DanSec

Threat actor

Scattered Spider

In 55 briefs, most recently 11 August 2026. RSS for this tag

Learn more: Malpedia ↗ ThreatFox ↗ MalwareBazaar ↗

Coverage in DanSec Daily

  1. Polish CHP plant hacked via private cellular APN, LexisNexis and Valve/CEVA breaches, and actively exploited Progress Kemp LoadMaster flaw.
  2. Coca-Cola's Fairlife ransomware halts US dairy output; 23andMe pays $18M to 43 states; Scattered Spider pair jailed over TfL hack.
  3. Medtronic breach affecting 3.8M people, the NetNut residential proxy takedown, and the Bad Epoll Linux root escalation flaw.
  4. Google and FBI disrupt NetNut proxy network, Scattered Spider suspect extradited, and Pegasus spyware hits EU Parliament investigators; plus Cursor and WinRAR …
  5. The Medtronic data breach by ShinyHunters, exposed Oracle E-Business Suite instances under attack, and Scattered Spider arrest news.
  6. Tata Electronics cyberattack and Klue OAuth-token breaches hitting LastPass and Salesforce customers, plus FortiBleed hitting 430,000 FortiGate firewalls with …
  7. Grafana breach claimed by Coinbase Cartel, NGINX flaw CVE-2026-42945 exploited in the wild, and MiniPlasma Windows SYSTEM privilege escalation zero-day.
  8. Sorry ransomware mass-exploits cPanel CVE-2026-41940; Linux root flaw CVE-2026-31431 added to KEV; Finnish teen charged over Scattered Spider.
  9. Trellix source code breach, Instructure Canvas cyber incident and CopyFail Linux root flaw (CVE-2026-31431).
  10. The Vimeo breach via Anodot, LAPSUS$ leaking Checkmarx data, and the critical GitHub RCE flaw CVE-2026-3854.
  11. Covers the France Titres government data breach, the $290M Kelp DAO crypto heist tied to North Korean actors, and over 1,500 exposed Perforce P4 servers.
  12. KelpDAO's $290M crypto theft tied to Lazarus Group, Vercel breach via compromised OAuth tokens, and a Scattered Spider leader's guilty plea.
  13. French FICOBA bank registry access exposing 1.2M accounts, Figure breach by ShinyHunters, and Ivanti zero-day exploitation surge.
  14. UNC3886 breaches Singapore's top telcos, Warlock exploits SmarterMail to hit SmarterTools, and a Firebase flaw exposes 300M Chat & Ask AI messages.
  15. Cloudflare's record 29.7 Tbps Aisuru botnet DDoS, the Oracle E-Business Suite Clop campaign hitting universities, and WordPress King Addons plugin takeovers.
  16. The Salesforce Gainsight breaches by ShinyHunters, the CrowdStrike insider leak, and the actively exploited Oracle Identity Manager flaw (CVE-2025-61757).
  17. Miljödata breach affecting 1.5M, Nikkei Slack compromise and actively exploited Post SMTP WordPress flaw.
  18. Co-op's £80M cyberattack loss, Shai-Hulud npm worm infecting 500+ packages, and Cisco zero-days under CISA emergency directive.
  19. Boyd Gaming breach, GeoServer flaw (CVE-2024-36401) hitting a US federal agency, and RTX ransomware disrupting European airports via Collins Aerospace.
  20. Boyd Gaming data breach, Jaguar Land Rover production shutdown, and fake Malwarebytes and LastPass installers on GitHub targeting Mac users.
  21. UNC1549 espionage against European telecoms, Turla and Gamaredon teaming up on Ukraine, and a CVSS 10.0 GoAnywhere MFT command injection patch.
  22. Iran-linked UNC1549 breaches European telecoms, Gamaredon and Turla team up on Ukraine, and ShinyHunters tied to healthcare breaches affecting 600K+ people.
  23. SonicWall cloud backup breach, Tiffany & Co. data theft and BianLian-linked Medical Associates of Brevard breach affecting nearly 250,000 people.
  24. Salesforce data theft by ShinyHunters via Salesloft Drift tokens, Shai-Hulud NPM supply chain worm, and Chrome zero-day CVE-2025-10585.
  25. JLR extends shutdown after cyberattack; Microsoft and Cloudflare dismantle RaccoonO365 phishing network; DHS misconfigured data hub exposes sensitive …
  26. The Jaguar Land Rover breach, a record NPM supply-chain attack, and Scattered Spider's $380M Clorox heist, plus Microsoft's 80 patches and Chinese APT activity.
  27. Colt Technology breach by Warlock ransomware, Apple zero-day patch, and Scattered Spider member sentenced to 10 years.
  28. Inotiv ransomware, Intel and Workhorse Software data exposures, password manager clickjacking flaws, Apple's CVE-2025-43300 zero-day, and RapperBot botnet …
  29. The Allianz Life Salesforce data theft, unpatched Citrix NetScaler CitrixBleed 2 exposure, and the Charon ransomware campaign against Middle East public sector …
  30. Columbia University breach hits 870,000, Bouygues discloses 6.4M-customer breach, and Royal/BlackSuit ransomware dismantled after 450+ U.S. victims.
  31. North Korea-linked UNC4899 crypto theft, UNC2891 ATM network breaches, and patched Honeywell Experion PKS industrial control flaws.
  32. ShinyHunters vishing breaches at Qantas, Allianz Life and Adidas; SafePay claims 3.5TB Ingram Micro theft; Microsoft SharePoint mass exploitation hits South …
  33. The Toptal npm supply chain breach, Cisco ISE and PaperCut exploitation, and the BlackSuit-to-Chaos ransomware shift in one daily brief.
  34. Scattered Spider targets VMware ESXi hypervisors for ransomware; Tridium Niagara flaws expose smart buildings; Post SMTP WordPress plugin takeover bug.
  35. Louis Vuitton and McDonald's data breaches, Gravity Forms WordPress plugin supply chain attack, and Gigabyte UEFI firmware flaws enabling Secure Boot bypass.
  36. Laravel apps exposed via leaked APP_KEYs, Wing FTP Server RCE exploited in the wild, and Scattered Spider arrests.
  37. UK arrests over Scattered Spider attacks on M&S, Co-op and Harrods; Qantas breach hits 5.7M customers; Citrix NetScaler CVE-2025-5777 added to KEV.
  38. Qantas breach hits 6M customers, Cisco Unified CM hardcoded root SSH backdoor patched, and Gamaredon spearphishing Ukraine. Plus Scattered Spider and NimDoor.
  39. Swiss federal data exposed via Radix ransomware breach, Scattered Spider targets airlines, and over 1,200 unpatched Citrix NetScaler servers under active …
  40. Hawaiian Airlines hit by Scattered Spider, 27%+ of UK firms report cyber incidents, and Salt Typhoon targets a Canadian telecom via Cisco flaws.
  41. Scattered Spider targets airlines via social engineering, hackers open a Norwegian dam valve, and GIFTEDCROOK malware evolves into a spy tool.
  42. Ahold Delhaize breach hits 2.2M people, Cloudflare mitigates record DDoS, Russia throttles Cloudflare, Citrix Bleed 2 exploited.
  43. The UNFI and Hawaiian Airlines cyberattacks, a DOJ charge against alleged IntelBroker, and critical Cisco ISE and Open VSX flaws.
  44. Scattered Spider attacks on Marks & Spencer and Co-op, the UK ICO fine against 23andMe over its 2023 breach, and Salt Typhoon's claimed attack.
  45. Iran state TV hack, $11M BitoPro crypto theft by Lazarus Group, Aflac breach tied to Scattered Spider, and record 7.3 Tbps DDoS attack.
  46. The Zoomcar breach affecting 8M+ users, Veeam's critical CVE-2025-23121 backup RCE, and the Langflow flaw exploited to deploy the Flodrix botnet.
  47. The Washington Post journalist email breach, Zoomcar's 8.4M-user data breach, and Scattered Spider's pivot to U.S. insurers.
  48. Victoria's Secret earnings delay, Coinbase data breach via bribed TaskUs staff, and Scattered Spider's attacks on UK retailers Marks & Spencer and Co-op.
  49. Cellcom outage cyberattack, SK Telecom malware breach exposing 27M USIM records, and RVTools supply chain attack delivering Bumblebee malware.
  50. Procolored printer drivers spread malware for six months, Coinbase offers $20M bounty after extortion, and Intel CPUs face new Spectre-style flaws.
  51. The Coinbase insider data breach and extortion attempt, SAP NetWeaver exploitation by BianLian and RansomExx, and Samsung MagicINFO Mirai attacks.
  52. Marks & Spencer customer data theft, Microsoft May 2025 Patch Tuesday with five zero-days, and SAP NetWeaver exploitation by ransomware gangs.
  53. Co-op confirms data theft after DragonForce claims, a Magento supply chain attack hits 500+ stores, and UK retailers face a ransomware wave.
  54. SonicWall SMA100 exploitation, Co-op cyberattack disruption and Ascension healthcare data breach.
  55. Marks & Spencer ransomware disruption by Scattered Spider, SAP NetWeaver CVE-2025-31324 exploitation, and Hitachi Vantara Akira attack.