Major Incidents or Breaches

• Harrods, a British department store, has notified customers of a data breach involving the compromise of some personal details. Four individuals were arrested in July in connection with cyberattacks targeting Harrods, Marks & Spencer, and the Co-op.

Newly Discovered Vulnerabilities

• Akira ransomware operators have been observed breaching SonicWall SSL VPN devices even when One-Time Password (OTP) Multi-Factor Authentication (MFA) is enabled. Attackers are successfully logging in to accounts protected by MFA, indicating a potential vulnerability or bypass method affecting SonicWall VPNs.

Notable Threat Actor Activity

Major Incidents or Breaches

• An app previously used to dox critics of Charlie Kirk reportedly exposed the personal information of its own users.
• A ransomware gang has stolen data on 8,000 preschoolers.
• Microsoft has blocked Israel’s military from using its cloud services for surveillance purposes.

Newly Discovered Vulnerabilities

• The call-recording app Neon has paused operations due to the discovery of security vulnerabilities.

Notable Threat Actor Activity

• China-linked threat actors are conducting ongoing campaigns targeting telecommunications and manufacturing sectors in Central and South Asia, distributing a new variant of PlugX malware.
• Fake Microsoft Teams installers, distributed via SEO poisoning and search engine advertisements, are being used to infect Windows devices with the Oyster backdoor, facilitating initial access for attackers.
• Two Dutch teenagers were arrested for attempting to spy on Europol on behalf of Russia, reportedly using hacking devices.

Trends, Tools, or Tactics of Interest

Major Incidents or Breaches

• Volvo and two other international vehicle manufacturers suffered supply chain cyberattacks in the past month, resulting in the theft of Volvo employee Social Security Numbers in a ransomware attack.
• Hackers stole data on 8,000 nursery children and contacted their parents directly, demanding ransom payments under threat of leaking the children’s information.
• A South Korean credit card company was hacked, and the Maryland Transit Administration experienced a ransomware attack. The UK’s Co-op lost £206 million due to a cyberattack.
• Flo Health and Google agreed to pay $56 million to settle lawsuits over the period-tracking app Flo sharing sensitive users’ health data for advertising purposes.
• Neon Mobile, a popular US app, pays users to record their phone calls and then sells this data for AI training.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• The Co-operative Group (UK) reported a loss of £80 million ($107 million) in operating profit due to a cyberattack attributed to the Scattered Spider threat group.
• RTX (Raytheon Technologies) confirmed a ransomware attack affecting its airport services division.
• Volvo Group disclosed that employee data was stolen in a ransomware attack linked to the Miljödata breach, impacting multiple Swedish organizations and municipalities.
• An unofficial npm package mimicking ‘postmark-mcp’ was found to exfiltrate users’ email communications.
• Over 500 npm packages were infected by the Shai-Hulud worm in a supply-chain attack, impacting packages with millions of downloads.
• Two malicious Rust crates (fast_tlog and fast_log) on crates.io were found stealing Solana and Ethereum wallet keys from developers, with 8,424 downloads confirmed.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Boyd Gaming reported a data breach affecting employees and other individuals, as disclosed to the SEC.
• A US Federal Civilian Executive Branch (FCEB) agency was breached via exploitation of a critical GeoServer vulnerability (CVE-2024-36401); attackers deployed China Chopper and remote access scripts and remained undetected for three weeks.
• European airports experienced widespread disruptions due to a ransomware attack linked to the RTX group; the UK National Crime Agency arrested a suspect in connection with the incident. The attack on Collins Aerospace is believed to have involved HardBit ransomware.
• Interpol-led law enforcement seized over $439 million in cash and cryptocurrency from cybercrime rings worldwide during a five-month joint operation.
• A record-breaking DDoS attack peaked at 22 Tbps and 10 billion packets per second (Bpps), targeting a European network infrastructure company and linked to the Aisuru botnet.
• The Python Package Index (PyPI) urged users to reset credentials following a new wave of phishing attacks using a fake PyPI website.
• GitHub users were targeted in a large-scale phishing campaign impersonating Y Combinator via GitHub notifications, delivering cryptocurrency drainers.
• KNP Logistics Group, a 158-year-old business, collapsed following a cyber incident attributed to poor password security.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Boyd Gaming Corporation disclosed a data breach following a cyberattack, resulting in the theft of employee and customer data.
• Jaguar Land Rover extended its production shutdown due to a cyberattack, with operations paused until at least October 1 as investigations continue.
• The American Archive of Public Broadcasting exposed restricted and copyrighted media for years due to inadequate access controls, allowing unauthorised downloads.
• CISA reported that attackers breached a US federal agency’s network by exploiting an unpatched GeoServer instance.
• The US Secret Service dismantled a major telecom threat in New York, seizing over 300 servers and 100,000 SIM cards used to threaten US officials and potentially disrupt critical infrastructure near the UN.
• Eurojust coordinated the arrest of five suspects in a cryptocurrency investment fraud scheme, responsible for over €100 million in losses across 23 countries.
• Fake versions of Malwarebytes, LastPass, and other software are being distributed via GitHub pages in a campaign targeting Mac users.
• Scammers are impersonating the FBI using fake IC3 websites to steal personal data.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• A ransomware attack against a third-party provider disrupted check-in and boarding systems at multiple major European airports, including Heathrow, causing widespread delays and flight cancellations. Collins Aerospace is reportedly facing recovery challenges following the incident.
• Stellantis, a major automotive manufacturer, confirmed a data breach involving the compromise of North American customer data after attackers accessed a third-party service provider’s Salesforce environment.
• A vulnerability in the American Archive of Public Broadcasting’s website allowed unauthorized downloading of protected and private media for several years before being patched this month.
• The FBI issued a warning about a spoofed IC3 (Internet Crime Complaint Center) website being used by threat actors for personal information theft and fraudulent activities.
• A verified Steam game, BlockBlasters, was used to steal $32,000 in cryptocurrency donations intended for a streamer’s cancer treatment.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Jaguar Land Rover (JLR) has suffered a significant cyberattack, resulting in halted vehicle production. The disruption has caused substantial financial losses and forced parts suppliers to lay off workers.
• A cyberattack targeting Collins Aerospace software has disrupted airport operations across Europe, impacting passenger check-in, boarding pass printing, baggage tagging, and luggage dispatch.

Newly Discovered Vulnerabilities

• Microsoft patched a critical vulnerability in Entra ID (formerly Azure Active Directory) involving a token validation failure. The flaw could have allowed attackers to impersonate any user, including Global Administrators, and hijack any organisation’s tenant globally through exploitation of legacy components.

Notable Threat Actor Activity

Major Incidents or Breaches

• UNC1549, an Iran-nexus cyber espionage group, compromised 34 devices across 11 European telecommunications firms using LinkedIn job lures and the MINIBIKE malware.
• Over 600,000 individuals were impacted by healthcare data breaches in the past day, with additional major intrusions attributed to the ShinyHunters group.
• The Royal Canadian Mounted Police dismantled the TradeOgre cryptocurrency exchange, seizing over $40 million linked to criminal activity.
• FBI issued an alert regarding cybercriminals impersonating the FBI’s Internet Crime Complaint Center (IC3) via fake reporting portals for malicious purposes.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• UNC1549, an Iran-linked cyber espionage group, successfully infiltrated 34 devices across 11 European telecommunications organisations using LinkedIn job lures and the MINIBIKE malware.
• Russian threat groups Gamaredon and Turla collaborated in a campaign targeting Ukrainian entities, with Turla malware deployed on systems previously compromised by Gamaredon.
• Over 600,000 individuals were impacted by recent healthcare sector breaches; ShinyHunters was identified as responsible for major attacks.
• The FBI issued a warning about cybercriminals creating fake FBI Internet Crime Complaint Center (IC3) portals for malicious activity.
• The REM Proxy botnet, powered by SystemBC malware, currently controls approximately 1,500 VPS victims daily via 80 C2 servers.
• A surge in phishing-as-a-service (PhaaS) operations, notably Lighthouse and Lucid, has resulted in over 17,500 phishing domains targeting 316 brands in 74 countries.

Newly Discovered Vulnerabilities