DanSec

Threat actor

Silver Fox

In 16 briefs, most recently 31 August 2026. RSS for this tag

Learn more: Malpedia ↗ ThreatFox ↗ MalwareBazaar ↗

Coverage in DanSec Daily

  1. McKesson breach claimed by ShinyHunters (284M records), Berlin city ransomware by Rhysida, and ServiceNow critical code injection patches.
  2. Anthropic's Claude agent breaching real organizations, the Brinks Home ShinyHunters breach, and a critical JetBrains TeamCity authentication bypass …
  3. ShareFile customers told to shut down storage controllers after an external threat; WP-SHELLSTORM backdoors thousands of WordPress sites; Zimbra critical flaw.
  4. Trellix source code breach, DigiCert certificate revocations after a chat-channel attack, and 40,000+ servers compromised via the cPanel flaw CVE-2026-41940.
  5. The TeamPCP SAP npm supply chain attack, Checkmarx GitHub data theft, and a five-year dormant WordPress plugin backdoor affecting 70,000+ sites.
  6. The CPUID supply chain attack, Hims health data breach, Storm-2755 payroll hijacking, and Juniper Junos OS critical flaw patches.
  7. Cisco source code theft, Axios npm hijack spreading malware, and Iranian Pay2Key pseudo-ransomware campaigns.
  8. ESA confirms breach of external servers, Korean Air data theft tied to Oracle EBS hack, and BlackCat ransomware pleas by ex-Sygnia and DigitalMint staff.
  9. React2Shell exploitation, Gladinet CentreStack hard-coded key attacks, WinRAR CVE-2025-6218 abuse, and Fortinet auth bypass patches in this security news brief.
  10. Inotiv ransomware theft, Marquis breach affecting 780,000+, and React2Shell (CVE-2025-55182) exploitation by China-linked actors.
  11. Envoy Air's Oracle EBS data theft claimed by Clop, Prosper's breach of 17.6 million accounts, and Zendesk email bombing.
  12. Salesloft Drift OAuth breach hits Cloudflare, Palo Alto Networks and Zscaler; Jaguar Land Rover cyberattack halts production; WhatsApp zero-day exploited …
  13. The Bouygues Telecom breach of 6.4 million customers, the Salesforce vishing campaign tied to ShinyHunters, and the CISA-mandated patch for Exchange …
  14. Qantas and Johnson Controls breach notices, a Chrome zero-day (CVE-2025-6554) under active exploitation, and Silver Fox's Gh0stRAT campaign against Taiwanese …
  15. Ahold Delhaize breach hits 2.2M people, Cloudflare mitigates record DDoS, Russia throttles Cloudflare, Citrix Bleed 2 exploited.
  16. The Zoomcar breach affecting 8M+ users, Veeam's critical CVE-2025-23121 backup RCE, and the Langflow flaw exploited to deploy the Flodrix botnet.