Major Incidents or Breaches

  • Instructure, an educational technology company, confirmed a data breach following claims by the ShinyHunters extortion group. Data stolen includes names, email addresses, student ID numbers, and user messages. Service disruptions were also reported.
  • A coordinated international law enforcement operation involving U.S. and Chinese authorities resulted in the arrest of 276 suspects, the shutdown of nine cryptocurrency scam centers, and the seizure of $701 million. The operation targeted large-scale cryptocurrency investment fraud schemes.

Newly Discovered Vulnerabilities

  • Wireshark released version 4.6.5, addressing 43 vulnerabilities (38 CVEs) and 35 additional bugs.

Notable Threat Actor Activity

  • The ShinyHunters extortion group claimed responsibility for the Instructure breach, threatening to leak stolen data.
  • Researchers identified large-scale abuse of Telegram’s Mini App feature by threat actors to conduct cryptocurrency scams, impersonate well-known brands, and distribute Android malware.

Trends, Tools, or Tactics of Interest

  • Microsoft Defender is generating widespread false-positive detections, incorrectly identifying legitimate DigiCert root certificates as Trojan:Win32/Cerdigent.A!dha, and in some cases removing certificates from Windows systems.
  • Threat actors are leveraging Telegram Mini Apps to facilitate both financial fraud and malware delivery, expanding attack vectors beyond traditional phishing and messaging schemes.

Regulatory or Policy Developments Affecting the Security Industry

  • The U.S. Department of Defense reached agreements with seven technology companies (Google, Microsoft, Amazon Web Services, Nvidia, OpenAI, Reflection, and SpaceX) to deploy their artificial intelligence solutions on classified military systems, aimed at supporting operational decision-making.