Miasma Worm Cripples GitHub Repos; Cisco Zero-Day Under Active Attack; Snowflake Breach Exposes 165 Customers

A new Egress report indicates a 28% increase in phishing attacks and a 52% rise in malicious emails bypassing secure email gateways in Q2 2026. Attackers are leveraging AI for deepfakes, chatbots, and 'payloadless' social engineering, with Microsoft being the most impersonated brand. The threat has expanded significantly beyond email to include SMS (smishing), QR codes (quishing), and collaboration platforms like Microsoft Teams, demanding a more comprehensive, multi-layered defense strategy. New MITRE techniques like T1598.001 (vishing) and T1598.003 (service phishing) are now relevant.

Following the successful takedown of the LockBit ransomware operation, the market is experiencing significant turmoil and a 'whack-a-mole' effect. Law enforcement disruptions have created a power vacuum, leading to the rapid emergence of new groups such as RansomHub, 8Base, and Akira. These new players are actively recruiting experienced affiliates from defunct operations, ensuring the continued high threat level. Attackers are diversifying initial access methods beyond traditional phishing, and new hunting hints like 'vssadmin delete shadows' and 'AdFind.exe' are critical for early detection.

New reports from June 7, 2026, reinforce the critical nature of CVE-2026-20245, a high-severity zero-day in Cisco Catalyst SD-WAN Manager. The vulnerability continues to be actively exploited in the wild, allowing an authenticated local attacker to achieve root privileges. Critically, Cisco has not yet released any security patch or official workaround, leaving organizations exposed. The advisory reiterates the broad impact across all deployment models and highlights the ongoing threat posed by this seventh SD-WAN zero-day in 2026. Mitigation efforts remain focused on strictly limiting access and enhanced monitoring.

The China-aligned APT group Webworm, previously noted for using Discord and Microsoft Graph API for C2, has now been observed widely deploying the open-source SoftEther VPN client. This new tactic allows them to establish persistent, encrypted command-and-control channels from compromised networks, making their traffic even more difficult to distinguish from legitimate VPN usage and enhancing their evasion capabilities. This development was highlighted in a recent ESET APT Activity Report.