Wednesday 29 April 2026

Major Incidents or Breaches

• Vimeo has confirmed a data breach affecting user and customer data, resulting from the Anodot data anomaly detection company breach. The ShinyHunters group is threatening to leak the stolen files unless a ransom is paid.
• Application security company Checkmarx has confirmed that the LAPSUS$ threat group leaked data stolen from its private GitHub repository.
• Robinhood systems were leveraged to send legitimate-looking phishing emails, luring recipients to malicious websites.
• Electric motorcycles (Zero Motorcycles) and scooters (Yadea) have been found vulnerable to attacks that could compromise rider safety.
• A Chinese engineer reportedly stole US military and NASA software over several years by impersonating researchers and convincing organisations to provide sensitive code.

Newly Discovered Vulnerabilities

• CVE-2026-42208: A critical pre-authentication SQL injection vulnerability in BerriAI’s LiteLLM Python package has been disclosed and is under active exploitation within 36 hours of public announcement. Attackers are targeting sensitive information stored by the LiteLLM gateway.
• CVE-2026-3854: A critical remote code execution vulnerability affecting GitHub.com and GitHub Enterprise Server allows authenticated users to achieve RCE via a single Git push. The flaw exposed millions of repositories.
• CVE-2026-25874: Hugging Face’s LeRobot open-source robotics platform is affected by a critical unpatched vulnerability that allows unauthenticated remote code execution.
• Vulnerabilities in Robinhood systems enabled attackers to send phishing emails from legitimate infrastructure.
• Vulnerabilities in Zero Motorcycles and Yadea electric scooters could allow attackers to compromise device security and rider safety.

Notable Threat Actor Activity

• The Brazilian-origin cybercrime group LofyGang has resurfaced after three years, distributing a new stealer malware, LofyStealer (aka GrabBot), targeting Minecraft players.
• The North Korean BlueNoroff group is conducting campaigns against cryptocurrency executives, using stolen victim videos, AI-generated avatars, and fake Zoom calls to enhance social engineering and malware delivery.
• LAPSUS$ threat group has leaked stolen data from Checkmarx’s private GitHub repository.
• Scattered Spider: A dual US-Estonian citizen, allegedly a prolific member of this group, has been arrested in Finland and faces US federal charges.
• ShinyHunters is threatening to leak data stolen in the Vimeo breach if ransom demands are not met.
• Feuding between ransomware groups 0APT and KryBit has led to the leaking of each other’s infrastructure and operational data, exposing details of ransomware operations.

Trends, Tools, or Tactics of Interest

• Threat actors are rapidly exploiting newly disclosed vulnerabilities, with the LiteLLM SQL injection (CVE-2026-42208) being exploited within 36 hours of disclosure.
• VECT 2.0 ransomware, due to a flaw in its encryption implementation, irreversibly destroys files larger than 131KB on Windows, Linux, and ESXi, effectively acting as a wiper rather than ransomware.
• Threat actors are publishing structured OPSEC playbooks detailing layered infrastructure, identity separation, and long-term evasion strategies to improve operational security and evade detection.
• The Vidar malware has become the leading infostealer in the market, filling the gap left by the takedown of Lumma and Rhadamanthys.
• Attackers are scaling supply chain attacks by seeding over 70 cloned Open VSX extensions with GlassWorm malware, targeting the VS Code ecosystem.
• Fake CAPTCHA scams are being used to trigger international SMS charges on victims’ phones, with scammers profiting from a share of the charges.
• The use of AI-generated content and social engineering (e.g., fake Zoom calls, deepfakes) is increasing in targeted attacks, particularly by state-linked and financially motivated groups.

Regulatory or Policy Developments Affecting the Security Industry

• Microsoft will deprecate legacy TLS connections for POP and IMAP email clients in Exchange Online starting July 2026, blocking insecure protocols.
• A member of the alleged Chinese state-backed Silk Typhoon group has been extradited to the US to face charges related to cyberattacks against US universities.
• The FIDO Alliance, Google, and Mastercard are collaborating to address security concerns related to AI agents making autonomous purchases, aiming to prevent unauthorised transactions.
• Increased focus on AI governance and agentic AI security, with industry initiatives and webinars promoting multi-layered governance frameworks and cost predictability for AI-driven security solutions.