KongTuke on DanSec Daily

Cybersecurity Brief – 2026-06-26

Fri, 26 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Personal data belonging to politicians, military leaders, and executives was left publicly accessible due to a security misconfiguration at an elite networking organization, leading to a data breach affecting high-profile individuals ^[40].
Authorities in Poland arrested four members of a cybercrime group accused of breaching telecommunications partners and hijacking email accounts to conduct SIM-swapping attacks, resulting in millions in cryptocurrency theft ^[13].

Newly Discovered Vulnerabilities

A critical vulnerability (CVE-2026-12569) in PTC Windchill enabling remote code execution has been exploited in the wild and added to CISA’s Known Exploited Vulnerabilities catalog ^[28].
A server-side request forgery (SSRF) flaw in Cisco Unified Communications Manager (CUCM) and Unified CM SME, which can escalate privileges to root, was weaponized by attackers less than 24 hours after disclosure ^[21].
A vulnerability in Lantronix Serial-to-IP converters (CVE-2025-67038), disclosed in April, has been exploited following OT threat warnings ^[33].
Chrome patched 18 vulnerabilities, including four critical flaws, two of which are WebGL bugs that could allow sandbox escape ^[38].
GitLab CE/EE released updates addressing 13 vulnerabilities, including three rated high severity that could lead to code execution or information disclosure ^[34].
The open-source curl tool patched 18 vulnerabilities, including a 25-year-old flaw, though all were rated medium or low severity ^[35].
A popular Chrome ad blocker extension for YouTube, with over 10 million installs, was found to have dormant script injection capability that could allow arbitrary JavaScript execution ^[7].

Notable Threat Actor Activity

The Russian state-sponsored threat actor Turla has deployed a previously undocumented .NET backdoor named STOCKSTAY in espionage attacks targeting government and military organizations in Ukraine ^[6].
The Gamaredon APT group has upgraded its toolset, increasing its use of legitimate online services for command and control and data exfiltration, and is forming new alliances to enhance operational security ^[5]^[22].
A new backdoor named Mistic, linked to the KongTuke group, has been used in financially motivated attacks targeting sectors including insurance, education, IT, and professional services ^[11].
Iranian hacker group Handala claimed responsibility for a cyberattack on California Water Service, but investigation found no evidence of OT system compromise ^[32].

Trends, Tools, or Tactics of Interest

Sophisticated phishing kits are increasingly targeting device code authentication flows to breach accounts without requiring passwords ^[2].
The Bluekit phishing-as-a-service platform has adopted browser-in-the-middle techniques for login theft and expanded its infrastructure with nearly 70 new hostnames in the past week ^[18].
Threat actors are abusing the Shop order-tracking app by inserting fake purchase receipts into users’ histories to launch callback phishing attacks ^[14].
New macOS malware named Gaslight uses prompt injection payloads and embeds fake errors specifically designed to confuse AI-assisted malware analysis tools ^[10]^[16].
There is a rise in attacks against SMBs involving fake AI tools, phishing, and the sale of stolen data on the dark web ^[1].
Ransomware operators are increasingly targeting EU organizations and their suppliers, making Europe the primary region of interest after a global lull ^[25].
EdTech attackers are shifting focus from direct attacks on schools to targeting their software suppliers, increasing supply chain risk ^[23].
Parcel mule scams are spreading via fake job offers, tricking victims into handling stolen goods ^[37].
Fake domain renewal emails and websites are being used to deceive website owners into paying scammers ^[39].

Regulatory or Policy Developments Affecting the Security Industry

Microsoft has extended its free Windows 10 Extended Security Updates (ESU) program for consumers by one year, allowing continued receipt of security updates until October 2027 ^[15].
The new enterprise-ready Model Context Protocol (MCP) specification shifts security responsibilities from the protocol itself to developers and platform operators, introducing new security challenges ^[29].
A WIRED investigation highlighted reliability issues with a UK police predictive analytics system built as part of the adoption of AI in law enforcement ^[26].

Sources

Elite network says it was hacked after members’ personal data was left exposed - malwarebytes.com
Poland busts SIM-swapping gang tied to millions in crypto theft - bleepingcomputer.com
First-Ever Exploitation of PTC Windchill Vulnerability Discovered in the Wild - securityweek.com
In Less Than 24 Hours, Attackers Weaponize Cisco CUCM Flaw - darkreading.com
Lantronix Serial-to-IP Converter Flaw Exploited in Attacks After OT Threat Warning - securityweek.com
Update Chrome to patch critical browser security flaws - malwarebytes.com
GitLab Patches Code Execution, Information Disclosure Vulnerabilities - securityweek.com
25-Year-Old Vulnerability Patched in Curl - securityweek.com
Chrome Ad Blocker with 10M+ Installs Found with Dormant Script Injection Capability - thehackernews.com
Google Details Turla's New STOCKSTAY Backdoor Used in Ukraine Espionage Attacks - thehackernews.com
Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances - welivesecurity.com
Russian APT 'Gamaredon' Upgrades Its Arsenal, Requiring New Defenses - darkreading.com
New Mistic Backdoor Linked to KongTuke in ClickFix and ModeloRAT Campaigns - thehackernews.com
Cal Water Says No OT Systems Breached in Iranian Handala Cyberattack - securityweek.com
Report: Device Code Phishing is Surging - blog.knowbe4.com
Bluekit phishing kit adopts browser-in-the-middle for login theft - bleepingcomputer.com
Order-tracking app Shop abused to push callback phishing attacks - bleepingcomputer.com
New Gaslight macOS Malware Uses Prompt Injection to Disrupt AI-Assisted Analysis - thehackernews.com
New macOS malware embeds fake errors to confuse AI analysis tools - bleepingcomputer.com
Inside the 2026 SMB threat landscape: From phishing and scams to fake AI tools - securelist.com
Europe Evolves Into Ransomware's Favorite Region - darkreading.com
EdTech Attackers Shift From Schools to Their Software Suppliers - darkreading.com
Beware of “Parcel Expert” job offers: They’re parcel mule scams - malwarebytes.com
Fake domain renewal emails trick website owners into paying scammers - malwarebytes.com
Microsoft quietly extends free Windows 10 ESU support to October 2027 - bleepingcomputer.com
New Enterprise-Ready MCP Specification Brings New Security Challenges - securityweek.com
British Police Built a Sprawling Crime-Prediction Machine. Some Results Couldn’t Be Trusted - wired.com

Cybersecurity Brief – 2026-06-25

Thu, 25 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Law enforcement and private sector partners have disrupted the infrastructure of the Amadey botnet and Stealc infostealer operations, recovering 27 million stolen credentials and impacting hundreds of command-and-control servers in a coordinated global action known as Operation Endgame ^[5]^[8]^[17]^[30].
The US Department of Justice has seized a cloud computing account linked to subsidiaries of Cambodia-based HuiOne Group, which was allegedly used for cyber scam money laundering ^[11].
A 21-year-old hacker known as “Snoopy” has been sentenced to 18 months in prison for their involvement in the 2022 DraftKings cyberattack, with a requirement to pay approximately $1.8 million in forfeiture and restitution ^[13]^[33].

Newly Discovered Vulnerabilities

A critical zero-day vulnerability in Cisco Catalyst SD-WAN (CVE-2026-20245) was exploited for at least two months before public disclosure, allowing attackers to gain root access and create rogue accounts through rogue peering and exploitation of the device’s web-based management interface ^[6]^[14]^[20]^[28].
CISA has issued warnings about active exploitation of critical vulnerabilities in Lantronix EDS5000 Series devices and Ubiquiti UniFi OS products, enabling remote, unauthenticated attackers to make system changes, access underlying accounts, and inject commands ^[7]^[16]^[34].
Researchers have identified a critical FFmpeg flaw, dubbed PixelSmash, which allows attackers to compromise systems via malicious video files ^[36].
Chrome 149 update addresses 18 severe vulnerabilities, with more than half being use-after-free bugs that could lead to remote code execution ^[27].
A security gap in macOS allows users, including standard non-admin accounts, to disable security and integrated browser tools without requiring administrator privileges or kernel exploits by chaining legitimate OS behaviors ^[24]^[32].

Notable Threat Actor Activity

A new global campaign named StrikeShark is delivering Cobalt Strike Beacon through a custom loader called SharkLoader ^[1].
The Silent Ransom Group has targeted US law firms using a combination of voice phishing and in-person social engineering to exfiltrate sensitive data ^[3].
The Mistic backdoor has been linked to the ransomware access broker KongTuke, with attacks observed against organizations in insurance, education, IT, and professional services sectors ^[19].
Malicious Microsoft Edge extension “Edgecution” has been used in ransomware attacks to escape the browser sandbox and deploy a Python-based backdoor via abuse of Native Messaging ^[15].
Malicious packages on the OpenClaw (ClawHub) AI skills marketplace were found to bypass security checks and include infostealers and other threats, posing risks to the AI supply chain ^[23].

Trends, Tools, or Tactics of Interest

Attackers are increasingly exploiting weaknesses in CI/CD workflows, with researchers highlighting a new class of flaws (Cordyceps) that expose over 300 GitHub repositories to supply-chain attacks ^[9].
Threat actors are abusing a variety of collaboration channels beyond email, adapting to improved cloud email security and seeking new vectors for social engineering and phishing ^[4].
Service desks remain a favored target for social engineering attacks aimed at obtaining password resets, MFA changes, and unauthorized access to corporate accounts ^[18].
There is a noted rise in cyber threats targeting major events, with the 2026 FIFA World Cup facing persistent cybercrime, social engineering, and infrastructure attacks across host countries ^[21].
Attackers are leveraging information as an attack surface, using tactics such as hidden content injections and cognitive state poisoning to compromise AI and autonomous systems ^[29]^[35].

Regulatory or Policy Developments Affecting the Security Industry

NIST has opened updated IoT security guidance for public review, aiming to establish cybersecurity requirements for IoT devices used in federal agency networks ^[26].
Google is rolling out new privacy controls for Search services and Google Play, giving users more granular control over saved activity history and personalized recommendations ^[12].

Sources

ESET takes part in Operation Endgame to disrupt Amadey and Stealc - welivesecurity.com
Amadey and StealC Malware Network Disrupted, 27M Stolen Credentials Recovered - thehackernews.com
Amadey, StealC malware operations disrupted in Operation Endgame action - bleepingcomputer.com
Microsoft and Allies Smash Shared Infrastructure of Amadey and StealC Malware - securityweek.com
DoJ Seizes Huione Cloud Account Tied to Cyber Scam Money Laundering - thehackernews.com
DraftKings hacker 'Snoopy' sentenced to 18 months in prison - bleepingcomputer.com
Third DraftKings Hacker Sentenced to 18 Months in Prison - securityweek.com
Cisco Catalyst SD-WAN Zero-Day CVE-2026-20245 Exploited to Gain Root Access - thehackernews.com
Mandiant reveals how Cisco SD-WAN zero-day attacks gained root access - bleepingcomputer.com
Attackers Hit Cisco SD-WAN Flaw 2 Months Before Disclosure - darkreading.com
Cisco SD-WAN Zero-Day Exploited Months Before Patching - securityweek.com
CISA Warns Critical Lantronix EDS5000 Flaw Is Being Actively Exploited - thehackernews.com
CISA warns of max severity Ubiquiti flaws exploited in attacks - bleepingcomputer.com
Critical Ubiquiti Vulnerabilities in Attackers’ Crosshairs - securityweek.com
PixelSmash flaw turns video files into attack tools - malwarebytes.com
Chrome 149 Update Resolves 18 Severe Vulnerabilities - securityweek.com
Apple's MacOS Gap Lets Users Disable Security Tools - darkreading.com
macOS Weaknesses Chained to Silently Disable Endpoint Security Agents - securityweek.com
StrikeShark: investigating a new campaign delivering Cobalt Strike through SharkLoader - securelist.com
Extortion Gang Sends In-Person Attackers to Exfiltrate Data - blog.knowbe4.com
Stealthy Mistic backdoor linked to ransomware access broker KongTuke - bleepingcomputer.com
Malicious Edge extension abuses Native Messaging as bridge to malware - bleepingcomputer.com
More Malicious OpenClaw Skills Threaten AI Supply Chain - darkreading.com
Cordyceps CI/CD Flaws Expose 300+ GitHub Repositories to Supply-Chain Attacks - thehackernews.com
Attackers aren’t loyal to any collaboration channel - blog.knowbe4.com
Securing the service desk: Why social engineering attacks keep succeeding - bleepingcomputer.com
2026 FIFA World Cup Faces Surge in Cyber Threats - darkreading.com
When Information Becomes the Attack Surface – Understanding AI Agent Traps - securityweek.com
Agentic AI Security: Wrong Context, Wrong Decisions at Machine Speed - securityweek.com
NIST Opens Updated IoT Security Guidance to Public Review - securityweek.com
Google releases new privacy controls for activity history, personalization - bleepingcomputer.com

Cybersecurity Brief – 2026-05-15

Fri, 15 May 2026 00:00:00 +0000

Major Incidents or Breaches

Foxconn suffered a ransomware attack by the Nitrogen group on its North American manufacturing facilities. This is one of over 600 attacks targeting manufacturers this year.
OpenAI confirmed a security breach resulting from the TanStack supply chain attack, which compromised two employee devices and necessitated code-signing certificate rotation.
Taiwanese rail operations were disrupted for nearly an hour after a student used software-defined radio to shut down three bullet trains, exposing cybersecurity gaps in rail systems.
TeamPCP is threatening to leak source code from the Mistral AI project unless a buyer is found, following a breach.
Dell confirmed its SupportAssist software is causing Windows BSOD crashes, leading to system instability for users.

Newly Discovered Vulnerabilities

Cisco Catalyst SD-WAN Controller is affected by a critical authentication bypass vulnerability (CVE-2026-20182), which has been actively exploited in the wild to gain administrative access. This is the sixth SD-WAN zero-day exploited in 2026.
Microsoft disclosed a new actively exploited vulnerability (CVE-2026-42897) impacting on-premise Exchange Server, allowing arbitrary code execution via crafted email. A separate Exchange zero-day enabling XSS-based code execution is also under active exploitation.
PraisonAI (CVE-2026-44338) was targeted by threat actors within hours of disclosure, exploiting an authentication bypass flaw in this open-source orchestration framework.
Three versions of the node-ipc npm package were found to contain a stealer backdoor targeting developer secrets.
An 18-year-old NGINX vulnerability was discovered, allowing denial of service and, under certain conditions, remote code execution.
A new Linux kernel vulnerability, “Fragnesia” (CVE-2026-46300), allows root privilege escalation and is similar to previous Dirty Frag and Copy Fail exploits.
Burst Statistics WordPress plugin is being exploited via a critical authentication bypass flaw to obtain admin-level access on affected sites.
Chrome 148 update was released to patch critical use-after-free and other high-severity vulnerabilities.
F5 released patches for over 50 vulnerabilities in BIG-IP, BIG-IQ, and NGINX products, covering high and medium-severity issues.

Notable Threat Actor Activity

Kimsuky, a North Korean threat group, is using new PebbleDash-based tools linked to the AppleSeed malware cluster in recent campaigns.
Ghostwriter, a Belarus-aligned group, targeted Ukrainian government entities with geofenced PDF phishing and Cobalt Strike payloads.
FrostyNeighbor, another Belarusian APT, is spear-phishing government organizations in Poland and Ukraine using unique victim fingerprinting for espionage.
Chinese APTs Salt Typhoon and Twill Typhoon expanded their targeting: Salt Typhoon attacked an Azerbaijani energy entity, and Twill Typhoon deployed an updated RAT against Asian organizations.
KongTuke, an initial access broker, is now using Microsoft Teams for rapid social engineering attacks to breach corporate networks.
TeamPCP released the source code for the Shai-Hulud worm, encouraging its use in supply chain attacks and offering financial incentives for widespread deployment.

Trends, Tools, or Tactics of Interest

Ransomware gangs are increasingly targeting manufacturers due to their low tolerance for downtime, as evidenced by the Foxconn incident.
Phishing attacks are ramping up ahead of the 2026 FIFA World Cup, with at least 79 phishing sites targeting fans.
Netflix-themed phishing campaigns are proliferating, with attackers leveraging poor user security practices for credential theft.
Cyber-enabled cargo crime is shifting from physical hijackings to phishing and credential theft to reroute and steal freight.
AI-assisted ransomware and AI-driven social engineering are emerging, with threat actors leveraging generative AI for more convincing phishing and attack automation.
AI hallucinations are creating new security risks by generating plausible but incorrect outputs, which can mislead decision-makers in critical infrastructure.
Supply chain attacks remain a significant threat, highlighted by the node-ipc, TanStack, and Shai-Hulud worm incidents.
New malware libraries are prompting the need for updated detection signatures.
Mythos, an autonomous vulnerability discovery tool, proves effective in code audits and reverse engineering but has inconsistent exploit validation.

Regulatory or Policy Developments Affecting the Security Industry

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Cisco SD-WAN CVE-2026-20182 to its Known Exploited Vulnerabilities (KEV) catalog, mandating urgent remediation.
G7 countries released guidance on AI Software Bill of Materials (SBOM), outlining minimum elements to enhance transparency in AI systems and supply chains.
SecurityScorecard acquired Driftnet to improve threat intelligence and third-party risk visibility, responding to growing concerns over supply chain attack vectors.
Akamai announced the acquisition of LayerX for $205 million, expanding its Zero Trust portfolio to include browser-level protection.

Cybersecurity Brief – 2026-01-20

Tue, 20 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Ingram Micro disclosed that a ransomware attack in July 2025 resulted in a data breach affecting over 42,000 individuals, with compromised data including names, dates of birth, Social Security numbers, and employment-related information.
A Fortune 100 company in the finance sector was targeted by ransomware attackers, who deployed a new malware strain named PDFSider to deliver malicious payloads on Windows systems.
Spanish energy company Endesa reported a data breach, as noted in Check Point’s latest threat intelligence report.
A Tennessee man pleaded guilty to hacking the U.S. Supreme Court’s electronic filing system and breaching accounts at AmeriCorps and the Department of Veterans Affairs, subsequently leaking stolen Supreme Court data on Instagram.

Newly Discovered Vulnerabilities

A hardware vulnerability, codenamed StackWarp, was disclosed affecting AMD Zen 1–5 CPUs. The flaw breaks Secure Encrypted Virtualization – Secure Nested Paging (SEV-SNP) protections, potentially undermining the security guarantees of AMD’s confidential computing technology.
TP-Link patched a vulnerability in its VIGI security cameras that exposed over 2,500 internet-facing devices to remote hacking risks.
Cybersecurity researchers disclosed an indirect prompt injection flaw in Google Gemini, which allowed attackers to bypass authorization guardrails and access private Google Calendar data via malicious calendar invites.

Notable Threat Actor Activity

The UK government issued warnings regarding ongoing attacks by Russian-aligned hacktivist groups targeting UK critical infrastructure and local government organisations with disruptive activities.
A Jordanian national pleaded guilty in US court to operating as an access broker, selling unauthorized access to at least 50 corporate networks.
Researchers identified a new information stealer dubbed SolyxImmortal, which abuses legitimate APIs and libraries to exfiltrate data via Discord webhooks.
A campaign named KongTuke was observed using a malicious Chrome extension, CrashFix, which masquerades as an ad blocker and intentionally crashes browsers to facilitate further malware installation via ClickFix-style lures.
Additional malvertising campaigns were reported using fake ad blocker extensions (e.g., NexShield) on Chrome and Edge to crash browsers and launch ClickFix attacks.
New sleeper browser extensions were found spying on users and installing backdoors, now targeting Firefox in addition to Chrome and Edge.

Trends, Tools, or Tactics of Interest

The emergence of PDFSider malware highlights the continued use of custom payloads by ransomware groups targeting large enterprises.
The use of browser extensions (CrashFix, NexShield) as vectors for malvertising and malware delivery is increasing, with attackers employing browser crashes as part of social engineering tactics.
Threat actors are leveraging Discord webhooks for data exfiltration, as seen with the SolyxImmortal information stealer.
Indirect prompt injection attacks targeting AI assistants (e.g., Google Gemini) are being actively researched and exploited as a means to bypass security controls and access sensitive data.
Sleeper extensions that remain dormant before activating malicious behaviour are being deployed across multiple browsers, broadening the attack surface for user surveillance and backdoor installation.

Regulatory or Policy Developments Affecting the Security Industry

The UK government’s public warning about Russian hacktivist group activity signals heightened concern over threats to national critical infrastructure and may prompt increased defensive measures and reporting requirements across the sector.