Major Incidents or Breaches

  • The European Commission confirmed a data breach following a cyberattack on its Europa.eu platform. The incident, claimed by the ShinyHunters extortion gang, resulted in unauthorised access to data.
  • The FBI confirmed that Iranian-linked Handala hackers compromised the personal email account of Director Kash Patel, with some exfiltrated data published. The US government has offered a $10 million reward for information on the hackers.

Newly Discovered Vulnerabilities

  • Attackers are actively exploiting a critical vulnerability in Fortinet’s FortiClient EMS platform. The flaw allows remote code execution and is now being used in the wild.
  • A vulnerability in the Smart Slider 3 WordPress plugin, affecting over 800,000 sites, allows users with subscriber-level access to read arbitrary files on the server.
  • A previously disclosed F5 BIG-IP denial-of-service vulnerability has been reclassified as a critical remote code execution issue. The flaw is now being exploited in the wild.

Notable Threat Actor Activity

  • Three China-linked threat clusters conducted a coordinated, sophisticated cyber campaign targeting a Southeast Asian government organisation, utilising complex and well-resourced tactics.
  • The ShinyHunters extortion gang claimed responsibility for the Europa.eu breach.
  • Iranian-affiliated Handala hackers targeted and breached the personal email account of an FBI director.

Trends, Tools, or Tactics of Interest

  • AI-assisted malware development has reached operational maturity, with evidence of advanced frameworks such as VoidLink, which is modular and professionally engineered, being developed and deployed by individual threat actors.
  • DShield honeypot data continues to show repeated bot traffic, particularly in Cowrie telnet and SSH sessions, with session durations and command counts being notable metrics.

Regulatory or Policy Developments Affecting the Security Industry

  • The US government has announced a $10 million reward for information leading to the identification or location of the Iranian hackers responsible for the FBI email compromise.