Government & Defence Sector Edition — July 2026

1. Sector snapshot

India and Australia used a Melbourne summit to launch PACTS, a five-pillar Partnership on Cyber, Critical Technologies and Supply Chains covering cybersecurity, digital and supply-chain resilience and defence-research cooperation, replacing the 2020 bilateral cyber framework. The same month, CERT-In's AI-exploitation patch blueprint moved from guidance to a mandatory directive for government labs and institutes — the backdrop against which the sector absorbed one unconfirmed and one confirmed data-exposure story this cycle. Source (with date): PIB/PMO; ThePrint (09 Jul 2026).

2. Threats targeting government & defence

Alleged DRDO/military data listed on the dark web — DRDO calls the report unverified. Alibi Global Threat Intelligence Group, a Thiruvananthapuram-based outfit, reported that a threat actor was advertising roughly 31GB of purported DRDO and military-linked data for $8,000 on a dark-web forum, apparently listed for close to two weeks before the report surfaced. DRDO initially said it was verifying the claim; officials subsequently said media coverage of the incident was "incorrect and unverified," stated there was no evidence of an active intrusion or ongoing exfiltration, and said the unclassified sample data shown publicly could be traced to an earlier breach from around 2020-22. Treat this as a validation exercise, not a confirmed breach: do not reproduce or download the advertised samples, and use the episode to audit supplier and contractor document-sharing hygiene. Source (with date): The Week (27 Jul 2026); Deccan Herald, Siasat/PTI (28 Jul 2026).

Mustang Panda runs two live espionage campaigns against Indian government and hydropower targets via Zoho WorkDrive. Acronis Threat Research Unit found the China-aligned actor abusing Zoho WorkDrive — widely used across India's government sector — as a covert command channel that blends into ordinary cloud traffic. ZOHOMURK carries hardcoded Zoho OAuth credentials and turns an attacker-controlled WorkDrive account into an inbox/outbox dead drop for commands and stolen data; SHARDLOADER sideloads a malicious DLL through signed binaries (a Solid PDF Creator executable in one campaign, a Citrix Receiver binary in the other), with reconnaissance tool MINIRECON deployed alongside. Lures were themed around a hydropower cooperation proposal and an India-Taiwan memorandum of understanding. Acronis found live compromises, including machines used by senior administrative staff, and coordinated with CERT-In on notification. Source (with date): Acronis TRU (28 Jun 2026); The Hacker News (29 Jun 2026).

Kudankulam Nuclear Power Plant contractor breach exposes roughly 19,000 files. The extortion group World Leaks (formerly Hunters International) published engineering drawings, supplier records and inspection documents for KKNP Units 3 and 4 after a ransom demand went unpaid. The intrusion hit a server operated by data-centre firm Yotta, flagged after unusual activity was detected on a machine belonging to Reliance Infrastructure. NPCIL says the breach did not expose any nuclear safety or security systems; NPCIL and CERT-In are investigating. Source (with date): Al Jazeera (16 Jul 2026); Eastern Herald (17 Jul 2026).

Four SharePoint/AD FS flaws give attackers persistence beyond a single patch. July's Patch Tuesday fixed CVE-2026-56164 (SharePoint privilege escalation) and CVE-2026-56155 (an AD FS access-control flaw that Microsoft's own DART team caught mid-exploitation) — both added to CISA's KEV on 14 Jul. CVE-2026-58644, a SharePoint deserialization RCE exploited as a zero-day, followed on 16 Jul; CVE-2026- 50522, a separate SharePoint deserialization RCE, was exploited within hours of a public PoC on 20 Jul and is used to steal IIS machine keys, giving attackers persistence that survives patching alone — it was KEV-added 22 Jul. On-prem SharePoint and AD FS are standard in government and PSU document-workflow and federated-identity estates, making this chain a priority regardless of a named Indian victim. Source (with date): CISA KEV (14 Jul 2026, 16 Jul 2026, 22 Jul 2026); CERT-In CIAD-2026-0035 (17 Jul 2026).

3. Sector tech & exposures

- SonicWall SMA1000 zero-days (CVE-2026-15409, SSRF, CVSS 10.0; CVE-2026-15410, command injection, CVSS 7.2) were exploited from 22 Jun, weeks ahead of SonicWall's 14 Jul disclosure; Volexity, which assisted SonicWall's investigation, documented custom malware installed on compromised appliances by an actor it tracks as UTA0533. Source (with date): Help Net Security (14 Jul 2026, 21 Jul 2026); Volexity. - Check Point SmartConsole authentication bypass (CVE-2026-16232, CVSS 9.1) lets an unauthenticated attacker obtain a full-admin login token against Quantum Security Management / Multi-Domain Security Management, enough to rewrite policy across every managed gateway. Source (with date): The Hacker News; CISA KEV (22 Jul 2026). - Arista VeloCloud Orchestrator (the on-prem SD-WAN orchestrator, formerly VMware VeloCloud) carries an unauthenticated command-injection flaw (CVE-2026-16812, CVSS 10.0) giving full compromise of the orchestrator and every SD-WAN edge it manages. Source (with date): CISA KEV; Security Affairs (27 Jul 2026). - Cisco Unified Communications Manager WebDialer SSRF (CVE-2026-20230, CVSS 8.6) lets an unauthenticated attacker write files to the OS that can later be used to reach root, on VoIP/PBX infrastructure common in government offices; affects only deployments with WebDialer enabled. Source (with date): Help Net Security (24 Jun 2026); CISA KEV (26 Jun 2026). - FortiBleed has moved from a credential-exposure story to a ransomware-enablement one: SOCRadar ties the harvested FortiGate credentials to INC and Lynx ransomware activity. Networks that rotated credentials only, without confirming session/token invalidation, remain at risk. Source (with date): SOCRadar; The Hacker News (02 Jul 2026). - GhostLock (CVE-2026-43499), a Linux kernel privilege-escalation flaw present since kernel 2.6.39 (2011) and found via AI-assisted research, was reported to give near-certain root across most major distributions — relevant wherever government estates run Linux, including BOSS Linux desktops flagged last edition. Source (with date): The Hacker News; SecurityWeek (08 Jul 2026, 13 Jul 2026).

4. Regulatory & compliance watch

- CERT-In's AI-exploitation blueprint became a live obligation this cycle. CISG-2026-02, issued 25 May, sets a 12-hour patch SLA for internet-facing critical flaws where feasible, graduating to five days for lower-risk internal issues; CSIR circulated it as a mandatory directive to government labs and institutes on 24 Jun. Source (with date): CSIR circular, reported via govtemployeeshub (24 Jun 2026). - PACTS — the India-Australia Partnership on Cyber, Critical Technologies and Supply Chains — adds defence-research cooperation and cybersecurity standards work to the bilateral relationship. Source (with date): PIB/PMO; ThePrint (09 Jul 2026). - CERT-In advisory CIAD-2026-0035 covered July's Microsoft patch batch (570 fixes), naming CVE-2026-56155 among the flaws requiring priority attention. Source (with date): CERT-In CIAD-2026-0035 (17 Jul 2026).

5. Actor in focus — Mustang Panda (PRC-aligned)

Attribution: high. Targeting of Indian government/hydropower bodies this cycle: high. Distinct from APT36/Transparent Tribe, last edition's focus, Mustang Panda's June 2026 operations show a deliberate pivot to abusing trusted SaaS platforms — Zoho WorkDrive here — as command-and-control infrastructure, which blends into ordinary cloud traffic and is harder to flag than classic domain-based C2. The dual lure themes (hydropower cooperation, an India-Taiwan MoU) point to intelligence collection on India's infrastructure planning and its defence-adjacent regional ties, not disruption. Attribution-direction note: India-nexus actors (SideWinder, Patchwork, DoNot Team, Confucius, Bitter/TA397) are not threats to India and are out of scope here. Source (with date): Acronis TRU (28 Jun 2026); The Hacker News (29 Jun 2026).

6. IOC pack

Public, attributed CVE and malware-family identifiers from the cited advisories, not hash/domain-level indicators — pull those from the named sources before blocking. No leaked data or MISP references.

7. Tiered actions

Board: Ask for a one-page status on SharePoint/AD FS and edge-appliance KEV exposure and on compliance with CERT-In's 12-hour patch SLA; keep the unconfirmed DRDO claim and the confirmed Kudankulam breach clearly distinct in any public statement.

CISO: Patch SharePoint, AD FS, SonicWall SMA1000, Check Point SmartConsole, Arista VeloCloud Orchestrator, Cisco Unified CM (or disable WebDialer where unused) and Linux kernels on an emergency basis; rotate SharePoint machine keys on any exposed farm; rotate FortiGate credentials and invalidate sessions where FortiBleed exposure is confirmed; extend contractor/vendor segmentation reviews to anyone holding facility-design or strategic-asset documentation, per the Kudankulam lesson.

SOC: Hunt anomalous Zoho WorkDrive OAuth/API traffic and DLL sideloading via signed PDF or Citrix binaries; watch for SMA1000 webshell indicators, SmartConsole login anomalies, VeloCloud command- injection attempts and WebDialer file writes; keep monitoring the mshta/LNK chains flagged as the APT36 baseline last edition.

8. Source index

The Week · Deccan Herald · Siasat/PTI · Acronis TRU · The Hacker News · Al Jazeera · Eastern Herald · CISA KEV · CERT-In (CIAD-2026-0035, CISG-2026-02) · Help Net Security · Volexity · Security Affairs · SOCRadar · SecurityWeek · PIB/PMO · ThePrint · CSIR (via govtemployeeshub).

9. Byline