Cloud Atlas on DanSec Daily

Cybersecurity Brief – 2026-05-23

Sat, 23 May 2026 00:00:00 +0000

Major Incidents or Breaches

Cloud Atlas has targeted public sector and diplomatic entities in Russia and Belarus, employing new tools including PowerCloud, and leveraging ReverseSocks, SSH, and Tor for persistence on infected systems ^[1].
The Belarus-aligned threat actor Ghostwriter has conducted phishing campaigns against Ukrainian government entities using lures associated with the Prometheus online learning platform ^[10].
The Megalodon automated attack campaign pushed over 5,700 malicious commits to more than 5,500 GitHub repositories within six hours, exploiting CI/CD workflows ^[11].
Authorities in Europe and North America dismantled the “First VPN” criminal VPN service, which was used by at least 25 ransomware groups to facilitate attacks and obscure their origins ^[9]^[30].
Dutch authorities seized 800 servers belonging to a hosting provider that enabled cyberattacks, interference operations, and disinformation campaigns, arresting two individuals ^[14].
A Canadian man was arrested and charged in connection with operating the Kimwolf DDoS botnet, which infected nearly two million devices globally and was used for DDoS-for-hire attacks ^[13]^[20]^[29].
Former US executives pleaded guilty to concealing a tech support fraud scheme that impacted victims worldwide ^[15].

Newly Discovered Vulnerabilities

A maximum-severity vulnerability (CVE-2026-48172, CVSS 10.0) in the LiteSpeed User-End cPanel Plugin is under active exploitation, allowing attackers to execute scripts as root ^[7].
A critical SQL injection vulnerability (CVE-2026-9082) in Drupal Core is being actively exploited in the wild and has been added to CISA’s Known Exploited Vulnerabilities catalog ^[8]^[17]^[27].
Trend Micro patched a zero-day directory traversal vulnerability (CVE-2026-34926) in Apex One, which has been exploited in attacks targeting Windows systems ^[16]^[31].
Ubiquiti released updates to address three maximum severity vulnerabilities in UniFi OS, which could be exploited by remote, unauthenticated attackers ^[19].
Google released security updates for Chrome to address critical vulnerabilities that could allow remote code execution via malicious websites ^[33].

Notable Threat Actor Activity

Cloud Atlas has updated its toolkit, incorporating PowerCloud and using ReverseSocks, SSH, and Tor for persistence, targeting government and diplomatic organizations in Russia and Belarus ^[1].
Ghostwriter (UAC-0057/UNC1151), aligned with Belarus, is using Prometheus-themed phishing to target Ukrainian governmental bodies ^[10].
Multiple Iran-nexus threat actors, including Nimbus Manticore, have been active during recent Middle East geopolitical tensions, advancing Iran’s strategic cyber objectives ^[32].

Trends, Tools, or Tactics of Interest

The Tycoon 2FA phishing-as-a-service platform has evolved to leverage OAuth device code phishing, enabling compromise of accounts protected by multifactor authentication ^[2].
Automated malicious commit campaigns, exemplified by Megalodon, are targeting thousands of GitHub repositories by exploiting CI/CD workflows ^[11].
There is an observed trend of threat actors making Windows kernel drivers exploitable from user mode without requiring the original hardware, broadening the attack surface for Bring Your Own Vulnerable Driver (BYOVD) attacks ^[12].
Fake FIFA World Cup websites are targeting soccer fans with phishing schemes designed to steal money and personal data by mimicking official ticketing and merchandise flows ^[6].
Social engineering attacks against the healthcare sector are increasing in sophistication and frequency, as highlighted in Verizon’s 2026 Data Breach Investigations Report ^[22].

Regulatory or Policy Developments Affecting the Security Industry

Lawmakers in the US are demanding answers from CISA following a contractor-related data leak, raising questions about oversight and data security practices within the agency ^[25]^[28].
The addition of the Drupal Core SQL injection vulnerability to the CISA Known Exploited Vulnerabilities catalog mandates accelerated patching timelines for US federal agencies ^[8].

Sources

Cloud Atlas activity in the second half of 2025 and early 2026: new tools and a new payload - securelist.com
Ghostwriter Targets Ukraine Government Entities with Prometheus Phishing Malware - thehackernews.com
Megalodon GitHub Attack Targets 5,561 Repos with Malicious CI/CD Workflows - thehackernews.com
First VPN Dismantled in Global Takedown Over Use by 25 Ransomware Groups - thehackernews.com
‘First VPN’ Cybercrime Service Disrupted, Administrator Arrested - securityweek.com
Netherlands seizes 800 servers of hosting firm enabling cyberattacks - bleepingcomputer.com
Kimwolf DDoS Botnet Operator Arrested in Canada Over DDoS-for-Hire Attacks - thehackernews.com
US and Canada arrest and charge suspected Kimwolf botnet admin - bleepingcomputer.com
Canadian Man Arrested for Operating Kimwolf Botnet - securityweek.com
Former US execs plead guilty to aiding tech support scammers - bleepingcomputer.com
LiteSpeed cPanel Plugin CVE-2026-48172 Exploited to Run Scripts as Root - thehackernews.com
Drupal Core SQL Injection Bug Actively Exploited, Added to CISA KEV - thehackernews.com
Drupal: Critical SQL injection flaw now targeted in attacks - bleepingcomputer.com
Drupal Vulnerability in Hacker Crosshairs Shortly After Disclosure - securityweek.com
Trend Micro warns of Apex One zero-day exploited in the wild - bleepingcomputer.com
TrendAI Patches Apex One Zero-Day Exploited in the Wild - securityweek.com
Ubiquiti patches three max severity UniFi OS vulnerabilities - bleepingcomputer.com
Update Chrome now: Critical bugs could let attackers run code - malwarebytes.com
Fast and Furious – Nimbus Manticore Operations During the Iranian Conflict - research.checkpoint.com
Report: The Tycoon 2FA Phishing Kit Has Evolved - blog.knowbe4.com
Making Vulnerable Drivers Exploitable Without Hardware - The BYOVD Perspective - thehackernews.com
Foul play: Fake FIFA websites target soccer fans looking for World Cup tickets, merchandise - welivesecurity.com
Verizon DBIR: Healthcare Fends Off Increased Social Engineering Attacks - darkreading.com
Lawmakers Demand Answers as CISA Tries to Contain Data Leak - krebsonsecurity.com
In Other News: Industrial Router Exploitation, CISA KEV Nomination Form, Gas Station Hacking - securityweek.com

Cybersecurity Brief – 2025-12-20

Sat, 20 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

University of Sydney Data Breach: A data breach at the University of Sydney has affected 27,000 individuals, including current and former staff, affiliates, alumni, and students. The breach was linked to information downloaded from a code library.
Microsoft Teams Outage: Microsoft Teams experienced significant service disruptions, with widespread issues and delays in message delivery.
Denmark Water Utility Attack: Danish intelligence has attributed destructive cyberattacks on the country’s water utility and other critical infrastructure to Russian state actors, in what is described as part of a broader campaign of hybrid warfare against Western nations.

Newly Discovered Vulnerabilities

WatchGuard Fireware OS VPN Vulnerability (CVE-2025-14733): A critical remote code execution vulnerability (CVSS 9.3) in WatchGuard Fireware OS VPN is being actively exploited in the wild. Patches have been released.
UEFI Firmware Flaw in Major Motherboards: Certain ASRock, ASUS, GIGABYTE, and MSI motherboards are affected by a UEFI vulnerability allowing early-boot DMA attacks that can bypass memory protections.
FortiCloud SSO Exposure: Over 25,000 Fortinet devices with FortiCloud SSO enabled are exposed online, putting them at risk of remote attacks amid ongoing exploitation of a critical authentication bypass vulnerability.
DCOM Lateral Movement via Control Panel: Researchers detailed a method for abusing DCOM interfaces and the Windows Registry to load malicious DLLs into memory via the Control Panel, facilitating lateral movement on Windows systems.
ASUS Live Update Backdoor: CISA has added the ASUS Live Update backdoor to its Known Exploited Vulnerabilities catalog, noting it remains exploitable seven years after the original discovery.

Notable Threat Actor Activity

Cloud Atlas APT: Cloud Atlas has updated its toolkit, deploying new versions of its signature backdoors (VBShower, VBCloud, PowerShower, CloudAtlas) in recent campaigns.
Russia-Linked Microsoft 365 Phishing: A Russian-aligned threat group is conducting phishing campaigns targeting Microsoft 365 accounts using device code authentication workflows for account takeover.
RaccoonO365 Phishing Platform: Nigerian authorities arrested three individuals behind the RaccoonO365 phishing-as-a-service platform, which was used in targeted Microsoft 365 attacks against major corporations.
LongNosedGoblin (China-Aligned APT): The LongNosedGoblin group is targeting Southeast Asian and Japanese government networks, using Group Policy to deploy cyberespionage tools.
Kimwolf Android Botnet: The Kimwolf botnet, linked to the Aisuru IoT botnet, has compromised 1.8 million Android devices and issued over 1.7 billion DDoS attack commands.
Cracked Software/YouTube Malware Campaign: A new campaign is distributing CountLoader and GachiLoader malware via cracked software sites and YouTube videos.
North Korean Threat Activity: North Korean cybercriminals shifted strategy to target higher-value victims, employing more sophisticated and patient attack methods for larger financial gain.
Cisco VPNs and Email Services Attacks: Cisco reported two separate threat campaigns-one sophisticated and one broad-targeting its VPN and email services.

Trends, Tools, or Tactics of Interest

OAuth Device Code Phishing: Multiple threat actors are leveraging OAuth device code authorization mechanisms for phishing attacks on Microsoft 365 accounts.
Group Policy Abuse: Chinese APTs are deploying espionage tools via Group Policy across targeted government networks.
DCOM and DLL Abuse: Lateral movement techniques abusing DCOM interfaces and DLL loading via TLS Callbacks and Control Panel are being actively researched and reported.
Modular Loader Malware: New variants of modular and stealthy loaders, such as CountLoader and GachiLoader, are being distributed through popular cracked software channels and video platforms.
AI in Cybersecurity: Criminal IP’s integration with Palo Alto Networks Cortex XSOAR brings AI-driven exposure intelligence to automated incident response. Palo Alto Networks and Google Cloud have also announced a multibillion-dollar deal to integrate AI and cloud security capabilities.
Hardened Open Source Docker Images: Docker has released 1,000 hardened, production-ready container images as free and open source resources.

Regulatory or Policy Developments

FTC Settlement with Instacart: Instacart will refund $60 million to customers following an FTC settlement over deceptive subscription practices.
Thailand-Led International Anti-Scam Initiative: An international initiative to combat online scams was launched at a conference in Bangkok, with participation from ASEAN member states.
US Law Enforcement Action on Crypto Exchange: The US has shut down the E-Note crypto exchange and charged its Russian administrator for laundering funds for ransomware and other cybercriminal groups.
CISA KEV Catalog Update: CISA has updated its Known Exploited Vulnerabilities catalog to include the ASUS Live Update backdoor.
US Policy Shifts: The Trump administration has made significant policy changes perceived as weakening the nation’s cybersecurity posture and willingness to address technology challenges.