Today’s digest is about how fast a single intrusion turns into a supply-chain event: a beverage giant’s dairy subsidiary halting US production, a Japanese logistics breach rippling into fried-chicken menus nationwide, and a forum platform’s pre-auth RCE sitting one public PoC away from mass exploitation. Here’s what changed since yesterday’s digest.
Breach watch: Coca-Cola confirms Anubis ransomware gang stole data from its Fairlife dairy unit
Coca-Cola confirmed that the Anubis ransomware gang stole data during a mid-July attack on Fairlife, its ultra-filtered milk and protein-shake subsidiary, which does more than $1 billion in annual retail sales. The attack forced Coca-Cola to suspend production at Fairlife’s four US facilities on July 16; most production has since resumed, and retail availability has stayed largely unaffected thanks to existing inventory. Anubis claims to have stolen roughly 1TB of confidential data and listed Fairlife on its leak site on July 20; the group’s countdown timer for publishing the data has since expired. BleepingComputer · SecurityWeek · Cybernews
A ransomware crew halting a $1B-revenue production line for the better part of two weeks is a reminder that OT and manufacturing-adjacent IT deserve the same log coverage as your core business systems — production outages are often the visible symptom of a breach whose actual entry point was a far less monitored corner of the network.
Ransomware watch: RansomHouse’s extortion of Japan’s largest cold-chain logistics operator disrupts KFC Japan’s menu
RansomHouse claimed responsibility for the cyberattack that took down Nichirei, Japan’s largest frozen-food and cold-chain logistics operator, after outages beginning July 13 disrupted shipping to roughly 5,000 corporate customers — including KFC Japan, Aeon, Kura Sushi, Hotto Motto, Yayoi Ken, and TableMark. KFC Japan had to shorten menus and operating hours across its 1,300+ restaurants as its Original Recipe chicken supply ran short; Nichirei says operations have since returned to normal. RansomHouse, active since 2022, doesn’t encrypt victim systems — it steals data and threatens publication, which is exactly the extortion path it’s now running against Nichirei. Japan Times · The Record · Dark Reading
Extortion-only groups like RansomHouse leave no encryption event to trip an EDR alert — the only signal is the data leaving the network. If your detection stack leans on ransomware-note or mass-encryption indicators, make sure large or unusual outbound transfers from file servers and logistics systems get equal attention.
Threat intel watch: A Telegram-based backdoor surfaces in a new campaign against Middle East government entities
Zscaler ThreatLabz disclosed a campaign by a threat actor with ties to East Asia targeting government entities across the Middle East, using three previously undocumented malware families: TELESHIM, a backdoor that abuses the Telegram Bot API for command-and-control so its traffic blends in with legitimate internet activity; MIXEDKEY; and BINDCLOAK, which encrypts its payload with a key derived from the infected machine’s volume serial number to resist analysis outside the original target. The infection chain starts with a weaponized ISO containing a legitimate ASUS executable that sideloads a malicious DLL, launching TELESHIM inside a trusted process. Both TELESHIM and MIXEDKEY use heavy obfuscation — control-flow flattening, mixed boolean arithmetic, opaque predicates — along with virtualization-detection checks meant to frustrate sandbox analysis. The Hacker News · Zscaler ThreatLabz · Security Boulevard
C2-over-Telegram is built to slip past domain- and IP-reputation detection, since the traffic terminates at a legitimate, widely-allow-listed API endpoint. For government and regional targets watching this threat actor class, that argues for behavioral detections — unexpected processes making outbound HTTPS calls to Telegram infrastructure — rather than relying on threat-intel feeds of known-bad C2 domains, which this technique is specifically designed to evade.
Vulnerability watch: Public exploit lands for a pre-auth remote code execution flaw in vBulletin
Researchers published exploit details for CVE-2026-61511, a critical unauthenticated remote code execution vulnerability in vBulletin forum software, affecting versions 6.2.1 and earlier and 6.1.6 and earlier. The bug lives in vB5_Template_Runtime::runMaths(), which processes vBulletin’s {vb:math} template tag: the code applies a regular expression meant to restrict input before passing it to PHP’s eval(), but the filter still permits digits, parentheses, arithmetic and binary operators, and XOR — enough to construct working PHP payloads with no account and no user interaction required. vBulletin shipped patches for 6.2.1, 6.2.0, and 6.1.6 in late June and released fixed version 6.2.2 on July 1. As of the July 27 public disclosure, the flaw was not listed in CISA’s Known Exploited Vulnerabilities catalog and no in-the-wild exploitation had been confirmed. The Hacker News · Cyber Security News · GBHackers
A three-week gap between patch and public PoC is closing fast — treat any internet-facing vBulletin forum still on 6.2.1/6.1.6 or earlier as urgent, and if you can’t patch immediately, watch for {vb:math}-style payloads and anomalous eval()-adjacent request patterns hitting /includes/vb5/template/runtime.php in your web access logs.
Also noted: ShinyHunters sets a July 31 deadline in its Ernst & Young extortion claim
ShinyHunters added Ernst & Young to its leak site, claiming it used credentials obtained through a supply-chain attack to access EY’s Jira, GitHub, and Azure environments, and is threatening to publish stolen data if the firm doesn’t respond by July 31. EY had already disclosed that a third-party support ticket platform used by its IT staff was compromised, with unauthorized access between March 28 and April 12 exposing support tickets that may contain client tax information. EY has not publicly confirmed ShinyHunters’ broader claims, and they remain independently unverified. BleepingComputer · Cyberpress
Final thought
Three of today’s five stories trace back to the same root cause: a compromise in one place — a support vendor, a logistics provider, a subsidiary’s network — becoming an operational or reputational crisis somewhere else entirely. If a vendor or subsidiary breach could disrupt your own operations or leak your data through their systems, that risk needs the same monitoring priority as your primary environment. For more on building visibility across the systems that actually matter to your business, see our how-to guides or book a discovery call.