GopherWhisper on DanSec Daily

Cybersecurity Brief – 2026-04-27

Mon, 27 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

Itron, Inc., an American utility firm, disclosed a cybersecurity incident involving unauthorised access to certain internal IT systems. The breach was reported to the U.S. Securities and Exchange Commission via an 8-K filing.
Discord users reportedly gained unauthorised access to Anthropic’s ‘Mythos’, with the incident highlighting unauthorised data exposure.
500,000 UK health records were listed for sale on Alibaba, indicating a significant data exposure event affecting sensitive personal information.

Newly Discovered Vulnerabilities

Apple patched a notification-related bug that could reveal sensitive information to unauthorised parties.

Notable Threat Actor Activity

A threat group tracked as UNC6692 leveraged Microsoft Teams in a social engineering campaign to deploy a new custom malware suite named ‘Snow’. The suite includes a browser extension, tunneler, and backdoor functionality.
China-linked APT group GopherWhisper was observed abusing legitimate services in attacks against government organisations. The group utilises multiple Go-based backdoors, custom loaders, and injectors.

Trends, Tools, or Tactics of Interest

Researchers uncovered a pre-Stuxnet malware, named ‘fast16’, written in Lua and designed to target engineering software, predating the well-known Stuxnet worm.
Spy firms are exploiting global telecom infrastructure weaknesses to track targets, as reported in recent security news coverage.

Regulatory or Policy Developments Affecting the Security Industry

Itron’s disclosure of its cybersecurity incident via SEC 8-K filing reflects ongoing regulatory requirements for timely breach reporting by publicly traded companies.

Cybersecurity Brief – 2026-04-26

Sun, 26 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

500,000 UK health records have been listed for sale on Alibaba, indicating a significant data breach involving sensitive personal information.
Discord users gained unauthorized access to Anthropic’s Mythos, exposing internal information from the AI company.

Newly Discovered Vulnerabilities

Apple has patched a notification bug that could potentially reveal sensitive information to unauthorized parties.

Notable Threat Actor Activity

The China-linked APT group “GopherWhisper” is conducting targeted attacks against government entities. The group leverages multiple Go-based backdoors and employs custom loaders and injectors, abusing legitimate services to evade detection.
Threat actor UNC6692 is using Microsoft Teams for social engineering, deploying a new malware suite called “Snow.” The suite includes a browser extension, tunneler, and backdoor to maintain persistence and facilitate lateral movement.

Trends, Tools, or Tactics of Interest

Researchers have uncovered “fast16,” a Lua-based malware predating Stuxnet, designed to target engineering software used in industrial environments, with indications it was intended for sabotage.
Threat groups are increasingly abusing legitimate collaboration and communication platforms (e.g., Microsoft Teams, Discord) to deliver malware and gain unauthorized access.
Spy firms are exploiting weaknesses in global telecom infrastructure to track targets, highlighting ongoing concerns around telecom security.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft has announced a revamp of the Windows Insider Program to address performance and reliability issues in Windows 11, which may impact enterprise testing and deployment practices.

Cybersecurity Brief – 2026-04-24

Fri, 24 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

Bitwarden CLI npm package was compromised as part of a wider Checkmarx supply chain attack campaign. Attackers uploaded a malicious @bitwarden/cli package to npm, which contained a credential-stealing payload capable of spreading to other projects. The incident is linked to the Shai-Hulud worm and affected developer environments.
Checkmarx KICS analysis tool was impacted in the same supply chain campaign, with compromised Docker images, VSCode, and Open VSX extensions used to harvest sensitive data from developer environments.
Vercel disclosed additional compromised customer accounts following a breach that enabled unauthorized access to internal systems.
Dutch cosmetics company Rituals reported a data breach affecting customers of its “My Rituals” membership programme, with personal information including names and addresses accessed by attackers.
A $290 million DeFi hack was reported, details unspecified but significant in scale.
Hackers are actively exploiting a critical file upload vulnerability in the Breeze Cache WordPress plugin, allowing unauthenticated arbitrary file uploads to affected servers.

Newly Discovered Vulnerabilities

PhantomRPC: A newly discovered Windows RPC privilege escalation technique enables attackers to create fake RPC servers and escalate privileges.
LMDeploy CVE-2026-33626: A high-severity flaw in the LMDeploy open-source toolkit for LLMs was publicly disclosed and exploited in the wild within 13 hours.
Apple patched CVE-2026-28950, a Notification Services vulnerability in iOS/iPadOS (versions 26.4.2 and 18.7.8), which allowed recovery of deleted notifications, including chat previews.
CISA ordered US federal agencies to patch a Microsoft Defender privilege escalation zero-day, dubbed BlueHammer, that has been actively exploited.
Cisco ASA, Firepower, and Secure Firewall products are being targeted by FIRESTARTER malware, with CISA issuing an alert regarding ongoing exploitation.

Notable Threat Actor Activity

GopherWhisper, a newly identified China-aligned APT group, has targeted at least 12 Mongolian government systems using Go-based backdoors and leveraging legitimate services such as Microsoft Outlook, Slack, Discord, and file.io for command and control communications.
UNC6692, a previously undocumented threat cluster, has been observed impersonating IT helpdesk staff via Microsoft Teams and deploying a custom malware suite (SNOW) through social engineering attacks.
Trigona ransomware operators are using a custom command-line exfiltration tool to accelerate and improve data theft from compromised environments.
Tropic Trooper, a Chinese state-sponsored APT, is expanding its targeting to include home routers and Japanese entities, diversifying its tools and attack vectors.
Chinese state-backed groups are increasingly industrializing botnets, using large-scale proxy networks of hijacked consumer devices to mask attack origins and evade detection, as highlighted in coordinated advisories from the UK NCSC, CISA, and international partners.

Trends, Tools, or Tactics of Interest

Supply chain attacks continue to escalate, with recent campaigns compromising widely used developer tools and npm packages, demonstrating ongoing risk to software supply chains.
Attackers are increasingly exploiting trusted relationships and routine business workflows, moving away from purely technical exploits to weaponize internal trust and social engineering.
AI-driven attack automation is advancing rapidly. Proofs of concept such as Zealot demonstrate that AI agents can autonomously conduct penetration testing operations-including reconnaissance, exploitation, and exfiltration-at speeds that challenge human defenders. Anthropic’s Project Glasswing AI model has shown exceptional vulnerability discovery capabilities, prompting withheld public release.
Social engineering via IT helpdesk impersonation is being used to bypass security controls, particularly through password reset abuse and collaboration platform phishing.
Legitimate cloud and collaboration tools (e.g., Microsoft 365 Outlook, Slack, Discord) are being repurposed by APTs for covert command and control.
macOS “Living off the Land” (LotL) abuse and SIM farm-based proxy networks are noted as emerging or ongoing tactics.

Regulatory or Policy Developments Affecting the Security Industry

CISA, the UK NCSC, and international partners issued a joint advisory warning of Chinese government-linked covert cyber networks, with emphasis on the use of proxy botnets and evasion techniques.
CISA mandated urgent patching of the Microsoft Defender BlueHammer vulnerability across US federal agencies, responding to evidence of active zero-day exploitation.