UNC6692 on DanSec Daily

Cybersecurity Brief – 2026-04-28

Tue, 28 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

Checkmarx has confirmed that data from its GitHub repositories was leaked on the dark web following a supply chain attack on March 23. The TeamPCP supply chain campaign has been linked to this and other concurrent compromises, including Bitwarden CLI and xinference PyPI.
Home security provider ADT suffered a breach affecting 5.5 million individuals, with the ShinyHunters extortion group claiming responsibility for stealing personal information.
Medtronic, a major medical device manufacturer, confirmed a breach after hackers claimed to have accessed up to 9 million records. The ShinyHunters group is also linked to this incident.
Itron, an energy and water management firm, reported unauthorized access to its systems detected on April 13.
Vercel disclosed a security incident, as noted in Checkpoint’s latest threat intelligence bulletin.
The elementary-data package on PyPI (with 1.1 million monthly downloads) was compromised to distribute information-stealing malware targeting developer data and cryptocurrency wallets.

Newly Discovered Vulnerabilities

Microsoft patched a privilege escalation flaw in Entra ID’s AI agent administrative role, which could enable service principal takeover.
Microsoft confirmed active exploitation of Windows Shell vulnerability CVE-2026-32202, which has been patched.
An unpatched Windows ‘PhantomRPC’ flaw was disclosed, with five exploit paths allowing privilege escalation via RPC architectural weaknesses.
An incomplete Windows patch left systems vulnerable to zero-click attacks, previously exploited by Russia-linked APT28 against Ukraine and EU targets.
A 15-year-old OpenSSH flaw was disclosed, allowing full root shell access due to certificate principal parsing issues.
A race condition vulnerability in Linux PackageKit, dubbed ‘Pack2TheRoot’, enables unprivileged users to escalate privileges during package installation.
Firefox vulnerability CVE-2026-6770, now patched in Firefox 150 and Tor 15.0.10, allowed fingerprinting of Tor users.

Notable Threat Actor Activity

PhantomCore, a pro-Ukrainian hacktivist group, has been actively targeting Russian TrueConf video conferencing servers since September 2025.
UNC6692, a newly identified threat actor, is conducting campaigns using Microsoft Teams, AWS S3 buckets, and custom “Snow” malware variants (Snowbelt, Snowglaze, Snowbasin). Their tactics include social engineering, email bombing, and cloud resource abuse.
ShinyHunters has claimed responsibility for the recent breaches of ADT and Medtronic, threatening to leak stolen data.
Silk Typhoon: A Chinese national alleged to be part of this group was extradited to the US for cyberespionage activities targeting US interests.

Trends, Tools, or Tactics of Interest

Researchers discovered 73 malicious Visual Studio Code extensions on the Open VSX repository delivering GlassWorm v2 malware, with the campaign leveraging “sleeper” extensions that activate malicious payloads post-update.
Malicious prompt injection attacks against AI systems are increasing, though most remain low in sophistication according to Google.
Deepfake voice attacks are becoming more prevalent, with reports showing that as little as three seconds of audio can enable successful cloning for fraud schemes.
The “fast16” malware framework, dating back 20 years and predating Stuxnet, has been uncovered and is believed to have been used in early cyber sabotage operations.
The Robinhood account creation process was exploited to send phishing messages via legitimate notification emails.
Supply chain attacks remain a key threat, with concurrent compromises (Checkmarx, Bitwarden CLI, xinference PyPI, npm worm “CanisterSprawl”) reported as part of ongoing campaigns.
Americans lost over $2.1 billion to social media scams in 2025, according to the FTC.
Canadian authorities arrested three individuals in Toronto for operating an “SMS blaster” device to send mass phishing texts.

Regulatory or Policy Developments

The US government has launched a sweeping crackdown on Southeast Asian cyberscam operations and imposed sanctions on a Cambodian senator for involvement.

Cybersecurity Brief – 2026-04-27

Mon, 27 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

Itron, Inc., an American utility firm, disclosed a cybersecurity incident involving unauthorised access to certain internal IT systems. The breach was reported to the U.S. Securities and Exchange Commission via an 8-K filing.
Discord users reportedly gained unauthorised access to Anthropic’s ‘Mythos’, with the incident highlighting unauthorised data exposure.
500,000 UK health records were listed for sale on Alibaba, indicating a significant data exposure event affecting sensitive personal information.

Newly Discovered Vulnerabilities

Apple patched a notification-related bug that could reveal sensitive information to unauthorised parties.

Notable Threat Actor Activity

A threat group tracked as UNC6692 leveraged Microsoft Teams in a social engineering campaign to deploy a new custom malware suite named ‘Snow’. The suite includes a browser extension, tunneler, and backdoor functionality.
China-linked APT group GopherWhisper was observed abusing legitimate services in attacks against government organisations. The group utilises multiple Go-based backdoors, custom loaders, and injectors.

Trends, Tools, or Tactics of Interest

Researchers uncovered a pre-Stuxnet malware, named ‘fast16’, written in Lua and designed to target engineering software, predating the well-known Stuxnet worm.
Spy firms are exploiting global telecom infrastructure weaknesses to track targets, as reported in recent security news coverage.

Regulatory or Policy Developments Affecting the Security Industry

Itron’s disclosure of its cybersecurity incident via SEC 8-K filing reflects ongoing regulatory requirements for timely breach reporting by publicly traded companies.

Cybersecurity Brief – 2026-04-26

Sun, 26 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

500,000 UK health records have been listed for sale on Alibaba, indicating a significant data breach involving sensitive personal information.
Discord users gained unauthorized access to Anthropic’s Mythos, exposing internal information from the AI company.

Newly Discovered Vulnerabilities

Apple has patched a notification bug that could potentially reveal sensitive information to unauthorized parties.

Notable Threat Actor Activity

The China-linked APT group “GopherWhisper” is conducting targeted attacks against government entities. The group leverages multiple Go-based backdoors and employs custom loaders and injectors, abusing legitimate services to evade detection.
Threat actor UNC6692 is using Microsoft Teams for social engineering, deploying a new malware suite called “Snow.” The suite includes a browser extension, tunneler, and backdoor to maintain persistence and facilitate lateral movement.

Trends, Tools, or Tactics of Interest

Researchers have uncovered “fast16,” a Lua-based malware predating Stuxnet, designed to target engineering software used in industrial environments, with indications it was intended for sabotage.
Threat groups are increasingly abusing legitimate collaboration and communication platforms (e.g., Microsoft Teams, Discord) to deliver malware and gain unauthorized access.
Spy firms are exploiting weaknesses in global telecom infrastructure to track targets, highlighting ongoing concerns around telecom security.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft has announced a revamp of the Windows Insider Program to address performance and reliability issues in Windows 11, which may impact enterprise testing and deployment practices.

Cybersecurity Brief – 2026-04-24

Fri, 24 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

Bitwarden CLI npm package was compromised as part of a wider Checkmarx supply chain attack campaign. Attackers uploaded a malicious @bitwarden/cli package to npm, which contained a credential-stealing payload capable of spreading to other projects. The incident is linked to the Shai-Hulud worm and affected developer environments.
Checkmarx KICS analysis tool was impacted in the same supply chain campaign, with compromised Docker images, VSCode, and Open VSX extensions used to harvest sensitive data from developer environments.
Vercel disclosed additional compromised customer accounts following a breach that enabled unauthorized access to internal systems.
Dutch cosmetics company Rituals reported a data breach affecting customers of its “My Rituals” membership programme, with personal information including names and addresses accessed by attackers.
A $290 million DeFi hack was reported, details unspecified but significant in scale.
Hackers are actively exploiting a critical file upload vulnerability in the Breeze Cache WordPress plugin, allowing unauthenticated arbitrary file uploads to affected servers.

Newly Discovered Vulnerabilities

PhantomRPC: A newly discovered Windows RPC privilege escalation technique enables attackers to create fake RPC servers and escalate privileges.
LMDeploy CVE-2026-33626: A high-severity flaw in the LMDeploy open-source toolkit for LLMs was publicly disclosed and exploited in the wild within 13 hours.
Apple patched CVE-2026-28950, a Notification Services vulnerability in iOS/iPadOS (versions 26.4.2 and 18.7.8), which allowed recovery of deleted notifications, including chat previews.
CISA ordered US federal agencies to patch a Microsoft Defender privilege escalation zero-day, dubbed BlueHammer, that has been actively exploited.
Cisco ASA, Firepower, and Secure Firewall products are being targeted by FIRESTARTER malware, with CISA issuing an alert regarding ongoing exploitation.

Notable Threat Actor Activity

GopherWhisper, a newly identified China-aligned APT group, has targeted at least 12 Mongolian government systems using Go-based backdoors and leveraging legitimate services such as Microsoft Outlook, Slack, Discord, and file.io for command and control communications.
UNC6692, a previously undocumented threat cluster, has been observed impersonating IT helpdesk staff via Microsoft Teams and deploying a custom malware suite (SNOW) through social engineering attacks.
Trigona ransomware operators are using a custom command-line exfiltration tool to accelerate and improve data theft from compromised environments.
Tropic Trooper, a Chinese state-sponsored APT, is expanding its targeting to include home routers and Japanese entities, diversifying its tools and attack vectors.
Chinese state-backed groups are increasingly industrializing botnets, using large-scale proxy networks of hijacked consumer devices to mask attack origins and evade detection, as highlighted in coordinated advisories from the UK NCSC, CISA, and international partners.

Trends, Tools, or Tactics of Interest

Supply chain attacks continue to escalate, with recent campaigns compromising widely used developer tools and npm packages, demonstrating ongoing risk to software supply chains.
Attackers are increasingly exploiting trusted relationships and routine business workflows, moving away from purely technical exploits to weaponize internal trust and social engineering.
AI-driven attack automation is advancing rapidly. Proofs of concept such as Zealot demonstrate that AI agents can autonomously conduct penetration testing operations-including reconnaissance, exploitation, and exfiltration-at speeds that challenge human defenders. Anthropic’s Project Glasswing AI model has shown exceptional vulnerability discovery capabilities, prompting withheld public release.
Social engineering via IT helpdesk impersonation is being used to bypass security controls, particularly through password reset abuse and collaboration platform phishing.
Legitimate cloud and collaboration tools (e.g., Microsoft 365 Outlook, Slack, Discord) are being repurposed by APTs for covert command and control.
macOS “Living off the Land” (LotL) abuse and SIM farm-based proxy networks are noted as emerging or ongoing tactics.

Regulatory or Policy Developments Affecting the Security Industry

CISA, the UK NCSC, and international partners issued a joint advisory warning of Chinese government-linked covert cyber networks, with emphasis on the use of proxy botnets and evasion techniques.
CISA mandated urgent patching of the Microsoft Defender BlueHammer vulnerability across US federal agencies, responding to evidence of active zero-day exploitation.