Threat intelligence briefing — second half of June 2026

• Reference: TI-2026-06H2 (public edition)
• Coverage: all monitored sectors
• Reporting period: 16–30 June 2026
• Issued: 6 July 2026 · Lead analyst: Peter Bassill

This is the public (TLP:CLEAR) edition of an intelligence product written by the UK Cyber Defence Security Operations Centre for its clients. Observations specific to individual client environments have been removed. Clients receive the full edition, including estate-specific indicators and detection content.

1. Executive summary

This report provides an assessment of the threat landscape affecting clients during the second half of June of 2026. Coverage this period is dominated by the CISA KEV addition of the SharePoint deserialisation defect (CVE-2026-45659) on 01 Jul with a three-day federal remediation deadline; the continued tail of CitrixBleed 3 session-token abuse against NetScaler estates; and sustained double-extortion activity by Qilin, Akira and the DragonForce cluster observed via FS-ISAC daily indicator exchange and ransomware.live leak-site scraping.

Key Judgements

The following key judgements represent the lead analyst’s assessed view at the time of issue. Each is qualified by an analytic confidence rating in line with the conventions described in Section 11.

1. It is highly likely that CVE-2026-45659 (SharePoint deserialisation RCE) will be exploited at scale against unpatched SharePoint estates within the next 14 days, given the CISA KEV three-day BOD 26-04 timeline, the low authenticated privilege bar (Site Member) and the prevalence of internally-facing SharePoint in FS document-management architectures (HIGH confidence).
2. It is highly likely that ransomware and pure data-extortion crews - Qilin, Akira, DragonForce and the LockBit 5.0 cluster - will continue to drive the majority of materially-disruptive incidents against UK and EU firms during the next two reporting cycles, consistent with ransomware.live activity showing fresh Qilin and Akira postings on 01 Jul (HIGH confidence).
3. It is likely that CitrixBleed 3 session-token abuse will continue against NetScaler-fronted remote-working and contractor access estates for a further two to four reporting cycles, given the known population of patched-but-not-session-invalidated deployments (MEDIUM-HIGH confidence).
4. It is likely that AI-driven KYC bypass - deepfake voice and video authorisation of payments and synthetic-identity onboarding - will continue to expand as a fraud-adjacent threat vector through Q3 2026, consistent with ISAC's April 2026 AI Cybersecurity Hardening Advisory (MEDIUM-HIGH confidence).
5. It is a realistic possibility that one of the BlueNoroff / Sapphire Sleet sub-clusters will conduct a credentialed intrusion against a UK or EU fintech or crypto-adjacent FS firm within the next two reporting cycles (MEDIUM confidence).

2. Threat Landscape

The largely financial services vertical continues to absorb a disproportionate share of organised criminal cyber activity directed at UK and European markets. The collection picture for this period is dominated by the emergence of CVE-2026-45659 as a mass-exploitation candidate, sustained ransomware leak-site activity. FS-ISAC daily indicator exchange during the period surfaces a consistent set of Tor and bulletproof-hosting source ranges probing OWA, NetScaler Gateway and Entra ID sign-in endpoints across peer FS estates.

The CVE-2026-45659 SharePoint chain is operationally significant. SharePoint is the dominant document-management platform in mid-market and insurance firms and is frequently the store of record for underwriting files, KYC / CDD packs, board packs, and third-party counterparty due diligence. The vulnerability is exploitable by any authenticated user with Site Member permissions or higher, which is a low bar in typical deployments where all employees carry at least Site Member on the corporate intranet. Combined with Microsoft's May 2026 patch release date, unpatched estates have effectively been exposed for eight weeks.

Ransomware leak-site activity over the period was led, in volume terms, by Qilin (multiple postings including a fresh 01 Jul entry noted by ransomware.live), Akira (including the Refinery Hotel NYC posting on 01 Jul), and DragonForce (continuing sustained mid-week activity following the M&S / Co-op / Harrods retail cluster fallout). NCA arrested four UK nationals during the period in connection with the M&S / Co-op / Harrods cluster; the arrests reduce, but do not eliminate, the operational threat from the DragonForce / Scattered Spider cluster given the alliance-affiliate model.

3. Key threat actors

The following actors are assessed to pose the most significant threat to organisations within the reporting period. The profile block below is repeated, in full, for each actor profiled.

4. Tactics, techniques and procedures

The TTPs listed below are aligned to the MITRE ATT&CK Enterprise framework and represent techniques observed in incidents affecting the vertical during the reporting period. The corresponding behaviours have been cross-referenced to the incidents listed in Section 5 and to detection logic deployed within client environments. These have driven a significant number of autonomous defence responses.

5. Notable incidents and campaigns

Where peer organisations are named, the source of attribution is recorded. Where peer organisations are anonymised, the description is sufficient to convey the operational lessons without identifying the affected party.

6. Vulnerabilities of concern

The vulnerabilities below are those assessed to carry the greatest material risk to the vertical at the time of issue, taking into account exploit availability, observed exploitation, the prevalence of affected products in the sector, and listing on the CISA Known Exploited Vulnerabilities catalogue. The remediation guidance should be read alongside the recommended actions in Section 9.

7. Indicators of compromise

The following indicators are provided to support detection engineering and threat hunting within non-client environments. Indicators are defanged in line with industry convention, and confidence ratings reflect the analyst’s assessment of the strength of the association between the indicator and the named actor or campaign. Indicators should be ingested with appropriate decay periods; high-confidence atomic indicators (hashes) generally warrant longer retention than network indicators (IPs, domains).

8. Sector risk assessment

The risk assessment below combines the threat picture established in earlier sections with an estimate of the impact each scenario would carry for a representative organisation operating in the vertical. The composite rating is intended to inform prioritisation of defensive investment and is not a substitute for an organisation-specific risk assessment.

9. Defensive Actions

The actions below are organised against the three operational pillars of Detect, Defend, and Disrupt.

Detect

Detection engineering should treat CVE-2026-45659 as the principal hunting hypothesis for the next reporting cycle. We built Pulse rules around w3wp.exe spawning cmd.exe, powershell.exe or rundll32.exe under the SharePoint app pool identity; anomalous deserialisation exception patterns in SharePoint ULS logs; and Site Member-permission accounts accessing /_vti_bin, /_layouts/15/upload.aspx or /_layouts/15/uploadex.aspx outside expected sessions. Continued hunts against CitrixBleed 3 residual token replay (multiple client sessions sharing a single ICA connection token, particularly from geographically distant addresses). We retained the standard Qilin / Akira / DragonForce initial-access playbook hunts (RMM install, PsExec / SMBExec, DCSync, Rclone-to-Mega) as the ransomware-tail baseline. We have deployed IP Insights critical-tail block / alert lists to WAF and Entra ID Conditional Access.

Defend

Preventive priorities follow Section 6 directly. Complete Citrix NetScaler patching where residual pre-3055 builds remain and run the session-invalidation commands ('kill icaconnection -all', 'kill pcoipConnection -all', 'kill aaa session -all') on every patched appliance. We are monitoring the patching updates for these. Complete Ubiquiti UniFi OS Server upgrade to 5.0.8 as a residual BOD 26-04 hangover. We recommend restricting SharePoint uploader and layouts endpoints to authenticated internal networks via WAF path filtering. We also recommend enforcing phishing-resistant MFA on all privileged accounts including finance-function payment approvers to raise the bar on help-desk social-engineering as demonstrated by the DragonForce cluster.

Disrupt

Disruption activity within the lawful authority has focused on:

1. sustained participation in the ISAC daily indicator exchange, with this period's IP Insights critical / block tail submitted as the highest-value contributable;
2. honeypot deployment fronting NetScaler Gateway and SharePoint uploader paths, with any capture routed to the disruption workflow and shared with ISAC and NCSC CiSP;
3. coordinated take-down requests to bulletproof-hosting providers (dmzhost, serverion, PPTECHNOLOGY) from the IP Insights critical tail this week, submitted via the NCSC Takedown Service where the tail intersects with UK-hosted infrastructure;
4. continued participation in the ISAC AI Cybersecurity Hardening working group covering deepfake payments-fraud detection.

10. Forward outlook

Looking forward to the next reporting period (July H1), it is likely that at least one UK FS firm will publicly disclose a SharePoint-borne incident traceable to CVE-2026-45659, given the volume of unpatched estate exposed to internal users with Site Member permissions and the short remediation deadline. It is likely that CitrixBleed 3 session-token replay against NetScaler estates will continue at low-to-moderate volume for at least two further cycles. Ransomware leak-site cadence from Qilin, Akira and the DragonForce cluster is expected to remain steady week-on-week; the NCA arrests are unlikely to materially reduce the operational threat to FS given the alliance-affiliate model.

Trigger conditions that would prompt revision of this outlook include:

1. a UK FS firm publicly attributing a breach to SharePoint CVE-2026-45659 exploitation, which would warrant immediate out-of-cycle reporting;
2. emergence of an unauthenticated variant of the SharePoint chain that removes the Site Member auth pre-requisite - this would elevate the risk to CRITICAL and warrant emergency advisory;
3. further CISA KEV additions materially affecting FS infrastructure (particularly Fortinet, Ivanti or SonicWall gateways);

11. Analytic confidence and source reliability

Analytic confidence ratings used throughout this report express the analyst’s assessment of the strength of the evidence and reasoning underlying each judgement. HIGH indicates well-corroborated evidence drawn from multiple credible sources and a strong analytic line of reasoning; MEDIUM indicates plausibility supported by partial corroboration or sound analytic inference; LOW indicates limited evidence, single-sourcing, or significant uncertainty in the underlying data. Where confidence is LOW, the rationale is recorded in the body of the report rather than allowed to stand unexamined.

Sources cited in Section 12 are graded against the Admiralty System, which assesses source reliability on a scale of A to F and information credibility on a scale of 1 to 6. The full key is reproduced below for reference.

12. References

The numbered references below correspond to citations within the body of the report. Each entry is graded against the Admiralty System.

---

About this report

UK Cyber Defence's SOC publishes sector threat intelligence for the organisations it defends, graded against the Admiralty system and mapped to MITRE ATT&CK. This public edition is provided in good faith on the basis of sources held to be reliable at the time of issue; recipients remain responsible for how they apply it. If you would like sector briefings, indicators and detection content for your own organisation, talk to an analyst or read about SOC365, our managed SOC.