Yanluowang on DanSec Daily

Cybersecurity Brief – 2026-03-26

Thu, 26 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

Russian law enforcement arrested the alleged administrator of LeakBase, a major stolen credential marketplace.
Personal data of hundreds of HackerOne employees was compromised in a large-scale breach targeting Navia.
A hacktivist group claims to have accessed sensitive data on millions of crime tipsters and those reported, with records dating back to 1987.
Device code phishing campaigns have targeted over 340 Microsoft 365 organizations across five countries, abusing OAuth for initial access.
Threat actors are leveraging the Bubble no-code app builder to create and host phishing sites targeting Microsoft account credentials.
Ongoing phishing campaigns have impersonated Palo Alto Networks recruiters since August, using LinkedIn-scraped data to defraud job candidates.

Newly Discovered Vulnerabilities

Citrix released patches for two NetScaler ADC and Gateway vulnerabilities, including one similar to previously exploited CitrixBleed flaws.
TP-Link patched critical authentication bypass and firmware upload vulnerabilities affecting Archer NX routers.
Attacks exploiting the ‘PolyShell’ vulnerability are targeting 56% of all vulnerable Magento Open Source and Adobe Commerce installations.
Apple released security updates addressing 85 vulnerabilities across iOS, macOS, and related products; none are currently exploited in the wild.

Notable Threat Actor Activity

The GlassWorm malware campaign has evolved to use Solana blockchain “dead drops” for multi-stage delivery of a RAT and theft of browser and cryptocurrency data.
The new Torg Grabber infostealer targets 728 cryptocurrency wallets and over 850 browser extensions.
The SmartApeSG campaign is distributing multiple RATs, including Remcos, NetSupport, StealC, and Sectop RAT.
TeamPCP, in collaboration with Lapsus$, compromised open-source software ecosystems (Docker Hub, VS Code, PyPI, NPM) by targeting GitHub Action tags.
Paid AI service accounts are now being traded at scale on underground markets, bundled with other access commodities.
US courts sentenced Ilya Angelov (TA-551/Gold Cabin) to two years in prison for operating a botnet used in ransomware attacks. Aleksei Volkov received 81 months for facilitating Yanluowang ransomware intrusions.

Trends, Tools, or Tactics of Interest

AI is a central enabler in both attack and defense, with SANS listing all top five new attack techniques as AI-driven.
Anthropic reported a state-sponsored group used an AI agent to autonomously conduct cyber espionage against 30 global targets, with the AI performing 80-90% of the intrusion lifecycle.
AI-powered bug detection has been integrated into GitHub’s Code Security tool, expanding coverage beyond CodeQL.
Cloud virtual machines are increasingly presenting unmanaged security gaps as their adoption accelerates.
Cybercriminals are increasingly targeting identity systems, with AI amplifying both attack speed and the evolution of identity theft into a supply chain.
Kali Linux 2026.1 was released, adding eight new tools and a BackTrack mode for undercover operations.
The use of no-code/low-code platforms (e.g., Bubble) is being abused for phishing and evasion of traditional detection.
The Kaspersky Security Services report highlights increased sophistication in attack chains and the use of MDR/IR data to reveal evolving TTPs.

Regulatory or Policy Developments Affecting the Security Industry

The US FCC has banned the sale of new consumer routers manufactured outside the US, citing national security risks.
At RSAC 2026, EU officials are leading discussions on cybersecurity challenges, while US officials are notably absent.
Apple extended security updates to older device generations, indicating ongoing regulatory and industry pressure for longer-term device support.

Cybersecurity Brief – 2026-03-25

Wed, 25 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

HackerOne disclosed a data breach impacting hundreds of employees, following a compromise of its US benefits administrator, Navia.
Infinite Campus, a widely used K-12 student information system, warned of a data breach and extortion attempt, attributed to the ShinyHunters threat actor.
The Dutch Ministry of Finance confirmed a breach affecting internal systems, detected in the previous week.
QualDerm, a healthcare provider, suffered a breach impacting 3.1 million individuals, with personal, medical, and insurance data stolen.
Extortion group Lapsus$ claimed to have compromised AstraZeneca, including internal code repositories, credentials, and employee data.

Newly Discovered Vulnerabilities

PTC Inc. warned of a critical remote code execution vulnerability affecting its Windchill and FlexPLM product lifecycle management solutions.
A critical Citrix NetScaler vulnerability was disclosed, allowing unauthenticated remote attackers to read sensitive information from memory.
Chrome 146 was released, addressing eight high-severity memory safety vulnerabilities across seven components.
Firefox 149 introduced a built-in VPN with a 50GB monthly data limit, enhancing privacy protections.
Researchers highlighted ongoing risks and vulnerabilities in IP KVM devices, following recent reports from Eclypsium.

Notable Threat Actor Activity

TeamPCP continued its supply chain attacks, compromising the popular LiteLLM Python package on PyPI (versions 1.82.7–1.82.8) via a Trivy CI/CD compromise, embedding credential harvesters and affecting hundreds of thousands of developers. TeamPCP was also linked to attacks on Trivy, Checkmarx KICS, and VS Code plug-ins, as well as recent compromises of GitHub Actions workflows through stolen CI credentials.
A large-scale malvertising campaign has been leveraging tax-related search ads since January 2026, distributing rogue installers for ConnectWise ScreenConnect. The campaign uses a Huawei driver to disable endpoint detection and response (EDR) solutions.
The Ghost campaign was identified as distributing seven malicious npm packages aimed at stealing cryptocurrency wallets and credentials.
Ongoing phishing campaigns are targeting French-speaking enterprises with fake resumes, leading to the deployment of information stealers and cryptocurrency miners.
FBI and CISA, along with European agencies, warned of Russian threat actors hijacking Signal and WhatsApp accounts via scalable social engineering campaigns.
Scam compounds are hiring individuals to appear as “AI models” in deepfake video calls to facilitate fraud.

Trends, Tools, or Tactics of Interest

The number of newly reported vulnerabilities is expected to exceed 100,000 this year, with a noted trend toward faster exploitation of zero-days.
Security researchers observed a rise in supply chain attacks targeting open-source software and developer tools, with AI-assisted campaigns distributing trojanized packages (e.g., OpenClaw Deployer on GitHub).
Increased use of credential-stealing malware targeting CI/CD pipelines and package repositories.
Attackers are using legitimate drivers (e.g., Huawei) to disable EDR in malware campaigns.
There is a continued increase in phishing campaigns leveraging social engineering and fake documentation (e.g., resumes) to gain initial access.
AI and agentic AI systems are being increasingly targeted, as evidenced by the McKinsey Lilli platform hack and discussions on the need for better governance and identity controls.
JPMorgan Chase reported the use of AI digital twins and digital fingerprints for advanced threat hunting and reducing false positives.
Endpoint security is being challenged by AI coding tools, which facilitate bypassing traditional defenses.
Surveillance systems are being targeted in geopolitical conflicts, as demonstrated by Israel’s exploitation of Iran’s camera network.

Regulatory or Policy Developments

The US Federal Communications Commission (FCC) updated its Covered List to ban the sale of all new consumer routers manufactured outside the USA, citing security risks.
The US Department of Energy (DoE) published a five-year energy security plan (Project Armor) to harden critical energy infrastructure.
Microsoft proposed new identity and governance guardrails for agentic AI systems to address emerging threats from autonomous AI agents.
Gartner released its first Market Guide for Guardian Agents, highlighting the emergence of this security technology category.
A Russian national received an 81-month prison sentence for acting as an initial access broker for Yanluowang ransomware attacks.

Cybersecurity Brief – 2025-11-11

Tue, 11 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

Nearly 30 organizations, including Logitech, The Washington Post, Cox Enterprises, Pan American Silver, LKQ Corporation, and Copeland, have been named as alleged victims of an Oracle E-Business Suite (EBS) hack on the Cl0p ransomware leak site.
The US Congressional Budget Office (CBO) confirmed a data breach.
Many Forbes AI 50 companies were found to have leaked sensitive secrets, including training data and private models, on public GitHub repositories.

Newly Discovered Vulnerabilities

A critical vulnerability in the expr-eval JavaScript library, used in over 800,000 weekly NPM downloads, allows remote code execution via malicious input.
Three vulnerabilities in runc (CVE-2025-31133, CVE-2025-52565, CVE-2025-52881) have been patched; these could be exploited to escape container environments.
Multiple vulnerabilities in QNAP devices, demonstrated at Pwn2Own Ireland, have been patched. These flaws could allow remote code execution, information disclosure, and denial-of-service.
A critical, now-patched flaw in Gladinet’s Triofox file-sharing and remote access platform was exploited to install remote access tools via its antivirus feature.
CISA has ordered US federal agencies to patch a critical Samsung zero-day vulnerability exploited in spyware attacks deploying LandFall spyware on WhatsApp-enabled devices.

Notable Threat Actor Activity

The Quantum Route Redirect phishing-as-a-service (PhaaS) platform is being used in a large-scale, automated campaign targeting Microsoft 365 users globally, utilising around 1,000 domains to steal credentials.
The North Korea-linked Konni (APT37) threat actor is abusing Google’s Find Hub tool in new attacks to track GPS positions and trigger remote data wipes on Android devices, as well as targeting Windows systems.
GlassWorm malware has resurfaced, infecting three additional Visual Studio Code extensions and spreading via both the Open VSX marketplace and GitHub repositories, targeting developer environments.
The ClickFix phishing campaign is targeting the hospitality sector, using infostealer and RAT malware to compromise hotel managers and subsequently launch phishing attacks against customers via email and WhatsApp.
A Russian national has pleaded guilty to acting as an initial access broker for Yanluowang ransomware, which targeted at least eight US companies between July 2021 and November 2022.
Fantasy Hub, a spyware-for-rent platform, is distributing RATs via fake Android apps capable of stealing logins, PINs, and messages with only SMS permissions.

Trends, Tools, or Tactics of Interest

Attackers are increasingly leveraging LinkedIn for phishing campaigns, aiming at executives and exploiting the platform to bypass traditional email security.
Malware is being concealed within virtual machines (e.g., Hyper-V), and there is a noted increase in side-channel attacks targeting AI chat data, as well as spyware campaigns against Android devices.
Scanning activity has been observed targeting “FTP_3cx” usernames, potentially indicating attempts to exploit business phone system software.
The Browser Security Report 2025 highlights that identity, SaaS, and AI-related risks are converging at the browser level, while traditional controls may not adequately address these threats.
Mozilla Firefox 145 has introduced new anti-fingerprinting defenses to enhance user privacy.
OWASP’s revised Top 10 list for web application risks now includes two new categories, with supply chain risks and security misconfiguration ranking highly.

Regulatory or Policy Developments

Australia has imposed sanctions on individuals and entities accused of supporting North Korea’s weapons programme, mirroring recent US actions.
CISA has mandated US federal agencies to patch a Samsung zero-day exploited in spyware campaigns.