Major Incidents or Breaches

  • KelpDAO suffered a $290 million cryptocurrency theft, attributed to North Korean state-sponsored Lazarus Group hackers. The attackers exploited the DeFi platform to drain assets.
  • Vercel, the creator of Next.js, confirmed a data breach after a threat actor claimed to have stolen data and offered it for sale for $2 million. The breach reportedly stemmed from compromised OAuth tokens used by an employee’s AI tool.
  • Seiko USA’s website was defaced, with attackers claiming theft of the Shopify customer database and threatening to leak the data unless a ransom is paid.
  • Bluesky social network experienced a 24-hour disruption due to a sophisticated DDoS attack, with a pro-Iran hacker group claiming responsibility.
  • Booking.com was reported as a recent victim of a cyberattack, with further details pending.
  • A British national, identified as a leader of the Scattered Spider cybercrime collective, pleaded guilty in the US to wire fraud and aggravated identity theft related to cryptocurrency theft.

Newly Discovered Vulnerabilities

  • Over twenty malicious apps impersonating popular crypto wallets (Metamask, Coinbase, Trust Wallet, OneKey, etc.) were discovered on the Apple App Store, primarily targeting users in China. These apps phished for recovery/seed phrases to steal cryptocurrency.
  • SGLang (CVE-2026-5760, CVSS 9.8): A critical vulnerability allows remote code execution via malicious GGUF model files.
  • Anthropic Model Context Protocol (MCP): A critical design weakness was disclosed, enabling remote code execution and posing a supply chain risk for AI deployments.
  • Serial-to-IP converters from Lantronix and Silex were found to contain 20 new vulnerabilities, exposing OT and healthcare systems to potential attacks.
  • CISA added eight new exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including three affecting Cisco devices.
  • WhatsApp was found to leak user metadata, allowing attackers to infer limited information about users without direct contact.
  • Half of the 6 million internet-facing FTP servers were found to lack encryption, exposing users and enterprises to various attacks.

Notable Threat Actor Activity

  • Lazarus Group (North Korea) linked to the $290 million KelpDAO crypto theft.
  • Scattered Spider leader pleaded guilty to multiple cybercrimes, including corporate intrusions and cryptocurrency theft.
  • Pro-Iran hacker group claimed responsibility for the DDoS attack on Bluesky.
  • The Gentlemen ransomware group was observed using the SystemBC proxy malware botnet (over 1,570 hosts) for bot-powered attacks, facilitating lateral movement and defense evasion.
  • Threat actors are abusing QEMU, a machine emulator, in campaigns to evade defenses and distribute ransomware and remote access tools.
  • Microsoft reported increased abuse of Microsoft Teams by threat actors for helpdesk impersonation and lateral movement using legitimate tools.
  • Reports indicate use of .wav files as a vector for malware delivery.

Trends, Tools, or Tactics of Interest

  • Third-party tools and compromised OAuth tokens are increasingly leveraged as initial access vectors in breaches, as seen in the Vercel incident.
  • There is a rise in threat actors exploiting trusted download paths and legitimate collaboration platforms (e.g., Microsoft Teams) for initial access and lateral movement.
  • The SystemBC proxy is being used by ransomware operators to automate attacks and maintain persistence within victim networks.
  • QEMU is being leveraged for defense evasion in recent ransomware and RAT campaigns.
  • Increase in phishing and malicious app distribution on official platforms, such as the Apple App Store, specifically targeting cryptocurrency assets.
  • Serial-to-IP converters in OT and healthcare environments remain a weak link due to numerous unpatched vulnerabilities.
  • AI supply chain risks are highlighted by critical vulnerabilities in AI model protocols and concerns about the misuse of powerful AI tools (e.g., Anthropic’s Mythos tool not publicly released over security fears).
  • Survey data from LevelBlue indicates ongoing concern among security leaders about the human element in cybersecurity, with workforce education seen as insufficient.

Regulatory or Policy Developments

  • The US Senate extended surveillance powers under a controversial program until 30 April 2026, following legislative delays.
  • CISA set federal deadlines in April–May 2026 for remediation of newly catalogued exploited vulnerabilities.