Major Incidents or Breaches#

  • French Government Agency Data Breach: France Titres, responsible for issuing administrative documents, confirmed a breach after a hacker claimed to have stolen citizen data and offered it for sale.

  • Healthcare Data Breaches in the US: Data breaches were reported by Southern Illinois Dermatology, Saint Anthony Hospital, and North Texas Behavioral Health Authority, collectively affecting approximately 600,000 individuals.

  • Kelp DAO Crypto Heist: North Korean threat actors are attributed to a $290 million theft from Kelp DAO, exploiting LayerZero’s DVN by compromising RPC endpoints and using DDoS attacks to force failover to malicious infrastructure.

  • Perforce Server Exposures: Over 1,500 Perforce P4 version control servers were found to be unsecured, exposing sensitive data from major organizations.

Newly Discovered Vulnerabilities#

  • Lantronix and Silex Serial-to-IP Converters: Researchers identified 22 vulnerabilities in popular models of serial-to-IP converters, exposing thousands of devices to hijacking and tampering risks.

  • Google Antigravity IDE: A prompt injection vulnerability in Google’s Antigravity IDE allowed arbitrary code execution and sandbox escape. Google has issued a patch.

  • Catalyst SD-WAN Manager: CISA flagged a new vulnerability in Catalyst SD-WAN Manager as actively exploited, mandating urgent patching for US federal agencies.

  • Apache ActiveMQ: Over 6,400 servers remain vulnerable to a high-severity code injection flaw in Apache ActiveMQ, which is being actively exploited in the wild.

  • Microsoft SharePoint Spoofing Vulnerability: Over 1,300 SharePoint servers remain unpatched and exposed to ongoing attacks exploiting a spoofing vulnerability that was previously used as a zero-day.

  • Bomgar RMM (CVE-2026-1731): A critical remote code execution flaw in Bomgar remote monitoring and management software is being exploited to spread ransomware and compromise supply chains.

  • Progress MOVEit WAF and LoadMaster: Multiple vulnerabilities, including remote code execution and OS command injection, were patched in MOVEit WAF and LoadMaster products.

  • Cisco, Kentico, Zimbra: CISA added several previously and newly exploited vulnerabilities affecting these platforms to its KEV catalog.

Notable Threat Actor Activity#

  • The Gentlemen Ransomware Operation: SystemBC proxy malware was linked to over 1,570 victims in attacks attributed to The Gentlemen ransomware-as-a-service operation.

  • NGate Android Malware Campaign: A new NGate variant, possibly developed with AI assistance, is targeting Brazilian users by trojanizing the HandyPay NFC payment app to steal card data and PINs.

  • Lotus Data Wiper: The Lotus wiper malware was used in targeted attacks against Venezuelan energy and utility firms.

  • Chinese APT Activity: Chinese state-linked threat actors are targeting Indian banks and South Korean policy organizations, using relatively unsophisticated techniques.

  • North Korean Crypto Theft: North Korean actors are blamed for the $290 million Kelp DAO crypto heist.

  • Scattered Spider: A British national, Tyler Robert Buchanan, pleaded guilty to involvement in the Scattered Spider cybercrime group, admitting to wire fraud conspiracy and aggravated identity theft.

  • BlackCat (ALPHV) Ransomware Insider: Angelo Martino, a former ransomware negotiator, pleaded guilty to collaborating with the BlackCat ransomware group to conduct attacks against US companies in 2023.

  • Malicious Crypto Apps in Apple App Store: Dozens of apps masquerading as cryptocurrency wallets were found in the App Store, capable of hijacking recovery phrases and private keys.

  • WhatsApp Phishing Campaign: Attackers are using WhatsApp messages to deliver malware via malicious Visual Basic Scripts.

  • Identity-Based Attacks: Increased focus on identity-based attacks as a primary entry vector, with attackers bypassing technical exploits in favour of credential-based access.

  • Windows Defender Exploitation: Three proof-of-concept exploits are being used in active attacks to turn Microsoft’s built-in security platform into an attack tool; two of these vulnerabilities remain unpatched.

  • Supply Chain Risks via RMM Tools: Surge in exploitation of Bomgar RMM demonstrates ongoing supply chain risk, with attackers leveraging RMM vulnerabilities to deploy ransomware.

  • Fraudulent Use of Apple Notifications: Scammers are abusing legitimate Apple notification emails to drive tech support scams.

  • Telegram Credential Harvesting: Attackers are using Telegram’s tdata files as a vector for credential harvesting, as observed in honeypot incidents.

  • Fake Google Antigravity Installers: Trojanized installers for Google Antigravity are being distributed, stealing user accounts upon installation.

  • Malicious Apps in Official Stores: Both Apple’s App Store and Google Play have seen an influx of malicious apps, particularly targeting cryptocurrency users.

  • Android Permissions Change: Android 17 introduces more granular contact access permissions, restricting apps from accessing full contact lists by default.

  • AI in Vulnerability Discovery: Mozilla used Anthropic’s Mythos AI to identify and fix 271 bugs in Firefox, highlighting increased use of AI in software security processes.

Regulatory or Policy Developments#

  • UK Ofcom Investigation into Telegram: Ofcom has launched an investigation into Telegram and teen chat sites over evidence of child sexual abuse material (CSAM) sharing.

  • Meta Sued Over Scam Ads: The Consumer Federation of America filed a lawsuit against Meta, alleging the company misled consumers about efforts to combat scam advertisements on Facebook and Instagram.