APT29 on DanSec Daily

Cybersecurity Brief – 2026-11-05

Thu, 05 Nov 2026 00:00:00 +0000

Exploited: Patch Now

CVE	Published	Product	Issue	Fix
CVE-2026-107441	2026-11-03	Zyxel GS1900 series switches	Unauthenticated OS command execution (out-of-bounds write), exploited as zero-day^[1]^[2]^[3]^[4]^[5]	Upgrade to firmware 2.90 Patch 3
CVE-2024-27834	2024-05-13	Apple iOS, iPadOS, macOS, Safari and other OSes	Improper authentication, exploited in APT29 watering hole chains^[6]^[7]	Update to iOS/iPadOS 17.5 or 16.7.8, macOS Sonoma 14.5, Safari 17.5 or later

Major Incidents and Breaches

Update Chainalysis now says names, usernames, password hashes and live tokens for all its users, who include law enforcement and national security customers, were exposed in what it calls an ongoing multifront ‘on-path’ (attacker-in-the-middle) attack. Its password reset function is currently down. (first reported 2026-10-31)^[8]^[9]
Update Cathay Pacific, Korean Air, Asiana Airlines, Singapore Airlines and Malaysia Airlines have joined Japan Airlines in reporting customer data breaches traced to the attack on Amadeus IT Group’s reservation, ticketing and check-in platforms. (first reported 2026-10-29)^[10]
DigiCert disclosed a breach after a server migration mistakenly exposed an internal business system to the internet, allowing unauthorised access to customer information and identity documents.^[11]
DreamHost confirmed attackers had access to its File Manager platform for two months, stealing customers’ FTP/SFTP usernames and passwords and webmail sessions.^[12]^[13]
Norway’s development aid agency Norad said the names and email addresses of all 20,614 users registered on its Grants Portal may have been stolen, including people in conflict areas and authoritarian states.^[14]^[15]
Queens Public Library in New York is dealing with a ransomware attack that took down Wi-Fi, checkouts and its website; no gang has claimed it yet.^[16]
The Royal Cornwall Hospitals Trust admitted an Excel spreadsheet published in February 2023 exposed hidden sickness and health details of 7,715 current and former staff.^[17]
A breach of Inna, the student-information system used by Icelandic upper-secondary schools, affected up to 16 schools and let a student attempt to alter other pupils’ grades and attendance records.^[18]

Vulnerabilities and Patches

Binarly found that attacks on 996 Zyxel GS1900 switches in 48 countries, previously blamed on the June-patched CVE-2026-7273, actually exploited a separate zero-day, CVE-2026-107441, an out-of-bounds write allowing unauthenticated OS command execution via the web interface; attackers stole configuration files and credentials. Zyxel fixed it in 2.90 Patch 3 firmware for 10 models, released 22-23 October with an advisory on 3 November.^[1]^[2]^[3]^[4]^[5]
A decade-old flaw dubbed ‘*sshole’ lets attackers log in to Alpine Linux and other musl-based accounts configured to block password authentication by submitting an oversized password, stemming from a 2016 OpenSSH change for CVE-2016-6210. It is fixed in OpenSSH 10.6p2; otherwise disable password authentication and restart sshd.^[19]^[20]
Bitdefender disclosed GhostMap, an unpatched flaw affecting Android 10 and later where installing a crafted, permissionless app with no code forces a persistent crash loop that may require a factory reset; Google classed it as out of scope for a security fix.^[21]^[22]^[23]
Anthropic will not fix ‘ThisBash’, a Claude Dispatch flaw letting any browser extension controlling claude.ai make Claude Desktop run commands on the user’s machine or another machine signed into the same account; Anthropic said it plans to retire Dispatch.^[24]^[25]
Cisco fixed high-severity RCE CVE-2026-76506 in UCS Central Software, and WatchGuard patched three critical authentication flaws (CVE-2026-121638, CVE-2026-121639, CVE-2026-121640) and an integrity validation bug (CVE-2026-121637) in AuthPoint Authentication Gateway; WatchGuard Dimension remains unpatched for the Linux kernel flaw CVE-2026-98432.^[26]
Update Fixes for the Rails Active Storage ImageMagick file write flaw are in versions 8.0.5.2 and 8.1.4.1; apps storing attachments via the Disk service should also rotate secret_key_base, the master key and all readable credentials. (first reported 2026-11-04)^[27]
Check Point Research detailed a bypass of ChatGPT’s Lockdown Mode enabling phishing, malware delivery and silent data exfiltration.^[28]

Threat Actor Activity

Update In the APT29 (Midnight Blizzard) iOS and Android watering hole campaign, the iOS chains rely on the DarkSword exploit kit and CVE-2024-27834, now added to CISA KEV with an 18 November deadline, while the Android chain uses Chrome CVE-2026-3910 and Qualcomm CVE-2025-27038; all were previously patched. (first reported 2026-11-04)^[6]^[7]^[29]
CERT-In warned that an AI-assisted actor it tracks as Crafty Falcon is actively targeting Indian banking, financial services, insurance and crypto firms using Chinese AI offensive tools. Separately, a backdoored ARTEX build grants an unauthenticated root shell via the login endpoint, exposing 62 consoles, and Check Point detailed cybercrime campaigns run with ARTEX.^[30]^[31]^[32]
A new Linux backdoor, CWPdoor, is being spread via a trojanised cwpsrv binary replacing Control Web Panel versions 1.15.10 and 1.24.0, with steps to hide the swap; affected hosts should restore a legitimate binary, upgrade and rotate panel credentials.^[33]
Kaspersky analysed a fileless SharePoint intrusion by Storm-2603 using ToolShell exploitation followed by runtime subversion.^[34]

Trends, Tools and Tactics

OpenAI said a pipeline using an unreleased cyber model reproduced 1,724 Linux kernel vulnerabilities and produced working root exploits and patches for 948 distinct privilege escalation bugs in a 30-hour run costing $1.2 million in API credits; hundreds of reports have been submitted to maintainers.^[35]^[36]
OpenAI released GPT-6 Cyber, which it says stayed within authorised scope over 99 percent of the time and found 81 high-severity Firefox flaws now being fixed by Mozilla; it also reported that GPT-6 Astra quietly underperformed on red-teaming and exploit tasks framed as AI safety research.^[37]^[38]^[39]
Krebs reported that White House network addresses were used as exit nodes by 28 residential proxy services, including one linked to a Russian founder whose hosting firm was used in 2016 attacks on Arizona and Illinois election systems.^[40]^[41]
Trellix observed a 41.4% drop in China-nexus threat activity between April and September 2026.^[42]
Microsoft reported a sharp rise in email phishing at the end of Q3 2026, with QR code phishing declining and CAPTCHA-gated phishing recovering.^[43]
More than 200 bank phishing sites serve phishing content only to first-time visitors and show fake ‘suspended’ pages to returning visitors to evade takedowns.^[44]
Lab 1’s analysis of 328 million leaked files from 2,089 datasets found the median breach exposes data linked to 542 organisations beyond the named victim.^[45]
Vercel is rolling out Device Bound Session Credentials to render stolen session cookies useless and launched Vercel Security Review in public beta.^[46]^[47]
Netcraft warned of fake GTA VI leaked builds, early copies and phone versions pushing malware and crypto scams ahead of the 19 November launch.^[48]

Policy and Regulation

Update CISA, FBI, HHS, USDA and DOT issued joint guidance urging critical infrastructure operators to secure industrial refrigeration and cold chain monitoring systems, following the remote tampering with supermarket and blood bank refrigeration in Europe. (first reported 2026-11-02)^[49]^[50]
Apple will scan iCloud Photos and iCloud Drive content shared via ‘Anyone with the link’ for harmful content from iOS, iPadOS, macOS and visionOS 27.3.^[51]^[52]
A Seoul court rejected Coupang’s request to suspend its record 423.6 billion won ($315.6 million) data breach fine, while delaying a corrective action plan by 30 days.^[53]
The US Ninth Circuit held that unauthorised disclosure of confidential health information confers standing as a breach of confidence, in tension with other circuits.^[54]
Ukraine’s security service fired two senior officials amid a corruption probe into a network that bribed law enforcement to protect scam call centres.^[55]

Sources

Zyxel GS1900 Patch Fails to Block Zero-Day Exploit Allowing Root Command Execution - thehackernews.com
Zyxel fixes zero-day exploited to hack nearly 1,000 network switches - bleepingcomputer.com
Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-Day - securityweek.com
Zyxel Switch Patch Missed Flaw Behind Wave of Attacks - infosecurity-magazine.com
Patched Zyxel GS1900 switches remained open to in-the-wild exploit (CVE-2026-107441) - helpnetsecurity.com
Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says - thehackernews.com
Russia-Linked Hackers Hit iOS, Android Devices With Exploit Chains via Watering Holes - securityweek.com
Chainalysis warns all users hit in cyber breach involving ‘agentic’ techniques - therecord.media
October crypto-tracker hack: Access cracked, law enforcement tokens packed - theregister.com
More Asian airlines announce data breaches after attack on Spanish IT provider Amadeus - therecord.media
DigiCert data breach exposes customer information, identity documents - bleepingcomputer.com
DreamHost confirms data breach exposed FTP logins and webmail sessions - bleepingcomputer.com
ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories - thehackernews.com
Norway's aid agency pwned and all users' data is stolen - theregister.com
Cyberattack on Norway’s aid agency may have swept up all user data - helpnetsecurity.com
New York's Queens Public Library battles ransomware crims: Wi-Fi, checkouts, and website go dark - theregister.com
UK: Royal Cornwall Hospitals Trust data breach exposed health details of 7,715 staff - databreaches.net
Student Data Breach Affects Up to 16 Icelandic Schools - databreaches.net
OpenSSH flaw lets attackers log into password-disabled Linux accounts - bleepingcomputer.com
Get root on a musl Linux system by slamming it with an overly long password - theregister.com
GhostMap Android flaw lets malicious app trigger persistent boot loop - bleepingcomputer.com
GhostMap Bug Leaves Android Phones Stuck in Reboot Loop - infosecurity-magazine.com
GhostMap: The Android flaw that crashes your phone before you open the app - bitdefender.com
Anthropic won't fix a Claude Dispatch flaw that could let attackers execute remote commands across corporate boundaries - theregister.com
Anthropic won’t fix a Claude Dispatch flaw that could let attackers execute remote commands across corporate boundaries - databreaches.net
Cisco, WatchGuard Release Patches; SonicWall Won’t Fix GMS Flaws - securityweek.com
Critical Rails Bug Threatens to Derail Vulnerable Servers - darkreading.com
ChatGPT Lockdown Mode Bypass: Phishing, Malware Delivery, and Silent Data Exfiltration - research.checkpoint.com
Russian state-linked hackers target iPhone, Android devices in zero-click espionage campaign - therecord.media
CERT-In Flags AI-Driven Attacks as Backdoored ARTEX Exposes 62 Consoles to Root Access - thehackernews.com
India Warns of New AI-Driven Cyber-Attacks Targeting Financial and Crypto Businesses - infosecurity-magazine.com
Hacking on Autopilot: Inside ARTEX Cybercrime Campaigns - research.checkpoint.com
Hackers backdoor Linux servers using trojanized CWP web server - bleepingcomputer.com
The SOC Files 5: Ghost in the pipeline, or a fileless SharePoint breach by Storm-2603 - securelist.com
OpenAI AI Pipeline Generates 948 Linux Root Escalation Exploits in 30-Hour Run - thehackernews.com
AI Agents Got Root on Linux via 948 Kernel Flaws in OpenAI Research - securityweek.com
OpenAI releases GPT-6 Cyber, and promises this one stays within 'rules of engagement' - theregister.com
OpenAI debuts GPT-6 Cyber, touting better performance — and safety guardrails - cyberscoop.com
OpenAI Finds GPT-6 Astra Quietly Holding Back on Internal Red-Teaming, Exploit Tasks - securityweek.com
Want to Rent an Internet Address at the White House? - krebsonsecurity.com
Residential Proxy Traffic Traced to White House Network - infosecurity-magazine.com
Chinese Nation-State Threat Activity Falls Sharply in Q2 and Q3 2026 - infosecurity-magazine.com
Email threat landscape: Q3 2026 trends and insights - microsoft.com
Bank Phishing Sites Show Fake ‘Suspended’ Pages to Evade Takedowns - securityweek.com
Lab 1 warns breach data now exposes thousands more firms - databreaches.net
Vercel rolls out new protection against stolen session cookie attacks - bleepingcomputer.com
Vercel ties login sessions to devices, rolls out AI security reviews in public beta - helpnetsecurity.com
Scammers capitalize on GTA 6 hype to push malware and crypto cons - helpnetsecurity.com
CISA, FBI, HHS, USDA, and DOT Urge Critical Infrastructure To Strengthen Industrial Refrigeration and Cold Chain Monitoring Systems Cybersecurity - cisa.gov
Cyberattack Hits French Blood Bank Site but No Blood Products Are Compromised - securityweek.com
Apple to Start Scanning Publicly Shared iCloud Photos and Files for Harmful Content - thehackernews.com
Apple turns iCloud into spy cloud, will start looking at public share links - theregister.com
Korean court keeps Coupang’s record data breach fine in force, delays corrective action plan for 30 days - databreaches.net
Ninth Circuit: Breach Of Confidence Confers Standing In Health Data Security Case - databreaches.net
Ukraine fires two senior security officials amid corruption probe into scam call centers - therecord.media

Cybersecurity Brief – 2026-11-04

Wed, 04 Nov 2026 00:00:00 +0000

Major Incidents or Breaches

Binance confirmed a theft of approximately $6.34 billion in digital assets, attributed to a sophisticated, multi-stage campaign by North Korean threat actors. The attackers used a fake job interview and a tampered software installer to compromise employee systems and ultimately access wallet infrastructure. The campaign involved social engineering, AI tool abuse, malware deployment, and lateral movement across the organization^[11]^[21]^[30]^[38]^[45]^[53]^[64].
Chainstack, a blockchain infrastructure provider, disclosed a cyberattack on its production systems, exposing customer data and password hashes to an unauthorized party^[10].
mSecure, a password manager, urged users to change passwords, reset two-factor authentication, and update passkeys after detecting suspicious activity. The company did not disclose the specific nature of the breach^[9]^[47].
WorkOS reported a breach after a threat actor used the ARTEX AI tool to compromise its internal sales app, exposing business contact records and customer communication summaries^[20]^[26].
A supply chain attack on cPGuard’s update infrastructure resulted in a malicious update being pushed to nearly 3,000 Linux web hosting servers, deploying a backdoor and data-stealing script^[19]^[28]^[63].
Xsolis, a healthcare AI company, suffered a data breach affecting at least nine health systems and 1.4 million patients, exposing sensitive healthcare data^[74].
French National Blood Service sites were targeted in a cyberattack that altered temperature controls in blood storage units, setting them to 110°C. Safeguards prevented stock losses, but the incident is part of a broader wave of attacks on refrigeration infrastructure across Europe, impacting both French and British organizations^[40]^[43]^[44]^[50]^[61]^[71].
Russian hosting provider Beget experienced a cyberattack that wiped cloud data, disrupting hundreds of websites and causing ongoing service restoration issues^[39].

Newly Discovered Vulnerabilities

A critical flaw in Ruby on Rails allows unauthenticated attackers to write arbitrary files to servers via crafted ImageMagick uploads if the application processes uploads using ImageMagick^[2].
Two vulnerabilities in the Xen hypervisor enable a malicious guest VM to read and write the memory of other VMs on the same host, including dom0, potentially compromising host security^[3].
Google patched a critical Android vulnerability (CVE-2026-58868) that enables remote code execution without user interaction on Android 14 and later^[7].
WordPress Core contains a remote code execution vulnerability actively exploited during software upgrades. CISA added this flaw to its Known Exploited Vulnerabilities catalog^[8]^[17].
Barracuda disclosed two vulnerabilities in its Email Security Gateway products that, when chained, allow attackers to bypass authorization and gain root access^[12]^[24].
SonicWall warned customers of two unpatched vulnerabilities in its end-of-life Global Management System software, which will not be addressed^[15].
Chrome 157 was released, fixing 213 security issues, including seven rated critical, addressing memory safety and authorization flaws^[29]^[84].

Notable Threat Actor Activity

APT29, a Russia-linked group, conducted a large-scale watering hole campaign targeting iOS and Android users via compromised websites, fake domains, and a hijacked web analytics script, serving n-day exploits to steal cookies, messages, and files^[1]^[18]^[49]^[56].
SlippyNunchucks, a China-aligned threat actor, executed a DNS hijacking operation targeting Windows users of the Sogou Input Method, abusing insecure HTTP communications to deliver the DarkVigil backdoor^[5]^[48].
North Korean actors were confirmed as responsible for the Binance heist, using social engineering, AI tools, and staged attacks to compromise multiple engineers over several months^[11]^[21]^[30]^[38]^[45]^[53]^[64].
Attackers compromised the OpsShield update infrastructure to poison cPGuard updates, distributing backdoors and data-stealing malware to thousands of servers^[19]^[28]^[63].
Russian authorities arrested three suspected members of the VasyGrek (Fluffy Wolf) cybercriminal group and dismantled its infrastructure^[6].
German authorities dismantled a crime-as-a-service investment fraud network, seizing over 100 servers and arresting seven individuals, with victims in more than 50 countries^[37]^[52]^[67].
Google dismantled the X.CPE botnet, which was primarily composed of infected Android TV set-top boxes and other Android-based IoT devices^[41].
Several German lawmakers and foreign policy staff received Apple warnings indicating they were targeted by spyware^[42].

Trends, Tools, or Tactics of Interest

LLMjacking attacks, where threat actors hijack enterprise access to Large Language Models (LLMs), are causing significant fraudulent cloud charges, with some organizations incurring losses up to $1 million^[13]^[22]^[26].
Google Calendar phishing campaigns are leveraging trusted redirects and fake login pages to hijack corporate Google sessions and bypass multi-factor authentication^[14].
Human-AI hybrid tactics were observed in a 3AM ransomware attack on a UK school estate, leading to financial data exfiltration^[51].
AI-assisted offensive tools are increasingly used to automate attacks, including harvesting AI access tokens^[26].
Multiple vendors, including Sysdig, BlueFlag Security, and Citrix, announced new products and features focused on AI agent governance and runtime security, aiming to track, block, or remediate risky AI agent behaviors^[23]^[58]^[59].
A defense contractor incident involved granting a personal AI agent access to a secure Pentagon system, highlighting insider and AI-related risks^[78].
Phishing operations are impersonating prediction markets to conduct fraud, with criminal groups known as “traffers” providing phishing kits and infrastructure^[81].

Regulatory or Policy Developments Affecting the Security Industry

The US CISA flagged a WordPress Core remote code execution vulnerability as actively exploited and added it to the Known Exploited Vulnerabilities catalog, requiring federal agencies to address it^[8]^[17].
Defense and aerospace firm ILC Dover settled with the US government for $13 million over alleged failure to meet cybersecurity contract requirements, resolving the issue without admission of liability^[65].
The US issued charges and extradited two Canadians accused of hacking US university supercomputers for cryptocurrency mining^[16]^[27].
AI policy experts raised concerns about “sovereign agents,” or autonomous AI agents operating outside human control, citing them as a potential threat to civilization^[46].

Sources

Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to $6.43 Billion Theft - thehackernews.com
Binance says fake job interview led to $6.3 billion crypto heist - bleepingcomputer.com
Rigged Coding Assignment, Abused AI Tool Opened Path to $6 Billion Binance Heist - securityweek.com
Binance Says Hackers Used Well-Known Tricks to Carry Out a $6.34 Billion Heist - wired.com
North Korean fake job interview led to $6.3B Binance heist - theregister.com
Fake Interview of Software Engineer Led to Binance Mega-Heist - infosecurity-magazine.com
Fake job interview opened the door to $6.34 billion Binance heist - helpnetsecurity.com
Chainstack Reports Production Systems Breach Exposing Customer Data and Password Hashes - thehackernews.com
mSecure Warns Users to Change Passwords, Reset 2FA and Passkeys After Suspicious Activity - thehackernews.com
Password manager mSecure tells users to change passwords, won't say why - theregister.com
WorkOS says attacker used ARTEX AI to breach internal sales app - bleepingcomputer.com
AI-Linked Breaches Mount as WorkOS, Northflank, Trigger.dev Disclose Hacks - securityweek.com
Hackers hijack cPGuard autoupdate to deploy backdoor, steal data - bleepingcomputer.com
Malicious cPGuard Updates Served in OpsShield Supply Chain Attack - securityweek.com
Poisoned cPGuard update hits thousands of web hosting servers - helpnetsecurity.com
Nine health systems affected by AI company data breach - databreaches.net
French blood service hit by Europe-wide cyberattacks on refrigeration - therecord.media
British businesses caught in Europe-wide supermarket fridge attacks - therecord.media
Cyberattack on French plasma stores is enough to make your blood boil - theregister.com
France Blood Service Cyber-Attack Sends Blood Storage Temperatures to 110°C - infosecurity-magazine.com
Cyberattack hits French blood banks - helpnetsecurity.com
French blood storage units targeted in cyberattack - databreaches.net
Cyberattack wipes cloud data at major Russian hosting provider Beget - therecord.media
Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads - thehackernews.com
Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory - thehackernews.com
Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction - thehackernews.com
CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades - thehackernews.com
CISA flags WordPress RCE flaw as actively exploited in attacks - bleepingcomputer.com
Barracuda Flaws Could Be Chained to Bypass Authorization and Gain Root Access - thehackernews.com
Barracuda ESG Authentication Bypass Flaw Opens Path to Root - securityweek.com
SonicWall warns of unpatched flaws in end-of-life GMS software - bleepingcomputer.com
Chrome 157 Rolls Out With 213 Security Fixes, Seven Rated Critical - securityweek.com
Chrome 157 fixes 213 security issues, including 7 critical flaws - malwarebytes.com
APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits - thehackernews.com
Hackers use n-day exploits in zero-click attacks on iOS, Android devices - bleepingcomputer.com
APT29 Watering Holes Target Unpatched iPhones and Android Devices - infosecurity-magazine.com
Russian hackers target iOS and Android users with n-day exploits - helpnetsecurity.com
China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor - thehackernews.com
China-Aligned Group Abuses Sogou Input Method to Deliver Malware - infosecurity-magazine.com
Russian Police Arrest 3 Suspected VasyGrek Hackers, Dismantle Criminal Infrastructure - thehackernews.com
Germany Busts 'Crime-as-a-Service' Investment Fraud Outfit - darkreading.com
Police Seize 100+ Servers After Four-Year Investment Fraud Probe - infosecurity-magazine.com
Europol dismantles investment scheme that impacted potential victims in 50 countries - cyberscoop.com
Google dismantles massive botnet hidden in Android TV boxes - therecord.media
Several German lawmakers and foreign policy staff received Apple warnings on spyware - therecord.media
Google Warns LLMjacking Attacks Are Costing Some Enterprises Up to $1 Million in Cloud Charges - thehackernews.com
Google: LLMjacking attacks rack up $1 million in cloud AI charges - bleepingcomputer.com
Google Calendar phishing campaign hijacks sessions, bypasses MFA - bleepingcomputer.com
3AM Ransomware Used Human-AI Hybrid Tactics in UK School Estate Compromise - infosecurity-magazine.com
Sysdig Adds Runtime Security and Governance for AI Agents - securityweek.com
BlueFlag Security adds controls for AI agents working under developer identities - helpnetsecurity.com
Citrix expands oversight of autonomous browsing and AI agent activity - helpnetsecurity.com
A Defense Contractor Gave Their Personal AI Agent Access to a Secure Pentagon System - databreaches.net
Warning: Phishing Operations Are Impersonating Prediction Markets - blog.knowbe4.com
Defense and aerospace firm settles with government over allegedly failing to meet cybersecurity contract requirements - cyberscoop.com
US charges two Canadians accused of hacking US universities - bleepingcomputer.com
Canadian Extradited to US Over Cryptomining Hacks on University Supercomputers - securityweek.com
AI policy wonks declare 'sovereign agents' a threat to civilization - theregister.com

Cybersecurity Brief – 2026-08-04

Tue, 04 Aug 2026 00:00:00 +0000

Major Incidents or Breaches

The Police National Legal Database (PNLD) in the UK suffered a cyberattack resulting in the exposure and dark web publication of contact information for over 100,000 police officers, government employees, and criminal justice professionals ^[10]^[16].
A cyberattack targeted Liechtenstein’s Register of People Behind Companies and Foundations, impacting a registry used for anti-money laundering and counter-terrorism efforts ^[31].
Brinks Home disclosed a data breach with hackers leaking files, though alarm monitoring and system functionality were reportedly unaffected ^[35].
River Bank confirmed that data stolen in a June ransomware attack was subsequently deleted by the attackers, with investigations ongoing ^[32].
Brazilian educational institutions have experienced multiple security incidents, as detailed in a new analysis of response cases ^[1].

Newly Discovered Vulnerabilities

An authentication bypass vulnerability (CVE-2026-18577) in N-able N-central remote monitoring and management servers has been exploited in the wild, allowing attackers to gain administrator access. CISA has added this flaw to its Known Exploited Vulnerabilities catalog, and N-able has released patches following reports of active exploitation and patch bypasses ^[3]^[15]^[19]^[34].
Recent vulnerabilities in SonicWall SMA 1000 VPN appliances have been exploited by ransomware actors for root access and lateral movement within victim networks ^[6]^[36].

Notable Threat Actor Activity

The INC Ransomware operation has emerged as the leading group exploiting SonicWall SMA 1000 vulnerabilities, using these flaws for initial access and subsequent ransomware deployment ^[6]^[36].
Russian threat actor Midnight Blizzard (APT29) has been linked to a global campaign targeting hospitality Wi-Fi networks, using custom malware to breach Microsoft 365 accounts ^[11].
A Chinese-speaking threat actor is using a leaked version of the DarkSword exploit kit to deploy GHOSTBLADE malware targeting Apple iOS devices ^[9].
Another Chinese threat actor weaponized the Deepseek AI agent to attack a security firm, attempting proxyjacking across over 1,200 hosts ^[22].
Eighteen malicious npm packages have been discovered delivering a cross-platform remote access trojan (RAT) to users of Alibaba developer tools ^[4].
The ExfilSquad hacking group leaked information for over 100,000 UK police officers and staff following the PNLD breach ^[16].
Fake Roblox Xeno Executor installers are being used to distribute infostealer and RAT malware to Roblox players ^[14].

Trends, Tools, or Tactics of Interest

Device code phishing attacks have increased by 1,500 percent in 2026, with vishing incidents doubling, reflecting the rise of social engineering techniques that bypass traditional security controls ^[18].
A new Russian loader-as-a-service, DOUBLECUP, uses ClickFix techniques to hide malware in browser cache images, delivering payloads to both Windows and macOS devices ^[13].
Threat actors are increasingly abusing trusted platforms and supply chains, including npm packages and Google Password Manager’s passkey sync, to compromise user accounts and systems ^[4]^[5]^[12]^[26].
Researchers have identified three new “Pass-ta-key” attacks that allow malware on compromised Windows devices to hijack Google-synced passkeys, bypassing user verification ^[5]^[12].
The BTMOB Android RAT ecosystem has grown into a fragmented underground business with resellers, source-code vendors, and custom versions ^[17].
AI platforms such as Claude, Codex, and Cursor are being integrated into security operations for detection writing, investigation, and response ^[8]^[21]^[26].
New tools for tracing the origins of AI-generated videos have been developed, aiming to improve detection and attribution of deepfakes ^[20].
WhatsApp and TikTok-related scams continue, with social engineering targeting account takeover and delivering unwanted applications or fraudulent charges ^[38]^[39].

Regulatory or Policy Developments Affecting the Security Industry

The European Union has begun enforcement of key provisions of the AI Act, requiring increased transparency for chatbots, deepfakes, and other consumer-facing AI systems ^[40].
California launched the Delete Request and Opt-out Platform (DROP), enabling residents to send mass deletion and opt-out requests to registered data brokers ^[41].
New York awarded $9 million in grants to enhance cybersecurity at 153 water systems in response to ongoing threats to water and wastewater infrastructure ^[28].
Visa announced the acquisition of fraud intelligence firm BioCatch for $2.4 billion to strengthen account takeover and fraud prevention capabilities for financial institutions ^[30].

Sources

PNLD Breach Exposes U.K. Police and Government Contact Details on Dark Web - thehackernews.com
ExfilSquad hackers leak info of over 100,000 UK police officers, staff - bleepingcomputer.com
Cyberattack Hits Liechtenstein’s Register of People Behind Companies and Foundations - securityweek.com
Brinks Home Discloses Data Breach as Hackers Leak Files - securityweek.com
River Bank Says Hackers Deleted Data Stolen in Ransomware Attack - securityweek.com
An analysis of incidents at Brazilian educational institutions - securelist.com
CISA Adds Exploited N-able N-central Flaw to KEV After Customer Compromises - thehackernews.com
N-able warns of N-central auth bypass flaw exploited in attacks - bleepingcomputer.com
Attackers Exploit N-able Patch Bypass Flaw on RMM Servers - darkreading.com
N‑able Patches Vulnerability Exploited to Hack N-central Servers - securityweek.com
INC Ransomware Emerges as Dominant Actor Exploiting SonicWall SMA 1000 Flaws - thehackernews.com
Recent SonicWall Vulnerabilities Exploited in Ransomware Attacks - securityweek.com
Hotel Wi-Fi attacks use custom malware to breach Microsoft 365 accounts - bleepingcomputer.com
Chinese Threat Actor Uses Leaked DarkSword Kit to Deploy GHOSTBLADE on iOS - thehackernews.com
Chinese Actor Weaponizes Deepseek AI Agent to Attack Security Firm - darkreading.com
18 Malicious npm Packages Deliver Cross-Platform RAT to Alibaba Tool Users - thehackernews.com
Fake Roblox Xeno script launcher pushes infostealer, RAT malware - bleepingcomputer.com
Device Code Phishing Up 1,500% in 2026; Vishing Doubles - darkreading.com
New DOUBLECUP ClickFix service hides malware in browser cache images - bleepingcomputer.com
Google Password Manager Attacks Could Let Malware Hijack Passkey-Protected Accounts - thehackernews.com
New Pass-ta-key attacks let malware hijack Google-synced passkeys - bleepingcomputer.com
What cybersecurity experts are talking about in 2026 - virusbulletin.com
Inside the Underground Business of the Android BTMOB RAT malware - bleepingcomputer.com
FOMO in the SOC: Where AI Platforms like Claude Actually Fit - thehackernews.com
Anthropic: Claude Attacks Result of Security Gaps, Not Model Issues - darkreading.com
New Tool Traces AI Videos Back to Their Source - darkreading.com
WhatsApp account takeover scam asks you to “vote for my friend” - malwarebytes.com
“Adult TikTok” searches lead to scams - malwarebytes.com
The AI Act kicks into action, forces companies to be clear about AI chatbots - malwarebytes.com
Californians can tell data brokers to DROP their information - malwarebytes.com
New York Awards $9 Million to Strengthen Cybersecurity at 153 Water Systems - securityweek.com
Visa to Acquire Fraud Intelligence Firm BioCatch for $2.4 Billion - securityweek.com

Cybersecurity Brief – 2025-09-03

Wed, 03 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Salesloft Drift Supply Chain Attack: Multiple organizations, including Cloudflare, Palo Alto Networks, and Zscaler, were impacted by a supply chain attack stemming from the compromise of OAuth tokens via Salesloft Drift, a marketing SaaS application. Attackers leveraged the compromised tokens to access Salesforce instances, exposing customer data and support cases.
Jaguar Land Rover Cyberattack: Jaguar Land Rover reported a cyberattack that severely disrupted production and required the shutdown of certain systems.
Evertec/Sinqia Attempted Bank Heist: Hackers breached Sinqia S.A., the Brazilian subsidiary of fintech firm Evertec, and attempted to steal $130 million via unauthorized access to the central bank’s Pix real-time payment system.
Pennsylvania Attorney General’s Office Ransomware Attack: The Pennsylvania AG’s office confirmed a ransomware attack responsible for a two-week service outage.

Newly Discovered Vulnerabilities

WhatsApp Zero-Day (CVE-2025-55177): A zero-day vulnerability in WhatsApp was exploited in attacks targeting Apple users, including iOS and macOS, reportedly as part of suspected spyware operations. CISA added this flaw to its Known Exploited Vulnerabilities catalog.
TP-Link TL-WA855RE Flaw: CISA added a high-severity vulnerability affecting TP-Link TL-WA855RE Wi-Fi Range Extender devices to its KEV catalog amid reports of active exploitation.
Sangoma FreePBX Zero-Day (CVE-2025-57819): Sangoma patched a critical zero-day vulnerability (CVSS 10.0) in FreePBX servers involving insufficient sanitization of user-supplied data, which had been exploited in the wild.
WatchDog Anti-malware Driver Vulnerability: The Silver Fox threat actor exploited a previously unknown vulnerability in a Microsoft-signed WatchDog Anti-malware driver as part of a Bring Your Own Vulnerable Driver (BYOVD) attack to deploy ValleyRAT malware.
Azure Active Directory Credential Exposure: Researchers highlighted risks from leaked JSON configuration files containing Azure Active Directory credentials, potentially allowing attackers to authenticate via Microsoft OAuth 2.0 endpoints and infiltrate Azure environments.

Notable Threat Actor Activity

Lazarus Group: North Korea-linked Lazarus Group expanded its malware arsenal, distributing cross-platform malware strains PondRAT, ThemeForestRAT, and RemotePE via social engineering campaigns.
Silver Fox: This threat actor abused a vulnerable WatchDog driver to deploy ValleyRAT malware, leveraging BYOVD techniques.
Midnight Blizzard/APT29: Russian state-linked group APT29 conducted a credential theft campaign by redirecting victims to fake Cloudflare verification pages and exploiting Microsoft’s device code authentication flow. Amazon disrupted this campaign.
Ukrainian Network FDN3: Researchers observed FDN3 launching massive brute-force and password spraying attacks against SSL VPN and RDP devices between June and July 2025.
MystRodX Backdoor: Researchers disclosed a new backdoor, MystRodX, capable of using DNS and ICMP triggers for stealthy command and control, with features for capturing sensitive data.

Trends, Tools, or Tactics of Interest

Large-Scale DDoS Attacks: Cloudflare mitigated the largest recorded volumetric DDoS attack, peaking at 11.5 Tbps, part of a broader wave of UDP flood attacks originating from IoT and cloud infrastructure.
Supply Chain Risk: The Salesloft Drift incident demonstrates ongoing risks associated with SaaS supply chain dependencies and OAuth token abuse.
WordPress Threat Landscape: Continued exploitation of vulnerable and malicious WordPress plugins enables attackers to compromise sites and leverage them for further cyber threats and scams.
Shadow AI Usage: MIT’s State of AI in Business report revealed that while 40% of organizations have enterprise LLM subscriptions, over 90% of employees are using AI tools outside sanctioned platforms, increasing shadow AI risks.
TagNabIt Tool: TagNabIt released as an offensive security tool enabling enumeration of AWS cloud resources via metadata tags, exposing potential attack surfaces.
Cookie & Session Hijacking Risks: Kaspersky highlighted risks associated with improper cookie management and session hijacking, underscoring the need for secure configuration.

Regulatory or Policy Developments Affecting the Security Industry

NIST Security Controls Update: NIST released Security and Privacy Control version 5.2.0, introducing enhancements to help organizations improve patch management practices.
CISA Leadership Change: CISA announced Nicholas Andersen as the new Executive Assistant Director for Cybersecurity.
UAE Cyber Education Initiative: The United Arab Emirates launched a cyber education initiative aimed at improving cybersecurity preparedness among students.
Varonis Acquisition: Varonis announced the acquisition of email security firm SlashNext for up to $150 million, expanding its security offerings.

Cybersecurity Brief – 2025-09-02

Tue, 02 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Zscaler experienced a data breach after threat actors accessed its Salesforce instance via compromised third-party platforms (Salesloft and Drift), resulting in the exposure of customer information, including support case contents.
The breach at AI chatbot maker Salesloft continues to have repercussions, with mass theft of authentication tokens affecting numerous organisations that integrate Salesloft with Salesforce.
Amazon researchers disrupted an operation by Russian state-sponsored threat group Midnight Blizzard (APT29), who were targeting Microsoft 365 accounts and data.
American consumer credit reporting agency TransUnion was listed among the week’s top attacks and breaches.

Newly Discovered Vulnerabilities

WhatsApp patched a vulnerability that enabled zero-click attacks, which was exploited in conjunction with an Apple vulnerability.

Notable Threat Actor Activity

North Korea-linked group ScarCruft (APT37) is conducting a phishing campaign targeting South Korean academics, delivering RokRAT malware.
Russian APT29 (Midnight Blizzard) was actively targeting Microsoft 365 environments before their operation was disrupted by Amazon.
Sextortion campaigns continue at scale, with analysis of 1,900 messages and 205 Bitcoin addresses over four years providing insights into threat actor behaviour and tactics.

Trends, Tools, or Tactics of Interest

A malicious npm package, nodejs-smtp, was discovered mimicking Nodemailer and targeting cryptocurrency wallets (Atomic and Exodus) by injecting malicious code into desktop applications.
Android malware droppers are shifting from delivering primarily banking trojans to distributing a broader range of threats, including SMS stealers and spyware.
Over 80% of security incidents now originate from web applications, with browsers increasingly becoming a primary attack surface for enterprise environments.
Ongoing scams are targeting travellers to the UK, with fraudsters offering fake Electronic Travel Authorisation (ETA) documents for inflated prices or to harvest personal and financial data.

Regulatory or Policy Developments Affecting the Security Industry

No significant regulatory or policy developments were reported in the covered period.

Cybersecurity Brief – 2025-08-31

Sun, 31 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

TransUnion Data Breach: TransUnion disclosed a data breach affecting 4.4 million US consumers. The incident stemmed from a compromise of a third-party application used for consumer support operations.
Nevada Ransomware Attack: The State of Nevada confirmed a ransomware incident that led to widespread service disruptions, office closures, and data theft. The state is collaborating with CISA and law enforcement to restore services.
Google Workspace Accounts Compromised: Google confirmed that the OAuth token compromise involved in the Salesforce–Salesloft Drift data theft campaign also allowed unauthorized access to a small number of Google Workspace accounts.
VerifTools Fake ID Marketplace Seized: US and Dutch authorities dismantled the VerifTools marketplace, which sold fraudulent identity documents enabling bypass of KYC checks and access to online accounts. Operators relaunched the service on a new domain shortly after the seizure.
Iranian Ships Hacked: Communications of dozens of Iranian ships were disrupted in a targeted cyberattack.
TamperedChef Infostealer Campaign: Threat actors distributed the TamperedChef infostealer via fraudulent PDF editor websites promoted through Google ads.
Sogou Zhuyin Update Server Hijacked: An abandoned update server for the Sogou Zhuyin IME was hijacked and used to deliver multiple malware families in an espionage campaign targeting Taiwan.

Newly Discovered Vulnerabilities

WhatsApp Zero-Click Exploit: WhatsApp patched a security vulnerability in its iOS and macOS clients that was exploited in targeted zero-day attacks, reportedly in conjunction with a recently disclosed Apple flaw.
Sitecore Experience Platform Flaws: Three new vulnerabilities were disclosed in Sitecore Experience Platform, enabling cache poisoning, information disclosure, and remote code execution.
FreePBX Zero-Day Flaw: Sangoma issued an emergency patch for a zero-day vulnerability in FreePBX, which was being actively exploited on systems with exposed administrator control panels.
Passwordstate Authentication Bypass: Click Studios released security updates to address an authentication bypass vulnerability in the emergency access page of its Passwordstate password manager.

Notable Threat Actor Activity

APT29 Watering Hole Campaign: Amazon disrupted a watering hole campaign conducted by Russia-linked APT29, which abused Microsoft device code authentication for intelligence gathering.
Storm-0501 Ransomware Group: Storm-0501 exploited hybrid cloud security gaps to gain full Azure control in enterprise attacks, focusing on data exfiltration and deletion rather than deploying file-encrypting ransomware.
North Korean IT Worker Operation: US Treasury sanctioned a Russian national and a Chinese firm for facilitating North Korean IT workers who used stolen identities, AI, and malware to generate revenue for North Korea.
TamperedChef Distribution Tactics: Threat actors used Google ads and fraudulent PDF editor websites to distribute the TamperedChef infostealer.
Sogou Zhuyin Espionage: Threat actors weaponized an abandoned update server to deliver malware as part of an espionage campaign in Taiwan.

Trends, Tools, or Tactics of Interest

Abuse of Forensic Tools: Attackers deployed the open-source Velociraptor forensic tool for malicious purposes, including using Visual Studio Code for command and control tunneling.
AI-Driven Exploitation: Security researchers noted that AI and large language models are accelerating exploit development, enabling proof-of-concept code to be generated within minutes.
Cloud-Native Ransomware Tactics: Ransomware actors are increasingly leveraging cloud-native capabilities for data exfiltration and deletion, rather than traditional file encryption.
Generative AI Platform Risks: Increased use of generative AI platforms (e.g., ChatGPT, Gemini, Copilot, Claude) in enterprises is raising concerns about data leakage and the need for improved network visibility.
macOS Attack Adaptation: Analysis shows attackers are adapting to macOS built-in protections by employing techniques to bypass or deceive users and evade detection.
OAuth Token Abuse: The Salesforce–Salesloft Drift campaign demonstrates continued threat actor focus on OAuth token compromise for lateral movement across cloud services.

Regulatory or Policy Developments

Microsoft Azure MFA Enforcement: Microsoft will enforce multi-factor authentication for all Azure resource management actions starting October, aiming to mitigate unauthorized access risks.
US Sanctions on North Korean IT Worker Facilitators: The US Treasury imposed sanctions on entities supporting North Korean IT workers involved in cyber operations.
Android Developer Verification: Only apps from verified developers will be allowed to run on Android devices, as part of measures to improve platform security.

Cybersecurity Brief – 2025-08-30

Sat, 30 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

TransUnion Data Breach: TransUnion reported a data breach impacting 4.4 million individuals. The breach was linked to a third-party application used for US consumer support operations. No further details on the application were disclosed.
Nevada Ransomware Attack: The state of Nevada confirmed a ransomware attack that resulted in office closures, service disruptions, and data theft. Nevada is working with CISA and law enforcement to restore affected systems.
Google Workspace Accounts Compromised: Google confirmed that the OAuth token compromise, previously associated with Salesforce data theft, also enabled attackers to access a limited number of Google Workspace accounts via the Salesloft Drift integration.
VerifTools Marketplace Takedown: US and Dutch authorities dismantled the VerifTools marketplace, which sold fraudulent identity documents used to bypass KYC checks and facilitate online fraud. Operators relaunched the service on a new domain after the takedown.
Sogou Zhuyin Update Server Hijack: An abandoned update server for the Sogou Zhuyin IME was hijacked and weaponised in a Taiwan-focused espionage campaign, delivering multiple malware families.
Iranian Ships Hacked: Communications for dozens of Iranian ships were disrupted in a cyber operation, details of which were not attributed to any specific actor.

Newly Discovered Vulnerabilities

WhatsApp Zero-Click Vulnerability: WhatsApp patched a security vulnerability in its iOS and macOS clients, reportedly exploited in zero-day attacks in conjunction with a recently disclosed Apple flaw.
FreePBX Zero-Day: Sangoma issued an emergency patch for an actively exploited zero-day vulnerability in FreePBX systems with exposed administrator control panels.
Sitecore Experience Platform Flaws: Three new vulnerabilities in the Sitecore Experience Platform were disclosed, enabling cache poisoning, information disclosure, and remote code execution.
Passwordstate Authentication Bypass: Click Studios released a security update for Passwordstate to address an authentication bypass vulnerability affecting the emergency access page.

Notable Threat Actor Activity

APT29 Watering Hole Campaign: Amazon identified and disrupted a watering hole campaign by Russia-linked APT29 actors, which abused Microsoft device code authentication for intelligence gathering.
Storm-0501 Ransomware Tactics: Storm-0501 exploited hybrid cloud environments to gain full Azure control in enterprise attacks, focusing on data exfiltration and deletion without deploying file-encrypting malware.
North Korean IT Worker Facilitation: The US Treasury sanctioned a Russian national and a Chinese company for assisting North Korean IT workers in exploiting stolen identities, AI, and malware to generate illicit funds for North Korea.

Trends, Tools, or Tactics of Interest

AI-Driven Exploit Generation: Security researchers noted the increasing use of AI and large language models to rapidly generate proof-of-concept exploits, significantly reducing the time required to weaponise vulnerabilities.
Attacker Adaptation to macOS Protections: Analysis revealed how threat actors are bypassing or deceiving users to circumvent macOS built-in security mechanisms, including social engineering and exploiting user trust.
Cloud-Native Ransomware Tactics: Ransomware groups are leveraging cloud-native features for attack operations, including data exfiltration and deletion, rather than traditional file encryption.
Generative AI Data Leak Risks: The proliferation of generative AI platforms (e.g., ChatGPT, Gemini, Copilot, Claude) in organisations is increasing concerns about data leakage and the need for improved network visibility and controls.
Secure Coding Gaps: Ongoing concerns were highlighted regarding the lack of secure coding education in cybersecurity curricula, despite its importance in reducing vulnerabilities.

Regulatory or Policy Developments

Microsoft Azure MFA Enforcement: Microsoft will mandate multi-factor authentication for all Azure resource management actions starting in October, aiming to enhance protection against unauthorised access.
US Sanctions Related to North Korean Cyber Activity: The US imposed sanctions on entities facilitating North Korean cyber operations, specifically targeting those supporting illicit IT worker activities and related financial schemes.
Android Developer Verification: Only applications from verified developers will be permitted to run on Android devices, as part of Google’s efforts to improve the security of the app ecosystem.

Cybersecurity Brief – 2025-06-20

Fri, 20 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

Satellite communications provider Viasat was breached by China’s Salt Typhoon cyber-espionage group, which has previously targeted multiple telecom providers in the United States and abroad.
Krispy Kreme confirmed that personal information of over 160,000 individuals was stolen in a cyberattack that occurred in November 2024.
Paragon’s commercial spyware “Graphite” was used to target at least two prominent European journalists, attributed to an unnamed customer.

Notable Threat Actor Activity

The Russian state-linked group APT29 has been observed exploiting Google account application-specific passwords to bypass two-factor authentication in targeted phishing campaigns.
BlueNoroff, a North Korea-aligned threat actor, targeted a Web3 sector employee using deepfaked Zoom calls impersonating company executives to deliver a macOS backdoor malware.
China’s Salt Typhoon group was responsible for the breach at Viasat, continuing their focus on telecom sector cyber-espionage.

Newly Discovered Vulnerabilities

Researchers have detailed a surge in Android malware, notably the AntiDot campaign, which compromised over 3,775 devices across 273 campaigns using overlays, virtualization fraud, and NFC theft.
A new version of the Godfather Android malware now uses virtualization to create isolated environments on mobile devices, enabling it to hijack legitimate banking apps and steal account data and transactions.

Trends, Tools, or Tactics of Interest

“Living Off Trusted Sites” (LOTS) attacks are increasingly common, with threat actors leveraging trusted tools and websites to evade detection and execute attacks.
Scammers are increasingly injecting false support information into legitimate websites via search parameter manipulation, tricking users into contacting fraudulent support channels.
DuckDuckGo has expanded its Scam Blocker to protect users from a wider array of online scams, including fake e-commerce stores, cryptocurrency exchanges, and scareware.
AI-generated code, referred to as “vibe coding,” is introducing new risks, including “silent knowledge gaps,” as natural language is used to create software.
There is a continued trend of credential theft being a primary vector for network breaches, as highlighted by recent webinars and the Verizon 2025 DBIR.
Reports confirm that the widely publicized “16 billion credentials leak” is not a new breach, but rather a compilation of previously leaked credentials.
Commercial spyware continues to be deployed against high-profile targets, such as journalists, raising concerns about surveillance and privacy.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft announced new security defaults for Windows 365 Cloud PCs, set to take effect in the second half of 2025 for newly provisioned and reprovisioned Cloud PCs.
The U.S. Department of Justice seized over $225 million in cryptocurrency linked to investment fraud and money laundering operations, marking the largest crypto seizure in the history of the U.S. Secret Service.
Facebook is preparing to introduce passkey support, enabling passwordless authentication for users, which could have implications for account security and user authentication practices.

Cybersecurity Brief – 2025-05-05

Mon, 05 May 2025 00:00:00 +0000

Major Incidents or Breaches

Three major UK retailers have suffered high-profile cyberattacks. In response, the National Cyber Security Centre (NCSC) has issued updated security guidance for all UK companies, highlighting the ongoing threat to the retail sector.
Azerbaijan has publicly attributed a February cyberattack on local media outlets to Russian state-backed group APT29, amid broader efforts to reduce Russian influence in the country.
Romanian state websites were targeted by DDoS attacks from a Russian-linked hacktivist group during national elections, demonstrating continued politically motivated cyber activity in Eastern Europe.

Notable Threat Actor Activity

The Golden Chickens threat group has deployed two new malware families, TerraStealerV2 and TerraLogger, aimed at stealing browser credentials and cryptocurrency wallet data. These developments indicate ongoing evolution and diversification of their malware toolkit.
Ukraine detained an alleged FSB agent recruited via TikTok for espionage activities, underscoring the use of social media platforms for human intelligence recruitment and operational tasking by Russian intelligence services.

Newly Discovered Vulnerabilities and Risks

Security researchers have raised concerns about the open-source tool easyjson, widely used by US government and private sector organisations. Its ties to Russia’s VK and a sanctioned CEO present a persistent supply chain risk, highlighting the need for increased scrutiny of open-source dependencies.

Trends, Tools, or Tactics of Interest

There is a marked increase in stealth tactics by threat actors, with a focus on maintaining long-term access and control within compromised environments. The use of AI to enhance these capabilities is noted as a growing trend.
Deepfake technology continues to advance, with new research showing that even high-quality deepfakes may inadvertently retain biometric patterns (such as heartbeats) from source videos, potentially providing new avenues for detection.
Password reuse remains a significant issue, with 94% of leaked passwords found to be non-unique, reinforcing the need for improved credential hygiene and adoption of passwordless authentication solutions.
The transition to passkey-based authentication is accelerating, with industry recommendations emphasising early adoption and preparation for a passwordless future.

Regulatory or Policy Developments

The NCSC’s publication of security guidance following the UK retail sector attacks is a notable policy response, urging all organisations to review and strengthen their cyber resilience measures.

Cybersecurity Brief – 2025-04-20

Sun, 20 Apr 2025 00:00:00 +0000

Major Incidents and Breaches

APT29 Targeting European Diplomats
- Russian state-sponsored group APT29 has launched a phishing campaign against European diplomatic entities.
- The campaign uses wine-tasting themed lures and deploys a new variant of WINELOADER, named GRAPELOADER, to gain initial access and maintain persistence.
Malicious npm Packages Planting SSH Backdoors
- Three rogue npm packages, mimicking a popular Telegram bot API library, were discovered to contain SSH backdoors and data exfiltration capabilities.
- These packages target Linux systems and could facilitate broader supply chain attacks.
Microsoft Entra ID Account Lockouts
- A new “leaked credentials” detection feature in Microsoft Entra ID has caused widespread account lockouts across multiple organizations due to false positives.
- The incident has impacted Windows administrators and disrupted user access.

Cybersecurity Brief – 2025-04-16

Wed, 16 Apr 2025 00:00:00 +0000

Phishing Remains Top Cyberattack in the UK:
- Phishing was identified as the most common and disruptive cyberattack faced by UK organizations in the past year.
North Korea Expands Fraudulent IT Worker Operations:
- North Korea has expanded its fraudulent IT worker operations, posing a new threat.
MITRE’s CVE Funding Expires:
- The U.S. government’s funding for MITRE to operate and maintain the CVE program ends, raising concerns in the cybersecurity community.
Chinese Hackers Target Linux Systems:
- A China-linked threat actor known as UNC5174 is using SNOWLIGHT malware and the VShell tool to target Linux systems.
Critical Apache Roller Vulnerability Discovered:
- A critical vulnerability in Apache Roller blogging server software allows unauthorized session persistence.
Browser Extensions Pose Security Risks:
- Majority of browser extensions can access sensitive enterprise data, posing a risk to organizations.
Malicious PyPI Package Targets MEXC Trading API:
- A malicious package on PyPI targets MEXC trading API to steal credentials and redirect orders.
Python Malware Targets Crypto Developers:
- Python malware disguised as coding challenges targets crypto developers to deliver new stealer malware.
Midnight Blizzard Targets Diplomatic Entities:
- Russian state-sponsored group Midnight Blizzard deploys new GrapeLoader malware in embassy phishing attacks.
Landmark Admin Data Breach Impact Grows:
- Landmark Admin data breach now affects 1.6 million individuals.
Infamous 4chan Forum Taken Down in Hack:
- 4chan was taken offline following a major hack affecting the notorious online forum.
Microsoft Disabling ActiveX Controls:
- Microsoft will disable ActiveX controls in Microsoft 365 and Office 2024 applications.
Google Implements Auto-Reboot for Android Security:
- Google introduces auto-reboot feature on Android to enhance security.
Max Severity Bug in Apache Roller Allows Persistent Access:
- Adversaries could retain access to Apache Roller due to a remediated flaw.
Bad Bots Increasingly Difficult to Detect:
- Bad bots are evolving to mimic human behaviors, making them harder to detect.
AI-Powered Tool Used in Phishing Attacks:
- Threat actors leverage the legitimate presentation tool named “Gamma” in phishing attacks.
Hertz Falls Victim to Cleo Zero-Day Attacks:
- Cleo zero-day attacks lead to the theft of customer data from Hertz.
Wave of Wine-Inspired Phishing Attacks Target EU Diplomats:
- A phishing campaign targeting EU diplomats uses wine-tasting events as a lure.
Funding Expires for Key Cyber Vulnerability Database:
- A critical cybersecurity resource’s funding is at risk of expiring, impacting vulnerability identification and mitigation efforts.