--- title: "Cyberthreat Intelligence Report: July 2026" description: Cynet's July 2026 CTI Report gives every stakeholder, from CISOs to SOC analysts, the intelligence they need to act on emerging threats. image: https://go.cynet.com/hubfs/og-image.jpg --- CTI Report # Cyberthreat Intelligence Report: July 2026 848 ransomware victims claimed. 10 critical and high-severity CVEs. Three new malware families. Cynet's July 2026 CTI Report gives every stakeholder, from CISOs to SOC analysts, the intelligence they need to act on emerging threats. ## Access the full report What's Inside Critical Cyber News - A roundup of the month's most consequential incidents, from Anubis's ransomware attack on Coca-Cola's Fairlife subsidiary and OpenAI's disclosure that its own AI models autonomously breached Hugging Face during a security evaluation, to Clop's new extortion campaign against PTC Windchill and FlexPLM users and law enforcement's takedown of the Kratos phishing-as-a-service platform. Vulnerability Spotlight - A technical breakdown of wp2shell, a combination of two WordPress core vulnerabilities (CVE-2026-63030 and CVE-2026-60137) that can be chained into remote code execution. CISA added the flaw to its Known Exploited Vulnerabilities catalog after confirming active exploitation. Includes the full exploitation chain and mitigation guidance. Featured Malware Analysis - Deep technical dives into three threats CyOps investigated this month: DeadLock, a closed-group ransomware operation that took nearly a year to launch a leak site and climbed to the third most active group in July; Unix Stealer, a feature-rich infostealer that abuses the Telegram Bot API for data exfiltration; and Booba, an emerging double-extortion ransomware group that has already claimed nine victims across the EU and US. Powered by Powered by Cynet CyOps Threat Intelligence. This report is produced by Cynet's CyOps Threat Intelligence Team, combining decades of combined expertise and continuous threat research, real-world telemetry, and hands-on incident response experience to deliver intelligence that is timely, relevant, and designed for action. Looking for More In-Depth Threat Intel? Cynet partners and customers receive exclusive access to CTI Reports before they are made available for public download. Learn more about [CyOps MDR](https://www.cynet.com/platform/cyops/) to unlock the advantage of ongoing threat intel and real-time response. 848 Ransomware victims claimed in July 10 Critical & high-severity CVEs reviewed 3 New malware families analyzed in depth ## Backed by the industry, loved by customers. ![MITRE\_ATTACK-Evals\_new\_logo](https://go.cynet.com/hs-fs/hubfs/Imported%20images/MITRE_ATTACK-Evals_new_logo.png?width=250&height=34&name=MITRE_ATTACK-Evals_new_logo.png) ### Outstanding results in 2025 MITRE - 100% Detection Visibility - 100% Technique-Level Coverage - 100% Protection [Learn more](https://www.cynet.com/mitre-attck-results/) ![G2-tags-spring2026](https://go.cynet.com/hubfs/G2-tags-spring2026.svg) ### Top-tier performance according to our users - 98% score for Real-Time Detection - 97% score for 24x7 support​ - 97% score for Automated Remediation [Learn more](https://www.g2.com/products/cynet/reviews) ![gartner-peer](https://go.cynet.com/hs-fs/hubfs/gartner-peer-insights-logo-white.png?width=180&height=63&name=gartner-peer-insights-logo-white.png) ### Recommended by 95% - Overall 4.8/5 Rating​ - Product capabilities 4.8/5 Rating​ - Ease of deployment 4.8/5 Rating​ [Learn more](https://www.gartner.com/reviews/market/extended-detection-and-response/vendor/cynet) ![cynet-logo-white](https://www.cynet.com/wp-content/themes/cynet/assets/images/homepage-lp/Cynet_logo%20.svg) Copyright © 2026 Cynet [Terms](https://www.cynet.com/eula/) [Privacy](https://www.cynet.com/privacy-policy/) [Website Terms of Use](https://www.cynet.com/terms-of-use/) [Data Processing Agreement](https://go.cynet.com/hubfs/Cynet%20-%20Data%20Processing%20Agreement.pdf?hsLang=en) - [![facebook social media account](https://www.cynet.com/wp-content/themes/cynet/assets/images/homepage-lp/facebook-logo.png)](https://www.facebook.com/CynetSecurity/) - [![in social media account](https://www.cynet.com/wp-content/themes/cynet/assets/images/homepage-lp/in-logo.png)](https://www.linkedin.com/company/cynet-security) - [![twitter social media account](https://www.cynet.com/wp-content/themes/cynet/assets/images/homepage-lp/twitter-logo.png)](https://x.com/cynet_security) [![Cynet\_Logo\_Dark](https://www.cynet.com/wp-content/uploads/elementor/thumbs/Cynet_Logo_Dark-ran98v077f10fndpxr0xlwpxpz8adxxhbu64jr17mg.png "Cynet_Logo_Dark")](https://go.cynet.com/?hsLang=en) - [Why Cynet](https://www.cynet.com/why-cynet/) - [Platform](https://www.cynet.com/platform/) - [Partners](https://www.cynet.com/partners/) - [Resources](https://www.cynet.com/resources/) - [Company](https://www.cynet.com/about-us/) - [Blog](https://www.cynet.com/blog/) - [Pricing](https://www.cynet.com/packages/) [Request a Demo](https://www.cynet.com/request-a-demo/) - [Why Cynet](https://www.cynet.com/why-cynet/) - [Platform](https://www.cynet.com/platform/) - [Partners](https://www.cynet.com/partners/) - [Resources](https://www.cynet.com/resources/) - [Company](https://www.cynet.com/about-us/)