HoneyMyte on DanSec Daily

Cybersecurity Brief – 2026-08-16

Sun, 16 Aug 2026 00:00:00 +0000

Major Incidents or Breaches

Shell is investigating a potential security incident following claims by the Clop ransomware group that it stole 89GB of data from the company ^[11].
The ShinyHunters extortion group breached RingCentral, exposing personal information of 1.6 million accounts, including names, addresses, email addresses, and phone numbers ^[12]^[23].
A data breach at Beacon CRM impacted over 1,000 charities, reportedly due to a compromised AWS access key found in public JavaScript build artifacts ^[24].
The Scottish Government’s prosecutor’s office suffered a data breach linked to a third-party service provider, with the potential to affect additional agencies ^[15].
Four individuals were arrested in Brazil and three charged in Europe for exploiting a service provider vulnerability, enabling €30 million in fraudulent bank withdrawals ^[7].

Newly Discovered Vulnerabilities

A maximum-severity remote code execution vulnerability in SAP Commerce Cloud, patched three days ago, is now being actively targeted in attacks ^[10].
Hackers are exploiting an authentication bypass flaw in macOS Screen Sharing to deploy Monero cryptocurrency miners, following the release of public exploit code ^[8].
Researchers identified a new variant of the CoolClient backdoor used by APT group HoneyMyte, now featuring a kernel-mode Windows rootkit that hides processes, files, and network connections ^[1].

Notable Threat Actor Activity

Attackers have compromised hotel Wi-Fi routers in multiple US cities, redirecting users to Microsoft 365 phishing sites ^[2].
The Evooo1Bot Linux botnet, based on Mirai, is targeting internet-facing gateway devices to turn them into SOCKS5 traffic relay nodes ^[5].
Threat actors are increasingly abusing trusted workflows to conduct scams, as highlighted in a new report ^[3].
The Clop ransomware gang claimed responsibility for the alleged Shell data theft ^[11].
The ShinyHunters group was identified as responsible for the RingCentral breach ^[12]^[23].

Trends, Tools, or Tactics of Interest

Google Workspace attacks are increasingly leveraging stolen OAuth tokens to access Gmail, Drive, and connected systems, bypassing traditional phishing vectors ^[9].
The National Institute of Standards and Technology is exploring the use of AI to manage the rising volume of vulnerabilities discovered through AI-augmented research and scanning ^[14].
Anthropic is developing watermarking methods to identify AI-generated text from its Claude model ^[6].
WhatsApp is testing an on-device AI feature that warns users about potential scam messages ^[26].
Apple has detailed its use of iPhone alerts for users targeted by mercenary spyware, via Threat Notifications ^[25].
Cyera’s acquisition of Oasis Security aims to integrate data security and identity management for AI agents, focusing on context-driven privileged access ^[17].
Over 95 percent of organisations affected in a recent compromise were exposed before malicious LiteLLM packages were published, with Trivy identified as the root cause ^[21].

Regulatory or Policy Developments Affecting the Security Industry

Google Cloud announced a roadmap to achieve post-quantum cryptography readiness by 2029, with interim milestones in 2027 and 2028 ^[22].
New York City lawmakers are proposing restrictions on the deployment of biometric surveillance technologies at public venues such as Madison Square Garden ^[18].

Sources

Shell investigates 'potential incident' after Clop data theft claims - bleepingcomputer.com
RingCentral data breach exposed info of 1.6 million accounts - bleepingcomputer.com
1.6 Million Likely Impacted by RingCentral Data Breach - securityweek.com
Over 1,000 Charities Hit by Beacon CRM Data Breach - securityweek.com
Scottish Govt Suffers Potentially Widening Data Breach at Prosecutor's Office - darkreading.com
Hackers arrested over €30M bank fraud exploiting service provider flaw - bleepingcomputer.com
Max severity SAP Commerce Cloud flaw now targeted in attacks - bleepingcomputer.com
Hackers exploit macOS Screen Sharing flaw to deploy Monero miner - bleepingcomputer.com
APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit - securelist.com
Warning: Compromised Hotel Routers Send Users to Phishing Sites - blog.knowbe4.com
New Evooo1Bot Linux botnet turns routers into traffic relay nodes - bleepingcomputer.com
Report: Scams Are Surging as Attackers Abuse Trusted Workflows - blog.knowbe4.com
The Modern Attack Chain: Rethinking Google Workspace Security in the Age of AI - bleepingcomputer.com
Amid AI-Driven Bug-Hunt Tsunami, NIST Looks to … AI - darkreading.com
How Anthropic plans to watermark Claude's AI-generated text - bleepingcomputer.com
WhatsApp is testing a new warning for scam messages - malwarebytes.com
Apple now uses iPhone alerts for targets of mercenary spyware - malwarebytes.com
Cyera's Oasis Security Buy Is All About AI Agent Control - darkreading.com
Trivy, Not LiteLLM Behind the 2,500 Org Compromise - securityweek.com
Google Cloud Sets Out Post-Quantum Roadmap With 2029 Readiness Goal - securityweek.com
New York City Lawmakers Push to ‘Ban the Scan’ at MSG - wired.com

Cybersecurity Brief – 2026-08-15

Sat, 15 Aug 2026 00:00:00 +0000

Major Incidents or Breaches

RingCentral suffered a data breach impacting 1.6 million accounts, with personal information including names, addresses, email addresses, and phone numbers stolen by the ShinyHunters extortion group and subsequently published online ^[11]^[23].
Beacon CRM experienced a data breach affecting over 1,000 charities. The breach was traced to a compromised AWS access key exposed in publicly available JavaScript build artifacts ^[24].
ShipMonk, a logistics provider, was breached, resulting in the theft of shipping information for 14,000 Trezor customers. Exposed data includes names, addresses, email addresses, and phone numbers ^[25].
The Scottish Government reported a data breach at the prosecutor’s office, attributed to a third-party provider, with concerns that other agencies serviced by the same provider may also be affected ^[15].
Shell is investigating a potential security incident following claims by the Clop ransomware group that it stole 89GB of data from the company ^[10].
Four individuals were arrested in Brazil and three charged in Europe for conducting a €30 million bank fraud by exploiting a vulnerability at a service provider, which enabled unauthorised withdrawals from customer accounts ^[6].
A former data analyst at Brightly Software was sentenced to two years in prison for stealing company data and attempting to extort $2.5 million from the employer ^[12].

Newly Discovered Vulnerabilities

A new variant of the CoolClient backdoor, used by APT group HoneyMyte, was discovered with a kernel-mode Windows rootkit driver capable of hiding malicious processes, files, and network connections from security tools and analysts ^[1].
Hackers are actively exploiting a macOS authentication bypass vulnerability in Screen Sharing, with public exploit code available and attacks resulting in the deployment of Monero cryptocurrency miners ^[7].
A maximum-severity remote code execution vulnerability in SAP Commerce Cloud, patched three days ago, is already being targeted in active attacks ^[9].

Notable Threat Actor Activity

The Clop ransomware group has claimed responsibility for the alleged data theft from Shell, stating it exfiltrated 89GB of sensitive data ^[10].
The ShinyHunters extortion group was behind the RingCentral breach, stealing and publishing personal data of 1.6 million users ^[11]^[23].
APT group HoneyMyte has upgraded its CoolClient backdoor with a kernel-level rootkit, enhancing its ability to evade detection ^[1].

Trends, Tools, or Tactics of Interest

Attackers are compromising hotel Wi-Fi routers to redirect users to Microsoft 365 phishing sites, with incidents observed in multiple US cities ^[2].
Threat actors are increasingly abusing trusted business workflows to conduct scams, leveraging the inherent trust in established processes to facilitate attacks ^[3].
There is a surge in the volume of vulnerabilities discovered, attributed to AI-augmented research and automated scanning tools ^[14].
Public exploit code for a macOS Screen Sharing authentication bypass vulnerability is being used to deploy cryptominers, highlighting rapid weaponisation of new flaws ^[7].
Google Workspace attacks are evolving, with attackers using stolen OAuth tokens to access Gmail, Drive, and connected systems, bypassing traditional phishing entry points ^[8].
Over 2,500 organisations were compromised due to issues related to Trivy, not the previously suspected LiteLLM packages, clarifying the source of a widespread supply chain incident ^[21].
WhatsApp is testing an on-device AI feature that warns users about potential scam messages ^[27].
Apple now provides iPhone alerts to users targeted by mercenary spyware, describing how its Threat Notifications system works ^[26].
AI-generated content detection is advancing, with Anthropic planning to watermark text produced by its Claude AI model ^[5].

Regulatory or Policy Developments Affecting the Security Industry

Google Cloud has published its post-quantum cryptography roadmap, aiming for full readiness by 2029, with intermediate milestones in 2027 and 2028 ^[22].
New York City lawmakers are advocating for stricter regulations on the use of biometric surveillance in public venues, specifically targeting practices at Madison Square Garden ^[18].

Sources

RingCentral data breach exposed info of 1.6 million accounts - bleepingcomputer.com
1.6 Million Likely Impacted by RingCentral Data Breach - securityweek.com
Over 1,000 Charities Hit by Beacon CRM Data Breach - securityweek.com
14,000 Trezor Customers Impacted by Data Breach at ShipMonk - securityweek.com
Scottish Govt Suffers Potentially Widening Data Breach at Prosecutor's Office - darkreading.com
Shell investigates 'potential incident' after Clop data theft claims - bleepingcomputer.com
Hackers arrested over €30M bank fraud exploiting service provider flaw - bleepingcomputer.com
Data analyst sent to prison for stealing data, extorting employer - bleepingcomputer.com
APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit - securelist.com
Hackers exploit macOS Screen Sharing flaw to deploy Monero miner - bleepingcomputer.com
Max severity SAP Commerce Cloud flaw now targeted in attacks - bleepingcomputer.com
Warning: Compromised Hotel Routers Send Users to Phishing Sites - blog.knowbe4.com
Report: Scams Are Surging as Attackers Abuse Trusted Workflows - blog.knowbe4.com
Amid AI-Driven Bug-Hunt Tsunami, NIST Looks to … AI - darkreading.com
The Modern Attack Chain: Rethinking Google Workspace Security in the Age of AI - bleepingcomputer.com
Trivy, Not LiteLLM Behind the 2,500 Org Compromise - securityweek.com
WhatsApp is testing a new warning for scam messages - malwarebytes.com
Apple now uses iPhone alerts for targets of mercenary spyware - malwarebytes.com
How Anthropic plans to watermark Claude's AI-generated text - bleepingcomputer.com
Google Cloud Sets Out Post-Quantum Roadmap With 2029 Readiness Goal - securityweek.com
New York City Lawmakers Push to ‘Ban the Scan’ at MSG - wired.com