Threat intelligence briefing — first half of July 2026

• Reference: TI-2026-07H1 (public edition)
• Coverage: all monitored sectors
• Reporting period: 1–17 July 2026
• Issued: 17 July 2026 · Lead analyst: Peter Bassill

This is the public (TLP:CLEAR) edition of an intelligence product written by the UK Cyber Defence Security Operations Centre for its clients. Observations specific to individual client environments have been removed. Clients receive the full edition, including estate-specific indicators and detection content.

1. Executive summary

This briefing is a unified cross-vertical threat intelligence product covering the seven client-facing industry verticals monitored by the UK Cyber Defence SOC. It is intended for security leadership and operational defenders across multiple sectors, and to inform prioritisation of detection and defensive investment during the reporting period 11 Jul 2026 - 17 Jul 2026. It consolidates the seven vertical-specific products (TI-2026-0717-001 through -007) into a single distribution-ready deliverable.

The reporting period was materially eventful across every monitored vertical, with four cross-cutting developments driving the picture:

SonicWall SMA1000 zero-day exploitation with a ransomware objective. CVE-2026-15409 (CVSS 10.0 SSRF) and CVE-2026-15410 (post-authentication OS command injection) were both added to CISA KEV on 14 Jul 2026. Rapid7 MDR has directly attributed the observed goal to ransomware. Exploitation began before public disclosure. Every vertical with SonicWall in the remote-access estate is exposed. Microsoft AD FS elevation-of-privilege CVE-2026-56155**.** Disclosed on 14 Jul 2026 as part of a record 622-CVE Patch Tuesday and added to the CISA KEV catalogue the same day, with active exploitation confirmed. A DKM container ACL weakness allows a low-privileged local user to gain administrator on the federation server; because AD FS bridges on-premises Active Directory to Microsoft 365 and Azure AD, compromise here yields tenant-wide identity impact. Federal remediation deadline 28 Jul 2026. 19-agency joint advisory on FSB Centre 16 and APT28 "FrostArmada". Published 13 Jul 2026. Systematic router-perimeter compromise across CNI and defence networks attributed to FSB Centre 16 (Static Tundra / Berserk Bear / Energetic Bear). Paired APT28 campaign hijacked DNS settings on approximately 18,000 MikroTik and TP-Link SOHO routers to intercept Microsoft 365 credentials and OAuth tokens. Every vertical with home-working populations connecting to M365 through consumer-grade routers is exposed. The Gentlemen ransomware brand dominance. Retained first place with 121 leak-site postings in June 2026 (Qilin 78) and ~300 postings across Q2 (Qilin 289). 90 per cent affiliate profit share is accelerating recruitment away from other brands. Qilin, DragonForce / Scattered Spider (four further UK arrests announced 10 Jul), Anubis, Interlock and Play continued to produce sector-relevant leak-site postings. The attacker rotates between first-party ROPC-capable Azure AD applications (Microsoft Azure CLI app id 04b07795-8ddb-461a-bbee-02f9e1bf7b46, Azure Active Directory PowerShell, Azure AD Connect, Microsoft Online Services, One Outlook Web, Microsoft Teams and OfficeHome), each of which represents a separate front door to the same deprecated flow. Every attempt observed to date has been refused by Entra smart lockout; zero successful sign-ins from attacker infrastructure across 30 days. The durable fix is a Conditional Access policy that blocks the ROPC / legacy-auth flow at the flow level rather than scoping to any single application id.

ISAC intelligence during the period continues to prioritise the cross-cutting developments above. Sector-specific focus:

FS-ISAC. Sustained probing of AD FS, NetScaler Gateway, SonicWall SMA workplace and Entra ID sign-in endpoints across peer FS estates.

MTS-ISAC. Anubis affiliate tradecraft after the Adriatic Port Authority precedent.

H-ISAC. Pathology, radiology and pharmacy-management system targeting.

RH-ISAC. Scattered Spider / DragonForce service-desk social engineering.

Space ISAC. Satellite-ground-segment and defence-supply-chain adversary interest.

For verticals without a dedicated ISAC (legal, trade bodies), analyst weight sits on the NCSC sector threat report and equivalent government advisories.

Key Judgements

The following key judgements represent the lead analyst’s assessed view at the time of issue. Each is qualified by an analytic confidence rating in line with the conventions described in Section 11.

1. It is highly likely that Microsoft AD FS CVE-2026-56155 will drive credential-federation intrusion attempts against UK and EU client estates across every monitored vertical over the next two reporting cycles, given the same-day CISA KEV listing on 14 Jul 2026, the confirmed active exploitation, and the outsized value of federation-server compromise as a route into cloud-tenant control (HIGH confidence).
2. It is highly likely that SonicWall SMA1000 CVE-2026-15409 and CVE-2026-15410, chained, will drive ransomware initial-access intrusions against UK and EU targets across financial services, retail, healthcare and defence contractor estates during the next two reporting cycles; Rapid7 MDR has confirmed the attacker objective is ransomware and the exploitation curve began before public disclosure (HIGH confidence).
3. It is highly likely that The Gentlemen, Qilin and DragonForce / Scattered Spider will continue to drive the majority of materially-disruptive ransomware incidents across the monitored verticals during the next two reporting cycles; The Gentlemen's 90 per cent affiliate profit share is materially accelerating recruitment away from other brands (HIGH confidence).
4. It is highly likely that FSB Centre 16 (Static Tundra) router-perimeter compromise will be found to have affected at least one UK or EU CNI, defence-adjacent or professional-services target by the end of Q3 2026, given the 13 Jul 2026 advisory and the historical scope of Berserk Bear targeting (HIGH confidence).
5. It is likely that the APT28 "FrostArmada" SOHO-router DNS-hijack campaign will surface additional Microsoft 365 credential-compromise cases across home-working populations in every monitored vertical during the next reporting cycle (MEDIUM-HIGH confidence).
6. It is a realistic possibility that the Entra ID password-spray campaign will be publicly attributed to a named initial-access broker within the next two reporting cycles, given the strength of the AS200373 DREI-K-TECH-GMBH single-AS pivot (MEDIUM confidence).

2. Sector threat landscape

The cross-vertical threat picture for this reporting period is shaped by four cross-cutting developments, each of which affects multiple monitored verticals simultaneously.

(1) SonicWall SMA1000 zero-day exploitation. CVE-2026-15409 (CVSS 10.0 SSRF) and CVE-2026-15410 (post-auth code injection) were added to CISA KEV on 14 Jul 2026. Rapid7 MDR has attributed the observed goal to ransomware. Exploitation began before public disclosure.

(2) Microsoft AD FS CVE-2026-56155. Elevation-of-privilege on federation servers via a DKM container ACL weakness. Same-day CISA KEV listing on 14 Jul 2026, active exploitation confirmed. Federal remediation deadline 28 Jul 2026.

(3) FSB Centre 16 and APT28 "FrostArmada" advisory. 19-agency joint advisory of 13 Jul 2026. Systematic router-perimeter compromise attributed to FSB Centre 16 (Static Tundra); paired APT28 campaign hijacking DNS on approximately 18,000 SOHO routers to steal Microsoft 365 credentials and OAuth tokens.

(4) The Gentlemen ransomware brand dominance**.** First place among ransomware brands in June 2026 (121 leak-site postings; Qilin 78) at a 90 per cent affiliate profit share. Qilin, DragonForce, Anubis, Interlock and Play continued their leak-site cadence into this reporting period.

(5) Cross-client deprecated-Azure-legacy-auth spray campaign. Attribution is via shared attacker infrastructure across /16 blocks between tenants and rotation across all ROPC-capable first-party Azure AD applications. Smart lockout is holding on every attempt observed to date. The durable fix is a Conditional Access policy that blocks the ROPC / legacy-auth flow, not one that names any specific application id. This campaign is treated as a cross-vertical concern rather than a single-client incident because every client running Microsoft 365 with Entra ID sign-in is directly exposed to the same attack surface.

Per-vertical summary:

Financial Services / Banking / Fintech / Insurance. Dominated by AD FS CVE-2026-56155, SonicWall SMA1000 zero-days, the FSB Centre 16 / APT28 router advisory and continued Gentlemen / Qilin / DragonForce ransomware cadence. FS-ISAC AI Cybersecurity Hardening advisory rolled forward for deepfake KYC bypass. Maritime & Logistics. Anubis affiliate tradecraft continues to be the sector reference case (Adriatic Port Authority precedent). SonicWall SMA1000 exposure especially relevant for port and terminal remote-access estates. MTS-ISAC exchange prioritises OT-adjacent probing. Legal / Solicitors / Barristers / Legal Services. Play, INC Ransom, The Gentlemen and Qilin continue to treat mid-market and boutique firms as "low-hanging fruit". Pure data-extortion (Luna Moth-model) growing 11x year-on-year per Arctic Wolf. ICO enforcement risk elevated. Retail. DragonForce / Scattered Spider service-desk social-engineering methodology remains active despite the 10 Jul NCA arrests; The Gentlemen and Qilin producing UK / EU retail victims at cadence. M&S / Co-op / Harrods retrospective classed as Category 2 cyber hurricane (£270m–£440m combined). Healthcare. Synnovis retrospective continues to shape sector reference. SonicWall SMA1000 heavily represented in NHS remote-access estate. Qilin, The Gentlemen and Interlock cadence against pathology, radiology and pharmacy-management systems. Research & Development / Military / Government Contractors. China-nexus (UNC3886, UNC5221) remains the highest-volume threat per Google Cloud DIB update. FSB Centre 16 router campaign and APT28 FrostArmada campaign have direct DIB relevance. DPRK Kimsuky and BlueNoroff social-engineering against technical staff continues. Trade Bodies & Membership Organisations. Under-resourced membership organisations are opportunistic targets for The Gentlemen, Qilin, DragonForce and Interlock. Politically-salient membership registers attract state-nexus interest. Pure data-extortion pattern from the legal sector transfers directly.

the Entra ID password-spray campaign – seen across all verticals

The attacker rotated IPs on every attempt across nine documented families and diversified to five Microsoft app vectors (Azure CLI, AAD PowerShell, One Outlook Web, Microsoft Teams, OfficeHome). Smart lockout held on every burst; zero successes attributed.

IP Insights enrichment established a single-AS pivot on the campaign: every documented IPv4 family (45.3.x, 209.50.x, 65.111.x, 104.207.x, 216.26.x, 151.123.x, 104.167.x) resolves to AS200373 DREI-K-TECH-GMBH (3xK Tech GmbH), a German ASN operating IPs geolocated across Brazil, Great Britain, the United States and Spain. The ASN is the pivot, not the per-IP geolocation.

3. Key threat actors

The following actors are assessed to pose the most significant threat to organisations within the named vertical during the reporting period. The profile block below should be repeated, in full, for each actor profiled. Prioritise actors for whom new or sector-relevant activity has been observed within the reporting period; established actors with no recent activity may be referenced briefly without a full profile.

The Gentlemen

• Aliases: The Gentlemen (single-name RaaS brand); Qilin-affiliate lineage per Halcyon
• Suspected Origin: Unattributed (Russian-speaking assessed)
• Suspected Sponsor: Organised criminal RaaS
• Primary Motivation: Financial (double extortion)
• Sector Targeting: Broad mid-market; disproportionately professional services, legal, healthcare, manufacturing, retail, trade bodies
• Geographic Focus: Global; western Europe and North America dominant in June-July 2026 tally; Germany over-represented
• Signature TTPs: Initial access via brokered credentials and public-facing exploitation (SharePoint CVE-2026-45659 chains this period), LOTL tooling, aggressive leak-site publication cadence, PowerShell + custom Rust payload
• Tooling / Malware Families: The Gentlemen ransomware (Rust), Rclone, PsExec, Cobalt Strike
• Recent Activity: 121 leak-site postings in Jun 2026 (revised up from initial 115) - first month above Qilin in over a year; 300 postings across Q2 2026 (Qilin 289); 90% affiliate profit share; sustained cadence into 11-17 Jul 2026
• Assessed Threat to Vertical: HIGH - fastest-growing RaaS brand
• Analytic Confidence: HIGH

Qilin (a.k.a. Agenda)

• Aliases: Agenda, Qilin.B, Water Galura
• Suspected Origin: Russian-speaking (unattributed)
• Suspected Sponsor: Organised criminal RaaS
• Primary Motivation: Financial (double extortion)
• Sector Targeting: Financial services, healthcare, manufacturing, retail, professional services, legal, logistics
• Geographic Focus: Global; UK and EU disproportionately represented in H1 2026 leak-site postings; Germany over-represented
• Signature TTPs: Initial access via brokered credentials, Check Point VPN CVE-2026-50751 exploitation, RMM abuse (AnyDesk, SplashTop), PowerShell + Rust ransomware payload; ESXi Linux variant
• Tooling / Malware Families: Qilin.B ransomware (Rust), Cobalt Strike, Rclone-to-Mega, Mimikatz, SharpHound
• Recent Activity: 1,496 leak-site victims across trailing 12 months (dominant RaaS by lifetime volume); 78 postings in June 2026 (overtaken by The Gentlemen); 289 postings across Q2 2026; Max Fordham (UK, 06 Jul 2026) leak-site claim
• Assessed Threat to Vertical: HIGH - dominant RaaS operator across UK/EU by lifetime volume
• Analytic Confidence: HIGH

DragonForce / Scattered Spider cluster

• Aliases: Scattered Spider, UNC3944, Octo Tempest, Muddled Libra, 0ktapus, DragonForce affiliate
• Suspected Origin: Anglophone (UK/US); further four arrests 10 Jul 2026 per NCA
• Suspected Sponsor: Organised criminal alliance / RaaS
• Primary Motivation: Financial (ransomware + data extortion)
• Sector Targeting: Retail, hospitality, telecoms, technology, real estate, manufacturing, construction, financial services (payments)
• Geographic Focus: Anglophone western targets
• Signature TTPs: Voice-phishing IT service desk to reset MFA, help-desk social engineering, EDR bypass via legitimate RMM tooling, DragonForce Linux/ESXi ransomware, aggressive cloud-tenant pivot
• Tooling / Malware Families: DragonForce ransomware, Ngrok, AnyDesk, SplashTop, Impacket, Chisel
• Recent Activity: Continued leak-site postings (Real Estate, Manufacturing, Construction focus); further NCA arrests 10 Jul 2026 connected to M&S/Co-op/Harrods case; alliance-affiliate operations continue
• Assessed Threat to Vertical: HIGH - social-engineering methodology transfers directly across verticals
• Analytic Confidence: HIGH

FSB Centre 16 (Static Tundra / Berserk Bear)

• Aliases: Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly, Ghost Blizzard, Static Tundra
• Suspected Origin: Russian Federation (FSB Centre 16)
• Suspected Sponsor: Nation state (Russian FSB)
• Primary Motivation: Espionage; strategic access; disruption-adjacent given target choice
• Sector Targeting: Energy, communications, defence industrial base, healthcare, financial services, government, critical national infrastructure globally
• Geographic Focus: Global; UK, US, EU and allied CNI
• Signature TTPs: Systematic router-perimeter compromise (Cisco IOS legacy CSRF resurfaced 13 Jul 2026), SNMP abuse, credential harvesting via man-in-the-middle, edge-appliance persistence
• Tooling / Malware Families: Custom implants on Cisco IOS, MikroTik, TP-Link; SNMP misuse; DNS hijacking
• Recent Activity: 19-agency joint advisory of 13 Jul 2026 attributing systematic router-perimeter compromise across CNI and defence-sector networks; paired APT28 "FrostArmada" DNS-hijack campaign against ~18,000 SOHO routers stealing M365 credentials and OAuth tokens
• Assessed Threat to Vertical: HIGH for CNI, defence, government; MEDIUM-HIGH elsewhere
• Analytic Confidence: HIGH

Anubis

• Aliases: Anubis ransomware / affiliate programme
• Suspected Origin: Unattributed
• Suspected Sponsor: Organised criminal RaaS
• Primary Motivation: Financial (double extortion; disruption-adjacent given target choice)
• Sector Targeting: Maritime, ports, logistics, 3PL, transportation, healthcare
• Geographic Focus: Global
• Signature TTPs: Spear-phishing initial access; lateral movement via unpatched systems (particularly OT-adjacent); privilege escalation; encryption of cargo-tracking / customs-processing / clinical-support systems; VPN credential abuse; RMM tooling for persistence
• Tooling / Malware Families: Anubis ransomware toolkit (RaaS), stolen VPN credentials, exploitation of CitrixBleed 2 (CVE-2025-5777) and adjacent VPN CVEs
• Recent Activity: Adriatic Port Authority (Port of Ancona, Italy) intrusion (Dec 2025, attributed Jan 2026, $10m demand, $380m supply-chain delay). Continued tradecraft into 2026 flagged in MTS-ISAC exchange; NCSC continues to investigate UK-terminated intrusions
• Assessed Threat to Vertical: HIGH - specific maritime and healthcare sector fit
• Analytic Confidence: HIGH

UNC3886 (China-nexus)

• Aliases: UNC3886 (Mandiant/Google Cloud)
• Suspected Origin: People's Republic of China
• Suspected Sponsor: Nation state (China-nexus)
• Primary Motivation: Espionage; strategic access to defence and technology sectors
• Sector Targeting: Defence industrial base, technology, telecommunications, virtualisation platforms, government
• Geographic Focus: Global; US, UK, EU and allied defence sectors
• Signature TTPs: Zero-day exploitation of virtualisation platforms (VMware ESXi / vCenter), Fortinet FortiOS and adjacent edge devices; persistence via appliance-native mechanisms; discreet lateral movement
• Tooling / Malware Families: Custom implants targeting VMware and network appliance firmware; LOTL tooling
• Recent Activity: Continued edge-device-focused activity per Google Cloud 2026 Defense Industrial Base update; representative of the dominant China-nexus tradecraft against the DIB
• Assessed Threat to Vertical: HIGH for defence industrial base, technology and telecoms
• Analytic Confidence: HIGH

4. Tactics, techniques and procedures

The TTPs listed below are aligned to the MITRE ATT&CK Enterprise framework and represent techniques observed in incidents affecting the vertical during the reporting period. The corresponding behaviours should be cross-referenced to the incidents listed in Section 5 and to detection logic deployed within client environments.

5. Notable incidents and campaigns

Where peer organisations are named, the source of attribution is recorded. Where peer organisations are anonymised, the description is sufficient to convey the operational lessons without identifying the affected party.

6. Vulnerabilities of concern

The vulnerabilities below are those assessed to carry the greatest material risk to the vertical at the time of issue, taking into account exploit availability, observed exploitation, the prevalence of affected products in the sector, and listing on the CISA Known Exploited Vulnerabilities catalogue. The remediation guidance should be read alongside the recommended actions in Section 9.

7. Indicators of compromise

The following indicators are provided to support detection engineering and threat hunting within client environments. Indicators are defanged in line with industry convention, and confidence ratings reflect the analyst’s assessment of the strength of the association between the indicator and the named actor or campaign. Indicators should be ingested with appropriate decay periods; high-confidence atomic indicators (hashes) generally warrant longer retention than network indicators (IPs, domains).

A machine-readable companion file in STIX 2.1 format is available on request from the lead analyst.

8. Sector risk assessment

The risk assessment below combines the threat picture established in earlier sections with an estimate of the impact each scenario would carry for a representative organisation operating in the vertical. The composite rating is intended to inform prioritisation of defensive investment and is not a substitute for an organisation-specific risk assessment.

9. Forward Outlook

Looking forward to the next reporting period (18 Jul - 24 Jul 2026), it is highly likely that at least one UK or EU public disclosure will attribute a breach to SonicWall SMA1000 CVE-2026-15409/-15410. It is likely that AD FS CVE-2026-56155 exploitation will feature in at least one public attribution to a nation-state or ransomware actor before the 28 Jul federal remediation deadline. It is likely that The Gentlemen, Qilin, DragonForce and Interlock will maintain their leak-site cadence with mid-market UK and EU victims across financial services, legal, healthcare, retail and professional services. It is a realistic possibility that a UK CNI or defence-adjacent target will be publicly linked to FSB Centre 16 activity or the FrostArmada campaign within the next two reporting cycles. It is a realistic possibility that public attribution will emerge linking the Entra ID password-spray campaign to a named initial-access broker given the strength of the AS200373 pivot.

Trigger conditions that would prompt revision of this outlook include:

1. a UK or EU organisation across any monitored vertical publicly attributing a breach to CVE-2026-15409/-15410, CVE-2026-56155, CVE-2026-45659 or CVE-2026-50751, which would warrant immediate out-of-cycle reporting;
2. emergence of an unauthenticated variant of the AD FS chain;
3. further CISA KEV additions materially affecting core infrastructure (particularly SonicWall, Check Point, Ivanti, Fortinet, Citrix or Microsoft);
4. a successful smart-lockout defeat on the campaign — the campaign's zero-success record to date is a load-bearing analytic assumption;
5. any public sector victim named in an FSB Centre 16 / APT28 attribution;
6. service-desk social-engineering methodology change post-arrest in the M&S / Co-op / Harrods case;
7. ICO announcement of a materially-sized monetary penalty in any monitored vertical.
8. observation of an eighth ROPC-capable first-party application in the attacker's rotation, particularly if it is one not previously identified as ROPC-capable in Microsoft documentation;

11. Analytic confidence and source reliability

Analytic confidence ratings used throughout this report express the analyst’s assessment of the strength of the evidence and reasoning underlying each judgement. HIGH indicates well-corroborated evidence drawn from multiple credible sources and a strong analytic line of reasoning; MEDIUM indicates plausibility supported by partial corroboration or sound analytic inference; LOW indicates limited evidence, single-sourcing, or significant uncertainty in the underlying data. Where confidence is LOW, the rationale is recorded in the body of the report rather than allowed to stand unexamined.

Sources cited in Section 12 are graded against the Admiralty System, which assesses source reliability on a scale of A to F and information credibility on a scale of 1 to 6. The full key is reproduced below for reference.

12. References

The numbered references below correspond to citations within the body of the report. Each entry is graded against the Admiralty System.

---

About this report

UK Cyber Defence's SOC publishes sector threat intelligence for the organisations it defends, graded against the Admiralty system and mapped to MITRE ATT&CK. This public edition is provided in good faith on the basis of sources held to be reliable at the time of issue; recipients remain responsible for how they apply it. If you would like sector briefings, indicators and detection content for your own organisation, talk to an analyst or read about SOC365, our managed SOC.