Silent Ransom Group on DanSec Daily

Cybersecurity Brief – 2026-06-25

Thu, 25 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Law enforcement and private sector partners have disrupted the infrastructure of the Amadey botnet and Stealc infostealer operations, recovering 27 million stolen credentials and impacting hundreds of command-and-control servers in a coordinated global action known as Operation Endgame ^[5]^[8]^[17]^[30].
The US Department of Justice has seized a cloud computing account linked to subsidiaries of Cambodia-based HuiOne Group, which was allegedly used for cyber scam money laundering ^[11].
A 21-year-old hacker known as “Snoopy” has been sentenced to 18 months in prison for their involvement in the 2022 DraftKings cyberattack, with a requirement to pay approximately $1.8 million in forfeiture and restitution ^[13]^[33].

Newly Discovered Vulnerabilities

A critical zero-day vulnerability in Cisco Catalyst SD-WAN (CVE-2026-20245) was exploited for at least two months before public disclosure, allowing attackers to gain root access and create rogue accounts through rogue peering and exploitation of the device’s web-based management interface ^[6]^[14]^[20]^[28].
CISA has issued warnings about active exploitation of critical vulnerabilities in Lantronix EDS5000 Series devices and Ubiquiti UniFi OS products, enabling remote, unauthenticated attackers to make system changes, access underlying accounts, and inject commands ^[7]^[16]^[34].
Researchers have identified a critical FFmpeg flaw, dubbed PixelSmash, which allows attackers to compromise systems via malicious video files ^[36].
Chrome 149 update addresses 18 severe vulnerabilities, with more than half being use-after-free bugs that could lead to remote code execution ^[27].
A security gap in macOS allows users, including standard non-admin accounts, to disable security and integrated browser tools without requiring administrator privileges or kernel exploits by chaining legitimate OS behaviors ^[24]^[32].

Notable Threat Actor Activity

A new global campaign named StrikeShark is delivering Cobalt Strike Beacon through a custom loader called SharkLoader ^[1].
The Silent Ransom Group has targeted US law firms using a combination of voice phishing and in-person social engineering to exfiltrate sensitive data ^[3].
The Mistic backdoor has been linked to the ransomware access broker KongTuke, with attacks observed against organizations in insurance, education, IT, and professional services sectors ^[19].
Malicious Microsoft Edge extension “Edgecution” has been used in ransomware attacks to escape the browser sandbox and deploy a Python-based backdoor via abuse of Native Messaging ^[15].
Malicious packages on the OpenClaw (ClawHub) AI skills marketplace were found to bypass security checks and include infostealers and other threats, posing risks to the AI supply chain ^[23].

Trends, Tools, or Tactics of Interest

Attackers are increasingly exploiting weaknesses in CI/CD workflows, with researchers highlighting a new class of flaws (Cordyceps) that expose over 300 GitHub repositories to supply-chain attacks ^[9].
Threat actors are abusing a variety of collaboration channels beyond email, adapting to improved cloud email security and seeking new vectors for social engineering and phishing ^[4].
Service desks remain a favored target for social engineering attacks aimed at obtaining password resets, MFA changes, and unauthorized access to corporate accounts ^[18].
There is a noted rise in cyber threats targeting major events, with the 2026 FIFA World Cup facing persistent cybercrime, social engineering, and infrastructure attacks across host countries ^[21].
Attackers are leveraging information as an attack surface, using tactics such as hidden content injections and cognitive state poisoning to compromise AI and autonomous systems ^[29]^[35].

Regulatory or Policy Developments Affecting the Security Industry

NIST has opened updated IoT security guidance for public review, aiming to establish cybersecurity requirements for IoT devices used in federal agency networks ^[26].
Google is rolling out new privacy controls for Search services and Google Play, giving users more granular control over saved activity history and personalized recommendations ^[12].

Sources

ESET takes part in Operation Endgame to disrupt Amadey and Stealc - welivesecurity.com
Amadey and StealC Malware Network Disrupted, 27M Stolen Credentials Recovered - thehackernews.com
Amadey, StealC malware operations disrupted in Operation Endgame action - bleepingcomputer.com
Microsoft and Allies Smash Shared Infrastructure of Amadey and StealC Malware - securityweek.com
DoJ Seizes Huione Cloud Account Tied to Cyber Scam Money Laundering - thehackernews.com
DraftKings hacker 'Snoopy' sentenced to 18 months in prison - bleepingcomputer.com
Third DraftKings Hacker Sentenced to 18 Months in Prison - securityweek.com
Cisco Catalyst SD-WAN Zero-Day CVE-2026-20245 Exploited to Gain Root Access - thehackernews.com
Mandiant reveals how Cisco SD-WAN zero-day attacks gained root access - bleepingcomputer.com
Attackers Hit Cisco SD-WAN Flaw 2 Months Before Disclosure - darkreading.com
Cisco SD-WAN Zero-Day Exploited Months Before Patching - securityweek.com
CISA Warns Critical Lantronix EDS5000 Flaw Is Being Actively Exploited - thehackernews.com
CISA warns of max severity Ubiquiti flaws exploited in attacks - bleepingcomputer.com
Critical Ubiquiti Vulnerabilities in Attackers’ Crosshairs - securityweek.com
PixelSmash flaw turns video files into attack tools - malwarebytes.com
Chrome 149 Update Resolves 18 Severe Vulnerabilities - securityweek.com
Apple's MacOS Gap Lets Users Disable Security Tools - darkreading.com
macOS Weaknesses Chained to Silently Disable Endpoint Security Agents - securityweek.com
StrikeShark: investigating a new campaign delivering Cobalt Strike through SharkLoader - securelist.com
Extortion Gang Sends In-Person Attackers to Exfiltrate Data - blog.knowbe4.com
Stealthy Mistic backdoor linked to ransomware access broker KongTuke - bleepingcomputer.com
Malicious Edge extension abuses Native Messaging as bridge to malware - bleepingcomputer.com
More Malicious OpenClaw Skills Threaten AI Supply Chain - darkreading.com
Cordyceps CI/CD Flaws Expose 300+ GitHub Repositories to Supply-Chain Attacks - thehackernews.com
Attackers aren’t loyal to any collaboration channel - blog.knowbe4.com
Securing the service desk: Why social engineering attacks keep succeeding - bleepingcomputer.com
2026 FIFA World Cup Faces Surge in Cyber Threats - darkreading.com
When Information Becomes the Attack Surface – Understanding AI Agent Traps - securityweek.com
Agentic AI Security: Wrong Context, Wrong Decisions at Machine Speed - securityweek.com
NIST Opens Updated IoT Security Guidance to Public Review - securityweek.com
Google releases new privacy controls for activity history, personalization - bleepingcomputer.com

Cybersecurity Brief – 2026-06-09

Tue, 09 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

SoFi confirmed a data breach at its Hong Kong subsidiary following unauthorised access to a third-party vendor database containing customer information ^[15].
The University of Oxford disclosed a data breach after its CareerConnect careers platform, managed by third-party provider Group GTI, was compromised ^[23].
Lansing Community College reported a breach impacting 174,000 individuals, with hackers accessing personal data from college systems ^[39].
DentaQuest, a US dental benefits administrator, suffered a breach exposing sensitive data, as reported in recent threat intelligence ^[40].
Silent Ransom Group targeted US law firms in escalating extortion attacks, using vishing, IT impersonation, and in-person intrusions to steal data ^[24].
Meta and WhatsApp detected and blocked new spear-phishing attacks linked to NSO Group, and Meta is pursuing a federal court contempt order against the spyware vendor for violating a no-hacking order ^[7]^[18]^[36].
Pirated PC games are being used to distribute password-stealing malware, with over 400,000 devices reportedly infected worldwide ^[42].

Newly Discovered Vulnerabilities

A critical authentication bypass vulnerability in Check Point Remote Access VPN and Mobile Access deployments using IKEv1 has been exploited in zero-day attacks by the Qilin ransomware gang. CISA has ordered US federal agencies to patch within three days ^[8]^[12]^[22]^[25]^[32].
BerriAI LiteLLM is affected by CVE-2026-42271, a high-severity flaw now being exploited in the wild, enabling unauthenticated remote code execution ^[5].
A one-character use-after-free vulnerability in the Linux kernel allows local privilege escalation to root and container escape. Exploits are now public ^[6].
Google patched a new Chrome zero-day vulnerability (CVE-2026-11645) exploited in the wild, marking the fifth such patch this year ^[13]^[33].
Gogs patched a critical zero-day vulnerability enabling remote code execution on Internet-facing instances and access to all repositories ^[19].
Ubiquiti UniFi OS is vulnerable to a chain of three bugs allowing unauthenticated remote code execution with root privileges ^[20].
Everest Forms, a popular WordPress plugin, has a vulnerability being exploited in the wild for remote code execution ^[38].

Notable Threat Actor Activity

The Qilin ransomware gang has been confirmed as the threat actor exploiting the Check Point VPN zero-day vulnerability in active attacks ^[22]^[25]^[32].
The Miasma supply chain campaign has evolved into the Hades attack, involving 37 malicious wheel artifacts across 19 PyPI packages, delivering the Bun credential stealer ^[4]^[27].
The Shai-Hulud supply chain attack compromised 19 science-focused PyPI packages, distributing malware to steal developer secrets ^[17]^[27].
NSO Group has been linked to new WhatsApp spear-phishing campaigns, which were detected and blocked by Meta and WhatsApp ^[7]^[18]^[36].
Silent Ransom Group is escalating its tactics against US law firms, combining vishing, impersonation, and physical intrusion ^[24].

Trends, Tools, or Tactics of Interest

AI-enabled social engineering attacks are increasing, with threat actors leveraging AI to bypass technical security controls and significantly boost phishing campaign volume ^[1]^[9]^[41].
A new side-channel attack called FROST allows malicious websites to track user browser and app activity via SSD timing using only JavaScript, requiring no native code or browser extensions ^[3].
Supply chain attacks via poisoned open-source packages, particularly on PyPI, continue to escalate with evolving tactics and the targeting of developer secrets ^[4]^[17]^[27]^[31].
Android malware (NFCShare) is being distributed as fake banking app updates on GitHub, targeting users with credential-stealing payloads ^[14].
Attackers are increasingly hiding password-stealing malware in cracked and pirated PC games, resulting in large-scale infections ^[42].

Regulatory or Policy Developments Affecting the Security Industry

CISA has mandated that US federal agencies patch the critical Check Point VPN vulnerability within three days due to confirmed exploitation by ransomware actors ^[12].
An extension of the Geneva Conventions is being considered to impose restrictions on cyberwarfare during ceasefire conditions, aiming to address current loopholes in international conflict law ^[26].

Sources

SoFi confirms third-party data breach at Hong Kong subsidiary - bleepingcomputer.com
Oxford University discloses data breach after careers platform hack - bleepingcomputer.com
174,000 Impacted by Lansing Community College Data Breach - securityweek.com
8th June – Threat Intelligence Report - research.checkpoint.com
Silent Ransom Group Hits US Law Firms in Escalating Extortion Attacks - darkreading.com
Meta Blocks NSO Group's New WhatsApp Phishing Attack, Files Contempt Order - thehackernews.com
WhatsApp says it disrupted new NSO spyware phishing attacks - bleepingcomputer.com
WhatsApp Catches Spyware Firm NSO Defying No-Hacking Court Order - securityweek.com
Pirated PC games are delivering password-stealing malware - malwarebytes.com
Critical Check Point VPN Flaw Exploited to Bypass Passwords in IKEv1 Setups - thehackernews.com
CISA gives feds 3 days to patch Check Point VPN bug exploited as zero-day - bleepingcomputer.com
Check Point links VPN zero-day attacks to Qilin ransomware gang - bleepingcomputer.com
Check Point VPN Flaw Exploited Since Early May - darkreading.com
Check Point VPN Zero-Day Exploited in Qilin Ransomware Attacks - securityweek.com
LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE - thehackernews.com
One-Character Linux Kernel Flaw Enables Local Root Access, Exploits Now Public - thehackernews.com
Google patches new Chrome zero-day flaw exploited in the wild - bleepingcomputer.com
Google Patches 5th Chrome Zero-Day Exploited in 2026 - securityweek.com
Gogs patches critical zero-day enabling remote code execution - bleepingcomputer.com
Critical UniFi OS bug lets hackers gain root without authentication - bleepingcomputer.com
Everest Forms Vulnerability Exploited to Hack WordPress Sites - securityweek.com
Hades PyPI Attack: 19 Packages Poisoned to Auto-Run Bun Credential Stealer - thehackernews.com
'Hades' Campaign Against PyPI Puts New Spin on Shai-Hulud - darkreading.com
New Shai-Hulud attack trojanizes 19 science-focused PyPI packages - bleepingcomputer.com
Report: AI-Enabled Social Engineering Attacks Are on the Rise - blog.knowbe4.com
AI Phishing Is Crushing SOCs with Alert Volume: How to Reduce Tier 1 Overload - thehackernews.com
Americans lost nearly $900 million to AI-powered scams, FBI says - malwarebytes.com
New FROST Attack Lets Websites Track What Sites and Apps You Open via SSD Timing - thehackernews.com
TeamPCP Supply Chain Campaign: Activity Through 2026-06-07, (Mon, Jun 8th) - isc.sans.edu
NFCShare Android malware spreads via fake banking app updates on GitHub - bleepingcomputer.com
Iran Signed a Ceasefire — Its Hackers Didn't - darkreading.com

Cybersecurity Brief – 2026-06-08

Mon, 08 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Meta disclosed that over 20,000 Instagram accounts were compromised after attackers exploited Meta’s AI-powered support system to reset passwords and hijack accounts. Authorities have been notified regarding the incident ^[3]^[12].
Law firms and professional services organizations in the United States have been targeted by the Silent Ransom Group, which uses fake IT support calls in social engineering attacks that lead to rapid data theft ^[6].
Researchers revealed details of a financially motivated extortion campaign by threat actor UNC3753, which has targeted dozens of organizations across professional, legal, and financial services sectors using vishing and physical intrusions ^[1].

Newly Discovered Vulnerabilities

SolarWinds patched a vulnerability in Serv-U that is being actively exploited in the wild. The flaw allows unauthenticated attackers to crash the Serv-U service via specially crafted POST requests ^[11].
A new variant of the Gafgyt botnet, C0XMO, is exploiting a flaw in DD-WRT router firmware to propagate. The botnet can also target multiple device types with various CPU architectures and is designed to remove rival malware from infected devices ^[5].

Notable Threat Actor Activity

UNC3753 has been identified as responsible for a data theft extortion campaign involving vishing and physical intrusions targeting organizations in the professional, legal, and financial sectors ^[1].
Silent Ransom Group is actively conducting social engineering attacks against U.S. law firms and professional services organizations, using fake IT support calls to facilitate data theft ^[6].

Trends, Tools, or Tactics of Interest

Microsoft announced that Visual Studio Code will implement a two-hour delay before extensions are automatically updated, aiming to reduce the risk of supply chain attacks via malicious or compromised extensions ^[2].
OpenAI is rolling out expanded account security controls for ChatGPT users, including Active Sessions and Lockdown Mode features ^[10].
The C0XMO botnet demonstrates the continued trend of malware targeting IoT and router firmware vulnerabilities, with added functionality to eliminate competing malware on infected devices ^[5].
Emphere has raised $2.1 million to develop AI-powered vulnerability remediation solutions for software companies, indicating increased investment in AI-driven security automation ^[13].

Sources

Over 20,000 Instagram accounts stolen in Meta AI support hack - bleepingcomputer.com
Meta Says 20,000 Instagram Accounts Hacked via AI Tool Abuse - securityweek.com
Silent Ransom Group targets law firms with fake IT support calls - bleepingcomputer.com
UNC3753 Used Vishing and Physical Intrusions in U.S. Data Theft Extortion Campaign - thehackernews.com
SolarWinds Serv-U Vulnerability Exploited in the Wild - securityweek.com
C0XMO botnet spreads via DD-WRT router flaw, kills rival malware - bleepingcomputer.com
VS Code Adds 2-Hour Extension Auto-Update Delay to Limit Supply Chain Attacks - thehackernews.com
OpenAI Rolling Out ChatGPT Account Security Controls - securityweek.com
Emphere Raises $2.1 Million for AI-Powered Vulnerability Remediation - securityweek.com

Cybersecurity Brief – 2026-05-28

Thu, 28 May 2026 00:00:00 +0000

Major Incidents or Breaches

The GlassWorm malware botnet, which targeted developers via software supply-chain attacks and relied on resilient command-and-control infrastructure using the Solana blockchain, has been disrupted through a coordinated takedown by CrowdStrike, Google, and the Shadowserver Foundation. All C2 channels associated with GlassWorm were taken down^[11]^[16]^[37].
The FBI has issued a warning that the Silent Ransom Group (SRG) extortion gang is targeting US-based law firms with in-person data theft attacks, involving physical intrusion and social engineering to gain access to sensitive data^[17]^[21].
A 35-year-old suspect was arrested by Dutch police in connection with the hacking of the professional football club Ajax Amsterdam earlier this year^[19].
A data breach in Uruguay has reportedly exposed 5.8 million records of citizens, attributed to cybercriminals targeting government agencies to monetize citizen data^[22].
The LA Metro cyberattack has been linked to Iranian state-sponsored hackers, despite claims of responsibility by a hacktivist group. Forensic analysis showed the use of infrastructure tied to the Iranian government^[38].

Newly Discovered Vulnerabilities

A security flaw in Gitea, an open-source version control platform, allows unauthenticated remote attackers to pull private container images, exposing sensitive data from self-hosted repositories^[13].
Researchers discovered an account takeover vulnerability in the open source CFP management tool Pretalx, which enabled attackers to guarantee acceptance of all submitted talks^[30].
A malicious npm package named “mouse5212-super-web” was found to steal files from directories associated with Claude AI users via GitHub, indicating a supply chain risk in the npm registry^[9].
CISA has mandated US federal agencies to patch a critical vulnerability in the LiteSpeed cPanel user-end plugin within four days, due to evidence of active exploitation^[18].

Notable Threat Actor Activity

Cybercrime groups have continued to exploit fans of pirated books, movies, and TV shows by infecting popular piracy sites with malware, including miners and remote access trojans, affecting tens of millions of users^[1].
The ShinyHunters and BlackFile extortion groups are utilizing automated phishing kits, with over 400 domains linked to their attacks, enabling large-scale, efficient credential harvesting and extortion operations^[6].
Two banking trojan campaigns, Grandoreiro and BTMOB RAT, are actively targeting Windows and Android users in Latin America and Europe, aiming to steal credentials and perform remote access attacks^[8].
Threat actors are distributing GPU mining malware through coordinated SEO poisoning campaigns and by manipulating AI chatbot recommendations, targeting systems with high-performance computing resources for cryptojacking^[14].
Phishing campaigns are abusing Adobe Target to track victims and steal LinkedIn credentials by redirecting users to legitimate LinkedIn pages after harvesting their information^[41].
The Kali365 phishing kit is being used by attackers to bypass multi-factor authentication and steal Microsoft Outlook, Teams, and OneDrive credentials, enabling persistent access to victim accounts^[39].
A new attack technique dubbed “SymJack” leverages malicious repositories and disguised symlinks to trick AI coding agents into installing attacker-controlled servers, compromising CI pipelines and stealing secrets in supply chain attacks^[36].

Trends, Tools, or Tactics of Interest

Attackers are increasingly using AI to accelerate exploit development, reducing the time required to weaponize vulnerabilities and outpacing the detection capabilities of traditional scanners^[23].
There is a documented rise in the use of deepfakes and sophisticated deception techniques in social engineering attacks, making it harder for individuals to discern legitimate communications^[2].
Geopolitical events, such as tensions involving Iran, are being leveraged to fuel social engineering campaigns, with attackers exploiting global conflict narratives to increase the success of their lures^[4].
The use of phishing kits to automate attacks, including adversary-in-the-middle (AiTM) techniques, is enabling extortion groups to efficiently bypass authentication mechanisms and harvest credentials at scale^[6]^[39].
Credential theft remains a critical threat, with AI-driven phishing, session hijacking, and abuse of stolen credentials undermining modern security controls^[35].
AI chatbots are being manipulated both for distributing malware and as vectors for social engineering, including recommending malicious downloads and providing inaccurate or dangerous health advice, raising privacy and security concerns^[7]^[14].
The cybersecurity industry is witnessing a shift from traditional perimeter defense to AI-native security approaches, adapting to new challenges posed by AI-driven threats^[24].
Security researchers are using AI models, such as BinNet, to hunt for vulnerabilities and backdoors in software binaries, reflecting the growing adoption of AI in both offensive and defensive security operations^[32].

Regulatory or Policy Developments Affecting the Security Industry

The UK’s cyberspying chief has warned that AI is becoming an unstoppable force and highlighted increased hostile activity from Russia in the cyber “gray zone” below the threshold of open conflict^[29].
CISA’s directive requiring rapid patching of actively exploited vulnerabilities in federal systems underscores the regulatory focus on timely remediation of critical security flaws^[18].

Sources

GlassWorm Malware Takedown Disrupts Developer Supply Chain Attack Infrastructure - thehackernews.com
Glassworm botnet disrupted after resilient C2 infrastructure takedown - bleepingcomputer.com
GlassWorm Botnet Disrupted - securityweek.com
FBI warns of in-person data theft attacks from extortion gang - bleepingcomputer.com
Ransomware Actors Show Up In Person to Steal Law Firm Data - darkreading.com
Dutch police arrests suspect linked to Ajax football club hack - bleepingcomputer.com
Latin American Cybercriminals Hoover Up Government Data - darkreading.com
LA Metro Cyberattack Linked to Iranian State-Sponsored Hackers - securityweek.com
Gitea Vulnerability Exposes Private Container Images without Authentication - thehackernews.com
Vulnerability in Popular Conference Software Granted Attackers a 100% Talk Acceptance Rate - securityweek.com
Malicious npm Package Stole Files From Claude AI User Directory via GitHub - thehackernews.com
CISA gives feds 4 days to patch actively exploited cPanel plugin flaw - bleepingcomputer.com
Pirates in the crosshairs: how one cybercrime gang has been infecting book, movie, and TV show fans for years - securelist.com
Alert: Extortion Groups Are Using Phishing Kits to Automate Their Attacks - blog.knowbe4.com
Grandoreiro Malware and BTMOB RAT Campaigns Target Windows and Android Users - thehackernews.com
GPU mining malware spreads via SEO poisoning, AI chatbots - bleepingcomputer.com
Fake LinkedIn emails abuse Adobe to track victims - malwarebytes.com
Kali365 phishing kit bypasses MFA and steals Microsoft logins - malwarebytes.com
‘SymJack’ Attack Turns AI Coding Agents Into Supply Chain Attack Delivery Systems - securityweek.com
AI-Assisted Exploit Development Outpaces Scanner Detection - darkreading.com
Perry Carpenter KB4-CON 2026 Q&A: Deepfakes & Deception - blog.knowbe4.com
When Global Conflict Becomes a Cyber Weapon: How Iran Tensions and Other Stressful Events Fuel Social Engineering Attacks - blog.knowbe4.com
The Credential Crisis: How Stolen Credentials Defeat Modern Security - securityweek.com
What to consider before asking an AI chatbot for health advice - welivesecurity.com
Cybersecurity Evolution: How We Went From Perimeter Defense to AI-Native Security - darkreading.com
RevEng.AI Raises $15 Million to Hunt for Flaws and Backdoors in Software Binaries - securityweek.com
UK Cyberspying Chief Calls AI ‘an Unstoppable Force’ and Warns About Russia - securityweek.com

Cybersecurity Brief – 2026-05-27

Wed, 27 May 2026 00:00:00 +0000

Major Incidents or Breaches

Charter Communications confirmed a data breach after the ShinyHunters extortion group threatened to leak stolen data unless a ransom was paid ^[13].
Information allegedly stolen from 7-Eleven has been leaked, impacting approximately 185,000 individuals and exposing email addresses, names, addresses, and dates of birth ^[33].
Over 5,500 GitHub repositories were compromised in a campaign using Megalodon malware, resulting in theft of credentials and developer secrets ^[18].
More than 700 education and tech websites were hijacked in a large-scale ClickFix malware campaign, exploiting a Ghost CMS flaw to serve malicious Cloudflare verification pages ^[40].

Newly Discovered Vulnerabilities

Microsoft released patches for a critical remote code execution vulnerability in SharePoint (CVE-2026-45659), which could be exploited without specialized conditions ^[8]^[20].
A critical zero-day vulnerability in the KnowledgeDeliver learning management system was exploited to deploy the Godzilla web shell; the flaw involved hardcoded machineKey values that enabled ViewState deserialization attacks ^[12]^[35].
CISA ordered immediate patching of an actively exploited SQL injection vulnerability in Drupal CMS for US government agencies ^[17].
CISA urged urgent patching of a zero-day vulnerability in the LiteSpeed cPanel plugin that was exploited in the wild to execute scripts with root privileges ^[29].

Notable Threat Actor Activity

The ShinyHunters extortion group was responsible for threats and data leaks targeting Charter Communications and 7-Eleven ^[13]^[33].
The Iranian APT group MuddyWater conducted a new espionage campaign targeting organizations across nine countries, employing DLL side-loading techniques ^[6].
The Iranian APT known as Nimbus Manticore continued targeting aviation and software companies using updated tools ^[32].
The FBI warned that the Silent Ransom Group is sending operatives in person to law firms to physically insert USB drives and steal data ^[28].
Fake installers and plugins for popular software such as ChatGPT and Claude, distributed via GitHub and SourceForge, were found to deliver Deno RAT, granting attackers full device control ^[39].

Trends, Tools, or Tactics of Interest

Threat actors are increasingly augmenting attacks with AI tools, including real-time operational deployment of AI in offensive operations, smarter AI-driven DDoS attacks, and use of AI to generate plain-English remediation guidance for vulnerabilities ^[2]^[7]^[38]^[37].
AI chatbot recommendations are being abused to redirect users to cryptojacking malware sites in active campaigns ^[5].
Multi-factor authentication (MFA) prompt bombing remains a prevalent tactic to bypass second-factor protections ^[9].
Remote access trojans such as BTMOB are leveraging ready-made campaign tools to lower barriers for full device compromise on Android devices ^[4].
Microsoft Defender is testing automatic endpoint isolation to prevent lateral movement after compromise ^[15].
AppOmni’s Marlin AI and Varonis Atlas are leveraging AI for autonomous SaaS security investigation and AI governance, respectively ^[31]^[14].
Anthropic released a Claude Sandbox security plugin to assist developers in identifying vulnerabilities during coding and expanded Claude’s enterprise security governance with 28 new integrations, including major security vendors ^[30]^[34].

Regulatory or Policy Developments Affecting the Security Industry

The Indian Computer Emergency Response Team (CERT-In) issued guidelines mandating that critical vulnerabilities in internet-facing systems be patched within 12 hours of detection amid increased AI-assisted attacks ^[10].
CISA announced a revised schedule for town halls to engage stakeholders on cyber incident reporting requirements for critical infrastructure ^[27].

Sources

Charter confirms data breach after ShinyHunters extortion threat - bleepingcomputer.com
185,000 Likely Impacted by 7-Eleven Data Breach - securityweek.com
Feeding Frenzy: 'Megalodon' Malware Infects Thousands of GitHub Repos - darkreading.com
700+ education and tech websites hijacked in huge ClickFix malware campaign - malwarebytes.com
Microsoft Patches SharePoint RCE Flaw CVE-2026-45659 Across Server Versions - thehackernews.com
Microsoft Issues Out-of-Band SharePoint Patch - darkreading.com
KnowledgeDeliver flaw exploited as a zero-day to install web shells - bleepingcomputer.com
Hackers Exploited KnowledgeDeliver Zero-Day for Web Shell Deployment - securityweek.com
CISA orders feds to patch actively exploited Drupal vulnerability - bleepingcomputer.com
CISA Urges Immediate Patching of Exploited LiteSpeed cPanel Plugin Zero-Day - securityweek.com
MuddyWater Uses DLL Side-Loading in Espionage Campaign Targeting 9 Countries - thehackernews.com
Iranian APT Targets Aviation, Software Companies With Updated Tools - securityweek.com
FBI: Hackers Sending Operatives in Person to Insert USB Drives and Steal Data - securityweek.com
Fake software on GitHub and SourceForge distribute Deno RAT - malwarebytes.com
Report: Adversarial Use of AI is Evolving - blog.knowbe4.com
[THN Webinar] New AI DDoS Attacks Are Smarter. Learn How to Fight Back - thehackernews.com
AI Threat Landscape Digest March-April 2026 - research.checkpoint.com
Open Source DockSec Uses AI to Cut Through Vulnerability Noise in Docker Images - securityweek.com
AI Chatbot Recommendations Redirect Users to Cryptojacking Malware Sites - thehackernews.com
MFA Prompt Bombing: Why Your Second Factor Isn't Saving You - thehackernews.com
BTMOB: A stealthy RAT burrowing deep into Android devices - welivesecurity.com
Microsoft Defender can now automatically isolate hacked endpoints - bleepingcomputer.com
AppOmni’s Marlin AI Brings Autonomous Investigation to SaaS Security - securityweek.com
How Varonis Atlas integrates Claude Compliance API for AI governance - bleepingcomputer.com
Anthropic Releases New Claude Sandbox, Security Guidance Plugin - securityweek.com
Anthropic Expands Claude’s Enterprise Security Governance With 28 New Integrations - securityweek.com
CERT-In Recommends 12-Hour Patching for Internet-Facing Flaws Amid AI-Assisted Attacks - thehackernews.com
CISA Announces Revised Town Hall Schedule to Engage with Stakeholders on Cyber Incident Reporting for Critical Infrastructure - cisa.gov

Cybersecurity Brief – 2025-06-06

Fri, 06 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

The Interlock ransomware group claimed responsibility for a cyberattack on Kettering Health, leaking data allegedly stolen from the healthcare network’s systems.
A threat actor has re-released data from the 2021 AT&T breach, this time combining files to directly link Social Security numbers and birth dates to 49 million phone numbers.
Two members of the ViLE gang were sentenced for breaching a US federal law enforcement web portal and conducting an extortion scheme.
The U.S. Department of Justice seized cryptocurrency funds and 145 clearnet and dark web domains associated with the BidenCash carding marketplace.
Cisco Talos researchers reported a destructive ‘PathWiper’ attack using new wiper malware against an unnamed critical infrastructure organization in Ukraine.
Thousands of Asus routers have been compromised and incorporated into botnets.
Cybercriminals are exploiting a simple technique to steal Salesforce business data for extortion purposes.
The FBI issued an alert that the BADBOX 2.0 Android malware campaign has infected over 1 million consumer IoT devices, converting them into residential proxies for malicious use.

Newly Discovered Vulnerabilities

Hackers are actively exploiting CVE-2025-49113, a critical vulnerability in the Roundcube open-source webmail application, enabling remote code execution. Technical details have been disclosed and exploits are for sale.
Cisco warned of a static credential vulnerability (CVSS 9.9) in Identity Services Engine (ISE) cloud deployments on AWS, Azure, and Oracle Cloud, resulting in shared credentials across instances running the same software release and cloud platform.
ConnectWise issued a patch for an unspecified vulnerability affecting ScreenConnect customers, though details about the flaw and timeline of exploitation remain unclear.
Several popular Google Chrome extensions were found to transmit data over HTTP and hard-code sensitive credentials, leaking API keys and user data.

Notable Threat Actor Activity

The Silent Ransom Group (SRG) is targeting law firms with IT-themed social engineering attacks and callback phishing emails, according to an FBI alert.
BladedFeline, an Iran-aligned APT group with likely ties to OilRig/APT34, has been conducting cyberespionage campaigns targeting Kurdish and Iraqi government officials. ESET research indicates the group has maintained long-term access to targeted networks for up to eight years, deploying Whisper and Spearal malware.
The Bitter APT group, assessed as state-backed and aligned with Indian government interests, is expanding its geographic scope and evolving its tactics for intelligence gathering.
A phishing campaign using copyright infringement lures is targeting European countries, as reported by Cybereason.
Sophos researchers identified a campaign distributing backdoored malware targeting novice cybercriminals via GitHub repositories, with links to other campaigns dating back to August 2022.

Trends, Tools, or Tactics of Interest

Q1 2025 threat statistics show a significant increase in attacks on both non-mobile (Windows, macOS, IoT) and mobile platforms, including ransomware, miners, adware, and unwanted apps.
AI is increasingly being embedded into threat detection and response tools, but hallucinations and inaccurate guidance remain a risk for security operations teams.
Proxy services are capitalizing on Ukraine’s loss of IP address space, with significant portions of the country’s internet resources now under Russian control or sold to brokers.
Cybercriminals are leveraging compromised consumer IoT devices as residential proxies for malicious activity, as highlighted by the BADBOX 2.0 campaign.
The DShield honeypot network is introducing changes to allow greater customization and data analysis.
There is a trend of cybercriminals leveraging simple but effective social engineering and phishing techniques to steal sensitive business data, as seen in Salesforce data theft and callback phishing attacks.

Regulatory or Policy Developments Affecting the Security Industry

Germany’s data protection authority (BfDI) fined Vodafone GmbH €45 million ($51.4 million) for privacy and security violations.
Cellebrite, a digital forensics firm, is set to acquire virtualization vendor Corellium for $170 million, which may have implications for mobile device forensics and privacy.
The US continues to debate the appropriate regulatory approach to AI, with commentary emphasizing the need to balance innovation and security without waiting for political consensus.