Fire Ant on DanSec Daily

Cybersecurity Brief – 2026-09-01

Tue, 01 Sep 2026 00:00:00 +0000

Major Incidents or Breaches

Berlin’s city administration confirmed data theft following a Rhysida ransomware attack, with cybercriminals attempting extortion after listing the city on a data leak site ^[18].
Hackers stole personal and health information affecting 9.5 million individuals from Aesto Health’s AWS infrastructure ^[33].
McKesson, a healthcare company, acknowledged a data breach after ShinyHunters claimed to have stolen hundreds of millions of records ^[42].
Nutex Health notified the SEC of a ransomware attack that compromised patient, employee, provider, business, and financial data ^[31].
Anthropic users were impacted by infostealer attacks, with session cookies stolen to gain access to Claude AI accounts and consume usage ^[19]^[41].
METR, an AI evaluation non-profit, suffered the theft of an API key, leading to the consumption of approximately $600,000 in AI credits ^[4].
Five Venezuelan nationals pleaded guilty in the US to ATM jackpotting attacks that involved attempting to physically install malware on ATMs to dispense cash ^[10]^[30].
The Cronos blockchain network was restarted after a price-manipulation exploit on the Tectonic lending platform enabled the theft of $74 million ^[12].

Newly Discovered Vulnerabilities

Nearly 22,000 Microsoft Exchange servers remain unpatched and exposed to a high-severity authentication bypass vulnerability, allowing attackers to hijack user mailboxes ^[9].
Two critical vulnerabilities in PaperCut NG and MF print management software (CVE-2026-82078 and CVE-2026-81578) are being actively exploited in data theft attacks; CISA has added these to its Known Exploited Vulnerabilities (KEV) catalog ^[11]^[35].
A critical authentication bypass vulnerability in JFrog Artifactory (CVE-2026-82329) is being exploited in the wild just days after disclosure ^[32].
WatchGuard patched three critical vulnerabilities in its Fireware OS iked process that could allow unauthenticated remote code execution ^[34].
ServiceNow patched three critical code injection vulnerabilities that could allow attackers to execute arbitrary code and access or tamper with data ^[37].
A critical flaw in Langflow (CVE-2026-0768) is under active exploitation, allowing unauthenticated remote execution of arbitrary Python code ^[6]^[29].
Kaspersky patched a vulnerability in its Endpoint Security product exploited by the Nightmare Eclipse group using the ‘HardBreacher’ technique ^[36].
Critical vulnerabilities in Ruby on Rails are being exploited for credential-probing and command and control activity ^[6].
JSCeal, a stealer targeting cryptocurrency applications, is delivered as compiled V8 bytecode and executed by a bundled Node.js runtime ^[38].

Notable Threat Actor Activity

Mirage Kitten, an Iran-linked threat actor, is targeting aviation and FinTech sectors across the Middle East and Africa with new malware families NodeRabbit (Node.js) and PollCat (JavaScript) ^[1].
The Russia-aligned UAC-0099 group is using a new technique, GuardBreaker, to plant nuclear weapon prompts in malware aimed at disrupting AI analysis in Ukraine ^[5].
North Korean threat actors are expanding job fraud operations beyond IT into healthcare and sales, seeking illicit employment in new sectors ^[7].
The Chinese Fire Ant group is using Cisco routers as spying platforms by establishing unauthorized GRE tunnel interfaces ^[16].
Rhysida ransomware is actively extorting the city of Berlin following a successful attack ^[18].
The Nightmare Eclipse group is exploiting a Kaspersky Endpoint Security vulnerability with a tool called ‘HardBreacher’ ^[36].

Trends, Tools, or Tactics of Interest

Abuse of enterprise collaboration tools by threat actors has increased fourfold in the past year as attackers use these platforms to evade detection ^[2].
The TerminalFix campaign, a variant of ClickFix, uses fake Cloudflare CAPTCHA prompts to trick users into executing malicious PowerShell commands, establishing reverse tunnels for deeper network access ^[13]^[20]^[40].
Infostealers are being used to hijack AI service accounts such as Anthropic’s Claude by stealing session cookies, enabling unauthorized access and usage ^[19]^[41].
Attackers are exploiting critical vulnerabilities in Langflow and Rails for credential harvesting and establishing command and control channels ^[6]^[29].
A router backdoor was observed where devices shipped with remote access enabled, allowing attackers to collect traffic and credentials and then erase logs ^[8].
Researchers demonstrated that AI models, such as Claude, can be used to port PLC exploits between device models quickly, reducing the barrier for industrial exploit development ^[28].
Job fraud tactics by North Korean actors are diversifying to include healthcare and sales roles ^[7].
JSCeal stealer is delivered in compiled V8 bytecode format and executed by a bundled Node.js runtime, targeting cryptocurrency users ^[38].

Regulatory or Policy Developments Affecting the Security Industry

CISA added the actively exploited PaperCut vulnerabilities (CVE-2026-82078 and CVE-2026-81578) to its Known Exploited Vulnerabilities catalog, signaling increased urgency for patching ^[35].
Nutex Health disclosed its ransomware breach to the SEC, reflecting regulatory requirements for timely breach notification ^[31].

Sources

Berlin confirms data theft after Rhysida ransomware attack claims - bleepingcomputer.com
9.5 Million Impacted by Aesto Health Data Breach - securityweek.com
McKesson confirms cyber incident after ShinyHunters claims patient-data theft - malwarebytes.com
Ransomware Gang Claims Nutex Health Data Breach - securityweek.com
Anthropic Users Hit by Infostealer Attacks, Session Thefts - darkreading.com
Infostealers are hijacking Claude accounts at users’ expense - malwarebytes.com
Attackers Steal METR API Key and Consume AI Credits Worth About $600,000 - thehackernews.com
Five Venezuelans plead guilty to ATM jackpotting attacks in US - bleepingcomputer.com
Five Venezuelans Plead Guilty in US Court to ATM Jackpotting - securityweek.com
Cronos blockchain restarts after $74 million Tectonic exploit - bleepingcomputer.com
Nearly 22,000 Microsoft Exchange servers vulnerable to hijack attacks - bleepingcomputer.com
Recently patched PaperCut zero-days used in data theft attacks - bleepingcomputer.com
PaperCut Exploitation Escalates to Active Intrusions - securityweek.com
Critical JFrog Artifactory Vulnerability Reportedly Exploited in the Wild - securityweek.com
WatchGuard Patches Critical Vulnerabilities - securityweek.com
ServiceNow Patches 3 Critical Code Injection Vulnerabilities - securityweek.com
Attackers Exploit Critical Langflow and Rails Flaws in Credential-Probing and C2 Activity - thehackernews.com
Hackers Start Exploiting Critical Langflow Vulnerability - securityweek.com
Nightmare Eclipse Drops ‘HardBreacher’ Kaspersky Product Exploit - securityweek.com
Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode - research.checkpoint.com
Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set - securelist.com
Russia-Aligned UAC-0099 Plants Nuclear Weapon Prompt in Malware to Disrupt AI Analysis - thehackernews.com
North Korean Job Fraud Expands Beyond IT Into Healthcare and Sales - thehackernews.com
Chinese Fire Ant hackers turn Cisco routers into spying platforms - bleepingcomputer.com
Attackers Abuse Enterprise Collaboration Tools to Avoid Detection - blog.knowbe4.com
Microsoft warns of TerminalFix attacks deploying reverse tunnels - bleepingcomputer.com
'TerminalFix' Campaign Weaponizes PowerShell for Enterprise Attacks - darkreading.com
TerminalFix looks like ClickFix, but delivers a very different payload - malwarebytes.com
⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off-Task, Router Backdoors and More - thehackernews.com
Experiment: Porting a PLC Exploit With AI Takes Hours and Hundreds of Dollars - securityweek.com

Cybersecurity Brief – 2026-08-31

Mon, 31 Aug 2026 00:00:00 +0000

Major Incidents or Breaches

McKesson, a major healthcare company, has confirmed a data breach after the ShinyHunters extortion group claimed responsibility for stealing 284 million records, which reportedly include patient data. The company is responding as the attacker’s deadline for extortion approaches ^[22]^[32].
Berlin city administration has confirmed data theft following a ransomware attack by the Rhysida group. Rhysida claims to have exfiltrated over 5TB of data, including personal information and credentials, and is attempting to extort the city. Berlin authorities have stated they will not pay the ransom ^[11]^[29].
Manchester Airports Group is the subject of a data breach claim by the extortion group FulcrumSec, which alleges theft of over 80GB of data and plans to leak it online ^[27]^[31].
Boston Scientific continues to recover from a cyberattack that caused global network disruption. CrowdStrike and other firms are assisting with the investigation ^[26].

Newly Discovered Vulnerabilities

ServiceNow has patched three critical code injection vulnerabilities that could allow attackers to execute arbitrary code and access or tamper with data ^[21].
Kaspersky has patched a vulnerability in its Endpoint Security product after the exploit “HardBreacher” was released by the threat group Nightmare Eclipse ^[20].
A critical Ruby on Rails vulnerability, named KindaRails2Shell, allows attackers to perform arbitrary file reads to extract secrets and execute code remotely. This flaw is actively being targeted by attackers ^[25].
A security researcher has disclosed nine vulnerabilities affecting ATM encryption and authentication software, highlighting systemic weaknesses in the software supply chain for ATM systems ^[17].

Notable Threat Actor Activity

The threat actor known as Silver Fox is distributing the ValleyRAT backdoor disguised as signed Chinese adware. The malware is run under trusted processes and users are sometimes tricked into adding it to antivirus exclusions ^[1]^[4].
The Aurora (Aur0ra) ransomware group has used SpaceX’s AI-powered coding assistant, Cursor, in attacks against at least ten targets ^[5].
The China-linked cyber espionage group Fire Ant has expanded operations to compromise Cisco IOS XR routers, using them to steal credentials and blind security logs. Fire Ant has also been observed creating unexplained GRE tunnel interfaces on compromised routers, turning them into spying platforms ^[7]^[9].

Trends, Tools, or Tactics of Interest

There is increased use of AI-powered tools and agents in cyberattacks, as demonstrated by Aurora ransomware’s use of Cursor and the need for security teams to treat AI agents as highly privileged identities following incidents involving Hugging Face and Claude ^[5]^[23]^[24].
Offensive security toolkits such as Praetorian are consolidating established workflows into portable Go-based tools, supporting direct pipelines and shared SDKs for red team operations ^[19].
JSCeal, a stealer targeting cryptocurrency applications, is being delivered as compiled V8 bytecode executed by a bundled Node.js runtime, representing a novel malware delivery technique ^[30].

Regulatory or Policy Developments Affecting the Security Industry

A judge has ruled that the Pentagon’s measures against Anthropic, which labeled the company as a supply chain risk, were illegal and baseless. This decision is part of an ongoing legal dispute between Anthropic and the US government ^[28].
The US Department of Justice has corrected a previous statement regarding Chinese cyberattacks, clarifying that US agencies were targets but not confirmed victims ^[8].

Sources

McKesson Confirms Data Breach as Attacker Deadline Looms - securityweek.com
McKesson confirms cyber incident after ShinyHunters claims patient-data theft - malwarebytes.com
Berlin confirms data theft after Rhysida ransomware attack claims - bleepingcomputer.com
Berlin Won’t Pay Extortion Group Claiming Data Theft - securityweek.com
Extortion Group Claims Manchester Airports Group Data Breach - securityweek.com
31th August – Threat Intelligence Report - research.checkpoint.com
Boston Scientific Still Recovering From Cyberattack - securityweek.com
ServiceNow Patches 3 Critical Code Injection Vulnerabilities - securityweek.com
Nightmare Eclipse Drops ‘HardBreacher’ Kaspersky Product Exploit - securityweek.com
Critical Ruby on Rails Vulnerability in Attackers’ Crosshairs - securityweek.com
ATM Flaws Reveal Key Weaknesses in the Software Supply Chain - wired.com
ValleyRAT masquerading as adware - securelist.com
ValleyRAT Backdoor Hides in Signed Adware That Users Add to Antivirus Exclusions - thehackernews.com
Aurora Ransomware Operators Use Cursor AI in Attacks Against 10 Targets - thehackernews.com
China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs - thehackernews.com
Chinese Fire Ant hackers turn Cisco routers into spying platforms - bleepingcomputer.com
What the Hugging Face Incident Teaches Security Leaders About AI Agent Access - securityweek.com
Anthropic Warns Claude Users of Infostealer Malware Infections - securityweek.com
Praetorian – Offensive Security Tools Built Around Portable Go Workflows - darknet.org.uk
Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode - research.checkpoint.com
Judge Says Pentagon’s Measures Against Anthropic Were ‘Illegal and Baseless’ - securityweek.com
DoJ Corrects China Hacking Claim, Says U.S. Agencies Were Targets, Not Victims - thehackernews.com

Cybersecurity Brief – 2025-07-27

Sun, 27 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Allianz Life confirmed a data breach impacting the majority of its 1.4 million customers, exposing personal information.
Steam platform was abused to distribute malware via a pre-release version of a game, leading to infostealer infections.
Instagram users are being targeted in a novel phishing campaign using convincing emails to steal credentials.

Newly Discovered Vulnerabilities

Over 200,000 WordPress sites are exposed to hijacking attacks due to a vulnerability in the Post SMTP plugin, allowing attackers to take control of administrator accounts.
Mitel patched a critical authentication bypass vulnerability in its MiVoice MX-ONE enterprise communication platform, which could allow attackers to access user or admin accounts.
LG Innotek LNV5110R security cameras are vulnerable to unauthenticated remote code execution; no patch is available.
A Google Cloud Build vulnerability was disclosed, earning a $30,000 bug bounty.
ToolShell bugs in Microsoft SharePoint are being actively exploited by cybercriminals and APT groups worldwide.

Notable Threat Actor Activity

The North Korean IT worker scheme continues, with the US sanctioning a front company and three individuals involved in fraudulent remote IT work. An Arizona woman was sentenced to over 8 years in prison for running a “laptop farm” that helped North Korean operatives infiltrate over 300 US firms.
Patchwork, an APT group, is targeting Turkish defense contractors with spear-phishing campaigns using malicious LNK files to gather strategic intelligence.
Chinese cyberespionage group “Fire Ant” is targeting virtualization and networking infrastructure, including VMware environments, to breach isolated network segments.
A cyber espionage campaign dubbed “Operation Carpet” is targeting Russian aerospace and defense sectors, deploying the EAGLET backdoor for data exfiltration.
Soco404 and Koske malware campaigns are targeting cloud services by exploiting vulnerabilities and misconfigurations to deploy cryptocurrency miners.
Koske Linux malware, developed with AI assistance, demonstrates advanced features in payload development, persistence, and adaptability.

Trends, Tools, or Tactics of Interest

Ransomware attacks surged by 63% year-over-year in Q2 2025, with 276 publicly disclosed incidents.
Increased use of generative AI tools developed in China has been observed among employees in the US and UK, frequently without security team oversight.
AI-generated malware, such as Koske, is reaching sophistication levels comparable to or exceeding traditional human-developed malware.
Security “nudges” are being increasingly adopted to influence user behavior, though concerns exist about their overuse.
Young individuals are being recruited into cybercriminal groups, attracted by community, financial incentives, and a perception of low prosecution risk.
Modern phishing kit distribution remains active, with a UK student sentenced for selling over 1,000 kits responsible for over $134 million in losses.
Steam games and popular platforms remain a vector for malware delivery, with attackers leveraging pre-release software for distribution.

Regulatory or Policy Developments Affecting the Security Industry

The US Department of the Treasury’s OFAC imposed sanctions on a North Korean front company and three individuals for involvement in fraudulent IT worker schemes.
The US government announced up to $15 million in rewards for information leading to the disruption of North Korea’s illicit IT operations.
Legal actions continue against individuals facilitating North Korean cyber operations, with significant prison sentences handed down.

Cybersecurity Brief – 2025-07-26

Sat, 26 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Ransomware attacks increased by 63% year-over-year in Q2 2025, with 276 publicly disclosed incidents reported.
A hacker compromised Amazon’s Q Developer Extension for Visual Studio Code, injecting data-wiping commands into the AI-powered coding agent.
Louis Vuitton experienced a data breach impacting customers in multiple countries.
Steam’s game publishing platform was abused to distribute info-stealing malware via a pre-release version of a game.
UK national Ollie Holman was sentenced to prison for selling over 1,000 phishing kits, causing losses exceeding $134 million.
Instagram users are being targeted in a novel phishing campaign leveraging legitimate-looking emails to steal credentials.

Newly Discovered Vulnerabilities

Mitel patched a critical authentication bypass vulnerability in its MiVoice MX-ONE enterprise communication platform, which could allow attackers to access user or admin accounts.
LG Innotek LNV5110R security cameras are affected by an unauthenticated remote code execution vulnerability; no patch is currently available.
A Google Cloud Build vulnerability was disclosed, earning a $30,000 bug bounty.
Microsoft removed a compatibility hold blocking Windows 11 2024 Update installations for users of Easy Anti-Cheat, following resolution of a blue screen issue.

Notable Threat Actor Activity

The North Korean IT worker scheme remains active; the US sanctioned a North Korean front company and three nationals for fraudulent remote IT work, and an Arizona woman was sentenced to prison for operating a laptop farm enabling North Korean infiltration of over 300 US firms.
The Patchwork threat actor is conducting spear-phishing campaigns targeting Turkish defense firms using malicious LNK files to collect strategic intelligence.
A cyber espionage campaign dubbed “Operation Caramel” targeted Russian aerospace and defense sectors with the EAGLET backdoor for data exfiltration.
The Chinese-nexus group “Fire Ant” targeted virtual environments, exploiting networking and virtualization flaws to breach isolated network segments.
Two malware campaigns, Soco404 and Koske, targeted cloud services with cross-platform cryptomining attacks exploiting vulnerabilities and misconfigurations.
AI-generated malware, specifically the Koske Linux miner, is being actively deployed, demonstrating advanced features such as persistence and adaptive payload development.

Trends, Tools, or Tactics of Interest

Use of generative AI tools developed in China is widespread among employees in the US and UK, often without security team oversight.
AI is increasingly being used to develop sophisticated malware, as seen with the Koske Linux miner, which rivals or exceeds traditional human-developed malware.
Attackers are leveraging vulnerabilities and misconfigurations in cloud environments for cryptomining operations.
Security nudges are being adopted as behavioural interventions but face challenges related to overuse.
There is a growing trend of young individuals being recruited into cybercriminal groups, motivated by community, financial gain, and perceived low risk of prosecution.
Organisations’ attack surfaces are expanding, increasing exposure to threats.

Regulatory or Policy Developments Affecting the Security Industry

The US Department of the Treasury’s OFAC sanctioned a North Korean front company and three nationals for involvement in fraudulent IT worker schemes.
The US Department of Justice sentenced an Arizona woman to over eight years in prison for aiding North Korean IT worker infiltration of US companies.
The US announced a $15 million reward for information leading to the disruption of North Korea’s illicit IT worker operations.

Cybersecurity Brief – 2025-07-25

Fri, 25 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Law enforcement has seized the dark web extortion sites of the BlackSuit ransomware operation, which has breached hundreds of organizations globally.
Toptal’s GitHub organization account was compromised, with attackers publishing ten malicious npm packages to the npm registry.
Security flaws in Airportr, a luggage service used by 10 airlines, exposed user data and allowed attackers to potentially redirect or steal luggage.
A threat actor named EncryptHub compromised an early access Steam game to distribute info-stealing malware to users.
CastleLoader malware has infected 469 devices by leveraging fake GitHub repositories and phishing techniques (ClickFix) to deliver info-stealers and remote access trojans.
Multiple npm developer accounts were compromised in a phishing campaign, resulting in malware being injected into popular npm packages.

Newly Discovered Vulnerabilities

Microsoft SharePoint: Five vulnerabilities collectively known as ToolShell were detailed, including a POST request exploit that can bypass initial patches. Over 400 SharePoint servers, including US government systems, have been targeted.
Mitel MiVoice MX-ONE: A critical authentication bypass vulnerability has been disclosed and patched, allowing attackers to gain full access to affected systems.
Sophos Firewall and SonicWall SMA 100 Series: Critical remote code execution vulnerabilities have been patched. SonicWall specifically urges immediate updates due to recent malware attacks exploiting these flaws.
Airportr: Web security bugs exposed sensitive user data and allowed privilege escalation.
AI-generated image watermarks have been found to be easily removable, undermining some anti-misinformation controls.

Notable Threat Actor Activity

Storm-2603, a China-based threat actor, is actively exploiting SharePoint ToolShell vulnerabilities to deploy Warlock ransomware in ongoing campaigns.
Fire Ant, a threat actor, is targeting VMware ESXi hosts and vCenter environments in a prolonged cyber espionage campaign.
China-nexus APTs have deployed fake Dalai Lama apps to spy on the Tibetan community in multi-stage attacks.
BlackSuit ransomware infrastructure was disrupted by law enforcement following a global campaign of breaches.
High-value npm developer accounts have been targeted in phishing campaigns to distribute malicious packages.
Koske, a new Linux malware, is using steganography-hiding malicious payloads in panda JPEG images-and may have been developed with AI.

Trends, Tools, or Tactics of Interest

Ransomware groups are increasingly exploiting SharePoint ToolShell vulnerabilities, with a focus on unpatched systems.
CastleLoader demonstrates the use of fake GitHub repositories and phishing as initial infection vectors for malware distribution.
New malware delivery methods include steganography (Koske) and compromised software supply chains (npm, Steam games).
The evilreplay tool enables real-time browser session hijacking via XSS without the need for cookie theft, providing interactive post-exploitation control.
Offensive security is shifting towards continuous, proactive testing rather than annual penetration tests.
Law enforcement actions are increasing against cybercrime forums (e.g., XSS) and ransomware operations.

Regulatory or Policy Developments Affecting the Security Industry

The UK has implemented mandatory age verification for adult content access, raising privacy and security concerns about the collection and management of personal data.
New York is seeking public input on proposed cyber regulations for water systems, including incident reporting, response plans, and compliance certification.
Clorox has filed a $380 million lawsuit against Cognizant over a 2023 hack, alleging that IT provider actions enabled the breach.