Cybersecurity Update July 2, 2026: FortiBleed Ransomware Campaign and Critical SharePoint Vulnerability

Ransomware groups are increasingly using advanced techniques such as Citrix Bleed 2, BYOVD, and supply chain credential theft to compromise targets, posing heightened challenges to global cybersecurity defenses as of July 2, 2026.

Cybersecurity researchers have traced the FortiBleed campaign to the INC and Lynx ransomware groups, revealing coordinated ransomware operations with credential theft tactics that are actively threatening organizations worldwide.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the SharePoint Remote Code Execution vulnerability CVE-2026-45659, with a critical CVSS score of 8.8, to its Known Exploited Vulnerabilities list after observing active exploitation in the wild as of July 2, 2026.

Navient reported a cybersecurity incident impacting borrower data that potentially exposed sensitive personal information of thousands of loan borrowers, highlighting the ongoing risks to financial data security.

The FBI seized hundreds of domains associated with NetNut, a residential proxy service operated by Israeli company Alarum Technologies, as part of a major operation targeting cybercrime infrastructure on July 2, 2026.

The ToddyCat threat group developed Umbrij malware abusing OAuth authentication to stealthily access Gmail accounts through the Google API, targeting corporate email systems with advanced malicious techniques.

Cybersecurity analysts linked the FortiBleed credential theft campaign to the INC and Lynx ransomware groups, underscoring the ongoing espionage and extortion threat posed by these coordinated ransomware operations.

Following evidence of active exploitation, CISA officially added SharePoint RCE vulnerability CVE-2026-45659 to its Known Exploited Vulnerabilities catalog on July 2, 2026, emphasizing the urgent need for mitigation in affected systems globally.

The Gentleman Ransomware targeted a prominent European NATO contractor, demonstrating the continued risk ransomware attacks pose to critical defense and security sectors as of early July 2026.

Cybercriminals have been distributing ransomware via fake Interpol emails, spotlighting the persistent and sophisticated phishing threats used to deploy ransomware attacks.