Major Incidents or Breaches

• 500,000 UK health records have been listed for sale on Alibaba, indicating a significant data breach involving sensitive personal information.
• Discord users gained unauthorized access to Anthropic’s Mythos, exposing internal information from the AI company.

Newly Discovered Vulnerabilities

• Apple has patched a notification bug that could potentially reveal sensitive information to unauthorized parties.

Notable Threat Actor Activity

• The China-linked APT group “GopherWhisper” is conducting targeted attacks against government entities. The group leverages multiple Go-based backdoors and employs custom loaders and injectors, abusing legitimate services to evade detection.
• Threat actor UNC6692 is using Microsoft Teams for social engineering, deploying a new malware suite called “Snow.” The suite includes a browser extension, tunneler, and backdoor to maintain persistence and facilitate lateral movement.

Trends, Tools, or Tactics of Interest

Major Incidents or Breaches

• ADT, a major home security provider, confirmed a data breach after the ShinyHunters extortion group threatened to leak stolen data unless a ransom was paid.
• Medical data of 500,000 UK Biobank volunteers was listed for sale on Alibaba, despite existing access controls.
• NASA disclosed that employees were targeted and duped in a spear-phishing campaign orchestrated by a Chinese national posing as a U.S. researcher, with the intent to compromise U.S. defense software.
• A U.S. federal civilian agency’s Cisco Firepower device was compromised with the Firestarter backdoor, which remains persistent even after applying security patches.
• Bitwarden’s NPM package was compromised in a supply chain attack attributed to TeamPCP, involving the Shai-Hulud worm.
• Over 10,000 Zimbra Collaboration Suite servers remain vulnerable to active exploitation of a cross-site scripting (XSS) flaw.
• 26 malicious apps impersonating popular cryptocurrency wallets were discovered on the Apple App Store, targeting users’ recovery phrases and private keys.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Bitwarden CLI npm package was compromised as part of a wider Checkmarx supply chain attack campaign. Attackers uploaded a malicious @bitwarden/cli package to npm, which contained a credential-stealing payload capable of spreading to other projects. The incident is linked to the Shai-Hulud worm and affected developer environments.
• Checkmarx KICS analysis tool was impacted in the same supply chain campaign, with compromised Docker images, VSCode, and Open VSX extensions used to harvest sensitive data from developer environments.
• Vercel disclosed additional compromised customer accounts following a breach that enabled unauthorized access to internal systems.
• Dutch cosmetics company Rituals reported a data breach affecting customers of its “My Rituals” membership programme, with personal information including names and addresses accessed by attackers.
• A $290 million DeFi hack was reported, details unspecified but significant in scale.
• Hackers are actively exploiting a critical file upload vulnerability in the Breeze Cache WordPress plugin, allowing unauthenticated arbitrary file uploads to affected servers.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Malicious Docker images were uploaded to the official “checkmarx/kics” repository on Docker Hub, impacting the software supply chain.
• A self-propagating worm compromised npm packages, stealing developer tokens and spreading via compromised npm accounts.
• The Lotus Wiper malware was deployed in destructive attacks against the Venezuelan energy sector, targeting recovery mechanisms and systematically deleting files.
• Moltbook, a social network for AI agents, exposed 35,000 email addresses and 1.5 million agent API tokens due to an unsecured database.
• A malicious trading website impersonating TradingView AI agents was used to deliver malware capable of hijacking browsers and stealing financial data.
• A researcher claims the Claude Desktop application for macOS installs spyware, raising privacy and security concerns.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• French Government Agency Data Breach: France Titres, responsible for issuing administrative documents, confirmed a breach after a hacker claimed to have stolen citizen data and offered it for sale.

• Healthcare Data Breaches in the US: Data breaches were reported by Southern Illinois Dermatology, Saint Anthony Hospital, and North Texas Behavioral Health Authority, collectively affecting approximately 600,000 individuals.

• Kelp DAO Crypto Heist: North Korean threat actors are attributed to a $290 million theft from Kelp DAO, exploiting LayerZero’s DVN by compromising RPC endpoints and using DDoS attacks to force failover to malicious infrastructure.

• Perforce Server Exposures: Over 1,500 Perforce P4 version control servers were found to be unsecured, exposing sensitive data from major organizations.

Major Incidents or Breaches

• KelpDAO suffered a $290 million cryptocurrency theft, attributed to North Korean state-sponsored Lazarus Group hackers. The attackers exploited the DeFi platform to drain assets.
• Vercel, the creator of Next.js, confirmed a data breach after a threat actor claimed to have stolen data and offered it for sale for $2 million. The breach reportedly stemmed from compromised OAuth tokens used by an employee’s AI tool.
• Seiko USA’s website was defaced, with attackers claiming theft of the Shopify customer database and threatening to leak the data unless a ransom is paid.
• Bluesky social network experienced a 24-hour disruption due to a sophisticated DDoS attack, with a pro-Iran hacker group claiming responsibility.
• Booking.com was reported as a recent victim of a cyberattack, with further details pending.
• A British national, identified as a leader of the Scattered Spider cybercrime collective, pleaded guilty in the US to wire fraud and aggravated identity theft related to cryptocurrency theft.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Vercel, a cloud development and web infrastructure provider, has disclosed a security breach involving unauthorized access to certain internal systems. The incident is linked to the compromise of Context AI. Threat actors claim to be selling stolen data allegedly obtained from the breach. Vercel has confirmed the incident and is investigating the scope of exposed customer credentials.

Notable Threat Actor Activity

• Threat actors are abusing Apple account change notifications to deliver phishing emails. The phishing campaigns leverage legitimate emails sent from Apple’s servers to increase credibility, with messages designed to appear as iPhone purchase alerts.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Grinex, a Kyrgyzstan-based cryptocurrency exchange sanctioned by the UK and US, has suspended operations following a $13.74 million hack. The exchange attributed the breach to Western intelligence agencies.
• Major data breaches have been reported at a gym chain and a hotel giant. Specific details regarding the impacted organisations or data types were not disclosed.
• Bluesky, a social media platform, experienced a disruptive distributed denial-of-service (DDoS) attack.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Grinex, a Kyrgyzstan-based cryptocurrency exchange, suspended operations following a $13.7 million hack, which it attributes to Western intelligence agencies.
• A recent hack targeted Rockstar Games, attributed to the ShinyHunters group.
• A new incident involving the DraftKings breach: Kamerin Stokes was sentenced to prison for selling stolen credentials related to the attack, continuing his activities even after pleading guilty.

Newly Discovered Vulnerabilities

• CVE-2024-3721: Threat actors are actively exploiting this vulnerability in TBK DVRs and end-of-life TP-Link Wi-Fi routers to deploy Mirai variant ‘Nexcorium’ for DDoS botnets.
• Three zero-day vulnerabilities in Microsoft Defender are being actively exploited to gain elevated privileges on compromised systems. Two of these vulnerabilities remain unpatched.
• Apache ActiveMQ: A high-severity remote code execution vulnerability (CVE-2026-34197) is being actively exploited in the wild. The flaw, present for 13 years, was patched earlier this month.
• ShowDoc: A vulnerability in this platform is being exploited in the wild.
• Google Chrome: A security flaw in Chrome was reportedly awarded a $90,000 bug bounty.

Notable Threat Actor Activity

Major Incidents or Breaches

• The ShinyHunters extortion group leaked data from 13.5 million McGraw Hill user accounts, obtained after breaching the company’s Salesforce environment.
• Cookeville Regional Medical Center in Tennessee reported a data breach affecting 337,000 individuals after a Rhysida ransomware attack that resulted in 500GB of data theft.
• A new campaign in the Czech Republic is actively targeting workers with the previously undocumented PowMix botnet, using randomized C2 traffic.
• ZionSiphon malware has been identified as targeting operational technology in water treatment and desalination facilities, aiming to sabotage operations.
• A DHL-themed phishing campaign is distributing remote access software designed to facilitate further malware deployment, including ransomware.
• Attackers are exploiting a critical vulnerability in Marimo reactive Python notebook to deploy NKAbuse malware via Hugging Face Spaces.
• A fake Slack installer is being used to provide attackers with a hidden desktop environment on victim machines for data and account access.
• The ShinyHunters group leaked data from 13.5 million McGraw Hill user accounts, stolen via a Salesforce breach.
• A data breach at Cookeville Regional Medical Center affected 337,000 individuals due to a ransomware attack.

Newly Discovered Vulnerabilities