Major Incidents or Breaches

  • Wynn Resorts confirmed an employee data breach following an extortion threat, with the ShinyHunters extortion group listing the company on its data leak site.
  • CarGurus suffered a data breach exposing information of 12.4 million accounts, with ShinyHunters publishing the stolen personal information.
  • ShinyHunters claimed responsibility for a breach at Dutch telecommunications provider Odido, reportedly affecting millions of user records.
  • A phishing campaign by the “Diesel Vortex” threat group targeted freight and logistics organisations in the US and Europe, stealing credentials via 52 domains.
  • Wynn Resorts, CarGurus, and Odido incidents all point to continued large-scale data theft and extortion targeting enterprises.
  • Roblox faces a lawsuit from Los Angeles County over alleged failure to protect children from predators.
  • A Taiwan security firm confirmed exploitation of a vulnerability in TeamT5 ThreatSonar Anti-Ransomware, likely by Chinese APTs.

Newly Discovered Vulnerabilities

  • SolarWinds patched four critical Serv-U remote code execution vulnerabilities that could allow attackers root access to unpatched servers.
  • VMware Aria Operations patched several vulnerabilities, including high-severity flaws enabling remote code execution.
  • CISA added FileZen CVE-2026-25108 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation.
  • A vulnerability in GitHub Codespaces allowed attackers to seize repository control by injecting malicious Copilot instructions via GitHub Issues.
  • A new supply chain attack, “Sandworm_Mode”, was discovered in the NPM ecosystem, propagating like a worm, poisoning AI assistants, exfiltrating secrets, and containing destructive capabilities.
  • Open redirect vulnerabilities remain overlooked, with continued potential for abuse in phishing and redirection attacks.

Notable Threat Actor Activity

  • The North Korea-linked Lazarus Group was observed using Medusa ransomware in attacks against US healthcare and Middle Eastern entities, also deploying the Comebacker backdoor, Blindingcan RAT, and Infohook infostealer.
  • UAC-0050, a Russia-aligned threat actor, targeted a European financial institution using a spoofed domain and RMS malware, likely for intelligence gathering or financial theft.
  • UnsolicitedBooker, a threat activity cluster, shifted focus to targeting telecommunications companies in Kyrgyzstan and Tajikistan, deploying LuciDoor and MarsSnake backdoors.
  • The ShinyHunters extortion group remains active, claiming responsibility for recent high-profile breaches.
  • “Diesel Vortex” threat group continues credential theft campaigns targeting freight and logistics sectors.
  • The “Arkanix Stealer” malware, written in C++ and Python, was observed exfiltrating system and browser data before disappearing shortly after its debut.
  • Arrests of Anonymous Fénix members in Spain disrupted part of the group’s operations.

Trends, Tools, or Tactics of Interest

  • Threat actors are increasingly using fake video meeting invites (Zoom, Teams, Google Meet) to trick users into installing remote monitoring and management (RMM) tools or surveillance software through social engineering.
  • 1Campaign, a new cybercrime service, enables threat actors to run malicious Google Ads that evade detection and remain online for extended periods.
  • Attackers now require as little as 29 minutes to gain control of a network, aided by credential misuse, AI tools, and security blind spots.
  • GitHub Copilot can be abused to process malicious instructions embedded in issues, leading to repository takeover when launching Codespaces.
  • Social engineering remains a primary attack vector, with increasing sophistication in tactics.
  • Identity-first security is highlighted as critical, with AI agents now provisioning infrastructure and inheriting over-scoped privileges.
  • Password length recommendations are being revisited in light of AI and quantum computing threats.
  • Human risk management tools, such as the AIDA Orchestration Agent, are being introduced to address persistent social engineering risks.

Regulatory or Policy Developments

  • The UK Information Commissioner’s Office (ICO) fined Reddit £14.47 million for unlawfully collecting and processing children’s data under 13 without adequate safeguards.
  • Ofcom and the ICO fined both Reddit and a US-based pornographic website for failing to protect children’s privacy and safety online.
  • Microsoft expanded data loss prevention (DLP) controls to restrict Copilot AI from processing confidential Word, Excel, and PowerPoint documents, regardless of storage location.