Monday Intel Drop: Russian Router Attacks, RoguePlanet Zero-Day, 5 Threats to Fix Today

Russian FSB Centre 16, tracked by Western intelligence as Ghost Blizzard, Energetic Bear, Crouching Yeti, and Dragonfly, is conducting opportunistic exploitation of internet-facing routers with default or weak Simple Network Management Protocol (SNMP) credentials. A joint advisory from the UK National Cyber Security Centre and 17 partner agencies across 11 additional countries, published July 13, 2026, confirms the group is scanning at scale for Cisco devices and exploiting three vulnerability categories: legacy SNMP configurations using default community strings, Cisco Smart Install (SMI) protocol misuse on internet-facing switches, and web-portal management interface flaws on Cisco IOS devices.

FSB Centre 16 struck the Polish energy grid in December 2025, disrupting heating systems for more than 500,000 civilians. The group attacked telecommunications infrastructure across EU member states throughout 2024 and 2025 under EU sanctions documentation. The July 13 advisory and simultaneous EU sanctions represent the most coordinated Western government response to Russian cyber activity since 2022. The timing signals that the campaign is active now, not historical.

Six sectors are confirmed as primary targets: communications, defense, energy, financial services, government, and healthcare. Any organization in these sectors running Cisco routers with default SNMP community strings, legacy SNMP versions, or Cisco SMI enabled should treat this advisory as an immediate response event. Ghost Blizzard's post-compromise objective is persistent access: mapping network topology, exfiltrating device configuration files, and pre-positioning capability for potential destructive attacks during geopolitical escalation.

Ghost Blizzard's exploitation chain targets the network management plane, not corporate endpoints. The attack begins with internet-wide scanning for Cisco devices responding on UDP port 161 (SNMP) with default community strings including public, private, and vendor-specific defaults. SNMPv1 and SNMPv2c are inherently unauthenticated protocols: any device responding with a known community string exposes full read access to device configuration data, routing tables, access control lists, and interface configurations without requiring any credentials beyond the community string.

After SNMP access is confirmed, Ghost Blizzard exploits Cisco Smart Install. Cisco SMI is a plug-and-play provisioning protocol for Cisco IOS switches designed for zero-touch deployment in branch environments. When SMI is enabled and internet-facing, an unauthenticated attacker can download device configurations, replace the operating system image, and execute arbitrary Tcl scripts directly on the device. Cisco documented SMI misuse in 2018 and issued advisories to disable SMI on all internet-facing devices, but adoption remains incomplete across organizations managing legacy network infrastructure at scale.

The third vector, Cisco web-portal flaws, targets devices with HTTP or HTTPS management interfaces exposed to the internet. Chaining SNMP credential access with web-portal authentication bypasses allows Ghost Blizzard to establish a full authenticated management session. After initial access, the group extracts configuration files, establishes persistent backdoor access, and uses the compromised router as an internal network reconnaissance platform. The December 2025 Poland energy attack demonstrates the endgame: not just intelligence collection but pre-positioned capability for physical-world disruption.

Microsoft patched 116 security vulnerabilities in the July 2026 Patch Tuesday release, including CVE-2026-50656, the RoguePlanet vulnerability in Microsoft Malware Protection Engine (mpengine.dll). RoguePlanet is a race condition flaw that allows any process running on a Windows device to spawn a command shell with SYSTEM-level privileges, bypassing all standard user access control mechanisms. Researcher Nightmare-Eclipse demonstrated the exploit works on fully patched Windows 10 and Windows 11 systems regardless of whether Microsoft Defender's real-time protection is active.

Microsoft released the fix in Malware Protection Engine version 1.1.26060.3008, distributed automatically via Windows Update. Organizations with blocked Windows Update policies, air-gapped environments, or manual Defender update configurations need to manually trigger the engine update. Without the patch, a local attacker can use the SYSTEM shell path for ransomware staging or lateral movement without triggering standard endpoint detection.

July 14, 2026 marks Phase 2 enforcement of Microsoft's Kerberos RC4 hardening initiative. RC4 encryption support in Kerberos is disabled by default starting Tuesday. Organizations running legacy Windows Server 2008 R2, applications authenticating via RC4-HMAC, or Kerberos configurations not migrated to AES encryption will see authentication failures begin at the next domain controller restart. Full patch details on SharePoint RCE CVE-2026-45659, also addressed in this Patch Tuesday cycle, are covered in our dedicated advisory. If your AES migration is incomplete, use the AllowRC4 registry key to buy time and escalate the migration today.

Adobe ColdFusion CVE-2026-48282 is a path traversal vulnerability that allows remote attackers to execute arbitrary code on vulnerable ColdFusion servers without any authentication. The flaw received a maximum CVSS score of 10.0. Adobe released patches addressing ColdFusion 2025.9 and ColdFusion 2023.20 in a coordinated security bulletin ahead of the July 2026 disclosure window, but exploitation began within two hours of full technical details becoming public.

The first confirmed exploitation attempt originated from IP address 103.207.14.220, geolocated to India. Security researchers tracking the exploit wave noted rapid weaponization consistent with organized criminal groups that prepare automated exploit code during the responsible disclosure window and deploy immediately at publication. Adobe had previously warned that the vulnerability was easy to exploit and likely to be targeted in attacks. CISA added CVE-2026-48282 to the Known Exploited Vulnerabilities catalog immediately following confirmed wild exploitation, establishing a compliance deadline for federal agencies.

Adobe ColdFusion is used extensively in U.S. federal government environments, healthcare records systems, and financial services applications, sectors where legacy ColdFusion deployments frequently run unsupported versions. Organizations that have not already patched based on our earlier dedicated Adobe ColdFusion CVE-2026-48282 advisory should treat this as an emergency remediation today. Any internet-facing ColdFusion instance without the July patch applied is currently compromised or imminently at risk.

Three additional high-priority threats complete today's Monday Intel Drop, each targeting a distinct layer of enterprise attack surface.

The EtherRAT campaign targeting Microsoft Teams continues. Financially motivated threat actors impersonate corporate IT support staff over Teams voice calls, convince employees to install HopToDesk or AnyDesk, then deploy EtherRAT, a cross-platform remote access trojan written in Node.js. EtherRAT's defining characteristic is its command-and-control architecture: it retrieves its C2 server address from Ethereum smart contracts, making traditional domain takedowns ineffective. Financial and healthcare organizations are confirmed primary targets. Attacker infrastructure observed in July campaigns includes email helpdesk@Progressive936.onmicrosoft[.]com and malware distribution domain camorreado[.]click.

Accenture confirmed a breach resulting in 35GB of source code stolen from the firm. The exfiltrated material includes proprietary codebases and internal tooling. Organizations using Accenture as a managed security service provider should conduct an immediate access review to determine whether their proprietary data or authentication credentials were included in the stolen material. Accenture manages security operations for thousands of enterprise clients globally, amplifying the supply chain exposure risk beyond the firm itself.

Progress Software instructed all ShareFile Storage Zone Controller administrators to immediately shut down servers following what it described as a credible external security threat to the on-premises file-sharing product. Progress has not disclosed a CVE identifier, indicating either active zero-day exploitation or verified imminent threat intelligence. Any organization running ShareFile Storage Zone Controllers on Windows should comply with the shutdown advisory immediately and await formal patch guidance.

Five threats, five distinct vectors, all confirmed active within the same seven-day window. The pattern is not coincidental: nation-state actors, criminal groups, and opportunistic attackers are all operating at a tempo that outpaces quarterly patch cycles.

The Russian FSB router campaign is the most structurally dangerous item in this brief because it targets the network foundation every other security control depends on. A compromised border router does not trigger endpoint detection alerts, does not appear in user behavior analytics, and does not generate SIEM events when it silently maps your internal network topology and pre-positions for a future destructive attack. Organizations that focus patching energy exclusively on endpoint operating systems while leaving network device firmware at vendor-default configurations provide attackers with an unmonitored entry point that bypasses the entire defense stack.

The Kerberos RC4 enforcement deadline on July 14 means that any organization still using RC4-HMAC in Active Directory will discover failed logins and application outages tomorrow morning. This is a deterministic, predictable failure announced six months in advance. If your Kerberos migration is incomplete, the window to escalate is right now.