Cybersecurity Brief – 2026-06-25

Thu, 25 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Law enforcement and private sector partners have disrupted the infrastructure of the Amadey botnet and Stealc infostealer operations, recovering 27 million stolen credentials and impacting hundreds of command-and-control servers in a coordinated global action known as Operation Endgame ^[5]^[8]^[17]^[30].
The US Department of Justice has seized a cloud computing account linked to subsidiaries of Cambodia-based HuiOne Group, which was allegedly used for cyber scam money laundering ^[11].
A 21-year-old hacker known as “Snoopy” has been sentenced to 18 months in prison for their involvement in the 2022 DraftKings cyberattack, with a requirement to pay approximately $1.8 million in forfeiture and restitution ^[13]^[33].

Newly Discovered Vulnerabilities

A critical zero-day vulnerability in Cisco Catalyst SD-WAN (CVE-2026-20245) was exploited for at least two months before public disclosure, allowing attackers to gain root access and create rogue accounts through rogue peering and exploitation of the device’s web-based management interface ^[6]^[14]^[20]^[28].
CISA has issued warnings about active exploitation of critical vulnerabilities in Lantronix EDS5000 Series devices and Ubiquiti UniFi OS products, enabling remote, unauthenticated attackers to make system changes, access underlying accounts, and inject commands ^[7]^[16]^[34].
Researchers have identified a critical FFmpeg flaw, dubbed PixelSmash, which allows attackers to compromise systems via malicious video files ^[36].
Chrome 149 update addresses 18 severe vulnerabilities, with more than half being use-after-free bugs that could lead to remote code execution ^[27].
A security gap in macOS allows users, including standard non-admin accounts, to disable security and integrated browser tools without requiring administrator privileges or kernel exploits by chaining legitimate OS behaviors ^[24]^[32].

Notable Threat Actor Activity

A new global campaign named StrikeShark is delivering Cobalt Strike Beacon through a custom loader called SharkLoader ^[1].
The Silent Ransom Group has targeted US law firms using a combination of voice phishing and in-person social engineering to exfiltrate sensitive data ^[3].
The Mistic backdoor has been linked to the ransomware access broker KongTuke, with attacks observed against organizations in insurance, education, IT, and professional services sectors ^[19].
Malicious Microsoft Edge extension “Edgecution” has been used in ransomware attacks to escape the browser sandbox and deploy a Python-based backdoor via abuse of Native Messaging ^[15].
Malicious packages on the OpenClaw (ClawHub) AI skills marketplace were found to bypass security checks and include infostealers and other threats, posing risks to the AI supply chain ^[23].

Trends, Tools, or Tactics of Interest

Attackers are increasingly exploiting weaknesses in CI/CD workflows, with researchers highlighting a new class of flaws (Cordyceps) that expose over 300 GitHub repositories to supply-chain attacks ^[9].
Threat actors are abusing a variety of collaboration channels beyond email, adapting to improved cloud email security and seeking new vectors for social engineering and phishing ^[4].
Service desks remain a favored target for social engineering attacks aimed at obtaining password resets, MFA changes, and unauthorized access to corporate accounts ^[18].
There is a noted rise in cyber threats targeting major events, with the 2026 FIFA World Cup facing persistent cybercrime, social engineering, and infrastructure attacks across host countries ^[21].
Attackers are leveraging information as an attack surface, using tactics such as hidden content injections and cognitive state poisoning to compromise AI and autonomous systems ^[29]^[35].

Regulatory or Policy Developments Affecting the Security Industry

NIST has opened updated IoT security guidance for public review, aiming to establish cybersecurity requirements for IoT devices used in federal agency networks ^[26].
Google is rolling out new privacy controls for Search services and Google Play, giving users more granular control over saved activity history and personalized recommendations ^[12].

Sources

ESET takes part in Operation Endgame to disrupt Amadey and Stealc - welivesecurity.com
Amadey and StealC Malware Network Disrupted, 27M Stolen Credentials Recovered - thehackernews.com
Amadey, StealC malware operations disrupted in Operation Endgame action - bleepingcomputer.com
Microsoft and Allies Smash Shared Infrastructure of Amadey and StealC Malware - securityweek.com
DoJ Seizes Huione Cloud Account Tied to Cyber Scam Money Laundering - thehackernews.com
DraftKings hacker 'Snoopy' sentenced to 18 months in prison - bleepingcomputer.com
Third DraftKings Hacker Sentenced to 18 Months in Prison - securityweek.com
Cisco Catalyst SD-WAN Zero-Day CVE-2026-20245 Exploited to Gain Root Access - thehackernews.com
Mandiant reveals how Cisco SD-WAN zero-day attacks gained root access - bleepingcomputer.com
Attackers Hit Cisco SD-WAN Flaw 2 Months Before Disclosure - darkreading.com
Cisco SD-WAN Zero-Day Exploited Months Before Patching - securityweek.com
CISA Warns Critical Lantronix EDS5000 Flaw Is Being Actively Exploited - thehackernews.com
CISA warns of max severity Ubiquiti flaws exploited in attacks - bleepingcomputer.com
Critical Ubiquiti Vulnerabilities in Attackers’ Crosshairs - securityweek.com
PixelSmash flaw turns video files into attack tools - malwarebytes.com
Chrome 149 Update Resolves 18 Severe Vulnerabilities - securityweek.com
Apple's MacOS Gap Lets Users Disable Security Tools - darkreading.com
macOS Weaknesses Chained to Silently Disable Endpoint Security Agents - securityweek.com
StrikeShark: investigating a new campaign delivering Cobalt Strike through SharkLoader - securelist.com
Extortion Gang Sends In-Person Attackers to Exfiltrate Data - blog.knowbe4.com
Stealthy Mistic backdoor linked to ransomware access broker KongTuke - bleepingcomputer.com
Malicious Edge extension abuses Native Messaging as bridge to malware - bleepingcomputer.com
More Malicious OpenClaw Skills Threaten AI Supply Chain - darkreading.com
Cordyceps CI/CD Flaws Expose 300+ GitHub Repositories to Supply-Chain Attacks - thehackernews.com
Attackers aren’t loyal to any collaboration channel - blog.knowbe4.com
Securing the service desk: Why social engineering attacks keep succeeding - bleepingcomputer.com
2026 FIFA World Cup Faces Surge in Cyber Threats - darkreading.com
When Information Becomes the Attack Surface – Understanding AI Agent Traps - securityweek.com
Agentic AI Security: Wrong Context, Wrong Decisions at Machine Speed - securityweek.com
NIST Opens Updated IoT Security Guidance to Public Review - securityweek.com
Google releases new privacy controls for activity history, personalization - bleepingcomputer.com

Snoopy on DanSec Daily

Cybersecurity Brief – 2026-06-25

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry

Sources