Today’s stories share a common thread: speed working against the defender. A federal patch deadline lands today, a supply chain attack hides its trigger until import time to dodge scanners, a new ransomware strain goes from web shell to full network encryption inside a day, and a diagnostics vendor is fighting two extortion claims at once. Here’s what changed since yesterday’s digest.
Patch priority: CISA’s deadline lands today for two actively exploited FortiSandbox flaws
CISA’s Binding Operational Directive 26-04 deadline for federal agencies to remediate CVE-2026-39808 and CVE-2026-25089 — both CVSS 9.1 OS command injection flaws in Fortinet FortiSandbox — falls today, July 19. CVE-2026-39808 lives in the FortiSandbox API’s /fortisandbox/job-detail/tracer-behavior endpoint, where the jid GET parameter reaches an OS process without stripping shell metacharacters, letting an attacker pipe in arbitrary commands that execute as root; a public exploit has circulated since Fortinet’s April disclosure. CVE-2026-25089 hits the FortiSandbox web UI (also affecting FortiSandbox Cloud and PaaS) via crafted HTTP requests and was disclosed June 9 by Fortinet’s own product security team. CISA confirmed active exploitation of both and added them to the KEV catalog alongside the SharePoint flaw we covered yesterday. BleepingComputer · CISA KEV Catalog
FortiSandbox doesn’t just sit at the network edge — it’s the appliance that hands down verdicts to your firewalls, email gateways, endpoint agents, and SIEM. If an attacker owns it, they can forge the “this file is clean” signal your other tools trust. If you can’t patch by today, CISA’s fallback guidance is to pull affected systems off the network rather than leave them reachable.
Supply chain watch: ViteVenom campaign hides a blockchain-controlled RAT inside npm packages impersonating Vite
Checkmarx disclosed ViteVenom, a cluster of seven malicious npm packages that impersonate the @vitejs/* scoped namespace to target developers building on the Vite frontend tooling ecosystem. The campaign is an evolution of the previously tracked ChainVeil operation and reuses its four-tier blockchain command-and-control design, spreading infrastructure across Tron, Aptos, and Binance Smart Chain — a setup Checkmarx researcher Pavan Gudimalla says makes the C2 “extremely difficult” to disable or take down, since no single chain or wallet takedown kills it. The delivered payload is a full-featured RAT capable of a reverse shell, credential harvesting, file exfiltration, and persistent backdoor injection. Attribution points to a threat actor Checkmarx calls SuccessKey, with wallet activity tied to the campaign dating back to February 27, 2026; the malicious packages themselves were published between June 29 and July 3. Critically, the malicious code doesn’t run at install time — it triggers on import — which sidesteps endpoint tooling that only inspects install-time postinstall scripts. The Hacker News
Scoped-name impersonation (@vitejs/* rather than an obvious typosquat) and import-time triggering are both specifically chosen to beat the checks most teams already have in place. If your build pipeline only scans package.json and install scripts, add a step that reviews actual imported code paths for new or updated frontend-tooling dependencies, and treat any outbound blockchain RPC traffic from a build or dev environment as worth investigating on its own.
Ransomware watch: new “Spirals” strain encrypts a South Asian IT company’s network within 24 hours of initial access
Researchers detailed Spirals, a previously undocumented Rust-based ransomware family deployed against an IT services organization in South Asia via a highly compressed intrusion chain observed in June. Attackers compromised an internet-facing IIS web server, uploaded an ASP.NET web shell, and within three hours were running commands through the IIS worker process to spawn cmd.exe and PowerShell for reconnaissance, a UAC bypass, RDP enablement, and creation of a local persistence account. By the following day, operators had switched to PsExec for mass deployment, pushing a base64-encoded PowerShell payload across dozens of machines per minute. Spirals itself disables Microsoft Defender and kills backup, virtualization, and database services (VMware, Veeam, SQL Server, Oracle, SAP) before encrypting files with per-file AES-128 keys secured under an ECDH P-256 public key, using chunk-based intermittent encryption for anything over 5MB to speed up the run. BleepingComputer · Help Net Security
The compressed timeline here — web shell to full encryption in about 24 hours — leaves almost no room for a manual detection-and-response cycle; if your internet-facing IIS servers don’t already alert on unexpected child processes from the worker process (w3wp.exe spawning cmd.exe or powershell.exe), that’s the single highest-value detection to add this week, since it’s the choke point earliest in this chain.
Breach watch: Abbott fights a two-front extortion claim after ShinyHunters and a second actor both claim data theft
Abbott Laboratories confirmed it’s investigating two unrelated cyber incidents. ShinyHunters added Abbott to its extortion data-leak site over unauthorized access to legacy Exact Sciences systems inside Abbott’s Cancer Diagnostics business (acquired March 2026), claiming initial access via a mid-June vishing attack that compromised a Microsoft Entra SSO account. ShinyHunters set a July 18 deadline to publish the stolen data, then extended it to July 21. Separately, an actor calling itself ShadowByt3$ claims to have breached Abbott’s LabCentral customer portal using compromised customer credentials, exploiting what it described as a “weak point” in the environment. Abbott maintains LabCentral is an externally hosted third-party portal containing only public technical reference documents — operating manuals, troubleshooting checklists, product specs — and no proprietary customer or business data. BleepingComputer · Cybernews
Two independent extortion claims landing on the same company in the same week is a pattern worth watching for, not a coincidence to dismiss — once one gang gets in via social engineering (vishing an SSO account), the resulting chatter or leaked access can draw a second opportunistic actor toward the same target. If your SSO tenant supports voice-based helpdesk resets, this is a good week to verify your verification-before-reset process actually resists a convincing phone call.
Final thought
Every story today comes down to how little time defenders get once something goes wrong — a federal patch clock that expires today, malicious code that waits for import to fire, a ransomware chain compressed into a single day, and an extortion deadline that’s already been moved once. Detection built to catch things “eventually” doesn’t help when the window is measured in hours. If you want a second opinion on whether your logging would catch a forged FortiSandbox verdict, an unexpected import-time payload in your build pipeline, or an IIS worker process spawning a shell, see our guide to supply chain attacks against software companies or book a discovery call.