2026 | PacketWatch

Written by PacketWatch Team Sixty43 | August 11, 2026

This week, we briefed our clients on recent data extortion campaigns targeting numerous industry verticals with fake technical support vishing calls.

KEY TAKEAWAYS

Multiple vishing campaigns from different threat actors targeting a variety of industry verticals. Learn how the attacks work plus mitigation and hardening strategies.
Critical and high severity vulnerabilities in Cisco, Veeam, VMware, Metabase, WordPress, Linux, Chrome, and JetBrains, plus updates to CISA KEV, patch now!

Vishing Attacks on the Rise with Extortion Groups

Vishing (voice phishing) attacks are nothing new. Scattered Spider famously used vishing to hack MGM back in September 2023. This method of social engineering attacks is extremely effective at compromising the end user and is only further empowered with the rise of AI tools and other frameworks. In recent months, numerous data extortion campaigns have been targeting a variety of industry verticals, where threat actors use vishing to trick victims into giving administrative access, usually to SSO or SaaS portals. With this access, threat actors are then quickly able to download large volumes of sensitive data, which they then threaten to release publicly on their data leak sites unless a ransom is paid by the victim.

UNC6671

Previously known as BlackFile extortion group, this threat cluster has recently rebranded as Redact, Pink, Helix, and Falcon. While the naming schemes have rapidly evolved, their attack playbook is consistent. The group uses vishing to target employees, posing as IT helpdesk staff, pushing what they claim are urgent and mandatory security migrations. This contact is often made directly to the employee's personal cellular device. During the call, the threat actor lures the victim to a spoofed login portal, where the threat actor uses Adversary-in-the-Middle (AiTM) infrastructure to capture credentials and multi-factor authentication (MFA) tokens. The threat actor then uses these captured credentials to facilitate automated scripts which harvest data from cloud environments, including Microsoft 365 and Okta.

Starting in the Spring of 2026, UNC6671 targeted manufacturing, real estate, healthcare, and insurance verticals. In June the group pivoted to technology, transportation, and hospitality verticals. In July, they pivoted to private equity firms, law firms, and financial rating agencies. According to reporting from Mandiant, this current targeting is focused on organizations involved in "mergers, acquisitions, capital deployment, and litigation." This "reflect(s) a strategy to target high-value corporate and confidential data to maximize leverage extortion demands."

Microsoft Teams Chaos

Sophos recently reported on a Microsoft Teams vishing campaign they track as STAC4749. The threat actor used external Microsoft Teams accounts which impersonated IT helpdesk or support personnel in Teams chats and voice calls. During the call, the threat actor will convince the user to visit a fake support website, where they then trick the user into downloading the Quick Assist remote management tool (or RemSupp RMM tool when Quick Assist is blocked). Using this remote access, the threat actor uses PowerShell to download a backdoor, followed by additional persistence mechanisms, ultimately leading to Chaos ransomware deployment.

ShinyHunters Targeting Healthcare

On July 24, the Health-ISAC published an advisory detailing a recent campaign from ShinyHunters where they have been heavily targeting the healthcare sector. Per the advisory, the attack pattern in reported incidents is as follows: vishing -> helpdesk/MFA reset or device re-enrollment -> Microsoft Entra (or Okta/Google) SSO account takeover -> pivot into connected SaaS platforms -> rapid data exfiltration for extortion leverage.

How to Protect Your Organization

There are a variety of controls that organizations can implement to mitigate these identity attacks:

User awareness training – All employees, especially IT and helpdesk, should be made aware of these campaigns. Social engineering attacks target the human, so the human is the first line of defense.
Enforce phishing-resistant MFA across all SSO environments and enterprise identity providers. Examples are FIDO2-compliant roaming security keys, passkeys, and platform authenticators such as Microsoft Hello for Business and Okta Fastpass.
Enforce session controls - Reduce session lengths to enforce re-authentication at least once per workday. Enforce idle session timeouts, especially for privileged access. Enforce "step-up" authentication when accessing critical or sensitive resources.
Restrict Authentication to Trusted Network Sources - Define and enforce these ranges within SaaS and cloud platforms as well with authentication policies in Entra ID or Okta.
Require Corporate-Managed Devices for Access - You can require that access can only be achieved if it comes from a corporate-managed device with MDM and EDR.
Harden helpdesk / IAM workflows

Require out-of-band identity proofing for any password reset, MFA reset, or device re-enrollment. Additional manager approval should be required for privileged users.
Implement a "no same-call" rule where the agent cannot complete a reset within the same inbound call. Require a ticket plus a verified callback.
Enforce step-up verification for anyone requesting changes to auth factors, especially executives, IT admins, finance, and security.

Disable or tightly restrict SMS and voice MFA.
Block legacy authentication protocols.

This list is not exhaustive. For a more comprehensive list of mitigations and recommendations, it is recommended to review the Health-ISAC advisory here. See Appendix A for PacketWatch queries to hunt for known IOCs from these campaigns.

Resources

Vulnerability Roundup

Cisco Fixes Multiple Critical Vulnerabilities in SD-WAN & IOS XE

Cisco recently disclosed a set of vulnerabilities for their SD-WAN and IOS XE products. These vulnerabilities were discovered through internal testing, and range from improper input validation, improper access control, and command/OS/argument injection. A full list of the CVEs and their corresponding fixed versions can be found below. Administrators are urged to patch as soon as possible. Please review further details from Cisco here and here.

Fig. 1: Cisco SD-WAN Vulnerabilities, Aug. 2026 Source: Cisco

Fig. 2: Cisco SD-WAN Fixed Releases Source: Cisco

Fig. 3: Cisco IOS XE Vulnerabilities, Aug. 2026 Source: Cisco

Fig. 4: Cisco IOS XE Fixed Releases Source: Cisco

Critical Flaws Fixed in Veeam Service Provider Console

Veeam recently disclosed multiple vulnerabilities in their Veeam Service Provider Console, including two rated as critical. CVE-2026-58073 allows an unauthenticated attacker to impersonate a managed agent and obtain that agent's credentials. CVE-2026-58072 allows arbitrary file write on the management server, which can lead to remote code execution. Administrators are urged to patch as soon as possible.

VMWare Fixes Multiple Flaws Including VM Escapes

Broadcom recently addressed five vulnerabilities affecting a variety of VMware products:

CVE-2026-59309 - An unauthenticated attacker with network access to vCenter can bypass authentication and gain unauthorized access to the system.
CVE-2026-59310 - Directory traversal vulnerability in vCenter Syslog that allows an unauthenticated attacker with network access to execute arbitrary code.
CVE-2026-47876 - An attacker with local administrative privileges inside a virtual machine using a VMXNET3 network adapter can exploit an out-of-bounds write vulnerability to execute code on the ESX host, achieving a VM escape.
CVE-2026-41703 - An out-of-bounds read vulnerability in ESX, Workstation, and Fusion, where an attacker with virtual machine deployment privileges can exploit the vulnerability to disclose information or cause a denial-of-service condition in the host process.
CVE-2026-41709 - An insufficient logging vulnerability that allows an ESX administrator to perform certain operations without them being logged.

A detailed FAQ was provided by the vendor to address impact and update questions for administrators. Administrators are urged to upgrade as soon as possible.

Maximum-severity SQLi Vulnerability in Metabase

Metabase, the open-source AI analytics software for business intelligence, recently disclosed a maximum-severity vulnerability that was exploited as a 0-day. The vulnerability has yet to be assigned a CVE. Per the vendor disclosure, "after gaining access to your instance, the attacker could inject arbitrary SQL against the Metabase application database, which can give them administrator access to the instance...the attacker could change your application configuration, steal stored credentials for your connected databases, read any data accessible through those connections, and export data." The table below shows affected versions and their corresponding patched version:

Fig. 5: Affected and fixed versions of Metabase Source: Metabase Github Advisory

The security advisory shows the flaw impacts the "api/session/reset_password" endpoint. If you are unable to upgrade to a fixed version, the vendor states that blocking this endpoint is a mitigation. After applying the patch, if this endpoint is publicly accessible, the vendor recommends taking the following actions:

Revoke all active user sessions by accessing the Metabase application database and deleting all rows in core_session table
Review your API keys and delete any unrecognized keys.
Review administrator accounts for any unexpected changes.
Rotate credentials for any of the connected databases.
Review data warehouse logs for any sign of unauthorized access.
Review Metabase activity and query history for unexpected or unauthorized activity.

New XSS Flaw in WordPress

A pre-authentication reflected cross-site scripting (XSS) flaw in the login screen of WordPress was recently disclosed. Tracked as CVE-2026-64638 and dubbed "XSS2Shell", the vulnerability affects every version of WordPress. Successful exploitation is possible if a user is already logged in as an administrator and then has "explicit interaction" with an attacker-controlled page (typically just a single click). Researchers showed this flaw can be chained with other vulnerabilities to achieve PHP code execution on the server. The issue has been fixed in WordPress 7.0.3. Administrators are urged to patch as soon as possible.

Linux Privilege Escalation Flaw Existed Since 2008

A privilege escalation flaw that has been present in the Linux kernel since 2008 was recently disclosed. Dubbed "SCTPhantom" and tracked as CVE-2026-64564, the bug is a result of a flaw in Linux's SCTP networking code. Any Linux host running previous kernel versions along with having SCTP reachable on the target are vulnerable. Stable versions 7.1.6, 6.18.42, 6.12.101, and 6.6.148 of the Linux kernel have fixed the issue. Administrators are urged to patch as soon as possible.

Don't Forget To Patch Your Browser

Last month we saw a record amount of vulnerabilities addressed in Microsoft's Patch Tuesday, nearly tripling the previous month (which was also a record). this is due to the use of modern LLMs to hunt for vulnerabilities. Web browsers are seeing similar impacts. In the last three Chrome releases, Google has addressed a total of 1,442 flaws. Versions 149 and 150 had a combined total of 1,072 bugs, more than the previous 23 versions combined. Patching has always been important, but moving forward it is even more critical due to the sheer volume of bugs being discovered with the use of AI tools. The graph below shows the sharp increase in bug discovery over the last several months. Administrators need to ensure browser updates occur regularly on endpoints via GPO.

Fig. 6: Number of security bugs fixed in recent Chrome Stable release milestones. Source: Google

JetBrains TeamCity Critical RCE

JetBrains published an advisory detailing CVE-2026-63077, a critical vulnerability that allows an unauthenticated attacker with HTTP/S access to a TeamCity server to bypass authentication checks and execute arbitrary OS commands on the server. Per the advisory, this vulnerability affects all TeamCity on-premises versions. Administrators are strongly encouraged to patch to versions 2025.11.7 or 2026.1.3 as soon as possible.

CISA KEV Additions

The following vulnerabilities were added to CISA's Known Exploited Vulnerabilities Catalog in the last 2 weeks:

CVE-2026-8037 - Progress LoadMaster Command Injection Vulnerability
CVE-2026-63077 - JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
CVE-2026-9198 - IBM Langflow Code Injection Vulnerability
CVE-2026-34486 - Apache Tomcat Missing encryption of Sensitive Data Vulnerability
CVE-2026-18556 - N-able N-central Authentication Bypass Using an Alternate Path of Channel Vulnerability
CVE-2026-18577 - N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability
CVE-2026-20316 - Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability
CVE-2026-16812 - Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability
CVE-2025-68686 - Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability

Appendix A

UNC6671 IOC PacketWatch Queries:

\*.host:(myoktasso.com OR mypasskeysso.com OR setupssopasskey.com OR mspasskey.com OR activatepasskey.com OR enrollpasskey.com OR keyokta.com OR oktaenroll.com OR oktaportalsso.com OR passkeyportal.com OR portalpasskey.com OR passkeyportalsetup.com OR addoktapasskey.com OR deploypasskey.com OR passkeydeploy.com OR activatemypasskey.com OR registerpasskey.com OR createpasskey.com OR passkeyadd.com OR passkeyregister.com OR passkeycenter.com OR secureauthpasskey.com OR passkeyrollout.com OR setpasskey.com OR passkeyokta.com OR passkeyset.com OR createmypasskey.com OR newpasskey.com OR passkeysupport.com OR sqfepjvmrd.xyz OR passkeyregistration.com OR addmypasskey.com OR passkey-setup.com OR passkey-portal.com OR startpasskeysetup.com OR passkey-connect.com OR portalsetuphub.com OR activatepasskeyportal.com OR assignpasskey.com OR myconnectkey.com OR mynewpasskey.com OR passkeycreate.com OR oskeyconnect.com OR passkeycreator.com OR oskeysync.com OR enablepasskey.com OR enablepasskey2fa.com OR checkpasskey.com OR passkeyuser.com OR keysyncos.com OR myaccountsecurity.com OR addpasskey2fa.com OR passkeyenroll.com OR startpasskey.com OR passkeyenable.com OR passkeyactivation.com OR createmfa.com OR passkeyhelpdesk.com OR makepasskey.com OR add-passkey.com OR passkey-check.com OR addyourpasskey.com OR passkey-enable.com OR mypasskeyid.com OR passkeystatus.com OR passkeystatus.com OR addssopasskey.com OR ssopasskey.com OR createssopasskey.com OR myssopasskey.com OR hubpasskey.com OR passkeymfa.com)

\*.ip:(31.7.56.61 OR 31.7.56.52 OR 193.34.212.132 OR 185.178.208.153 OR 23.234.75.84 OR 195.140.213.114 OR 195.140.213.115 OR 107.128.45.122 OR 76.103.148.180 OR 38.42.59.171 OR 47.218.103.146)

CSTAC4749 IOC PacketWatch QueryA

\*.host:(sequrityupdate.top OR scan-security.top OR system-online.top OR system-connect.top OR corp-connect.top OR info-secure.top OR supportsoft.top OR update-syscontrol.top OR sequpdate.top OR service-clien.top OR system-connect.top OR service-corporation.top OR scansequrity.top OR system-connect.top OR info-secure.top OR supportsoft.top OR service-help.top OR corp-connect.top OR info-secure.top OR corp-connect.top OR sequritycheck.top OR scansequrity.top OR service-help.top OR it-service.top OR sequpdate.top OR scansequrity.top OR sequrityupdate.top OR upsecscan.top OR upsecscan.top)

This report is provided FREE to the cybersecurity community.

Visit our Cyber Threat Intelligence Blog for additional reports.

Visit our Cyber Threat Profile Blog for detailed intelligence profiles.

Visit our Beyond the Threat Feed Blog for more articles.

Subscribe to be notified of future Reports:

NOTE
We have enhanced our report with data from SOCRadar. You may need to register to view their threat intelligence content.

View full post