Storm-1175 on DanSec Daily

Cybersecurity Brief – 2026-08-11

Tue, 11 Aug 2026 00:00:00 +0000

Major Incidents or Breaches

Hackers breached a Polish combined heat and power plant by exploiting a private cellular network (APN), leading to the shutdown of a steam turbine and water treatment system. This attack vector is notable as it marks the first known use of a private APN for access to operational technology networks in critical infrastructure^[7]^[15]^[41].
LexisNexis took its Diligence, Metabase API, and Newsdesk services offline following detection of unusual activity on servers managed by a third-party vendor^[22].
Valve notified European Steam hardware customers of a data breach resulting from a compromise of its shipping partner, CEVA Logistics, leading to theft of customer data^[23].
Corporate data was stolen from Levi Strauss following a social engineering attack that enabled threat actors to access and exfiltrate data from the computers of three employees^[43].

Newly Discovered Vulnerabilities

A critical Progress Kemp LoadMaster command injection vulnerability is being actively exploited in the wild, allowing unauthenticated remote attackers to execute arbitrary commands. CISA has issued an urgent warning to patch affected systems^[24]^[42].
Two recently patched SonicWall SMA1000 vulnerabilities, including a maximum-severity server-side request forgery flaw, are now being exploited by ransomware groups^[19].
A maximum-severity, unauthenticated, remote administrator access vulnerability in Metabase has been exploited as a zero-day. Metabase has released a patch, but the vulnerability does not yet have a CVE^[27]^[40].
High-severity vulnerabilities in ClamAV, Cisco’s anti-malware engine, have been disclosed with a public proof-of-concept. These bugs could be exploited remotely by unauthenticated attackers to cause denial-of-service conditions^[37].
New passkey attacks have been demonstrated that can recover synced private keys or bypass phishing-resistant multi-factor authentication without breaking underlying cryptography^[13].

Notable Threat Actor Activity

Storm-1175, a financially motivated Chinese threat actor and former Medusa ransomware affiliate, has deployed a new ransomware strain named StormEncryptor, likely using an N-central flaw as an entry vector^[10]^[18].
The North Korean Kimsuky group has developed an offline AI stack to enhance phishing campaigns and automate malware development, allowing operations without dependence on public AI services^[12].
The threat actor Head Mare is exploiting unpatched TrueConf server vulnerabilities to replace legitimate client installers with a backdoor named PhantomCore, targeting Russian companies in various sectors^[14].
A supply chain compromise at WordPress plugin vendor BdThemes allowed attackers to poison a remote JSON feed, creating rogue WordPress admin accounts on affected sites^[8]^[16].
Iranian-linked actors have widened attacks on water systems across at least a dozen US states, targeting internet-exposed industrial control systems at water facilities^[26]^[39].

Trends, Tools, or Tactics of Interest

Malware targeting Windows, macOS, and IoT devices continued to evolve in Q2 2026, with notable increases in sophistication and targeting breadth^[1].
Mobile threat trends in Q2 2026 include the rise of the Anatsa banking trojan and increased use of dropper techniques to bypass detection^[2].
AI-driven social engineering attacks are becoming more convincing and personalized, with attackers leveraging AI to increase the speed and effectiveness of phishing, credential theft, and social engineering operations^[3]^[20].
“Ghostjacking” is a newly described attack method where poisoned security logs or alerts are used to manipulate and hijack AI agents by embedding malicious instructions^[25]^[38].
Sophisticated iOS exploit chains, such as Coruna and DarkSword, are proliferating from nation-state use to wider adoption by organized cybercrime groups^[29].
A turnkey scam kit has been discovered that lowers the technical barrier for conducting online scams, making it easier for non-technical actors to launch fraudulent campaigns^[45].
A new phishing kit, dubbed “Bulletproof Redirector,” uses compromised legitimate websites and hidden directories to evade secure email gateways and facilitate credential theft^[4].
Attackers are increasingly exploiting supply chain weaknesses, as seen in the BdThemes and Metabase incidents, to compromise downstream targets^[8]^[16]^[27]^[40].
Security researchers have demonstrated that passkey-based authentication can be undermined through attacks on synchronization and device trust mechanisms^[13]^[20].
Increased scanning activity targeting Solana blockchain endpoints has been observed, indicating heightened interest in exploiting crypto-related infrastructure^[33].

Regulatory or Policy Developments Affecting the Security Industry

Outdated cybercrime laws are putting security researchers at risk, prompting calls for legal reforms to protect ethical hackers and good-faith security research^[30].
Microsoft Edge is dropping support for Manifest V2, which will impact popular privacy tools that rely on older extension technology, potentially reducing user privacy protections^[46].
Mozilla has issued a new Firefox GPG signing key after the previous subkey was inadvertently exposed on GitHub, requiring a key revocation^[34].

Sources

Hackers Breach Polish Power Plant Controls via Private Cellular Network and Shut Turbine - thehackernews.com
Hackers breached a small Polish energy plant via private APN last year - bleepingcomputer.com
Novel Private APN Pivot Let Hackers Sabotage Second Polish Energy Facility - securityweek.com
LexisNexis shuts down services after suspicious activity on servers - bleepingcomputer.com
Valve notifies Steam hardware customers of a data breach - bleepingcomputer.com
Corporate Data Stolen in Levi Strauss Cyberattack - securityweek.com
Critical Progress LoadMaster flaw now actively exploited in attacks - bleepingcomputer.com
CISA Urges Immediate Patching of Exploited Progress LoadMaster Vulnerability - securityweek.com
CISA: SonicWall SMA1000 flaws now exploited by ransomware gangs - bleepingcomputer.com
Metabase SQL Zero-Day Attacks Could Have Wide Blast Radius - darkreading.com
Metabase Patches Vulnerability Exploited as Zero-Day - securityweek.com
Cisco Warns of High-Severity ClamAV Vulnerabilities With Public PoC - securityweek.com
New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing-Resistant MFA - thehackernews.com
China-Linked Hackers Deploy New StormEncryptor Ransomware, Likely via N-central Flaw - thehackernews.com
New StormEncryptor ransomware used by former Medusa affiliate - bleepingcomputer.com
Kimsuky Builds Offline AI Stack to Boost Phishing and Automate Malware Development - thehackernews.com
TrueConf Server Flaws Exploited to Replace Client Installers with PhantomCore - thehackernews.com
BdThemes Supply Chain Attack Poisons JSON to Create Rogue WordPress Admins - thehackernews.com
BdThemes plugins supply-chain hack creates rogue WordPress admins - bleepingcomputer.com
Multistate Water System Attacks Widen, Iran Suspected - darkreading.com
New Jersey, Alabama Join States Targeted in Water Cyberattacks - securityweek.com
IT threat evolution in Q2 2026. Non-mobile statistics - securelist.com
IT threat evolution in Q2 2026. Mobile statistics - securelist.com
Introducing Real-Time Coaching in KnowBe4’s AI-Native Security Awareness Training - blog.knowbe4.com
When Credentials Are No Longer Enough: Device Trust in the AI Era - bleepingcomputer.com
'GhostJacking' Exposes Identity Governance Gaps in AI Agents - darkreading.com
‘Ghostjacking’ Attack Uses Poisoned Logs to Turn AI Agents Bad - securityweek.com
Coruna, DarkSword iOS Exploits Proliferate Globally - darkreading.com
New turnkey kit makes it easy for anyone to become a scammer - malwarebytes.com
The Blind Spot: How “Bulletproof” Phishing Redirectors Slip Past SEGs - blog.knowbe4.com
Scans for Solana (Surfpool?) Endpoints, (Mon, Aug 10th) - isc.sans.edu
Outdated Cybercrime Laws Put Security Researchers at Risk - darkreading.com
Edge is dropping older extensions, affecting popular privacy tools - malwarebytes.com
Mozilla Issues New Firefox GPG Key Following Exposure - securityweek.com

Cybersecurity Brief – 2026-04-08

Wed, 08 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

Massachusetts Hospital Cyberattack
- Signature Healthcare in Massachusetts experienced a cyberattack resulting in ambulance diversions, cancellation of some services, and pharmacy disruptions.
Snowflake SaaS Integrator Breach
- Over a dozen companies suffered data theft attacks after a SaaS integration provider was breached, with attackers stealing authentication tokens.
Router Hijacking and Espionage by APT28
- The Russia-linked APT28 (Forest Blizzard) compromised MikroTik and TP-Link routers globally, hijacking DNS settings to steal Microsoft 365 and Office authentication tokens.
- An international law enforcement operation disrupted the “FrostArmada” APT28 campaign.
Critical Infrastructure Attacks by Iran-Linked Actors
- Iran-affiliated threat actors targeted internet-exposed programmable logic controllers (PLCs) and SCADA systems in US critical infrastructure sectors, causing operational disruptions.
Doxing, Spyware, and Nonconsensual Abuse
- Widespread abuse in Telegram groups, where individuals are purchasing hacking tools, sharing nonconsensual images, and engaging in doxing and spyware deployment.

Cybersecurity Brief – 2026-04-07

Tue, 07 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

Wynn Resorts disclosed that 21,000 employees were affected by the ShinyHunters hack. The company reportedly paid a ransom to prevent data leakage.
Drift Protocol attributed its recent $280M cryptocurrency theft to a six-month, in-person operation where attackers established an operational presence inside the organisation.
Axios, a popular NPM package, was compromised in a supply chain attack involving sophisticated social engineering targeting maintainers. North Korean threat actors are linked to this and similar campaigns against Node.js maintainers.
Guardarian users were targeted via 36 malicious NPM packages impersonating Strapi plugins, enabling shell execution, container escape, and credential harvesting.
The European Commission experienced a significant cyber incident, as noted in Check Point’s threat intelligence report.

Newly Discovered Vulnerabilities

Flowise AI Agent Builder is under active exploitation for a CVSS 10.0 remote code execution vulnerability. Over 12,000 instances are exposed.
Fortinet issued an emergency patch for a zero-day authentication bypass flaw (CVE-2026-35616) in FortiClient EMS, which allows unauthenticated remote code execution. CISA has mandated federal agencies patch this vulnerability.
A new GPUBreach attack technique enables privilege escalation and system takeover through Rowhammer-induced bit-flips on GPU GDDR6 memory.
Exploit code for an unpatched Windows privilege escalation zero-day (“BlueHammer”) was leaked, allowing local attackers to gain SYSTEM or administrator privileges.
Automated credential harvesting campaigns are exploiting the React2Shell flaw in vulnerable Next.js applications.
Google DeepMind researchers identified “AI Agent Traps,” a vulnerability that allows attackers to manipulate and exploit AI agents via malicious web content.

Notable Threat Actor Activity

China-linked Storm-1175 has been observed exploiting zero-day and n-day vulnerabilities to rapidly deploy Medusa ransomware in high-velocity attacks.
Qilin and Warlock ransomware groups are using the bring-your-own-vulnerable-driver (BYOVD) tactic to disable over 300 endpoint detection and response (EDR) tools during ransomware deployment.
An Iran-linked threat actor is conducting password-spraying attacks against over 300 Israeli and UAE Microsoft 365 organisations.
DPRK-linked actors are using GitHub as command-and-control infrastructure in multi-stage attacks targeting South Korean entities.
North Korean threat actors are targeting Node.js maintainers with social engineering as part of supply chain attacks.
A threat cluster tracked as UAT-10608 is automating credential harvesting by exploiting web-exposed Next.js applications.

Trends, Tools, or Tactics of Interest

There is increased use of AI-assisted tools by threat actors in supply chain attacks, as seen in the PRT-scan campaign targeting GitHub misconfigurations.
Social engineering targeting open-source maintainers is becoming industrialised, with attackers leveraging complex, scalable tactics.
The BYOVD technique remains prevalent among ransomware operators for bypassing security controls.
Open redirects continue to be widely abused in phishing campaigns.
Infostealers are harvesting credentials and session cookies at scale, outpacing traditional breach monitoring capabilities.
Developer workstations are being increasingly targeted as entry points for credential theft and lateral movement.
Shadow AI use in healthcare persists, with medical professionals adopting unsanctioned AI tools.

Regulatory or Policy Developments Affecting the Security Industry

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch the actively exploited Fortinet EMS vulnerability by Friday.
The OWASP GenAI Security Project has updated its risk matrix, now recognising 21 generative AI risks and recommending tailored security approaches for GenAI and agentic AI systems.
German authorities have formally identified two Russian nationals as the leaders of the GandCrab and REvil ransomware operations between 2019 and 2021.
Microsoft has deprecated and removed the Support and Recovery Assistant (SaRA) tool from all supported Windows versions as of March 10.

Cybersecurity Brief – 2025-10-08

Wed, 08 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

Salesforce has confirmed a widespread data theft attack affecting its customers, stating it will not pay ransom to the threat actors. The ShinyHunters group is linked to the exfiltration of over a billion records from Salesforce customers and has launched a data leak site to extort victims.
Electronics distributor Avnet disclosed a data breach, noting that stolen data is unreadable without proprietary tools.
BK Technologies, a public safety communications firm, reported an IT intrusion and subsequent data theft.
CPAP Medical suffered a data breach exposing personal and health information of over 90,000 military patients, troops, veterans, and their families.
Discord has warned users of a third-party breach resulting in the theft of names, emails, limited billing information, and some government-ID images.
DraftKings notified customers of account breaches following a credential stuffing attack.
North Korean hackers have reportedly stolen over $2 billion in cryptocurrency assets in 2025, the largest annual total recorded.
Asahi brewery in Japan experienced a ransomware attack that disrupted domestic operations and led to a beer shortage.

Newly Discovered Vulnerabilities

Redis disclosed a critical, 13-year-old vulnerability (CVSS 10.0), tracked as “RediShell,” allowing remote code execution under certain conditions. Over 60,000 servers are currently at risk, with more than 300,000 instances exposed globally.
FreePBX (CVE-2025-57819) is affected by a code execution vulnerability via its web-based admin interface.
Oracle E-Business Suite (EBS) zero-day vulnerability has been exploited by the Clop ransomware gang for data theft since at least early August.
The Year 2038 (Y2K38) bug has been highlighted as a vulnerability that could be exploited in ICS and consumer devices well before the date is reached.

Notable Threat Actor Activity

Microsoft attributed the exploitation of a critical Fortra GoAnywhere MFT vulnerability to the Storm-1175 threat actor, leading to Medusa ransomware deployment. Exploitation began one week before patches were released and reportedly requires a private key.
The Clop ransomware gang exploited a critical Oracle EBS zero-day in data theft operations.
BatShadow, a Vietnamese threat actor, is using a new Go-based malware (“Vampire Bot”) targeting job seekers and digital marketing professionals via social engineering.
OpenAI disrupted three clusters of activity by Russian, North Korean, and Chinese threat actors misusing ChatGPT for malware development.
Security research exposed BIETA and CIII, Beijing-based research institutes, as developers and suppliers of technology supporting Chinese intelligence and military cyber operations.

Trends, Tools, or Tactics of Interest

Microsoft reported a new phishing campaign leveraging AI tools to obfuscate payloads and evade detection.
Researchers observed an uptick in spam and malicious emails using hidden content to bypass security filters.
XWorm 6.0 malware has emerged with over 35 plugins, enhancing its data theft and modular attack capabilities.
AI is identified as the leading data exfiltration channel in enterprise environments, according to new research.
Security teams are adopting AI-powered breach and attack simulation tools to rapidly test and validate defences against emerging threats.
Google DeepMind announced “CodeMender,” an AI agent that detects, patches, and rewrites vulnerable code.
AI-assisted penetration testing is now mainstream, with 70% of surveyed security researchers using AI tools, as reported by HackerOne.
Google launched an AI Vulnerability Reward Program, offering up to $30,000 for reported AI system flaws.
Google decided not to patch a new ASCII smuggling attack in its Gemini AI assistant, which could be used to manipulate responses or alter model behaviour.

Regulatory or Policy Developments Affecting the Security Industry

Docker announced affordable, unlimited access to its Hardened Images catalog for startups and SMBs to support secure development.
Microsoft is removing additional methods to bypass Microsoft account requirements in Windows 11 installations.
Significant cybersecurity M&A activity was reported in September 2025, with major deals involving Check Point, CrowdStrike, F5, Mitsubishi Electric, and SentinelOne.

Cybersecurity Brief – 2025-10-07

Tue, 07 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

Red Hat suffered a data breach, with the ShinyHunters extortion group leaking samples of stolen customer engagement reports (CERs) and threatening further exposure.
Discord disclosed that user information, including names, usernames, email addresses, contact details, IP addresses, and billing information, was compromised via a third-party data breach.
Doctors Imaging Group notified approximately 171,000 individuals of a cybersecurity incident that occurred nearly a year ago.
Beer giant Asahi reported a ransomware attack resulting in data theft and disruption to operations at its Japanese subsidiaries, forcing a shift to manual order processing and shipment.
Salesforce faced extortion attempts after data from dozens of customers was stolen; Salesforce stated these relate to past or unsubstantiated incidents, not new intrusions.

Newly Discovered Vulnerabilities

Oracle E-Business Suite: A critical remote code execution vulnerability (CVE-2025-61882) has been exploited in the wild by the Cl0p ransomware group. Oracle has released an emergency patch.
GoAnywhere MFT: Microsoft reported that Storm-1175 has been exploiting a maximum severity vulnerability in GoAnywhere MFT for Medusa ransomware attacks for nearly a month.
Redis: The Redis security team released patches for a maximum-severity vulnerability that could allow remote code execution on thousands of exposed instances.
Unity Game Engine: A code execution vulnerability in the Unity engine could enable attackers to gain code execution on Android and privilege escalation on Windows. Microsoft and Steam have issued warnings and are taking action.
Zimbra: Attackers exploited a zero-day vulnerability in Zimbra via ICS files, targeting Brazilian military entities.
BitLocker Bypass and VMScape vulnerabilities were also highlighted in recent security roundups.

Notable Threat Actor Activity

Cl0p ransomware group exploited Oracle E-Business Suite zero-day (CVE-2025-61882) for data theft and extortion attacks.
ShinyHunters is actively extorting Red Hat following their data breach.
Storm-1175 exploited GoAnywhere MFT vulnerabilities in Medusa ransomware campaigns.
Chinese-speaking cybercrime group UAT-8099 is running a global SEO fraud operation using compromised IIS servers, stealing high-value credentials.
XWorm malware resurfaced with a ransomware module and over 35 plugins, distributed via phishing campaigns.
Water Saci campaign deployed self-propagating malware (Sorvepotel) via WhatsApp in Brazil, targeting financial institutions.
Phishing campaigns are targeting 1Password users with convincing fake breach alert emails.
A threat actor impersonating the Libyan Navy’s Office of Protocol targeted Brazil’s military using Zimbra zero-day exploits.

Trends, Tools, or Tactics of Interest

AI-driven phishing and social engineering attacks are cited as a top concern by nearly 40% of surveyed security leaders.
Machine learning models for detecting DLL hijacking have been developed and integrated into Kaspersky SIEM, enabling early incident detection.
Increased use of AI in cybersecurity, including open-source XDR/SIEM platforms like Waziuh and the risk of insecure AI-generated code (“vibe coding”).
XWorm’s modular architecture and plugin system highlight evolving malware sophistication.
High-profile phishing and social engineering attacks continue to leverage realistic lures and automation.
Self-propagating malware targeting messaging platforms (e.g., WhatsApp) is being used for credential theft and financial fraud.
The launch of the Zeroday.Cloud hacking competition offers $4.5 million in bounties for exploits targeting open-source cloud and AI tools.

Notable Threat Actor Attribution

CrowdStrike attributes recent Oracle EBS exploitation to Graceful Spider (aka Cl0p).
Chinese research firms BIETA and CIII have been linked to the Ministry of State Security (MSS) and assessed as fronts for PRC cyber operations.
Reports highlight Chinese government fronts collaborating with Western organisations to acquire cyber technologies for state intelligence purposes.

Regulatory or Policy Developments Affecting the Security Industry

LinkedIn has filed a lawsuit against ProAPIs Inc. and its founder for scraping user data via over one million fake accounts, addressing large-scale data harvesting.
Compliance training updates and frameworks (e.g., KnowBe4’s Compliance Plus and the DEEP Matrix for unified defence) are being promoted to address evolving human risk management and regulatory requirements.