Cybersecurity Brief – 2026-07-11

Sat, 11 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

Progress Software has instructed ShareFile customers to immediately shut down Windows Storage Zone Controllers due to a “credible external security threat” targeting these servers. The company is actively responding to the incident and has communicated directly with affected customers ^[5]^[20].
Researchers uncovered that a cybercrime group left one of its servers exposed, revealing details about the WP-SHELLSTORM campaign, which has backdoored thousands of WordPress sites. The exposure included hacking tools, logs, and target lists ^[13].
The Dutch National Police reported strong indications that Dutch hackers were involved in the February breach at telecommunications provider Odido ^[19].
A data breach at AssuranceAmerica has affected 7 million individuals, as disclosed in a roundup of recent incidents ^[33].
The US Department of Homeland Security (DHS) database was reportedly hacked, according to recent reports ^[33].

Newly Discovered Vulnerabilities

Zimbra has issued an urgent advisory to patch a critical vulnerability in its Classic Web Client that could allow attackers to execute arbitrary code via crafted emails. The flaw is actively being addressed and users are urged to update ^[4]^[24].
Six new vulnerabilities have been identified in the U-Boot bootloader, used across a wide range of hardware, which could allow malicious images to crash devices or execute code at boot, enabling stealthy firmware attacks ^[7]^[17].
A critical authentication bypass vulnerability is being actively exploited in the official Docker image for the Gitea self-hosted Git service. Attackers can impersonate any user, including administrators ^[21].
A flaw in Alibaba’s XQUIC (XRING) QUIC and HTTP/3 library allows any remote client to crash the server with legal traffic. There is currently no patch available ^[11].
A newly disclosed flaw called “Ill Bloom” in certain cryptocurrency wallet software’s recovery phrase generation has been exploited to drain over $5 million from wallets ^[16].
Researchers have demonstrated that a laser attack can reset passwords on Tangem wallet cards by targeting the chip, and affected cards cannot be patched ^[8].
Three now-patched vulnerabilities in the OpenClaw AI assistant allowed for credential theft, privilege escalation, and remote code execution through a WhatsApp-to-host attack chain ^[9].
Security issues in Microsoft BitLocker security wrappers have exposed ATMs and organizations to potential compromise ^[28].
Two critical vulnerabilities in Google Chrome were patched in rapid succession, prompting users to update for protection ^[41].

Notable Threat Actor Activity

An initial access broker associated with the Payouts King ransomware group is using Microsoft Teams phishing to deploy a malicious Microsoft Edge browser extension, facilitating ransomware attacks ^[3].
Hackers are exploiting the Gitea Docker image authentication bypass vulnerability to gain admin access to self-hosted Git instances ^[21].
Attackers are targeting Microsoft 365 users with vishing campaigns, using fake Microsoft Entra passkey enrollment requests and voice-based social engineering to gain access. Okta has issued a warning regarding these tactics ^[15]^[36].
Unknown threat actors compromised Injective Labs’ GitHub repository for its SDK project, publishing malicious npm packages designed to steal cryptocurrency wallet keys and credentials ^[6].
A China-linked group known as Silver Fox has been attributed to the new MODBEACON remote access trojan, which uses gRPC streaming for encrypted command and control traffic ^[10].
Both China and India-linked hacking groups have been documented targeting the Balochistan Police force in Pakistan over the past two years ^[35].
Researchers demonstrated “HalluSquatting,” using adversarial AI hallucinations to deliver botnet malware via popular AI assistants ^[38].

Trends, Tools, or Tactics of Interest

Cyberattacks against healthcare service providers more than doubled in the first half of 2026, with attackers increasingly targeting service providers and other healthcare businesses beyond hospitals and clinics ^[27].
GigaWiper, a new remote access Trojan, combines standalone wiper, ransomware encryption, and multi-pass wiping commands for system-level sabotage ^[37]^[39].
AI agents are driving rapid growth in non-human identities within organizations, complicating identity management and access visibility ^[23].
Researchers identified that many free Android VPN apps leak traffic, transmit unencrypted data, and engage in tracking, undermining user privacy and security expectations ^[14].
Comment stuffing in HTML phishing attachments is being used as a mechanism to evade AI-based detection systems ^[32].
AI coding tools are prompting debate over whether their security risks outweigh productivity gains, with concerns about scanning, remediation, and false positives ^[30].

Regulatory or Policy Developments Affecting the Security Industry

Multiple countries are increasing social media restrictions, particularly age-based account controls, though compliance by major platforms is reportedly lacking ^[29].
Adobe has increased its patch release cadence in response to growing security concerns ^[33].
The NSA has reinstated its Tailored Access Operations (TAO) unit, signaling renewed emphasis on offensive cyber capabilities ^[33].

Legal and Law Enforcement Actions

A member of the Ryuk ransomware group has pleaded guilty in the US and faces up to 15 years in prison for attacks on US companies ^[18].
A former ransomware negotiator for DigitalMint was sentenced to 70 months in prison for assisting the BlackCat (ALPHV) ransomware group ^[25]^[34].
A Bulgarian national has been charged with stealing $290,000 in government-seized cryptocurrency while serving a prison sentence for money laundering ^[22].
Canadian authorities have disrupted ransomware operations, as noted in a recent incident roundup ^[33].

Sources

URGENT - Progress Tells ShareFile Customers to Shut Down Storage Zone Controllers Over Security Threat - thehackernews.com
Progress urges ShareFile admins to shut down servers over “credible” threat - bleepingcomputer.com
Exposed Hacker Server Reveals WP-SHELLSTORM Backdooring Thousands of WordPress Sites - thehackernews.com
Police suspects Dutch hackers were involved in Odido breach - bleepingcomputer.com
In Other News: DHS Database Hacked, Adobe Boosts Patch Cadence, Canada Disrupts Ransomware Ops - securityweek.com
Critical Zimbra Flaw Could Let Crafted Emails Run Malicious Code in User Sessions - thehackernews.com
Zimbra urges customers to patch critical web client XSS flaw - bleepingcomputer.com
Six New U-Boot Flaws Could Let Malicious Images Crash Devices or Run Code at Boot - thehackernews.com
New U-Boot flaws could enable stealthy firmware attacks - bleepingcomputer.com
Hackers exploit critical auth bypass in Gitea Docker image - bleepingcomputer.com
Unpatched XRING Flaw in XQUIC Lets Remote Clients Crash HTTP/3 Servers - thehackernews.com
Attackers Exploit 'Ill Bloom' Vulnerability to Drain Over $5 Million From Cryptocurrency Wallets - thehackernews.com
Laser Attack Resets Tangem Wallet Passwords on Cards That Can't Be Patched - thehackernews.com
Researcher Details WhatsApp-to-Host Attack Chain Using Three OpenClaw Flaws - thehackernews.com
Fresh ATM Crypto Software Bugs: Jackpot or Bust? - darkreading.com
Two Chrome updates in two days fix critical vulnerabilities - malwarebytes.com
Threat Actor Uses Phishing to Breach Orgs for Ransomware Gangs - blog.knowbe4.com
Hackers Use Fake Microsoft Entra Passkey Enrollment to Gain Microsoft 365 Access - thehackernews.com
Okta Warns of Vishing Attacks Targeting Microsoft 365 Customers - securityweek.com
Injective Labs GitHub Compromise Pushes Wallet-Key-Stealing npm Packages - thehackernews.com
New MODBEACON RAT Uses gRPC Streaming for Encrypted C2 Traffic - thehackernews.com
China, India-Linked Hackers Both Targeted Same Pakistani Police Force - securityweek.com
‘HalluSquatting’ Turns AI Hallucinations Into Botnet Delivery Mechanism - securityweek.com
Cybercriminals Flock to Healthcare Businesses as Attacks Surge - darkreading.com
GigaWiper Combines Multiple Malware for System-Level Sabotage - securityweek.com
This new Windows malware can take over your PC and wipe it clean - malwarebytes.com
The Replicant in Your Directory: AI Agents and the Identity Security Gap - bleepingcomputer.com
Study of 281 Free Android VPN Apps Finds Traffic Leaks, Unencrypted Data, and Tracking - thehackernews.com
"Comment stuffing" in an HTML phishing attachment as a mechanism for evading AI-based detection?, (Fri, Jul 10th) - isc.sans.edu
AI Coding: Do Security Risks Outweigh Productivity Gains? - darkreading.com
More Countries Jump on the Social Media 'Ban Wagon' - darkreading.com
Ryuk ransomware member pleads guilty in the US, faces 15 years in prison - bleepingcomputer.com
Former ransomware negotiator gets 4 years for BlackCat attacks - bleepingcomputer.com
Third US Security Expert Sentenced to Prison for Helping Ransomware Gang - securityweek.com
Money launderer accused of stealing seized crypto while in prison - bleepingcomputer.com

Cybersecurity Brief – 2026-04-18

Sat, 18 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

Grinex, a Kyrgyzstan-based cryptocurrency exchange, suspended operations following a $13.7 million hack, which it attributes to Western intelligence agencies.
A recent hack targeted Rockstar Games, attributed to the ShinyHunters group.
A new incident involving the DraftKings breach: Kamerin Stokes was sentenced to prison for selling stolen credentials related to the attack, continuing his activities even after pleading guilty.

Newly Discovered Vulnerabilities

CVE-2024-3721: Threat actors are actively exploiting this vulnerability in TBK DVRs and end-of-life TP-Link Wi-Fi routers to deploy Mirai variant ‘Nexcorium’ for DDoS botnets.
Three zero-day vulnerabilities in Microsoft Defender are being actively exploited to gain elevated privileges on compromised systems. Two of these vulnerabilities remain unpatched.
Apache ActiveMQ: A high-severity remote code execution vulnerability (CVE-2026-34197) is being actively exploited in the wild. The flaw, present for 13 years, was patched earlier this month.
ShowDoc: A vulnerability in this platform is being exploited in the wild.
Google Chrome: A security flaw in Chrome was reportedly awarded a $90,000 bug bounty.

Notable Threat Actor Activity

The Payouts King ransomware group is using QEMU virtual machines as reverse SSH backdoors to bypass endpoint security and maintain persistence.
Tycoon phishing group has shifted to device code phishing, leveraging legitimate new-device login flows to bypass two-factor authentication.
North Korean IT worker scheme: Two facilitators, Kejia Wang and Zhenxing Wang, were jailed in the US for helping North Korean workers obtain employment at over 100 US companies using stolen identities.
ZionSiphon malware is targeting industrial control systems in Israeli water treatment and desalination plants.
Underground cybercrime guides are circulating, teaching threat actors how to vet and select stolen credit card shops based on data quality, reputation, and survivability.
ShinyHunters group involved in the Rockstar Games breach.

Trends, Tools, or Tactics of Interest

Fake data breach alerts are being used as phishing lures to trick recipients into divulging sensitive information.
Old vulnerabilities are being increasingly targeted and amplified by AI-driven attack techniques.
Classic Nigerian advance-fee scams remain prevalent, with new twists keeping them effective.
Identity Management Day highlights the growing importance of identity management at the edge as a core component of digital trust.
CoChat launched an AI collaboration platform designed to combat “shadow AI” by improving visibility and governance over enterprise AI use.
Google blocked or removed 8.3 billion policy-violating ads in 2025 and announced new Play policy updates focused on privacy and fraud prevention.
Microsoft reported that some Windows domain controllers are entering reboot loops after the April 2026 security updates.

Regulatory or Policy Developments Affecting the Security Industry

NIST has reduced its enrichment of CVE data, impacting vulnerability management efforts; industry and ad-hoc coalitions are forming to address the gap.
The US Coast Guard released new cybersecurity rules under the Maritime Transportation Security Act (MTSA), requiring OT security plans, third-party audits, and hybrid OT-security roles.
The US House blocked an extension of Section 702, a surveillance program used by the FBI for warrantless searches.
The White House is engaging with AI labs, including Anthropic, to discuss the security of advanced AI technologies.
The Satellite Cybersecurity Act and increased EPA cybersecurity budget to $19 million were noted as recent legislative developments.
Lawmakers in the US held closed-door discussions about the risks and rapid advancement of AI technologies.

Payouts King on DanSec Daily

Cybersecurity Brief – 2026-07-11

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry

Legal and Law Enforcement Actions

Sources

Cybersecurity Brief – 2026-04-18

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry