DanSec

Cybersecurity Brief

Friday 12 June 2026

In this brief Novo Nordisk, Oracle, Kyushu Electric Power, Coupang, LangGraph, Google, +7 more
Vendors
Novo Nordisk, Oracle, Kyushu Electric Power, Coupang, LangGraph, Google, Langflow, Ivanti, Microsoft
Threat actors
ShinyHunters, The Gentlemen, OnyxC2
CVEs
CVE-2026-35273

Major Incidents or Breaches

  • Danish pharmaceutical company Novo Nordisk disclosed a data breach impacting patient information from certain clinical trials[13].
  • The French government confirmed a breach of its encrypted Tchap messaging platform, affecting over 73,000 public sector employee accounts[15].
  • Kyushu Electric Power in Japan reported a physical security incident involving the loss of a drive containing personal data of 10.9 million clients[16].
  • South Korean e-commerce firm Coupang was fined a record $409 million by the Personal Information Protection Commission following a massive data breach[21].
  • Fake breach disclosures were submitted to Maine’s official breach portal and published publicly before verification, constituting a misinformation campaign[17].

Newly Discovered Vulnerabilities

  • Oracle PeopleSoft Suite was found to contain a critical zero-day vulnerability (CVE-2026-35273) allowing unauthenticated remote code execution, exploited in the wild by the ShinyHunters group. Oracle has released mitigations[6][18][33][34].
  • Three security flaws in LangGraph, including a critical chain enabling remote code execution, have been disclosed and patched[3].
  • Researchers demonstrated that OpenClaw, a self-hosted AI agent, can be manipulated to execute attacker-controlled code or leak sensitive data[7].
  • A new BitLocker bypass exploit for Windows, dubbed GreatXML, has been released, enabling attackers to circumvent BitLocker protections via recovery partition XML files[8].
  • Google Chrome 149 update addressed 28 vulnerabilities, including several critical and high-severity issues such as use-after-free bugs[31].
  • Hackers are exploiting a Langflow vulnerability that allows unauthenticated file writes and potential remote code execution[38].

Notable Threat Actor Activity

  • The ShinyHunters extortion group exploited the Oracle PeopleSoft zero-day to breach enterprise and university systems, steal data, and extort victims[6][18][33][34].
  • The Gentlemen ransomware group has claimed 478 victims and is capable of worm-like propagation, conducting double extortion attacks[9].
  • The OnyxC2 stealer malware is being marketed to cybercriminals for $250 per month, targeting over 200 applications and using evasion techniques such as encrypted payloads, DLL sideloading, and in-memory execution[37].
  • Attackers are using a spoofed ChatGPT download site, leveraging sponsored search results and SEO manipulation, to deliver malware[1].
  • Fake FACEIT verification pages are being used to steal Steam accounts via convincing phishing attacks[40].
  • Phishing attack volume has decreased by 20 percent, but attackers are focusing on more sophisticated, AI-enhanced campaigns, increasing overall risk[23].
  • AI-driven attacks are challenging the effectiveness of traditional MSP security stacks, highlighting the need for integrated security, automation, and rapid response[20].
  • Alert fatigue is becoming a significant risk, with organisations turning to AI and automation to better triage and respond to security alerts[35].
  • Device-Bound Session Credentials, recently released by Google, provide enhanced protection against local cookie theft but remain susceptible to phishing and hacking[2].
  • There is a growing trend among CISOs to shift budgets from traditional vulnerability management to breach and attack simulation (BAS) solutions due to the speed at which AI is enabling vulnerability weaponisation[12].

Regulatory or Policy Developments Affecting the Security Industry

  • The US Cybersecurity and Infrastructure Security Agency (CISA) issued Binding Operational Directive 26-04, requiring federal agencies to prioritise and patch actively exploited vulnerabilities, with a specific three-day deadline for critical flaws such as those in Ivanti Sentry[14][22][24][30][36].
  • A German court has ruled that Google can be held liable for false or defamatory content generated by its AI Overviews, rejecting the defence that “AI can make mistakes”[41].
  • Authorities in Europe dismantled the AudiA6 cryptocurrency laundering service, which was used by ransomware groups and criminal networks to launder over $380 million[5][19].
  • INTERPOL, through Operation Ramz, took down the Sniper Dz phishing-as-a-service platform and arrested its administrator[4].

Sources

  1. Pharma giant Novo Nordisk discloses breach of clinical trials data - bleepingcomputer.com
  2. Over 73,000 French govt employees affected in Tchap messenger breach - bleepingcomputer.com
  3. Japanese energy firm loses drive with data of 10.9 million clients - bleepingcomputer.com
  4. Coupang hit with record $409 million data breach fine in Korea - bleepingcomputer.com
  5. Maine breach portal abused to publish fake data breach disclosures - bleepingcomputer.com
  6. ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273) to Breach Universities - thehackernews.com
  7. Oracle mitigates PeopleSoft zero-day exploited in data theft attacks - bleepingcomputer.com
  8. Google Confirms Exploitation of Oracle PeopleSoft Zero-Day by ShinyHunters - securityweek.com
  9. Oracle Addresses PeopleSoft Vulnerability Amid Reports of Zero-Day Attacks - securityweek.com
  10. LangGraph Flaw Chain Exposes Self-Hosted AI Agents to Remote Code Execution - thehackernews.com
  11. New Attacks Trick OpenClaw AI Agent Into Running Code and Leaking Secrets - thehackernews.com
  12. New GreatXML Exploit Bypasses Windows BitLocker via Recovery Partition XML Files - thehackernews.com
  13. Chrome 149 Update Patches 28 Vulnerabilities - securityweek.com
  14. Hackers Exploit Langflow Vulnerability for Remote Code Execution - securityweek.com
  15. The Gentlemen Ransomware Claims 478 Victims, Can Spread Like a Worm - thehackernews.com
  16. OnyxC2 Stealer Offers Cybercriminals Enterprise-Grade Theft for $250 a Month - securityweek.com
  17. Attackers Use Spoofed ChatGPT Site to Deliver Malware - blog.knowbe4.com
  18. Fake verification pages are stealing Steam accounts from players - malwarebytes.com
  19. Phishing Attack Volume Down 20%, but Risk Still Rising - darkreading.com
  20. Why AI-driven threats are exposing the limits of MSP security stacks - bleepingcomputer.com
  21. Alert Fatigue Is Becoming a Security Threat of Its Own - securityweek.com
  22. I Love Device-Bound Session Credentials, But They Are Still Phishable and Hackable - blog.knowbe4.com
  23. AI Broke Vulnerability Management. That's Why CISOs Are Moving Budget to BAS. - thehackernews.com
  24. CISA orders feds to patch actively exploited Ivanti flaw by Sunday - bleepingcomputer.com
  25. CISA tells govt agencies to patch critical exploited flaws in 3 days - bleepingcomputer.com
  26. Max-Severity Ivanti Flaw Exploited 24 Hours After Disclosure - darkreading.com
  27. Ivanti Sentry Exploitation Attempts Hitting Honeypots - securityweek.com
  28. CISA Directs Federal Agencies to Prioritize Security Patches Based on Risk - securityweek.com
  29. Google can be liable for false AI Overviews, court rules - malwarebytes.com
  30. Europol Disrupts AudiA6 Crypto Laundering Service Used by Ransomware Gangs - thehackernews.com
  31. Authorities dismantle 'AudiA6' ransomware crypto-laundering service - bleepingcomputer.com
  32. INTERPOL Operation Takes Down Sniper Dz Phishing Platform, Arrests Administrator - thehackernews.com