A cyberattack on one of Japan's largest food and cold-chain logistics operators disrupted refrigerated warehousing and frozen-food shipments for four days this month, in the most physically consequential incident of the week.
We reported that incident when it broke: A cyberattack on one cold-chain operator emptied KFC Japan's shelves.
Nichirei Corp confirmed that system failures beginning on 13 July were caused by an attack on its servers. The company disconnected group systems to protect customer and partner data, filed an initial report with Japan's Personal Information Protection Commission over possible leakage, and began restoring operations from 17 July. Some affected servers held personal data, though exfiltration has not been confirmed.
AI features in two separate research findings
Two unrelated pieces of research published this month place artificial intelligence in attack chains.
APT42, an Iranian-linked espionage group, has been using generative AI to sharpen its phishing, using it to research targets, build personas, handle translation and assist with code, paired with a modular collection framework called TAMECAT. Its targets are senior government officials, military personnel, foreign-policy advisers and, in several cases, their families. The researchers who documented it are careful to describe the AI as an operational accelerator rather than an autonomous intrusion system.
Separately, academic work from Zhejiang University described an attack on power infrastructure that requires no access to any power system at all: rent cloud GPUs, modulate their load, and let the resulting oscillations propagate into a local grid. We have covered that research in detail separately, including which of its striking figures were measured and which were simulated.
Espionage campaigns centre on mail access
| Actor | Method | Targets |
|---|---|---|
| TA488 | Zimbra exploitation, ZimReaper backdoor surviving password resets | Government, research, defence |
| APT42 | Generative AI for target research and persona building; TAMECAT framework | Senior officials, military, policy advisers and family members |
| LAUNDRY BEAR | A 2025 Zimbra flaw; targeting the last 90 days of mail, address lists, 2FA codes | Western government and commercial bodies |
| Kimsuky | Diplomatic-themed lures, LNK files installing the PebbleDash backdoor | Diplomacy-related personnel |
| UAC-0145 | Fake CAPTCHA pages prompting victims to paste a command themselves | Ukrainian organisations |
Four of the five rely on mail access or user action rather than on a novel exploit. Zimbra appears twice, exploited by different actors for different ends.
Zimbra features twice. TA488 exploited the collaboration suite to run a long, quiet campaign against government, research and defence organisations, deploying a backdoor that the researchers note survives password resets — meaning a credential reset does not by itself evict the intruder. LAUNDRY BEAR, meanwhile, has been working a 2025 Zimbra vulnerability since last July, going after the previous 90 days of email, global address lists, passwords and two-factor codes.
Kimsuky continued its diplomatic-lure phishing, using LNK files to install the PebbleDash backdoor and creating backdoor accounts for remote access. And Ukraine's CERT documented UAC-0145 replacing legitimate CAPTCHA pages with fakes that instruct visitors to open the Windows Run dialog and paste a command — an approach that sidesteps most email controls by having the victim execute the payload personally.
Two banking trojans in active distribution
Lampion, a Brazilian-origin trojan, is now almost entirely a Portuguese problem: Acronis's threat research unit puts 94.6% of detections in Portugal, with limited spillover into Spain and the UK. Attackers impersonate Portuguese private-sector organisations warning of pending financial or administrative issues, and the malware overlays banking sites to harvest credentials. Researchers attribute the concentration to shared language between the Brazilian crimeware ecosystem and Portuguese-speaking targets.
RedHook, an Android banking trojan, has been documented in a new version that grants itself system-level privileges by using Android's accessibility service to switch on developer options and then wireless debugging — obtaining a privileged shell without exploiting any vulnerability and without rooting the device. No vulnerability is involved. The mechanism is a developer feature reached through a permission the victim grants, after a phone call or message impersonating a bank directs them to a counterfeit app store.
Government sites turned into delivery infrastructure
A crew tracked as PhantomEnigma compromised at least 20 official Brazilian municipal and police websites on the .gov.br domain and used them to distribute malware — a trojanised build of a well-known open-source note-taking application, carrying a backdoor. Phishing emails were sent from legitimate government mailboxes, allowing them to pass email controls. The crew rotates infrastructure roughly weekly, which limits detection based on static domains or addresses.
Eight new ransomware listings
| Group | Victim | Sector | Listed |
|---|---|---|---|
| Qilin | Cano Industrial | Manufacturing, Mexico | 23 July |
| Qilin | EFU Life Assurance | Insurance, Pakistan | July |
| worldleaks | PinnPACK | Manufacturing, US | 21 July |
| WorldLeaks | St Francis Xavier Catholic School System | Education | 21 July |
| Akira | A university sprinkler system | Education / facilities | 22 July |
| incransom | Cabin Creek Health Systems | Healthcare, West Virginia | 23 July |
| thegentlemen | A private family office | Financial services, US | 23 July |
| chaos | A pharmaceutical testing lab | Pharmaceutical | 22 July |
Leak-site listings are claims by the attacker. None of these victims has confirmed an incident, and the volume figures groups attach to them are unaudited.
The listings span a manufacturer in Mexico, an insurer in Pakistan, a community health centre in West Virginia, a Catholic school system and a university sprinkler system. Facilities and building-management systems appearing as named victims reflects their position inside larger networks.
The family office listed by "thegentlemen" is a private investment office associated with Roy E. Disney's descendants. It is not The Walt Disney Company.
Perimeter devices dominate July's exploited-vulnerability additions
| Measure | July 2026 |
|---|---|
| CVEs added to the CISA catalogue | 25 |
| From network edge or perimeter vendors | 8 (32%) |
| Of those, given a three-day remediation window | 7 of 8 |
| Vendors involved | SonicWall, Fortinet, Cisco, Check Point, DD-WRT |
Our count from the CISA KEV feed, catalogue version 2026.07.27. Fortinet appears three times in the month.
CISA added Microsoft SharePoint and Check Point SmartConsole flaws to its catalogue of actively exploited vulnerabilities on 22 July, both with a three-day federal remediation deadline of 25 July. The SmartConsole flaw is the second actively exploited authentication bypass from that vendor in seven weeks.
Our KEV deadline calculator converts those windows into working days, and flags the ones that fall on a weekend.
Across the month, eight of twenty-five catalogue additions came from network edge or perimeter vendors, and seven of those eight drew the shortest remediation window CISA issues. We have written separately on how those deadlines compressed — and on why a three-day calendar-day clock issued on a Thursday leaves a single working day.
Teams working this beat may also want ThreatBook's Flocks for detection and SafeSkill for exposure assessment, alongside its open-source honeypot framework HFish.
The caveats that matter
- Ransomware listings are attacker claims. None of the eight victims above has confirmed an incident, and the data volumes such groups advertise are unaudited and routinely inflated.
- The EFU Life attribution is unconfirmed by the company.
- We have withheld operational detail throughout — no indicators, addresses, hashes or exploitation steps for any item here.
- The APT42 activity predates its publication. The campaign documented runs from late 2025 into May 2026; July is when the research appeared.
- Our catalogue count is ours, classifying vendors as edge or perimeter by name — a judgement, not a CISA label.
Key takeaways
- Nichirei lost four days of cold-chain operations to a server compromise, with a possible-leakage report filed to Japan's privacy regulator.
- AI appeared on both sides — APT42 using it for phishing craft, and research showing rented GPUs can disturb a grid.
- Zimbra was exploited by two separate actors, one with a backdoor that outlives a password reset.
- RedHook needs no vulnerability, reaching system-level rights through accessibility and wireless debugging.
- Eight new ransomware victims, and a third of July's exploited-vulnerability additions were perimeter devices.
View author profile → · Editorial policy
