Researchers have identified active exploitation of CVE-2026-8037, a critical unauthenticated remote code execution vulnerability affecting Progress Kemp LoadMaster. The vulnerability affects LoadMaster GA versions 7.2.63.1 and earlier and LTSF versions 7.2.54.17 and earlier and can allow a remote adversary to execute commands on an affected appliance without valid credentials when the vulnerable API is exposed. Progress has released updates addressing CVE-2026-8037 and CVE-2026-33691, a separate Web Application Firewall security control bypass, in GA 7.2.63.2 and LTSF 7.2.54.18.

The exploitation of this vulnerability reflects a broader trend of threat actors targeting internet-facing enterprise technologies. For example, Progress MOVEit Transfer experienced significant scanning and exploitation activity in 2025 involving CVE-2023-34362 and CVE-2023-36934, as well as the 2023 exploitation of CVE-2023-34362 by the Cl0p ransomware group for large-scale data theft and extortion. More recently, CISA confirmed the exploitation of SonicWall SMA1000 vulnerabilities, CVE-2026-15409 and CVE-2026-15410, by ransomware groups. Collectively, these incidents demonstrate the continued targeting of perimeter-facing enterprise technologies as high-value entry points into corporate environments. 

What’s Notable and Unique 

• Public exploit research, observed exploitation attempts, and CISA KEV inclusion indicate that CVE-2026-8037 has progressed into an active operational threat, increasing urgency for organizations with exposed and unpatched LoadMaster systems. 

• Internet-facing infrastructure can be rapidly identified through automated scanning, enabling threat actors to quickly identify vulnerable systems and capitalize on newly disclosed vulnerabilities and publicly available exploit techniques. 

Analyst Comments 

CVE-2026-8037 is significant not only for its severity but also because it affects infrastructure positioned between the internet and critical enterprise applications. The combination of external exposure, unauthenticated exploitation, and public exploit research lowers the barrier for threat actors seeking initial access, and the broader threat landscape reinforces this concern. The exploitation of Progress MOVEit by Cl0p, continued scanning activity against MOVEit, and recent ransomware exploitation of SonicWall SMA1000 vulnerabilities demonstrate sustained adversarial interest in perimeter-facing enterprise technologies. These incidents indicate that such infrastructure should be treated as high-value assets within enterprise security programs.  

Sources 

• Surge in MOVEit Transfer Scanning Could Signal Emerging Threat Activity 

• LoadMaster Critical Security Bulletin – June 2026 – (CVE-2026-8037, CVE-2026-33691) 

• Enterprise Tech In, Shell Out (Progress Kemp LoadMaster Uninitialized Heap to Pre-Auth RCE CVE-2026-8037)

• CISA: SonicWall SMA1000 flaws now exploited by ransomware gangs

In this episode of Bytes of Insight, host Vinny Sakore sits down with John Morrissey, Arete’s Director of Cryptocurrency Operations and Sanctions Compliance, and Trenton Howard, Arete’s Lead Threat Intelligence Consultant, to discuss cryptocurrency and blockchain technology. They explore the impact of cryptocurrency on both innovation and cybercrime, threat actors’ use of the blockchain for ransom payments, and Arete’s patent-pending Compliance and Sanctions Analysis Process.

The ClickFix social engineering technique has significantly evolved from a relatively simple malware delivery mechanism into a highly sophisticated, evasive attack framework. Initially relying on straightforward PowerShell downloaders and disk-based payloads, the campaign now employs fileless execution, advanced obfuscation techniques, and server-side polymorphism to evade traditional security controls. 

What’s Notable and Unique 

• ClickFix primarily relies on social engineering, as victims are presented with fake CAPTCHA verification pages that imitate trusted services such as Cloudflare or Google reCAPTCHA. Users are instructed to copy and execute a PowerShell command, believing they are completing a legitimate verification process. Instead, the command initiates the malware infection chain. 

  
  

• To bypass traditional security tools, threat actors transitioned to fileless techniques. Instead of downloading scripts directly to disk, newer variants execute malicious code entirely in memory. The most notable recent advancement in ClickFix is the adoption of server-side polymorphism. Unlike traditional malware that delivers a static payload, the threat actor's server dynamically generates unique payloads for each victim request. This approach undermines signature-based detection methods because each delivered payload appears unique, preventing defenders from relying solely on file hashes or static indicators. 

  
  

• The campaign was observed beginning around March 25, 2026, with a significant increase in activity thereafter, indicating that the techniques are proving effective against many organizations' defenses. 

Analyst Comments 

ClickFix social engineering campaigns continue to evolve in 2026, becoming more sophisticated and expanding across multiple operating systems. Organizations should focus on behavioral detection, browser isolation, endpoint monitoring, and user awareness training rather than relying solely on indicators such as hashes or blocklists. The campaign's use of fake CAPTCHA prompts also reinforces the importance of educating users never to execute commands from websites. 

Sources 

• The Evolution of ClickFix: From Cleartext to Server Side Polymorphism 

INC Ransom was the most active threat group in July, while activity remained relatively distributed among multiple threat groups, with 19 unique groups observed throughout the month. Alongside INC Ransom, Qilin, Global Secret Group, Anubis, and DragonForce rounded out the five most active threat groups observed in July. Several emerging threat actors were also observed during the month, including Booba Team, Settra, and Global Secret Group.

Figure 1. Activity from the top 3 threat groups in July 2026

 Throughout the month, analysts at Arete identified several trends behind the threat actors perpetrating cybercrime activities:

• In July 2026, Global Secret Group emerged as a new threat actor, leveraging the leaked LockBit 3.0 (LockBit Black) source code. Although the group began operations in June 2026, it quickly accumulated a substantial number of victims on its data leak site (DLS). The group operates through TOR-based negotiation portals and qTox communications. Notably, its DLS provides step-by-step guidance on purchasing Bitcoin, including references to Coinbase and Binance, demonstrating a streamlined, victim-focused extortion process designed to simplify ransom payments.
  
  

• Similar to Fulcrumsec, the recently emerged Settra ransomware group appears to leverage AI-driven analysis of stolen data, publishing detailed and highly structured victim reports on its DLS. Additionally, a potential EDR-disabling tool, edr_blind.exe, was identified in multiple cases, suggesting a focus on defense-evasion capabilities.
  
  

• With the continuation of the FortiBleed campaign, researchers have now identified compromised FortiGate credentials being leveraged by both the INC and Lynx ransomware operations. Analysis revealed direct operational links between the groups, including shared ransomware infrastructure and overlap between FortiBleed victims and ransomware targets. The operators are also incorporating AI to enhance various stages of the attack lifecycle and increase operational efficiency and scale. Notably, Arete also observed an INC ransomware intrusion leveraging FortiBleed-derived access in July, reinforcing the campaign's role as a precursor to ransomware deployment.

Sources

• Arete Internal