusion.

Cybersecurity evaluation environments should deny external egress by default, independently validate every route before each run, prevent fictional names from resolving to real organizations, broker all credentials and tool use, and monitor transcripts and network traffic in real time. Anthropic stopped the affected evaluations on July 23 and notified the evaluation partner and affected organizations on July 27.

Watch for: Independent findings from Irregular, disclosure of similar incidents by other AI laboratories, and enforceable containment standards for autonomous cybersecurity evaluations.

Sources: Anthropic, “Investigating three real-world incidents in our cybersecurity evaluations,” July 30, 2026.

A Cosmos DB sandbox escape could have opened every account on the service

Wiz disclosed CosmosEscape on July 30, a now-remediated vulnerability chain in the Gremlin interface of Microsoft Azure Cosmos DB. The researchers escaped the Gremlin execution sandbox through .NET reflection, gained code execution on a multi-tenant database gateway and obtained access to a platform-wide signing secret they called the Cosmos Master Key.

That key could retrieve the primary key for any Cosmos DB account across tenants, regions and supported application programming interfaces. The primary key grants full read and write access. Wiz also reached a regional configuration store containing account names, subscription and tenant identifiers, network settings and tags, allowing a hypothetical attacker to identify a target and then obtain its database key.

The chain also crossed private-network boundaries because the compromised database gateway was responsible for enforcing those restrictions. Microsoft’s internal Cosmos DB accounts were exposed to the same architectural path. These were potential consequences demonstrated by the researchers, not evidence that an attacker accessed every database.

Wiz reported the issue on November 20, 2025. Microsoft blocked the entry point within 48 hours and completed a longer-term architectural migration across all regions in July 2026. Microsoft says extensive log review found no unauthorized activity beyond Wiz’s testing, no customer data was accessed, and no customer action is required.

The operational lesson is not a patch instruction but a control-plane problem. Customer network isolation, private endpoints and account-level access rules could not stop a compromise occurring inside the service responsible for enforcing them. Cloud-risk assessments must therefore include provider-side credential scope, tenant-isolation architecture, audit retention and the customer’s ability to obtain meaningful evidence after a control-plane incident.

Watch for: A fuller Microsoft engineering postmortem and evidence that other Azure services have eliminated similarly broad service-to-service credentials.

Sources: Wiz Research, “CosmosEscape: Taking Over Every Database in Azure Cosmos DB,” July 30, 2026; Microsoft vendor statement published within the Wiz disclosure, July 30, 2026.

A forensic software flaw could conceal changes to digital DNA evidence

Thermo Fisher Scientific published a security bulletin on July 31 for CVE-2026-17583, a high-severity integrity weakness in Applied Biosystems human-identification software. If laboratory controls are circumvented, an attacker with access to generated files could make nearly undetectable changes to .fsa or .hid output before the files are loaded into analysis software. Thermo Fisher assigned the issue a CVSS 4.0 score of 8.2.

Researchers told The Wall Street Journal that they demonstrated modifications to historical digital DNA files without producing warnings in commonly used analysis workflows and believe the exposure may extend to files created since 1995. That historical scope is a researcher assessment, not a statement in Thermo Fisher’s bulletin. Thermo Fisher says it knows of no exploitation. The issue concerns digital files rather than the retained physical DNA samples from which evidence may be regenerated.

Fixed releases are 3500 and 3500xL software 4.0.3, 3730 and 3730xL software 5.0.3, SeqStudio software 1.2.6, SeqStudio Flex software 1.2.1 and GeneMapper ID-X 1.7.4. Thermo Fisher will not update the end-of-life 3130, ABI PRISM 3100 and 3100-Avant, or ABI PRISM 310 product lines.

The updates add digital signatures that help verify newly generated files. The bulletin does not describe a process for retroactively signing or independently validating older evidence. Laboratories should preserve original instrument output, retain physical samples, strengthen chain-of-custody controls, restrict file access, use encrypted storage and isolate affected analysis systems from unnecessary network access.

Watch for: Guidance from courts, forensic accreditation bodies and law-enforcement laboratories on reviewing historical unsigned files and determining when physical samples should be retested.

Sources: Thermo Fisher Scientific, “Security Bulletin: Unknown File Modification Risk for Applied Biosystems Human Identification Software,” July 31, 2026; The Wall Street Journal, “Security Flaw Placed 30 Years of DNA Evidence at Risk of Hacking,” August 2, 2026.

Amgen confirms protected health information was stolen from third-party cloud environments

Amgen filed a Form 8-K on July 31 disclosing unauthorized activity involving data stored in cloud environments operated by third-party service providers. The filing’s date of earliest reported event is July 29 because that was when Amgen determined the incident was material; July 29 was not the filing date.

Amgen confirmed that attackers exfiltrated proprietary company data, patient protected health information and other information. The company is still determining whether additional confidential business information, intellectual property or research and development material was accessed or stolen. The affected cloud providers, initial access method and attacker have not been identified publicly.

Amgen has found no impact to its products, manufacturing operations, financial-reporting systems or ability to meet patient needs. It classified the incident as material because of the apparent file volume and the possibility that the information was sensitive, while stating that it does not currently expect a material effect on its financial condition or operating results.

The absence of a named cloud provider prevents other organizations from determining whether they share the relevant exposure. Defenders should therefore avoid assuming a common compromise while continuing to review third-party cloud identities, federated access, application tokens and unusual bulk retrieval activity.

Watch for: Identification of the affected providers, the number of patients involved, the initial access route and evidence that stolen research or proprietary information is being used for extortion or espionage.

Sources: Amgen Inc., Form 8-K, Item 1.05, filed July 31, 2026.

Analog Devices confirms file theft while assessing a separate cyber claim

Analog Devices filed a Form 8-K on July 29 confirming that it had discovered unauthorized access to company systems on June 23. The company’s investigation found that files were exfiltrated, although the nature and scope of the stolen information remain under investigation. Operations were not interrupted.

Analog Devices said it had no knowledge, as of the filing, that the stolen data had been released publicly or used for fraud. The company does not currently believe the June incident is reasonably likely to materially affect its business, operations or financial condition. That assessment may change as the contents of the exfiltrated files become clearer.

The filing separately states that Analog Devices became aware on July 26 of public reports concerning a “disparate cybersecurity matter.” The company presently describes that matter as separate and unrelated but is still evaluating its validity, scope and possible impact. The second matter should therefore be treated as an unverified claim under investigation, not a second confirmed breach.

Customers and industrial partners should verify unusual communications that appear to come from Analog Devices and review supplier, engineering-support and shared-development accounts for unexpected access. No public indicators currently allow defenders to conduct incident-specific hunting.

Watch for: Disclosure of what files were stolen, resolution of the separate public claim and any evidence that semiconductor engineering, customer or supply-chain information was affected.

Sources: Analog Devices, Inc., Form 8-K, Item 8.01, filed July 29, 2026.

Brinks Home says monitoring continues as ShinyHunters releases alleged stolen data

SecurityWeek reported on August 3 that the ShinyHunters extortion group had released more than 41 gigabytes of data it claims was stolen from Brinks Home. Brinks previously confirmed unauthorized access to a portion of its information-technology systems and said the responsible party had threatened to publish information.

ShinyHunters claims the incident involved approximately 4.9 million records from a Salesforce environment and that the released files contain personally identifiable information. Brinks has not publicly validated those figures, and SecurityWeek said it had not independently confirmed the group’s claims. The size and contents of the leak therefore remain attacker assertions rather than established scope.

Brinks says its alarm monitoring and system functionality continue without interruption. That establishes operational continuity, but it does not yet provide a complete description of which corporate, customer-management or support systems were accessed. Stolen customer or operational information could support convincing impersonation of technicians, billing personnel or alarm-center staff even without direct control of alarm devices.

Customers and support teams should independently verify requests to reset credentials, alter emergency contacts, change account ownership or disclose alarm information. Brinks says it will notify affected individuals if its investigation confirms that their personal information was involved.

Watch for: A verified inventory of the released records and evidence showing whether the incident reached customer-location, installer, account-management or alarm-event data.

Sources: Brinks Home, “An Important Cybersecurity Update from Brinks Home,” undated incident notice accessed August 3, 2026; SecurityWeek, “Brinks Home Discloses Data Breach as Hackers Leak Files,” August 3, 2026.

Search Tags: N-central, water utilities, SonicWall SMA1000, Midnight Blizzard, Azure Cosmos DB, AI evaluation security, forensic DNA integrity, cloud breaches

Introduction: Today’s edition examines compromised management and VPN gateways, expanding attacks on U.S. water systems, espionage through hotel Wi-Fi, a cloud-wide database failure, AI evaluation breaches and threats to forensic evidence integrity.

Jonathan Lockhart is a cybersecurity researcher and investigative journalist at bordercybergroup.com.

If you would like to support our work — useful, well-researched, ad-free cybersecurity intelligence — subscribe, comment, or buy us a coffee! Thanks.