Major Incidents or Breaches

  • Cloud Atlas has targeted public sector and diplomatic entities in Russia and Belarus, employing new tools including PowerCloud, and leveraging ReverseSocks, SSH, and Tor for persistence on infected systems [1].
  • The Belarus-aligned threat actor Ghostwriter has conducted phishing campaigns against Ukrainian government entities using lures associated with the Prometheus online learning platform [10].
  • The Megalodon automated attack campaign pushed over 5,700 malicious commits to more than 5,500 GitHub repositories within six hours, exploiting CI/CD workflows [11].
  • Authorities in Europe and North America dismantled the “First VPN” criminal VPN service, which was used by at least 25 ransomware groups to facilitate attacks and obscure their origins [9][30].
  • Dutch authorities seized 800 servers belonging to a hosting provider that enabled cyberattacks, interference operations, and disinformation campaigns, arresting two individuals [14].
  • A Canadian man was arrested and charged in connection with operating the Kimwolf DDoS botnet, which infected nearly two million devices globally and was used for DDoS-for-hire attacks [13][20][29].
  • Former US executives pleaded guilty to concealing a tech support fraud scheme that impacted victims worldwide [15].

Newly Discovered Vulnerabilities

  • A maximum-severity vulnerability (CVE-2026-48172, CVSS 10.0) in the LiteSpeed User-End cPanel Plugin is under active exploitation, allowing attackers to execute scripts as root [7].
  • A critical SQL injection vulnerability (CVE-2026-9082) in Drupal Core is being actively exploited in the wild and has been added to CISA’s Known Exploited Vulnerabilities catalog [8][17][27].
  • Trend Micro patched a zero-day directory traversal vulnerability (CVE-2026-34926) in Apex One, which has been exploited in attacks targeting Windows systems [16][31].
  • Ubiquiti released updates to address three maximum severity vulnerabilities in UniFi OS, which could be exploited by remote, unauthenticated attackers [19].
  • Google released security updates for Chrome to address critical vulnerabilities that could allow remote code execution via malicious websites [33].

Notable Threat Actor Activity

  • Cloud Atlas has updated its toolkit, incorporating PowerCloud and using ReverseSocks, SSH, and Tor for persistence, targeting government and diplomatic organizations in Russia and Belarus [1].
  • Ghostwriter (UAC-0057/UNC1151), aligned with Belarus, is using Prometheus-themed phishing to target Ukrainian governmental bodies [10].
  • Multiple Iran-nexus threat actors, including Nimbus Manticore, have been active during recent Middle East geopolitical tensions, advancing Iran’s strategic cyber objectives [32].

Trends, Tools, or Tactics of Interest

  • The Tycoon 2FA phishing-as-a-service platform has evolved to leverage OAuth device code phishing, enabling compromise of accounts protected by multifactor authentication [2].
  • Automated malicious commit campaigns, exemplified by Megalodon, are targeting thousands of GitHub repositories by exploiting CI/CD workflows [11].
  • There is an observed trend of threat actors making Windows kernel drivers exploitable from user mode without requiring the original hardware, broadening the attack surface for Bring Your Own Vulnerable Driver (BYOVD) attacks [12].
  • Fake FIFA World Cup websites are targeting soccer fans with phishing schemes designed to steal money and personal data by mimicking official ticketing and merchandise flows [6].
  • Social engineering attacks against the healthcare sector are increasing in sophistication and frequency, as highlighted in Verizon’s 2026 Data Breach Investigations Report [22].

Regulatory or Policy Developments Affecting the Security Industry

  • Lawmakers in the US are demanding answers from CISA following a contractor-related data leak, raising questions about oversight and data security practices within the agency [25][28].
  • The addition of the Drupal Core SQL injection vulnerability to the CISA Known Exploited Vulnerabilities catalog mandates accelerated patching timelines for US federal agencies [8].

Sources#

  1. Cloud Atlas activity in the second half of 2025 and early 2026: new tools and a new payload - securelist.com
  2. Ghostwriter Targets Ukraine Government Entities with Prometheus Phishing Malware - thehackernews.com
  3. Megalodon GitHub Attack Targets 5,561 Repos with Malicious CI/CD Workflows - thehackernews.com
  4. First VPN Dismantled in Global Takedown Over Use by 25 Ransomware Groups - thehackernews.com
  5. ‘First VPN’ Cybercrime Service Disrupted, Administrator Arrested - securityweek.com
  6. Netherlands seizes 800 servers of hosting firm enabling cyberattacks - bleepingcomputer.com
  7. Kimwolf DDoS Botnet Operator Arrested in Canada Over DDoS-for-Hire Attacks - thehackernews.com
  8. US and Canada arrest and charge suspected Kimwolf botnet admin - bleepingcomputer.com
  9. Canadian Man Arrested for Operating Kimwolf Botnet - securityweek.com
  10. Former US execs plead guilty to aiding tech support scammers - bleepingcomputer.com
  11. LiteSpeed cPanel Plugin CVE-2026-48172 Exploited to Run Scripts as Root - thehackernews.com
  12. Drupal Core SQL Injection Bug Actively Exploited, Added to CISA KEV - thehackernews.com
  13. Drupal: Critical SQL injection flaw now targeted in attacks - bleepingcomputer.com
  14. Drupal Vulnerability in Hacker Crosshairs Shortly After Disclosure - securityweek.com
  15. Trend Micro warns of Apex One zero-day exploited in the wild - bleepingcomputer.com
  16. TrendAI Patches Apex One Zero-Day Exploited in the Wild - securityweek.com
  17. Ubiquiti patches three max severity UniFi OS vulnerabilities - bleepingcomputer.com
  18. Update Chrome now: Critical bugs could let attackers run code - malwarebytes.com
  19. Fast and Furious – Nimbus Manticore Operations During the Iranian Conflict - research.checkpoint.com
  20. Report: The Tycoon 2FA Phishing Kit Has Evolved - blog.knowbe4.com
  21. Making Vulnerable Drivers Exploitable Without Hardware - The BYOVD Perspective - thehackernews.com
  22. Foul play: Fake FIFA websites target soccer fans looking for World Cup tickets, merchandise - welivesecurity.com
  23. Verizon DBIR: Healthcare Fends Off Increased Social Engineering Attacks - darkreading.com
  24. Lawmakers Demand Answers as CISA Tries to Contain Data Leak - krebsonsecurity.com
  25. In Other News: Industrial Router Exploitation, CISA KEV Nomination Form, Gas Station Hacking - securityweek.com