Black Basta on DanSec Daily

Cybersecurity Brief – 2026-10-28

Wed, 28 Oct 2026 00:00:00 +0000

Major Incidents or Breaches

Sony-owned So-net, a Japanese internet provider, suffered a data breach exposing personal information of over 2.58 million current and former customers, including email passwords for more than 54,000 users ^[58].
The University of New Mexico Health Sciences Center experienced a ransomware attack causing system outages, disruption to patient care, and the diversion of ambulances. Outpatient surgeries and academic activities were suspended ^[20]^[46]^[50].
Japanese internet giant GMO Group instructed customers to disconnect and shut down PCs following a breach of its Onamae Desktop Cloud service and a subsequent ransomware threat. The company is offering up to $1 million for information leading to the identification of the attackers ^[8]^[18]^[69].
Moldova was forced to take down over 80 public services following a cyberattack ^[67].
Bithumb, a South Korean cryptocurrency exchange, disclosed a data leak after a breach of its internal mobile system ^[68].
Warp, a development environment provider, disclosed a breach that exposed AI agent decision logs and user telemetry data due to a third-party vendor compromise ^[23].
123 Reg, a UK-based hosting provider, reported an “AI cyberattack” on customer data and suspects a China-linked threat actor, possibly related to the ARTEX group ^[48].
British police data has been breached multiple times through third-party IT suppliers, according to a report from His Majesty’s Inspectorate of Constabulary and Fire & Rescue Services ^[45].
Attackers hijacked a Convertr analytics script, leading to the theft of payment card data from e-commerce shoppers ^[21].

Newly Discovered Vulnerabilities

A critical unauthenticated SQL injection vulnerability (CVE-2026-101767) in Oracle E-Business Suite is being actively scanned and probed by attackers for remote code execution ^[1]^[15]^[31].
The critical Oracle PeopleSoft zero-day exploited by ShinyHunters consists of three chained vulnerabilities, all now patched ^[10].
Tailscale patched multiple SSH server vulnerabilities that could allow lateral movement and root access on other servers within tailnets. The flaws were disclosed publicly before fixes were available ^[9]^[33]^[55].
Adobe released patches for eight critical vulnerabilities in Campaign Classic, which could enable arbitrary code execution, security bypass, and privilege escalation ^[4].
Google Chrome and Mozilla Firefox released updates addressing over 200 vulnerabilities combined, including serious security flaws ^[25]^[82].
A 16-year-old flaw in EDK II, used in UEFI firmware, allows code execution before secure boot on network-booting servers ^[2].
TLS flaws in the GoAhead web server, used in hundreds of millions of devices, could allow revoked certificates or eavesdropping on encrypted sessions ^[26].
Four long-hidden vulnerabilities in EPICS Base, a control software used in research facilities, were patched after discovery by an autonomous system. The flaws could let attackers crash processes at particle accelerators and fusion labs ^[28]^[49].
Two critical PHP vulnerabilities, collectively known as “PHP2Shell,” are being actively exploited to compromise web management interfaces of firewalls, VPNs, and application delivery controllers ^[13]^[14]^[27]^[51].
Node2Shell, a critical Brotli vulnerability affecting Adobe Commerce, Magento, and Google’s Brotli decoder, is under active exploitation and has been added to CISA’s Known Exploited Vulnerabilities catalog ^[11]^[16]^[32].

Notable Threat Actor Activity

China-linked hackers have exploited PHP2Shell and Fragnesia vulnerabilities to gain root access to firewalls, including attacks on US government-affiliated organizations ^[27].
ShinyHunters exploited chained Oracle PeopleSoft vulnerabilities for attacks since May ^[10].
A credit card skimming group compromised Convertr analytics scripts to steal payment card data ^[21].
CyberStrikeAI used 44 AI agents in three cyberattacks targeting organizations in Japan, with AI playing a central role in attack execution or support ^[12].
A Ukrainian national, Artem Stryzhak, was sentenced to 70 months in prison for his involvement in Nefilim and Hive ransomware attacks targeting hospitals, government entities, law firms, and businesses worldwide, causing over $100 million in losses. The US is offering an $11 million reward for information on a co-conspirator ^[17]^[43]^[56]^[65]^[73].
The FBI seized the domain of bulletproof hosting provider Virtualine, which was used for criminal hosting, money laundering, and facilitating the distribution of child sexual abuse material ^[7]^[42]^[57].
123 Reg suspects a China-based group in its AI-enabled cyberattack, possibly linked to the ARTEX group known for targeting South Korean financial institutions ^[48].

Trends, Tools, or Tactics of Interest

Threat actors are increasingly chaining multiple vulnerabilities for exploitation, as seen in the Oracle PeopleSoft and PHP2Shell cases ^[10]^[27].
Attackers are abusing legitimate cloud services, authentication mechanisms, and trusted business infrastructure in phishing campaigns, moving beyond traditional credential theft ^[5]^[78].
A significant increase in phishing campaigns leveraging legitimate platforms has been observed, with over 25 services abused in the past year ^[78].
AI-driven attacks are on the rise, with examples including CyberStrikeAI’s multi-agent operations in Japan and the use of unreleased AI models to chain vulnerabilities across Chrome, Safari, Windows, and Linux into working exploits ^[6]^[12].
Malware such as “Aokigahara” stealer is targeting developer keyrings and AI assistants, expanding the focus of infostealers to sensitive business and AI data ^[39].
Mail bombing and social engineering via external Teams chats are being used for malware delivery, possibly linked to the Black Basta ransomware gang ^[36].
Attackers are leveraging mobile device management (MDM) platforms to deploy rogue remote monitoring and management (RMM) tools for persistent remote access ^[85].
Cisco open-sourced Project Quarry, a tool for detecting AI agents engaged in hacking operations ^[47].
CISA released updated versions of ScubaGear and ScubaGoggles, open-source tools for auditing Microsoft 365 and Google Workspace security settings ^[59].
AbuseBox, a new open-source tool, enables monitoring of IP and domain reputation, DNS, SSL, and email records ^[61].

Regulatory or Policy Developments Affecting the Security Industry

The US National Institute of Standards and Technology (NIST) released a roadmap for migration to post-quantum cryptography, with accelerated deadlines for sensitive federal systems ^[62].
Microsoft released out-of-band Windows updates to distrust certificates tied to compromised eMudhra certificate authority keys ^[22].
CISA added the Node2Shell and PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities catalog, mandating patching for federal agencies ^[11]^[16]^[32]^[51].
The UK’s His Majesty’s Inspectorate of Constabulary and Fire & Rescue Services highlighted repeated breaches of British police data via third-party suppliers, raising concerns about supply chain security ^[45].
Austria is preparing to replace email and phone communications among doctors with an end-to-end encrypted instant messaging service for hospitals and clinics ^[52].

Sources

Data breach at Sony-owned internet provider compromises 2.6 million customer records - helpnetsecurity.com
UNM Health ransomware attack disrupts patient care, surgeries - bleepingcomputer.com
University of New Mexico hospital diverts ambulances after cyberattack - therecord.media
Day 2 of canceled classes at University of New Mexico after Health Sciences Center cyberattack - theregister.com
Japan's GMO Offers $1 Million Bounty to Catch Hackers Behind FX Trading Cloud Breach - thehackernews.com
Japan's GMO urges customers to shut down PCs amid ransomware threat - bleepingcomputer.com
Japanese internet giant GMO tells customers to shut down and disconnect PCs from the internet following data breach and ransomware threat - databreaches.net
Risky Bulletin: Moldova takes down 80+ public services after cyberattack - news.risky.biz
KR: Bithumb discloses data leak after internal system breach; One of three financial firm breaches reported that day - databreaches.net
Warp discloses breach exposing AI agent logs, user telemetry data - bleepingcomputer.com
123 Reg discloses 'AI cyberattack' on customer data, suspects China nexus - theregister.com
Hackers repeatedly breached suppliers holding UK police data, watchdog finds - therecord.media
Hackers hijack Convertr analytics script to steal payment card data - bleepingcomputer.com
Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch - thehackernews.com
Hackers now scanning systems for recently-patched Oracle flaw - bleepingcomputer.com
Hackers Start Probing Fresh Oracle EBS Vulnerability - securityweek.com
ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws - thehackernews.com
Tailscale Patches SSH Flaws That Could Let Hacked Devices Gain Root Access on Other Servers - thehackernews.com
Tailscale Rushes Patches After Uncoordinated Disclosure of ‘Tailworm’ Flaws - securityweek.com
Tailscale fixes SSH flaws allowing lateral movement within tailnets - helpnetsecurity.com
Adobe Fixes 8 Critical Campaign Classic Flaws Allowing Code Execution and Security Bypass - thehackernews.com
Chrome and Firefox Updates Patch Over 200 Vulnerabilities - securityweek.com
Chrome and Firefox updates fix serious security flaws. Install them now - malwarebytes.com
Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers - thehackernews.com
TLS Flaws Found in GoAhead Web Server Used in Hundreds of Millions of Devices - securityweek.com
Long-Hidden Flaws Patched in EPICS Research Facility Control Software - securityweek.com
AI 'hacker' finds 4 severe bugs in popular industrial control software in under 4 hours - theregister.com
InfraTrust report warns of exploited flaws in critical network infrastructure - bleepingcomputer.com
Even after PHP2Shell, blast radius matters more than a CVSS score - bleepingcomputer.com
China-Linked Hackers Exploit PHP2Shell to Root Firewalls - securityweek.com
CISA confirms PHP2Shell under attack as researchers clock successful exploits - theregister.com
Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges - thehackernews.com
CISA warns of hackers now exploiting critical Node2Shell flaw - bleepingcomputer.com
CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts - securityweek.com
CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets - thehackernews.com
Nefilim and Hive ransomware affiliate gets 70 months in prison - bleepingcomputer.com
Nefilim, Hive ransomware operator given five-year-plus sentence after guilty plea - therecord.media
Ukrainian ransomware hacker sentenced, $11 million reward offered for co-conspirator - helpnetsecurity.com
Prolific Hive and Nefilim ransomware affiliate sentenced to 70 months in prison - cyberscoop.com
Ukrainian National Sentenced for Role in Hacking Hospitals, Businesses, and Governments as Part of Ransomware Conspiracies Causing Over $100 Million in Losses - databreaches.net
FBI Seizes Virtualine Domain Over Alleged Criminal Hosting and Bitcoin Money Laundering - thehackernews.com
FBI seizes ‘bulletproof’ hosting site accused of facilitating child abuse, money laundering - therecord.media
FBI seizes Virtualine, bulletproof hosting provider that promised to shield criminals from police - helpnetsecurity.com
American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed - thehackernews.com
Attackers Abuse Legitimate Infrastructure to Distribute Phishing Emails - blog.knowbe4.com
Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits - thehackernews.com
'Aokigahara' Stealer Targets 'Developer Keyrings' & AI Assistants - darkreading.com
External Teams Chats Anchor 15-Minute Malware Delivery - darkreading.com
Managed for Malice: How Attackers Turn MDM into Remote Access - huntress.com
Cisco open sources tool for detecting AI agents on hacking sprees - theregister.com
CISA updates ScubaGear and ScubaGoggles, and says Microsoft 365 checks get faster - helpnetsecurity.com
AbuseBox: Open-source monitor for blacklists, DNS, SSL and email records - helpnetsecurity.com
NIST starts the countdown to retire quantum-vulnerable encryption - helpnetsecurity.com
Microsoft releases Windows OOB updates to distrust eMudhra certificates - bleepingcomputer.com
Austrian doctors to swap emails and phone calls for encrypted messages - computerweekly.com

Cybersecurity Brief – 2026-01-18

Sun, 18 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

U.S. hackers have reportedly caused a blackout in Venezuela, according to recent reports, indicating a significant cyber operation targeting critical infrastructure.
Nicholas Moore, a Tennessee man, pleaded guilty to repeatedly hacking the U.S. Supreme Court’s filing system and illegally accessing systems belonging to AmeriCorps and the Department of Veterans Affairs.

Newly Discovered Vulnerabilities

Wireshark 4.6.3 has been released, addressing 4 vulnerabilities and 9 bugs.

Notable Threat Actor Activity

Ukrainian and German law enforcement have identified two Ukrainian nationals suspected of working for the Russia-linked Black Basta ransomware group. One of the group’s leaders has been added to the EU Most Wanted list and is the subject of an INTERPOL Red Notice.
Malicious Chrome extensions impersonating productivity and security tools have been found stealing authentication credentials from enterprise HR and ERP platforms or blocking legitimate extensions.
Seventeen additional malicious browser extensions linked to the GhostPoster campaign have been discovered in Chrome, Firefox, and Edge stores, with a combined total of 840,000 installations.

Trends, Tools, or Tactics of Interest

Google Chrome now allows users to delete local AI models used for scam detection under the “Enhanced Protection” feature, providing more user control over on-device AI-powered security functions.

Cybersecurity Brief – 2026-01-17

Sat, 17 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

The Canadian Investment Regulatory Organization (CIRO) suffered a data breach impacting 750,000 individuals, exposing personal information of member firms and their registered employees.
Five malicious Chrome browser extensions impersonating HR and ERP platforms such as Workday and NetSuite were discovered hijacking user accounts.
Verizon experienced a nationwide wireless outage last week and is now issuing $20 credits to affected customers.
Researchers hijacked StealC malware control panels via an XSS flaw, gaining intelligence on the info-stealing operation and active attacker sessions.

Newly Discovered Vulnerabilities

A critical command injection vulnerability (CVE-2025-64155) in Fortinet FortiSIEM is actively exploited in the wild. Public proof-of-concept code is available, and attacks from multiple IP addresses have been observed.
Cisco fixed a maximum-severity AsyncOS zero-day in Secure Email Gateway appliances that had been exploited since November 2025.
A critical vulnerability in Bluetooth audio accessories, dubbed “WhisperPair,” allows attackers to hijack, track, and eavesdrop on millions of devices using improper Google Fast Pair implementations.
Microsoft confirmed that the January Windows 11 update (KB5074109) causes Outlook to freeze for POP users and prevents some Windows 11 23H2 devices with System Guard Secure Launch enabled from shutting down.

Notable Threat Actor Activity

China-linked threat actor UAT-8837 exploited a Sitecore zero-day and other known vulnerabilities to target critical infrastructure in North America.
Chinese group UAT-9686 exploited a Cisco vulnerability to deploy the AquaShell backdoor on internet-exposed Cisco appliances.
The Black Basta ransomware gang leader’s identity has been confirmed by law enforcement in Ukraine and Germany, and the individual has been added to Europol and Interpol’s wanted lists.
A new campaign targeting U.S. government and policy entities used Venezuela-themed spear phishing to deliver the LOTUSLITE backdoor.
Russian threat actors reportedly targeted the Polish power grid, as noted in industry roundups.

Trends, Tools, or Tactics of Interest

GootLoader malware now uses malformed ZIP archives concatenating 500–1,000 ZIP files to evade detection.
Social engineering attacks are increasingly leveraging AI to enhance effectiveness.
The BodySnatcher agentic AI hijacking technique, Telegram IP exposure, and researcher-led attacks on shipping systems were noted as emerging security concerns.
Pacific Northwest National Labs introduced ALOHA, an AI system that reduces attack reconstruction time from weeks to hours.
Dutch police conducted an operation selling fake event tickets to demonstrate the prevalence and effectiveness of online scams.

Regulatory or Policy Developments Affecting the Security Industry

CISOs are increasingly joining executive suites, driven by heightened regulatory and compliance standards.
Reports indicate China is instituting a software ban, with all top 20 domestic cybersecurity firms working with the government.
Former CISA Director Jen Easterly has been appointed CEO of the RSA Conference (RSAC).
Project Eleven raised $20 million to develop post-quantum security infrastructure, and Monnai secured $12 million for identity and risk data solutions.

Cybersecurity Brief – 2025-06-12

Thu, 12 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

Erie Insurance and Erie Indemnity Company confirmed a cyberattack that caused recent business disruptions and platform outages.
INTERPOL’s Operation Secure dismantled over 20,000 malicious IP addresses or domains linked to 69 infostealer malware variants, resulting in 32 arrests, the seizure of 117 command-and-control servers, and disruption of infrastructure in 26 countries.
Over 80,000 Microsoft Entra ID (formerly Azure AD) accounts were targeted in an account takeover campaign using the open-source TeamFiltration tool.
Coordinated brute-force attacks involving 295 malicious IPs targeted Apache Tomcat Manager interfaces exposed online.

Newly Discovered Vulnerabilities

Microsoft released patches for 67 vulnerabilities, including a WebDAV remote code execution zero-day (CVE-2025-25099) actively exploited in the wild. The zero-day was leveraged by the Stealth Falcon APT group to drop malware targeting defense and government organizations in Turkey, Qatar, Egypt, and the UAE.
A zero-click vulnerability named “EchoLeak” was identified in Microsoft 365 Copilot, allowing exfiltration of sensitive data from a user’s context without user interaction.
Two vulnerabilities in SinoTrack GPS devices were disclosed, enabling remote control of certain vehicle functions and tracking via default passwords.
A bug in Google’s password-recovery page allowed brute-forcing of any user’s phone number, exposing contact information and enabling phishing and SIM-swapping attacks.
Mirai botnets were observed exploiting a vulnerability in the Wazuh security platform, highlighting rapid exploitation of newly published CVEs.

Notable Threat Actor Activity

A new malicious implant, BrowserVenom, was discovered mimicking DeepSeek. The malware enables a proxy in Chrome and Mozilla browsers and spreads via phishing websites.
Former Black Basta ransomware members used email bombing and Microsoft Teams phishing, along with Python scripts, to establish persistent access in recent attacks.
Stealth Falcon APT exploited the Windows WebDAV zero-day for malware delivery in targeted attacks.
TeamFiltration, an open-source penetration testing tool, was repurposed for large-scale account takeover campaigns against Microsoft Entra ID accounts.

Trends, Tools, or Tactics of Interest

Threat actors are increasingly leveraging AI tools, as highlighted in OpenAI’s report, to assist in social engineering attacks and influence operations.
“SmartAttack” is a new technique using smartwatches as covert ultrasonic receivers to exfiltrate data from air-gapped systems.
Brute-force campaigns targeting web management panels, such as Apache Tomcat Manager, are being conducted via large numbers of distributed IP addresses.
Botnet operators are reducing time-to-exploit for new CVEs, as evidenced by recent Mirai botnet campaigns.
DNS security is being emphasized as a critical but often overlooked defense layer.
Increased adoption and discussion of agentic AI security products at industry events, such as Gartner’s Security & Risk Management Summit.
Microsoft issued revised updates for Windows 11 24H2 on incompatible PCs and fixed Windows Server domain controller issues stemming from earlier updates.

Regulatory or Policy Developments

ConnectWise announced plans to rotate code-signing certificates based on third-party researcher recommendations, unrelated to a recent nation-state attack.
Google introduced new enterprise-scale security protections for Android devices.
INTERPOL’s Operation Secure represents a significant multinational law enforcement action against infostealer malware infrastructure.