Aug 17, 2026 · Covering Aug 10, 2026 – Aug 16, 2026

This Week in Threats: August 10–August 16, 2026

Multiple data breaches, DDoS disruptions, and active exploitation of critical vulnerabilities marked a high-activity week in the cyber threat landscape.

weekly-reportREF7707Earth AluxSilent ChollimaStorm-0530Storm-1175

Overview

The week of August 10–16, 2026 saw widespread cyber threats including data breaches at SafePal and RingCentral, DDoS attacks on Threema, and active exploitation of critical vulnerabilities in SAP Commerce Cloud, VMware vCenter, and macOS systems. Threat actors such as Jewelbug and HoneyMyte advanced their operations with enhanced tooling, while new malware like AmnesiaStealer targeted macOS users.

Active Threat Actors

Jewelbug, a China-based APT group also known as Earth Alux or REF7707, conducted parallel espionage and cryptocurrency fraud operations using shared infrastructure and a unified control panel called XG-Web, targeting government ministries in the Middle East, Southeast Asia, and South Asia through browser-based attacks and watering-hole compromises Jewelbug: APT Group Runs Espionage and Crypto Fraud Operations Side by Side. HoneyMyte, also known as Mustang Panda, upgraded its CoolClient backdoor with a kernel-mode Windows rootkit deployed via DLL sideloading using a renamed Sangfor executable APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit. Akira ransomware affiliates gained access via an exposed SonicWall VPN without MFA, moved laterally using RDP, and exfiltrated data after disabling EDR by rebooting into Safe Mode with Networking Akira hackers disable EDR with Safe Mode, steal data but fail to encrypt. ShinyHunters breached RingCentral through a social engineering campaign, exfiltrated data from 1.6 million accounts, and leaked a 280GB archive after the company refused to pay ransom RingCentral data breach exposed info of 1.6 million accounts.

Notable Malware

AmnesiaStealer, a macOS-targeting information-stealing malware distributed via fake GitHub download pages, steals browser profiles, passwords, cryptocurrency wallets, Apple Notes, keychain data, and documents, and includes a ‘stream_module’ component enabling remote control of a headless browser instance loaded with the victim’s cloned Chromium session New AmnesiaStealer macOS malware hijacks browser sessions via remote control. Monero Miner malware was deployed by attackers exploiting a macOS Screen Sharing vulnerability (CVE-2026-65400), allowing root access via exposed port 5900 Hackers exploit macOS Screen Sharing flaw to deploy Monero miner. CoolClient, used by the HoneyMyte APT group, was updated with a kernel-mode rootkit via a signed driver msagent.sys to hide malicious processes, files, registry keys, and network connections APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit.

Key CVEs & Campaigns

A critical remote code execution vulnerability, CVE-2026-58231 in SAP Commerce Cloud with a CVSS score of 10.0, is being actively exploited just three days after patching, stemming from improper authorization in the Data Hub Adapter extension Max severity SAP Commerce Cloud flaw now targeted in attacks. VMware vCenter Syslog Server is affected by a critical directory traversal vulnerability, CVE-2026-59310, actively exploited to achieve remote code execution and deploy the reverse_ssh framework for reverse SSH access Critical VMware vCenter RCE flaw exploited for reverse SSH access. The Netherlands’ NCSC warned of active exploitation of CVE-2026-65400, a macOS Screen Sharing flaw allowing network-based attackers to bypass authentication and gain root access without credentials Hackers exploit macOS Screen Sharing flaw to deploy Monero miner. SafePal suffered a data breach due to an authorization flaw in an order-tracking plugin, exposing personal and purchase data of 39,798 customers SafePal data breach impacts 39,798 customers, stolen info for sale. Threema experienced service disruptions due to large-scale DDoS attacks targeting its infrastructure and colocation partner Nine, with attackers continuously changing patterns Large-scale DDoS attacks disrupted Threema secure messaging service.

Sources