Executive summary
June's reporting connected software publication, network administration and data extortion: Wiz disclosed compromised Red Hat npm packages, while Mandiant described PeopleSoft exploitation and a Cisco network-management intrusion. The US Cybersecurity and Infrastructure Security Agency (CISA) added 23 entries to its Known Exploited Vulnerabilities (KEV) catalogue, and the National Vulnerability Database (NVD) records 8,001 vulnerability publications during the month. The UK's National Cyber Security Centre (NCSC) separately warned that Fortinet firewalls and virtual private network (VPN) gateways were being targeted through credential attacks, while Eurojust announced an Operation Endgame disruption affecting three malware services. We assess it is likely (B2) that organisations responding only with software updates will leave material exposure unresolved where an attacker has already obtained administrative access or developer credentials; the June guidance explicitly couples remediation with investigation and, in the Fortinet case, restoration of compromised devices.
The month in numbers
The CISA catalogue snapshot released on 29 June 2026, the final snapshot before this review, contains 23 additions dated in June. Two entries had their ransomware-use field marked Known: the Check Point Security Gateway vulnerability and the Oracle PeopleSoft vulnerability. The remaining 21 were marked Unknown. Unknown is not a finding that ransomware use did not occur, and the catalogue's addition date should not be treated as the date exploitation began.
The NVD publication-date query returns 8,001 Common Vulnerabilities and Exposures (CVE) records. This is the API's totalResults for the inclusive June publication window. It measures records published, rather than attacks, affected organisations or vulnerabilities first discovered during June. It should therefore sit beside the KEV count, rather than be added to it or used to estimate exploitation prevalence.
For ransomware, this review uses a deliberately bounded panel of four ransomware.live group pages. Counting entries whose Discovered date falls in June gives the following results:
| Group page | June postings | Public source |
|---|---|---|
| Qilin | 78 | ransomware.live |
| The Gentlemen | 76 | ransomware.live |
| LockBit 5.0, listed as lockbit5 | 59 | ransomware.live |
| Akira | 32 | ransomware.live |
| Four-page subtotal | 245 | Sum of the rows above |
These are criminal claims, not verified victim counts. The subtotal is a floor for the wider landscape and is not a complete monthly total or a ranking of all groups. A discovery date records when the tracker observed a posting; it does not establish when the underlying intrusion happened. No organisation is identified from these claims. This limited panel supports a repeatable observation about publication activity without presenting the unseen portion of the market as measured.
Four themes from June reporting
1. Developer identity became a supply-chain control point
Wiz's 1 June 2026 Miasma report identified at least 32 modified releases in the @redhat-cloud-services npm namespace. Its analysis describes malicious installation-time execution and collectors aimed at cloud identities. Wiz says evidence points to a compromised employee GitHub account and publishing workflows that produced valid provenance attestations. It also explicitly declines definitive attribution to TeamPCP: similarities to publicly released Mini Shai-Hulud code could reflect another actor using that material.
The distinction matters for defenders. A valid publishing attestation and a malicious package can coexist in the incident Wiz describes. Our recommendation is to review the identity and workflow authorised to publish, the specific package versions installed, and the secrets reachable from the installation environment. Treat those as separate checks. A repository appearing unchanged is insufficient evidence that an installed release is safe when the investigation concerns differences between the distributed package and its source repository.
Wiz recommends examining developer workstations, build environments and repositories, reviewing unexpected tokens and workflow activity, and rotating potentially exposed secrets. That sequence should be adapted to the organisation's evidence: first identify where a suspect version executed, then determine which credentials that process could access. Replacing the dependency should not automatically close the credential investigation. Attribution to a particular criminal brand is unnecessary for taking those containment steps.
2. PeopleSoft administrative exposure supported extortion
In its 11 June 2026 report, Mandiant and Google Threat Intelligence Group (GTIG) attributed an active PeopleSoft compromise and extortion campaign to the cluster they identify as UNC6240, or ShinyHunters. They report activity between 27 May 2026 and 9 June 2026 consistent with exploitation of CVE-2026-35273 before Oracle's 10 June 2026 advisory. Their notification effort covered more than 100 organisations with potentially vulnerable endpoints; 68 per cent were in higher education. Those are notification and exposure figures, not a count of confirmed compromises.
The report describes customised MeshCentral remote-management agents, internal reconnaissance and a script intended to propagate an extortion marker. It recommends disabling the Environment Management Hub service in multi-server deployments or removing the PSEMHUB application in single-server deployments, following Oracle's guidance. Where the service cannot be disabled, it calls for external access restrictions at the network perimeter and warns against relying solely on web application firewall body inspection.
For education-sector response teams, the practical priority is to separate the public application from its administrative and integration paths. The cited report's hunting guidance includes unexpected web-tier files, suspicious requests to management endpoints and outbound traffic from PeopleSoft hosts. Our recommendation is to attach an investigation result to each exposed instance: evidence collected, period searched, suspicious activity found and disposition. An exposure notification should trigger triage, but it should not be rewritten as a confirmed breach in internal or public reporting.
3. Patching an appliance did not resolve its trust history
Mandiant's 24 June 2026 Cisco report disclosed an intrusion at a service provider involving software-defined wide area network (SD-WAN) infrastructure. The reported activity predated June: the investigators observed rogue peering connections and account manipulation, followed by exploitation of CVE-2026-20245 to elevate an administrative account to root. The report also describes deletion of malicious files and restoration of altered configuration. It is a June disclosure of earlier activity, not evidence that this intrusion started in June.
The initial-access qualification is essential. Mandiant says later rogue peering occurred on a version unaffected by one previously disclosed flaw, while Cisco ruled out another as the cause of those connections. Previously stolen certificate material was a possible explanation. Mandiant also says it is unclear whether the earlier and later rogue connections involved the same actor. That prevents a confident claim that every observed connection represents exploitation of the same vulnerability or belongs to one continuous campaign.
The response implication is to investigate the trust relationship as well as the software version. Our recommended review includes approved peers, certificate handling, unexpected privileged logins, password-change history and retained configuration changes. The vendor investigation should guide remediation when suspicious activity is found. A clean check of the current filesystem cannot, by itself, settle an incident whose reported behaviour includes cleanup and restoration of files.
4. Credential attacks required their own incident response
The NCSC's 18 June 2026 Fortinet alert describes a global campaign involving brute-force, dictionary and credential-stuffing attempts against internet-facing FortiGate and VPN portals, with indications of potential UK impact. It reports that a threat actor leaked a credential database. The alert does not justify treating every listed device or account as a confirmed compromise, and this review does not characterise the campaign as a newly disclosed software vulnerability.
For devices where compromise is evidenced, NCSC advises isolation and a factory reset, explaining that changing credentials alone may not remove persistence. It specifically tells organisations to obtain logs, configurations and other investigative material before a reset destroys them. Its recovery advice includes examining other devices that share credentials and systems reachable from the affected device, removing internet exposure from management interfaces, updating supported systems and enforcing multi-factor authentication on VPN and management access.
Our operational recommendation is to assign one owner to the evidence-preservation decision and another to restoration, with a shared incident record. This avoids an unexamined reset on one side and an indefinitely exposed appliance on the other. Recovery should document which accounts, trust relationships and reachable systems were checked. The existence of a patching ticket is not a substitute for that record when the entry route under investigation is a credential.
Actors and the vulnerability landscape
This month's actor picture is bounded by the reporting reviewed here. GTIG names UNC6240 in the PeopleSoft campaign. Wiz leaves the Miasma operator unresolved beyond similarities in tooling. Mandiant's Cisco investigation describes an actor without establishing a named group in the report. These distinctions should survive into an organisation's intelligence notes; merging the cases under a familiar name would create confidence the sources do not supply.
Selected June KEV additions illustrate the range of exposed administrative services. Every row below comes from the historical CISA snapshot; this is a prioritisation sample, not the complete set of 23.
| CVE | Product in CISA's record | Added | Ransomware use in this snapshot |
|---|---|---|---|
| CVE-2026-50751 | Check Point Security Gateway | 8 June 2026 | Known |
| CVE-2026-20245 | Cisco Catalyst SD-WAN Manager | 9 June 2026 | Unknown |
| CVE-2026-10520 | Ivanti Sentry | 11 June 2026 | Unknown |
| CVE-2026-35273 | Oracle PeopleSoft Enterprise PeopleTools | 12 June 2026 | Known |
| CVE-2026-20253 | Splunk Enterprise | 18 June 2026 | Unknown |
| CVE-2026-12569 | PTC Windchill and FlexPLM | 25 June 2026 | Unknown |
| CVE-2026-48558 | SimpleHelp | 29 June 2026 | Unknown |
For a practical queue, we recommend matching these records to specific deployed products and reachable services, then recording whether vendor mitigation is applied and whether the system was exposed before it. Avoid assigning the same investigation to every asset merely because the CVE appears in an inventory. Conversely, do not downgrade an internet-reachable administration service solely because the catalogue does not identify ransomware use. Exploitation status and ransomware association answer different questions.
Ransomware and extortion beyond the leak-site panel
Mandiant's 5 June 2026 law-firm report describes a data-theft extortion campaign observed from January through May against US professional, legal and financial services organisations. It attributes the activity to UNC3753. The reported approach uses telephone impersonation of support staff, screen sharing and legitimate remote-management tools; some investigated intrusions progressed from contact to theft and extortion within one business day. This is reporting published during June about earlier observations, rather than a June-only incident count.
Mandiant also discusses physical visits by supposed technicians, but says limited forensic evidence and the absence of subsequent extortion prevent formal attribution of those physical incidents. It assesses an association with UNC3753, rather than establishing it as a fact. That qualification belongs beside the warning. The defensive opportunity does not depend on settling the attribution: verify technicians and support calls through an independently obtained contact route, restrict unapproved remote-control tools, and review bulk access to sensitive document repositories.
Taken alongside the PeopleSoft report, the lesson for extortion readiness is to test two distinct paths: exploitation of exposed application infrastructure and a person granting access after a convincing support interaction. Our recommendation is to exercise both. Ask whether analysts can connect a new support session to subsequent document searches, downloads and unusual transfers, and whether incident leaders can make a containment decision before a full inventory of stolen data is available. These are preparedness checks, not claims that every suspicious session is hostile.
Law enforcement and disruption
Eurojust announced on 24 June 2026 that an international action week from 15 to 19 June 2026 neutralised 326 servers and 142 domains and recovered 27 million compromised data sets. It names SocGholish, StealC and Amadey as the targeted malware variants. Its release describes an operation against infrastructure that supports initial access, information theft and further criminal activity.
Those are operational results reported by Eurojust, not a measurement of how many future ransomware incidents were prevented. Our recommendation is to use a disruption as a reason to revisit detections, exposed credentials and affected hosts, while retaining ordinary containment and recovery requirements. Taking infrastructure offline does not establish that a previously infected endpoint is clean or that information already stolen has been recovered from every criminal recipient. The public announcement alone cannot provide either assurance.
What to watch
The headline assessment is likely (B2): residual access will remain a practical concern where remediation stops at changing software. The supporting evidence is specific rather than statistical—Mandiant's account of earlier trust material and cleanup, Wiz's warning about developer secrets, and NCSC's instruction to preserve evidence and restore compromised Fortinet devices. This does not estimate how many organisations retain such exposure.
For July, our suggested watch list is therefore operational: completion of PeopleSoft exposure reviews, verification of appliance trust and account state, follow-through on developer-secret rotation, and response exercises covering support impersonation. Track completion with evidence an analyst can inspect. Record unanswered questions explicitly, especially when a reset, short log retention or a cleaned-up intrusion limits the investigation. A transparent limitation is more useful than a confident statement of eradication unsupported by the available record.
June briefings
The completed weekly periods within June are listed below. Calendar-month figures above also include 29–30 June 2026; they should not be reconstructed by adding whole weeks that extend into another month.
- Weekly threat briefing: 1–7 June 2026.
- Weekly threat briefing: 8–14 June 2026.
- Weekly threat briefing: 15–21 June 2026.
- Weekly threat briefing: 22–28 June 2026.
