Major Incidents or Breaches

  • Grinex, a Kyrgyzstan-based cryptocurrency exchange, suspended operations following a $13.7 million hack, which it attributes to Western intelligence agencies.
  • A recent hack targeted Rockstar Games, attributed to the ShinyHunters group.
  • A new incident involving the DraftKings breach: Kamerin Stokes was sentenced to prison for selling stolen credentials related to the attack, continuing his activities even after pleading guilty.

Newly Discovered Vulnerabilities

  • CVE-2024-3721: Threat actors are actively exploiting this vulnerability in TBK DVRs and end-of-life TP-Link Wi-Fi routers to deploy Mirai variant ‘Nexcorium’ for DDoS botnets.
  • Three zero-day vulnerabilities in Microsoft Defender are being actively exploited to gain elevated privileges on compromised systems. Two of these vulnerabilities remain unpatched.
  • Apache ActiveMQ: A high-severity remote code execution vulnerability (CVE-2026-34197) is being actively exploited in the wild. The flaw, present for 13 years, was patched earlier this month.
  • ShowDoc: A vulnerability in this platform is being exploited in the wild.
  • Google Chrome: A security flaw in Chrome was reportedly awarded a $90,000 bug bounty.

Notable Threat Actor Activity

  • The Payouts King ransomware group is using QEMU virtual machines as reverse SSH backdoors to bypass endpoint security and maintain persistence.
  • Tycoon phishing group has shifted to device code phishing, leveraging legitimate new-device login flows to bypass two-factor authentication.
  • North Korean IT worker scheme: Two facilitators, Kejia Wang and Zhenxing Wang, were jailed in the US for helping North Korean workers obtain employment at over 100 US companies using stolen identities.
  • ZionSiphon malware is targeting industrial control systems in Israeli water treatment and desalination plants.
  • Underground cybercrime guides are circulating, teaching threat actors how to vet and select stolen credit card shops based on data quality, reputation, and survivability.
  • ShinyHunters group involved in the Rockstar Games breach.

Trends, Tools, or Tactics of Interest

  • Fake data breach alerts are being used as phishing lures to trick recipients into divulging sensitive information.
  • Old vulnerabilities are being increasingly targeted and amplified by AI-driven attack techniques.
  • Classic Nigerian advance-fee scams remain prevalent, with new twists keeping them effective.
  • Identity Management Day highlights the growing importance of identity management at the edge as a core component of digital trust.
  • CoChat launched an AI collaboration platform designed to combat “shadow AI” by improving visibility and governance over enterprise AI use.
  • Google blocked or removed 8.3 billion policy-violating ads in 2025 and announced new Play policy updates focused on privacy and fraud prevention.
  • Microsoft reported that some Windows domain controllers are entering reboot loops after the April 2026 security updates.

Regulatory or Policy Developments Affecting the Security Industry

  • NIST has reduced its enrichment of CVE data, impacting vulnerability management efforts; industry and ad-hoc coalitions are forming to address the gap.
  • The US Coast Guard released new cybersecurity rules under the Maritime Transportation Security Act (MTSA), requiring OT security plans, third-party audits, and hybrid OT-security roles.
  • The US House blocked an extension of Section 702, a surveillance program used by the FBI for warrantless searches.
  • The White House is engaging with AI labs, including Anthropic, to discuss the security of advanced AI technologies.
  • The Satellite Cybersecurity Act and increased EPA cybersecurity budget to $19 million were noted as recent legislative developments.
  • Lawmakers in the US held closed-door discussions about the risks and rapid advancement of AI technologies.