Microsoft Patches Record 622 Flaws Including Active Zero-Days as US Warns of Russian Attacks on Critical Infrastructure Routers

Executive Summary

This week's intelligence cycle (July 8-15, 2026) is dominated by an unprecedented vulnerability disclosure from Microsoft, coordinated government warnings about Russian cyber operations targeting critical infrastructure, and significant regulatory shifts affecting defense contractors.

• Record-Breaking Patch Tuesday: Microsoft released fixes for 622 vulnerabilities—nearly triple the previous record—including two zero-days actively exploited in attacks targeting Active Directory and SharePoint Server. This exponential increase, attributed to AI-assisted vulnerability discovery, signals a fundamental shift in the threat landscape that will strain patch management resources across all sectors.
• Russian APT Campaign Against Infrastructure: The United States and allied nations issued a joint warning about Russian state-sponsored actors compromising poorly secured routers across critical infrastructure networks. Multiple APT groups are actively targeting network edge devices, emphasizing the need for immediate router security hygiene improvements.
• CMMC Phase II Suspension: The Department of Defense suspended Cybersecurity Maturity Model Certification (CMMC) Phase II requirements, launching a 60-day comprehensive review. Defense contractors should continue security improvements while monitoring for revised guidance.
• Critical ICS Vulnerabilities: CISA released four advisories for ABB and Rockwell Automation industrial control systems widely deployed in energy and manufacturing sectors, requiring immediate attention from asset owners.
• White House AI Security Initiative: The administration detailed "Gold Eagle," a new clearinghouse for AI-related cyber threats that has begun receiving vulnerability intelligence and prioritizing patches—a significant development for AI-dependent infrastructure.

Threat Landscape

Nation-State Threat Actor Activities

• Russian Critical Infrastructure Campaign: A joint advisory from US and allied governments warns that multiple Russian state-sponsored APT groups are actively compromising routers and network edge devices across critical infrastructure sectors. The campaign exploits poor security hygiene including default credentials, unpatched firmware, and inadequate network segmentation. Organizations should immediately audit router configurations and implement recommended hardening measures.
• ShinyHunters Salesforce Campaign: Microsoft has mapped three distinct attack paths used by threat actors aligned with the ShinyHunters data-extortion group. The year-long campaign has compromised corporate Salesforce environments without exploiting platform vulnerabilities, instead leveraging misconfigurations and credential theft. Organizations using Salesforce should review access controls and authentication mechanisms.

Ransomware and Cybercriminal Developments

• Treasury Sanctions Ransomware Enablers: The U.S. Treasury Department's OFAC designated 1VPNS, a VPN service, along with its alleged Ukrainian administrator and a Belarusian individual who sold "cryptors" to disguise ransomware. This marks the first sanctions against a VPN provider for enabling ransomware operations, signaling increased focus on infrastructure supporting cybercriminal activities.
• D1R Extortion Claims: The D1R cybercrime group claimed to have stolen data from Synopsys and Bosch, threatening to leak unless ransoms are paid. Synopsys has found no evidence of a breach, highlighting the need to verify extortion claims before responding.
• Spanish Fraud Ring Dismantled: Spanish Police dismantled a cybercrime organization that generated €140 million ($160 million) through investment fraud and business email compromise attacks, arresting four individuals.

Emerging Attack Vectors

• Supply Chain Attacks: Multiple supply chain compromises were identified this week:
  • Jscrambler NPM packages were poisoned to deploy cross-platform credential stealers
  • 148 npm packages disguised as student web proxies converted browsers into DDoS botnets
  • Nearly 300 fake GitHub repositories impersonating legitimate security tools distributed infostealer malware
• LabubaRAT: A new Rust-based remote access trojan masquerades as NVIDIA software to evade detection on Windows systems. The malware's use of legitimate software branding complicates detection efforts.
• OAuth Credential Validation: Threat actors are using OAuth client ID spoofing to validate stolen Microsoft Entra credentials while evading security telemetry, enabling more targeted attacks against enterprise environments.
• UEFI Secure Boot Bypass: Researchers discovered 11 Microsoft-signed UEFI applications that could bypass Secure Boot protections on most modern systems, potentially enabling persistent firmware-level compromises.

Phishing and Social Engineering

• New M365 Phishing Kits: Two phishing kits, Jalisco and OmegaLord, are targeting Microsoft 365 accounts with techniques that defeat multi-factor authentication.
• Forg365 Phishing Platform: A new phishing-as-a-service platform is lowering the barrier for Microsoft 365 account takeovers, enabling less sophisticated threat actors to conduct effective campaigns.
• Password Manager Phishing: LastPass and Bitwarden users are being targeted with fake security alerts directing them to fraudulent websites designed to steal master passwords.

Sector-Specific Analysis

Energy Sector

Threat Level: ELEVATED

• ICS Vulnerabilities: CISA released four advisories affecting industrial control systems commonly deployed in energy sector environments:
  • ABB Advant Master Online Builder - vulnerabilities in engineering workstation software
  • ABB Ability Edgenius - edge computing platform vulnerabilities with public exploit code available
  • ABB T-MAC Plus - substation automation system vulnerabilities
  • Rockwell Automation 1715-AENTR - EtherNet/IP adapter vulnerabilities enabling potential remote exploitation
• Russian Targeting: The joint government advisory specifically identifies energy sector networks as targets for Russian APT router compromise campaigns. Energy sector organizations should prioritize network device audits.
• Sovereign Infrastructure Investment: UK-based Valarian raised $50 million for its ACRA sovereign infrastructure control technology, reflecting growing investment in protecting critical energy and utility systems from foreign interference.

Water & Wastewater Systems

Threat Level: ELEVATED

• SharePoint Exploitation Alert: WaterISAC issued a vulnerability notification regarding actively exploited Microsoft SharePoint Server vulnerabilities. Water utilities using SharePoint for document management or operational coordination should apply patches immediately.
• Router Security: The Russian APT campaign targeting critical infrastructure routers includes water sector networks. Many water utilities operate with limited IT resources and may have legacy network equipment requiring immediate attention.
• ICS Exposure: ABB and Rockwell Automation systems identified in this week's CISA advisories are deployed across water treatment and distribution facilities. Asset owners should inventory affected systems and coordinate patching with operations.

Communications & Information Technology

Threat Level: HIGH

• Microsoft Vulnerability Surge: The record 622 vulnerabilities patched by Microsoft represent a fundamental shift in vulnerability discovery rates. Key concerns include:
  • Two actively exploited zero-days in Active Directory and SharePoint Server
  • Publicly disclosed BitLocker vulnerability
  • AI-assisted vulnerability discovery driving exponential increases in disclosed flaws
• VMware Critical Flaws: Seven severe vulnerabilities in VMware Avi Load Balancer enable authentication bypass, remote code execution, and privilege escalation—critical concerns for virtualized infrastructure.
• SonicWall Zero-Day Attacks: SonicWall SMA1000 appliances are under active zero-day exploitation. Organizations using these secure access devices should patch immediately.
• Progress ShareFile Zero-Day: Progress Software confirmed a zero-day vulnerability forced emergency shutdown of ShareFile Storage Zone Controllers. Security updates are now available.
• Claude for Chrome Vulnerability: An unpatched vulnerability in Anthropic's Claude for Chrome extension allows other browser extensions to trigger unauthorized access to Gmail and Calendar data. The flaw reportedly persists across eight patch attempts.
• RabbitMQ Access Control Flaws: Two vulnerabilities in RabbitMQ message broker could leak OAuth client secrets and expose cross-tenant queue metadata, affecting organizations using the platform for application messaging.

Transportation Systems

Threat Level: MODERATE

• Network Infrastructure Risk: Transportation sector networks are included in the Russian APT router targeting campaign. Aviation, maritime, rail, and mass transit operators should audit network edge devices for compromise indicators.
• Enterprise Software Exposure: Transportation agencies using Microsoft Active Directory, SharePoint, or SAP NetWeaver should prioritize this week's critical patches given the sector's reliance on these platforms for operations and logistics.

Healthcare & Public Health

Threat Level: ELEVATED

• Microsoft Patching Priority: Healthcare organizations face significant exposure from the 622 Microsoft vulnerabilities, particularly the Active Directory and SharePoint zero-days. Electronic health record systems and clinical applications dependent on these platforms require immediate patching coordination.
• SAP Healthcare Systems: Healthcare organizations using SAP NetWeaver for enterprise resource planning should address the CVSS 9.9 vulnerability that could expose or modify sensitive data.
• HIPAA Security Guidance: NIST and HHS OCR will host a September event on building assurance through HIPAA Security requirements, providing updated guidance for healthcare security programs.
• macOS Malware Threat: CrashStealer malware targeting macOS systems poses risks to healthcare environments with Apple devices, stealing passwords and cryptocurrency wallets while posing as Apple Crash Reporter.

Financial Services

Threat Level: ELEVATED

• Crypto Wallet Privacy Risks: Research on 85 cryptocurrency wallet browser extensions found widespread address leaks and cross-site tracking vulnerabilities, enabling linking and tracking of users. Financial institutions offering crypto services should evaluate extension security.
• Microsoft 365 Account Targeting: The Jalisco and OmegaLord phishing kits specifically target Microsoft 365 accounts with MFA bypass capabilities, threatening financial services organizations relying on M365 for operations.
• BEC Fraud Operations: The €140 million Spanish fraud ring takedown demonstrates the continued scale of business email compromise threats to financial operations.
• Passkey Transition: Microsoft's announcement that passkeys will become default for Entra ID authentication starting September 2026 will require financial services organizations to plan authentication infrastructure updates.

Defense Industrial Base

Threat Level: MODERATE (Regulatory Uncertainty)

• CMMC Phase II Suspension: The Department of Defense suspended CMMC Phase II requirements and launched a 60-day comprehensive review through a new reform task force. Defense contractors should:
  • Continue implementing security controls aligned with NIST 800-171
  • Monitor for revised guidance and timelines
  • Maintain documentation of current security posture
  • Avoid pausing security investments pending review outcomes

Vulnerability & Mitigation Updates

Critical Vulnerabilities Requiring Immediate Attention

Vendor/Product	Severity	Status	Action Required
Microsoft Active Directory	Critical (Zero-Day)	Actively Exploited	Patch Immediately
Microsoft SharePoint Server	Critical (Zero-Day)	Actively Exploited	Patch Immediately
SonicWall SMA1000	Critical (Zero-Day)	Actively Exploited	Patch Immediately
Progress ShareFile	High (Zero-Day)	Patch Available	Patch Immediately
SAP NetWeaver ABAP	Critical (CVSS 9.9)	Patch Available	Patch Within 48 Hours
VMware Avi Load Balancer	Critical	Patch Available	Patch Within 48 Hours
Adobe ColdFusion	Critical	Patch Available	Patch Within 72 Hours
ABB ICS Products (4 advisories)	High	Mitigations Available	Review CISA Advisories
Rockwell 1715-AENTR	High	Mitigations Available	Review CISA Advisory

Microsoft July 2026 Patch Tuesday

Microsoft's record-breaking release requires strategic prioritization:

• Immediate Priority: Active Directory and SharePoint Server zero-days under active exploitation
• High Priority: BitLocker vulnerability (publicly disclosed)
• Extended Security Updates: Windows 10 KB5099539 available for organizations on extended support
• Windows 11: KB5101650 and KB5099414 cumulative updates released

Analysis: The tripling of vulnerability disclosures reflects AI-assisted code analysis capabilities. Organizations should anticipate sustained high-volume patch cycles and consider automation investments for patch management.

SAP Security Updates

SAP's July 2026 updates address 16 vulnerabilities including:

• CVSS 9.9 flaw in NetWeaver Application Server ABAP enabling data access and modification
• Critical vulnerabilities in Commerce Cloud and AppRouter
• System unavailability and request-response desynchronization risks

Recommended Defensive Measures

• Router Security Hardening: Per the joint government advisory:
  • Change default credentials on all network devices
  • Apply latest firmware updates
  • Disable unnecessary services and protocols
  • Implement network segmentation
  • Enable logging and monitor for anomalous activity
• Supply Chain Security:
  • Audit npm and GitHub dependencies for malicious packages
  • Implement software composition analysis tools
  • Verify package integrity before deployment
• Authentication Security:
  • Prepare for Microsoft Entra ID passkey default (September 2026)
  • Implement phishing-resistant MFA where possible
  • Monitor for OAuth client ID spoofing indicators

Resilience & Continuity Planning

Lessons Learned

• AI-Driven Vulnerability Discovery: Microsoft's acknowledgment that AI is driving exponential vulnerability discovery rates requires organizations to reassess patch management capacity. Consider:
  • Automated patch deployment for non-critical systems
  • Risk-based prioritization frameworks
  • Increased testing resources for critical system patches
  • Vendor diversification to distribute patch management burden
• Zero-Day Response: Multiple zero-day disclosures this week (Microsoft, SonicWall, Progress ShareFile) underscore the importance of:
  • Maintaining current asset inventories
  • Establishing rapid patch deployment capabilities
  • Implementing compensating controls when patches are unavailable

Supply Chain Security Developments

• NPM Ecosystem Risks: Two separate campaigns (Jscrambler poisoning and DDoS botnet packages) demonstrate persistent supply chain risks in JavaScript ecosystems. Organizations should:
  • Implement package lockfiles and integrity verification
  • Use private registries with security scanning
  • Monitor for unexpected package updates
• GitHub Repository Impersonation: Nearly 300 fake repositories impersonating security tools highlight risks of downloading software from unverified sources. Verify repository authenticity through official vendor channels.

Cross-Sector Dependencies

• Microsoft Ecosystem: The 622-vulnerability patch cycle affects virtually all critical infrastructure sectors dependent on Windows, Active Directory, and Microsoft 365. Coordinate patching across IT and OT environments.
• Network Infrastructure: Russian APT targeting of routers creates cross-sector risk as compromised network devices can enable lateral movement across interconnected systems.
• Cloud Service Dependencies: Salesforce compromise techniques identified by Microsoft affect organizations across sectors using the platform for customer relationship management and operational workflows.

AI Security Considerations

• Gold Eagle Clearinghouse: The White House AI threat clearinghouse represents a new public-private coordination mechanism for AI-related vulnerabilities. Organizations deploying AI systems should monitor for guidance from this initiative.
• AI Incident Response: New guidance on AI incident playbooks addresses the unique challenges of responding to AI-powered breaches, including model manipulation and training data poisoning.
• Grok Build Data Exposure: xAI's Grok Build CLI was found uploading entire Git repositories to cloud storage, highlighting data exposure risks from AI coding assistants. Review AI tool data handling practices.

Regulatory & Policy Developments

Federal Guidelines and Regulatory Changes

• CMMC Program Review: The 60-day CMMC Phase II suspension creates regulatory uncertainty for defense contractors. The reform task force will conduct a comprehensive review of the program. Organizations should:
  • Continue security control implementation
  • Document current compliance status
  • Engage with industry associations monitoring the review
  • Prepare for potential program modifications
• Critical Infrastructure Defense Testing: The House passed legislation to test critical infrastructure defenses against terrorism, potentially establishing new assessment requirements for infrastructure operators.

Authentication Standards

• Microsoft Passkey Default: Microsoft's enterprise passkey transition beginning September 2026 will require organizations to update authentication infrastructure and user training programs.

International Developments

• Allied Coordination on Russian Threats: The joint advisory on Russian APT router targeting demonstrates continued international coordination on critical infrastructure protection, with implications for information sharing and defensive collaboration.
• Sovereign Infrastructure Investment: Valarian's $50 million raise for sovereign infrastructure control technology reflects growing international focus on protecting critical systems from foreign interference.

Training & Resource Spotlight

Upcoming Training Opportunities

• NIST Time and Frequency Seminar (July 21, 2026): Annual seminar covering precision clocks, atomic frequency standards, and synchronization technologies relevant to critical infrastructure timing systems. Registration Information
• NCCoE Cybersecurity Connections: Mobile Driver's Licenses (July 21, 2026, 11:00 AM - 1:30 PM EDT): Virtual event on accelerating adoption of mobile driver's licenses with security implications for identity verification systems. Event Details
• NIST AI Data Center Security Workshop (July 22, 2026): Session on securing AI data center architecture, security posture, and emerging standards. Relevant for organizations deploying AI infrastructure. More Information
• HIPAA Security 2026: Safeguarding Health Information (September 2, 2026): Joint HHS OCR and NIST event on building assurance through HIPAA Security requirements. Essential for healthcare sector security professionals. Registration

New Resources and Frameworks

• AI Incident Response Playbooks: Guidance on building AI-specific incident response procedures addresses unique challenges including model integrity verification and training data analysis.
• Router Security Hygiene: Government guidance on router security provides actionable recommendations for hardening network edge devices against nation-state threats.
• Pentera AI Security Validation: New approach to AI security workflow validation using TTP chaining for organizations evaluating AI-assisted security tools.

World Cup Cybersecurity Lessons

Analysis of World Cup cybersecurity challenges provides lessons applicable to major event security planning, including digital risk management and threat anticipation for large-scale events.

Looking Ahead: Upcoming Events

Key Dates and Events

• July 21, 2026: NIST Time and Frequency Seminar - precision timing technologies for critical infrastructure
• July 21, 2026: NCCoE Cybersecurity Connections Event on Mobile Driver's Licenses (Virtual, 11:00 AM - 1:30 PM EDT)
• July 22, 2026: NIST Workshop on Securing AI Data Center Architecture and Emerging Standards
• September 2, 2026: HHS/NIST HIPAA Security 2026 Conference
• September 2026: Microsoft Entra ID passkey default authentication begins - organizations should prepare authentication infrastructure
• Mid-September 2026