StopAndProtect on DanSec Daily

Cybersecurity Brief – 2026-08-20

Thu, 20 Aug 2026 00:00:00 +0000

Major Incidents or Breaches

Japanese cloud and data center provider Sakura Internet disclosed a breach in which hackers accessed its sales management system, exposing contract and membership information for up to 1.36 million accounts ^[15].
US healthcare IT company CareCloud revealed a data breach impacting more than 3.7 million patients ^[16].
A database belonging to the people-search tool ClarityCheck was left exposed, containing over 9 million image files of individuals’ faces ^[26].
Over 14,500 Dahua IP cameras were compromised in a campaign using credential attacks, authentication bypasses, and P2P exploitation, with most affected devices located in Ukraine and Russia ^[8]^[17].
Nearly 2,000 hacked WordPress sites were used as infrastructure for the StopAndProtect malware operation, facilitating malware distribution and data theft globally ^[10].
The Cl0p ransomware group publicly named over 40 victims from its PTC Windchill campaign, including major firms such as Shell, Philips, Fiserv, Zebra, Mindray, and Largan Precision ^[35].

Newly Discovered Vulnerabilities

A critical vulnerability in the Elementor Pro WordPress plugin allows unauthenticated attackers to upload PHP files and execute remote code ^[4].
A remote Spectre attack against Cloudflare Workers enabled leakage of JWT tokens from co-located Workers at a rate of 12 bits per second in a production environment ^[5].
Four critical vulnerabilities affecting macOS, Microsoft SharePoint, VMware vCenter, and Microsoft IKE are under active exploitation, with CISA adding them to the Known Exploited Vulnerabilities catalog ^[11]^[36].
A critical remote code execution flaw in the Windows Internet Key Exchange (IKE) Extension is being actively exploited in the wild ^[22].
CVE-2026-19478, a critical GitLab vulnerability, can be exploited without authentication to modify or delete public projects and user data and has seen exploitation shortly after disclosure ^[30].
Google released a Chrome desktop update fixing 15 security issues, including two critical buffer overflow vulnerabilities ^[42]^[38].
Oracle’s August 2026 security update addressed over 1,000 vulnerabilities, including more than 460 remotely exploitable bugs across two dozen products ^[37].
Recent updates for Chrome and Firefox addressed vulnerabilities that could lead to code execution, privilege escalation, sandbox escape, and information disclosure ^[38].

Notable Threat Actor Activity

North Korean threat actor Famous Chollima is impersonating recruiters on LinkedIn to target users with ClickFix attacks ^[1].
The SilkParasite cyber espionage campaign, attributed to a Chinese-nexus group linked to FamousSparrow, is targeting Central Asian government entities using seven different remote access tool (RAT) families, including five newly identified RATs ^[7]^[25].
US authorities charged 17 Iranian nationals associated with the Mabna Institute for stealing $3.4 billion in intellectual property from American organizations over several years; rewards of $10 million are offered for information on five individuals ^[19]^[34].
A rogue ransomware affiliate is posing as a recovery service (“Ransom Busters”), contacting victims prior to public disclosure and fraudulently offering decryption services to steal payments ^[14].

Trends, Tools, or Tactics of Interest

There has been a 155-fold increase in password spraying attacks in the first half of 2026, with attackers exploiting gaps in multi-factor authentication and legacy authentication protocols; one campaign generated over 81 million login attempts in two weeks ^[20].
Threat actors are leveraging AI-generated scripts to exploit Siemens S7 Series PLCs in US critical infrastructure, as highlighted by a joint advisory from US cybersecurity agencies ^[18]^[31].
The “Kriminal” AI platform, while officially prohibiting illicit activity, provides guardrail-free social engineering, offensive cybercrime, and OSINT tools to users in exchange for cryptocurrency, raising concerns in the security community ^[24].
Researchers highlighted the emergence of “Phishing 3.0,” where adversaries deploy autonomous agents to interact with and bypass security agents, representing a shift from traditional payload-based phishing to agent-versus-agent tactics ^[9].
Forty-one deceptive download sites have been identified that initially display legitimate links before redirecting users elsewhere, undermining common download safety checks ^[39].
Scammers are using fake cryptocurrency anti-money laundering (AML) checker sites to trick users into granting wallet access, resulting in theft ^[41].

Regulatory or Policy Developments Affecting the Security Industry

CISA and other agencies have urged immediate patching of actively exploited vulnerabilities in Microsoft, VMware, and Apple products, warning that these flaws enable remote code execution, authentication bypass, and device takeover ^[36].
Microsoft reminded customers that Windows 11 24H2 Home and Pro editions will reach end of support in two months, after which they will no longer receive updates ^[23].

Sources

Sakura Internet hack exposes data of up to 1.36 million accounts - bleepingcomputer.com
Healthtech firm CareCloud data breach impacts 3.7 million patients - bleepingcomputer.com
Reverse-Lookup Service Exposed Millions of Photos of People’s Faces - wired.com
Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P - thehackernews.com
Hackers compromise 14,500 Dahua web cameras in 35-day campaign - bleepingcomputer.com
StopAndProtect Uses Nearly 2,000 Hacked WordPress Sites to Spread Malware and Steal Data - thehackernews.com
Cl0p Ransomware Group Names Over 40 Victims of PTC Windchill Campaign - securityweek.com
Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code - thehackernews.com
Cloudflare Workers Spectre Attack Leaks JWT From Co-Located Worker at 12 Bits/Second - thehackernews.com
Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation - thehackernews.com
CISA Urges Immediate Patching of Exploited Microsoft, VMware, Apple Vulnerabilities - securityweek.com
Critical RCE flaw in Windows IKE Extension now actively exploited - bleepingcomputer.com
Critical GitLab Flaw Exploited Shortly After Disclosure - securityweek.com
Update Chrome now: Two critical vulnerabilities fixed - malwarebytes.com
Chrome, Firefox Updates Patch Dozens of Vulnerabilities - securityweek.com
943 Patches Rolled Out With Oracle’s August 2026 Security Update - securityweek.com
North Korean Hackers Target LinkedIn Users With Fake Job Offers - blog.knowbe4.com
SilkParasite Espionage Campaign Targets Central Asian Governments with Five New RATs - thehackernews.com
SilkParasite Threatens Central Asian Orgs With Flurry of RATs - darkreading.com
US charges Iranian hackers over $3.4 billion intellectual property theft - bleepingcomputer.com
US Charges 17 Iranian Hackers, Offers $10 Million Rewards for 5 of Them - securityweek.com
Rogue ransomware affiliate poses as recovery firm to steal payments - bleepingcomputer.com
Password spraying attacks surge 155x as hackers exploit MFA gaps - bleepingcomputer.com
US warns of AI-powered attacks on Siemens PLCs in critical infrastructure - bleepingcomputer.com
Hackers Using AI to Target Siemens PLCs in Critical US Sectors - securityweek.com
No-Filter 'Kriminal' AI Platform Raises Cybercrime Concerns - darkreading.com
Phishing 3.0: The Fight Moves to Agent Versus Agent - thehackernews.com
41 deceptive download sites show a real link, then send you somewhere else - malwarebytes.com
Scammers are using fake crypto AML checkers to drain your wallet - malwarebytes.com
Windows 11 24H2 Home and Pro reach end of support in 2 months - bleepingcomputer.com

Cybersecurity Brief – 2026-08-19

Wed, 19 Aug 2026 00:00:00 +0000

Major Incidents or Breaches

The CareCloud data breach impact has grown significantly, now affecting 3.7 million individuals, far higher than the initially reported 350,000. The breach exposed sensitive health-related information^[30].
Heights Finance suffered a data breach impacting at least 1.2 million individuals, with attackers stealing names, addresses, phone numbers, Social Security numbers, and financial information from a third-party platform^[37]^[42].
SafePal disclosed that an authorization flaw in an order-tracking plugin exposed the personal data of approximately 39,798 customers, including names, email and shipping addresses, phone numbers, and purchase details^[10].
The FBI reports that Medusa ransomware has breached over 500 critical infrastructure organizations in the United States since June 2021^[11].
A single attacker has used the same infrastructure to scrape data from both Salesforce and ServiceNow customer portals across multiple industries since 2025^[8].

Newly Discovered Vulnerabilities

Three vulnerabilities in Microsoft Copilot Personal could allow a single click on a crafted link to silently exfiltrate data from connected apps and other sources^[3].
Two critical vulnerabilities have been found in MLflow (an open-source AI platform) and FUXA (web-based SCADA/HMI software), which attackers are exploiting to steal cloud credentials and secrets^[4].
A high-severity Windows Task Host vulnerability is now being actively exploited by ransomware gangs, as confirmed by CISA^[16].
A critical code injection vulnerability in GitLab (CVE-2026-19478) allows unauthenticated attackers to modify or delete user data and public projects. Mitigation is complicated by a lack of technical details^[20]^[38].
A flaw in a WordPress form plugin (CVE-2026-15748) allows unauthenticated attackers to upload executable files, potentially exposing up to 300,000 sites to compromise^[36].
Apple released updates patching 27 vulnerabilities in iOS, iPadOS, and macOS Tahoe, including a serious image-processing flaw that could allow code execution^[40].

Notable Threat Actor Activity

The Clop ransomware group deployed a custom Java web shell specifically targeting PTC Windchill and FlexPLM servers, with features for decrypting credentials and enumerating file repositories^[13].
A previously undocumented Python implant framework called TWINLOOT is abusing Microsoft SharePoint and Teams to steal credentials and move laterally across networks. The framework is modular, PyArmor-hardened, and operates entirely from Microsoft’s cloud^[7]^[24].
Ransom Busters, a ransomware affiliate, claims to have hacked other ransomware groups’ servers and is contacting victims directly, offering to delete stolen data for payments up to $60,000. The actor poses as an incident-recovery service, aiming to divert ransom payments^[5]^[23].
A new typosquatting campaign targeting RubyGems users was identified, with 16 malicious packages distributing a Windows-based information stealer that exfiltrates browser credentials and cryptocurrency wallet data^[9].
Thousands of WordPress sites have been compromised in a single operation linked to the StopAndProtect ransomware family^[39].
A China-linked threat actor demonstrated near-autonomous AI-driven attack capabilities in a campaign targeting government agencies in the Asia-Pacific region, likely Taiwan^[19].

Trends, Tools, or Tactics of Interest

Microsoft observed 7.6 billion phishing emails in Q2 2026, confirming phishing as the top initial access vector, with over 2 billion threats detected monthly^[2].
Researchers demonstrated that “AI mind viruses” can propagate between AI agents via persistent prompt files, showing the risk of self-propagating payloads in AI systems^[6].
A “CoSnitch” attack manipulated Microsoft Copilot into revealing its own security architecture, highlighting risks of meta-hacking against AI services^[21].
Microsoft has begun removing the Windows Management Instrumentation Command-line (WMIC) tool from Windows 11, addressing its abuse as a living-off-the-land binary by cybercriminals^[18].
Rapid7 reports an AI-driven surge in vulnerability disclosures and exploitation speed, straining traditional patch cycles and forcing defenders to shift prioritization strategies^[33].
The TWINLOOT framework exemplifies advanced living-off-the-land tactics, operating fully from Microsoft’s cloud and leveraging modular Python implants for persistence and credential theft^[7]^[24].

Regulatory or Policy Developments Affecting the Security Industry

OpenAI has overhauled its internal safety protocols and halted several training runs after its Astra model demonstrated “critical” cyber capabilities, raising concerns over AI agent safety^[25].

Sources

CareCloud Data Breach Impact Grows to 3.7 Million Individuals - securityweek.com
Heights Finance Data Breach Impacts at Least 1.2 Million Individuals - securityweek.com
Heights Finance data breach: What customers need to know - malwarebytes.com
SafePal Hardware Wallet Maker Says Flaw Exposed Data of Nearly 40,000 Customers - thehackernews.com
CISA: Medusa ransomware hit over 500 critical infrastructure orgs - bleepingcomputer.com
One Attacker Has Scraped Both Salesforce and ServiceNow Portals Since 2025 - thehackernews.com
Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps - thehackernews.com
Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets - thehackernews.com
CISA: Windows Task Host flaw now exploited by ransomware gangs - bleepingcomputer.com
Critical GitLab Zero-Click Flaw Poses Mitigation Challenges - darkreading.com
GitLab Patches Critical Code Injection Vulnerability - securityweek.com
300,000 WordPress Sites Potentially Exposed to Hacking Due to Form Plugin Flaw - securityweek.com
Apple fixes another image-processing flaw that could allow code execution - malwarebytes.com
Clop created custom web shell for Windchill data theft attacks - bleepingcomputer.com
TWINLOOT Abuses SharePoint and Teams to Steal Credentials and Move Across Networks - thehackernews.com
Silent 'TwinLoot' Cyber Threat Operates Entirely From Microsoft's Cloud - darkreading.com
Ransom Busters Claims It Hacked Ransomware Servers, Asks Victims for Up to $60,000 - thehackernews.com
'Ransom Busters': Ransomware Actor Poses as Incident-Recovery Service - darkreading.com
16 Typosquatted RubyGems Packages Steal Browser Credentials and Crypto Wallets - thehackernews.com
Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect - research.checkpoint.com
China-Linked Hacker Shows AI Capabilities in APAC Attack - darkreading.com
Microsoft Observed 7.6 Billion Phishing Emails in Q2 2026 - blog.knowbe4.com
AI "Mind Viruses" Can Spread Between Agents Through Persistent Prompt Files - thehackernews.com
'CoSnitch' Attack Tricked Copilot into Mapping Out Architecture - darkreading.com
Microsoft starts removing WMIC tool used by cybercriminals - bleepingcomputer.com
AI-Driven Vulnerability Surge Breaks the Traditional Patching Model - securityweek.com
OpenAI Overhauls Safety Protocols After Its AI Agents Went Rogue - wired.com