Cobalt Strike on DanSec Daily

Cybersecurity Brief – 2026-06-27

Sat, 27 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Polymarket customers lost approximately $3 million after hackers injected a malicious script into the platform’s frontend via a third-party vendor compromise. Polymarket has stated it will fully reimburse affected customers ^[16]^[31].
The Klue-Salesforce breach has impacted roughly two dozen companies, with affected organizations notifying their customers of the incident ^[27].
Exposed records from the Dialog group included personal information of a senior White House intelligence official and an active-duty special operations officer, prompting a Pentagon review ^[25].

Newly Discovered Vulnerabilities

A high-severity vulnerability in Amazon Q Developer allowed malicious repositories to execute code and steal developers’ cloud credentials. AWS has patched the flaw and issued an advisory ^[7]^[26].
CVE-2026-46331, also known as “pedit COW,” is an out-of-bounds write flaw in the Linux kernel’s traffic-control subsystem that enables local privilege escalation to root ^[6].
DirtyClone is a newly disclosed Linux kernel privilege escalation vulnerability in the DirtyFrag family. Researchers have published a working exploit for the flaw ^[9].
The US Cybersecurity and Infrastructure Security Agency (CISA) has added a critical remote code execution vulnerability affecting PTC Windchill PDMlink and PTC FlexPLM to its Known Exploited Vulnerabilities (KEV) catalog, as web shell attacks exploiting this flaw continue ^[8].
CISA has set an urgent deadline for federal agencies to patch an actively exploited vulnerability in Cisco Unified Communications Manager Server ^[15].

Notable Threat Actor Activity

Russian intelligence-linked hackers have evolved their phishing campaign targeting Signal users. The latest tactics involve tricking victims into providing Signal Backup Recovery Keys, granting attackers access to message histories ^[3]^[14].
The Turla group, a Russian APT, has deployed the StockStay backdoor in espionage operations against Ukrainian government and military targets ^[32].
A Chinese-speaking APT has been linked to the deployment of a new custom backdoor, TinyRCT, in attacks against government entities and critical infrastructure in Southeast Asia ^[5].
A newly observed campaign is delivering SharkLoader malware, which acts as a loader for deploying Cobalt Strike Beacon on compromised systems ^[4].
Cybersecurity researchers have detected a supply chain attack involving the Miasma malware family, which targeted npm packages and GitHub Actions ^[11].
Microsoft reported a phishing campaign targeting hotels and hospitality organizations in Europe and Asia, using photo-themed ZIP files to deliver a Node.js implant ^[12].
Threat actors are impersonating legitimate companies by creating fraudulent OpenAI tenants and inviting cybersecurity firm employees, aiming to collect sensitive corporate information ^[17].
Malware campaigns are installing malicious Chrome extensions via phishing to steal Chrome session cookies and hijack user accounts on Windows devices ^[33].
Russian authorities used Cellebrite forensic tools to extract data from an opposition activist’s iPhone, despite Cellebrite’s earlier claims of halting sales to Russia ^[13]^[28].

Trends, Tools, or Tactics of Interest

There is a continued rise in supply chain attacks, as evidenced by recent incidents involving npm packages, GitHub Actions, and third-party vendor compromises ^[11]^[16]^[31].
Attackers are increasingly targeting backup and recovery mechanisms within secure messaging platforms, as seen in the Signal phishing campaigns ^[3]^[14].
The use of Cobalt Strike Beacon remains prevalent in new malware loader campaigns, such as those involving SharkLoader ^[4].
AI agents are being integrated into enterprise identity governance, inheriting permissions and traversing systems with minimal oversight ^[10].
Confidence in autonomous penetration testing tools powered by AI is declining, with organizations experimenting but relying less on these technologies ^[19].
The Open Source Sustainability Initiative has launched to help enterprises manage and secure aging open source projects and maintain regulatory compliance ^[21].
The Linux Foundation has announced Akrites, a new open source security project to support vulnerability reporting, patching, and disclosure in open source software ^[30].

Regulatory or Policy Developments Affecting the Security Industry

CISA continues to mandate urgent patching of actively exploited vulnerabilities in widely used enterprise products, including Cisco Unified Communications Manager Server and PTC Windchill ^[8]^[15].
The Open Source Sustainability Initiative aims to address regulatory compliance challenges related to end-of-life open source software ^[21].

Sources

Polymarket customers lose $3 million in supply-chain attack - bleepingcomputer.com
$3 Million Reportedly Stolen in Polymarket Hack - securityweek.com
More Klue Breach Victims Identified as Hackers Get Hacked - securityweek.com
The Pentagon Is Looking Into the Dialog Data Exposure for Unmasking National Security Officials - wired.com
Amazon Q Developer Flaw Could Let Malicious Repos Run Code via MCP Configs - thehackernews.com
Amazon Q Flaw Enabled Cloud Credential Theft via Malicious Repositories - securityweek.com
New Linux pedit COW Exploit Enables Root Access by Poisoning Cached Binaries - thehackernews.com
New DirtyClone Linux Kernel Flaw Lets Local Users Gain Root via Cloned Packets - thehackernews.com
CISA Adds Exploited PTC Windchill RCE Flaw to KEV as Web Shell Attacks Continue - thehackernews.com
CISA sets urgent deadline to fix Cisco flaw exploited in attacks - bleepingcomputer.com
FBI Warns Russian Intelligence Hackers Target Signal Backup Recovery Keys - thehackernews.com
FBI: Russian hackers now target Signal backup recovery keys - bleepingcomputer.com
Russian APT Deploys ‘StockStay’ Backdoor Against Ukrainian Targets - securityweek.com
Chinese-Speaking APT Deploys New TinyRCT Backdoor in Southeast Asia Campaign - thehackernews.com
New SharkLoader Malware Deploys Cobalt Strike in StrikeShark Cyberattacks - thehackernews.com
Miasma Malware Targets npm Packages and GitHub Actions in Supply Chain Attack - thehackernews.com
Microsoft Warns of Photo ZIP Phishing Campaign Targeting Hotels with Node.js Implant - thehackernews.com
Cybersecurity firms targeted by fraudulent OpenAI organization invites - bleepingcomputer.com
Malware steals Chrome session cookies to take over your accounts - malwarebytes.com
Russia Used Cellebrite on Jailed Activist's iPhone Months After Sales Cutoff - thehackernews.com
In Other News: Chinese Mythos-Like AI, Tata Electronics Breach, Snyk Layoffs - securityweek.com
Guardian Agents: The Next Layer of Identity Governance - thehackernews.com
AI Decline? Confidence in Autonomous Penetration Testing Falls - darkreading.com
New Initiative Tackles Security for End-of-Life Open Source Software - darkreading.com
Linux Foundation Unveils New Open Source Security Project Akrites - securityweek.com

Cybersecurity Brief – 2025-07-31

Thu, 31 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

The ShinyHunters extortion group has been linked to data breaches at Qantas, Allianz Life, LVMH, and Adidas, using voice phishing attacks to steal data from Salesforce environments.
SafePay ransomware group claims to have stolen 3.5TB of data from Ingram Micro and is threatening to leak the data.
Telecom provider Orange suffered a cyberattack resulting in service disruptions for both corporate and individual customers.
The UNC2891 (LightBasin) threat group attempted a physical intrusion by planting a 4G-equipped Raspberry Pi on a bank’s network during a failed ATM heist.
The City of Saint Paul, Minnesota, called in the National Guard to respond to a cyberattack.
The National Treasury of South Africa and several other organisations were compromised in mass exploits of on-premises Microsoft SharePoint servers.
A U.S.-based chemicals company was breached via exploitation of a SAP NetWeaver vulnerability, leading to deployment of the Auto-Color backdoor.
The Python Software Foundation warned that attackers are using a fake PyPI website to phish for developer credentials.
Over 250 fake mobile apps targeting Koreans have been used to deploy spyware and conduct blackmail campaigns.
Discord and other social platforms are being flooded with fraudulent online gaming and wagering sites, which lure users and steal funds.

Newly Discovered Vulnerabilities

Apple released security updates for iOS, iPadOS, and Safari, patching 29 vulnerabilities, including a WebKit flaw that was exploited as a zero-day in Google Chrome.
Lenovo issued UEFI firmware updates to address high-severity BIOS flaws enabling Secure Boot bypass in certain desktop models.
Critical, now-patched vulnerabilities in Dahua smart camera firmware could allow remote hijacking via ONVIF and file upload exploits.
Researchers disclosed a critical authentication bypass in the Vibe coding platform Base44, which exposed private enterprise applications; Wix patched the issue.
A critical unauthenticated arbitrary file upload vulnerability in the WordPress ‘Alone’ theme is being actively exploited for remote code execution and full site takeovers.

Notable Threat Actor Activity

Cobalt Strike Beacon is being delivered via social media, Microsoft Learn Challenge, Quora, and GitHub in a campaign targeting Russian entities.
Hackers are distributing JSCEAL malware through Facebook ads promoting fake cryptocurrency trading apps, using compiled V8 JavaScript to capture sensitive data.
Chinese state-sponsored group Silk Typhoon (Hafnium) is linked to over 15 technology patents for cyber espionage tools, highlighting PRC-backed contractor involvement.
Scattered Spider’s activity has decreased following recent arrests, but their social engineering and backup targeting tactics are being adopted by other financially motivated actors.

Trends, Tools, or Tactics of Interest

Device Bound Session Credentials (DBSC) launched in open beta in Google Chrome to protect against session cookie theft.
A new attack vector allows threat actors to use malicious browser extensions to inject prompts into popular generative AI tools, including ChatGPT and Gemini (“Man in the Prompt” attack).
AI adoption in vCISO services is rapidly increasing, with a reported 68% reduction in workload and tripling of adoption rates among MSPs and MSSPs.
VPN usage in the UK is rising sharply in response to age verification controls mandated by the Online Safety Act.
Security awareness training and tools, such as KnowBe4’s Phish Alert Button, can significantly increase employee phishing reporting rates, as evidenced by a 50-fold increase in a large retail organisation.
Fraudsters are exploiting Discord and social media to promote sophisticated scam gaming sites.
Mass exploitation of on-premises Microsoft SharePoint servers continues to impact organisations, particularly in Africa.
Threat actors are using phishing with fake PyPI sites to target software developers and steal credentials.

Regulatory or Policy Developments

The US Senate Committee has advanced the nomination of Sean Plankey to lead the Cybersecurity and Infrastructure Security Agency (CISA).
The UK’s Online Safety Act, which mandates age verification on adult sites, is directly influencing a surge in VPN adoption across the region.

Industry Developments

Palo Alto Networks announced the acquisition of CyberArk for $25 billion, marking a significant move into the identity security market.
BlinkOps raised $50 million for its agentic security automation platform, bringing total funding to $90 million.
Legion emerged from stealth with $38 million in funding for its browser-native AI Security Operations Center (SOC) platform.
Cyata, an Israeli startup focused on AI agent monitoring and control, raised $8.5 million in funding.
The average cost of a data breach in the US has risen to $10.22 million, while the global average has decreased slightly to $4.44 million, according to IBM.

Cybersecurity Brief – 2025-05-23

Fri, 23 May 2025 00:00:00 +0000

Major Incidents or Breaches

Chinese Threat Actor Activity:
- Chinese-speaking group UAT-6382 exploited a now-patched remote code execution vulnerability in Trimble Cityworks to breach multiple US local government networks, deploying Cobalt Strike and VShell.
- Chinese nexus actors exploited recently patched Ivanti Endpoint Manager Mobile (EPMM) vulnerabilities to target government agencies and enterprises across Europe, North America, and Asia.
Phishing Campaign Targeting International Students:
- The FBI reported an ongoing phishing campaign specifically targeting Middle Eastern students studying in the US, aiming to steal personal and financial information.
Database Exposure:
- A database containing 184 million login credentials, including those for Apple, Google, Meta, and various government services, was discovered and subsequently taken offline.
Cryptocurrency Theft via Fake Apps:
- Cybercriminals are distributing fake Ledger apps targeting macOS users to steal cryptocurrency seed phrases and digital assets.