DanSec

Cybersecurity Brief

Tuesday 16 June 2026

In this brief Council of Europe, Infinite Campus, Novo Nordisk, Cisco, iRhythm, REDCap, +24 more
Vendors
Council of Europe, Infinite Campus, Novo Nordisk, Cisco, iRhythm, REDCap, Mackay Sugar, University of Nottingham, LiteSpeed, LiteLLM, Microsoft, SimpleHelp, Google, Steam, WordPress, Anthropic, PushEngage, OptinMonster, TrustPulse
Threat actors
ShinyHunters, Chinese espionage actors, The Gentlemen, APT37, Contagious Interview, UNC6508, Conti, Outsider Enterprise, SprySOCKS, Famous Chollima
CVEs
CVE-2026-20262

Major Incidents or Breaches

  • The Council of Europe is investigating claims by the ShinyHunters extortion group that it has stolen and is threatening to leak 297 GB of data, including employee personal information [21][42].
  • The Infinite Campus K-12 student information system suffered a data breach by ShinyHunters, resulting in the theft of personal information from more than 137,000 school staff accounts [26].
  • Novo Nordisk, the pharmaceutical company behind Ozempic, disclosed that hackers breached its IT systems and accessed personal data [40].
  • French government officials confirmed a breach of the Tchap messaging platform, affecting approximately 73,000 government accounts, with the attacker claiming theft of messages and user data [41].
  • iRhythm Holdings, a digital healthcare company, reported a data breach in which hackers stole patients’ personal and health information from third-party-hosted business applications [16].
  • Chinese espionage actors breached REDCap servers at a North American medical institution, deploying InfiniteRed malware to steal sensitive research data [24][29][37].
  • Mackay Sugar, Australia’s second-largest sugar producer, was forced to shut down mills following a ransomware attack attributed to the group “The Gentlemen” [36].
  • The University of Nottingham, a UK research university, experienced a cyber incident, as noted in a threat intelligence bulletin [44].

Newly Discovered Vulnerabilities

  • Cisco released security updates for a vulnerability in Catalyst SD-WAN Manager (CVE-2026-20262), which was actively exploited in the wild to escalate privileges and perform arbitrary file writes [5][20][35].
  • The US CISA added a LiteSpeed cPanel Plugin vulnerability to its Known Exploited Vulnerabilities catalog, as it allows root privilege escalation and is being actively exploited [6].
  • A vulnerability chain in LiteLLM, an AI gateway, allows a default low-privilege account to escalate to admin and execute code on the server by chaining three flaws [9].
  • A critical vulnerability chain dubbed “SearchLeak” in Microsoft 365 Copilot Enterprise allowed attackers to steal emails, files, and MFA codes in a single click via a trusted Microsoft link. The vulnerability has been patched [10][25][28].
  • The SimpleHelp remote management software contains a vulnerability in the OpenID Connect authentication protocol that enables unauthenticated attackers to create privileged technician accounts [18].

Notable Threat Actor Activity

  • The North Korean ScarCruft (APT37) group used spear-phishing emails impersonating Microsoft Account security notifications to deliver the NarwhalRAT malware [4].
  • North Korean threat actors are leveraging developer tools as malware delivery channels in campaigns attributed to the Contagious Interview (Famous Chollima, Hexagon Geometry) cluster [8].
  • Chinese state-linked espionage group UNC6508 conducted a year-long campaign targeting North American medical, academic, and defense research networks, stealing sensitive emails and research data by abusing Google Workspace and exploiting REDCap credentials [7][24][29][37].
  • The ShinyHunters extortion group claimed responsibility for data breaches at the Council of Europe and Infinite Campus [21][26][42].
  • Ransomware group “The Gentlemen” was identified as responsible for the attack on Mackay Sugar in Australia [36].
  • Oleksii Oleksiyovych Lytvynenko, a Ukrainian national, pleaded guilty in the US to charges related to the development of a loader for the Conti ransomware gang [39].
  • The FBI and Google dismantled the “Outsider Enterprise” phishing service, which used over 9,000 phishing sites and stole nearly 4 million credit cards, causing approximately $1.9 billion in losses [43].
  • Malware is being distributed through dozens of malicious wallpapers on Steam Workshop, putting gamers’ accounts at risk [1].
  • A network of 152 Chrome wallpaper extensions with over 105,000 installs was found distributing adware and generating fake traffic [13].
  • Trusted JavaScript files in popular WordPress plugins (PushEngage, OptinMonster, TrustPulse) were tampered with in a CDN supply-chain attack to plant hidden backdoors on sites [14][19].
  • A malicious infrastructure was uncovered delivering EtherRAT, phishing pages, and various malware via a vast network of sites [45].
  • There is an increasing trend of employees developing automations and apps with AI tools outside traditional security oversight, leading to code sprawl and shadow tooling concerns for CISOs [23].
  • The Windows variant of the SprySOCKS Linux malware is being used in attacks against government organizations in at least four countries [15].
  • The FBI warned that fraudsters are using couriers in cryptocurrency investment scams to physically collect money from victims [22].

Regulatory or Policy Developments Affecting the Security Industry

  • The US Department of Justice seized the CFAKE.com and SOCFAKE.com deepfake nude sites under the TAKE IT DOWN Act, targeting nonconsensual AI-generated content [17].
  • The US government ordered Anthropic to suspend access to its Claude Fable 5 and Mythos 5 AI models for foreign nationals due to export control concerns and fears of abuse [32][46].

Sources

  1. Council of Europe investigates ShinyHunters data breach claims - bleepingcomputer.com
  2. ShinyHunters Claims Council of Europe Hack - securityweek.com
  3. Infinite Campus data breach affects 137,000 school staff accounts - bleepingcomputer.com
  4. Ozempic Maker Novo Nordisk Says Hackers Breached IT Systems - securityweek.com
  5. French Government Messaging Platform Breached by Mysterious ‘Misere’ Hacker - securityweek.com
  6. iRhythm discloses data breach, says hackers stole patient info - bleepingcomputer.com
  7. Chinese hackers breach REDCap servers, steal medical research - bleepingcomputer.com
  8. China-Nexus Actor Spy on US Researchers Undetected for a Year - darkreading.com
  9. Chinese Hackers Target Medical, Military, and AI Research in North America - securityweek.com
  10. Ransomware Attack Shuts Down Mills of Australia’s Second-Largest Sugar Producer - securityweek.com
  11. 15th June – Threat Intelligence Report - research.checkpoint.com
  12. Cisco Releases Security Updates for Actively Exploited SD-WAN Manager Flaw - thehackernews.com
  13. Cisco fixes SD-WAN vManage flaw exploited in zero-day attacks - bleepingcomputer.com
  14. Cisco Patches Another SD-WAN Zero-Day Exploited in Attacks - securityweek.com
  15. CISA Flags LiteSpeed cPanel Plugin Flaw Exploited for Root Privilege Escalation - thehackernews.com
  16. LiteLLM Vulnerability Chain Lets Low-Privilege Users Take Over AI Gateway Servers - thehackernews.com
  17. One-Click Microsoft 365 Copilot Flaw Could Have Let Attackers Steal Emails, Files, and MFA Codes - thehackernews.com
  18. New attack turned Microsoft 365 Copilot into 1-click data theft tool - bleepingcomputer.com
  19. Copilot 'SearchLeak' Attack Allows 1-Click Data Theft - darkreading.com
  20. SimpleHelp bug lets hackers create rogue remote support accounts - bleepingcomputer.com
  21. Fake Microsoft Alerts Used to Deploy North Korean NarwhalRAT Malware - thehackernews.com
  22. North Korean Hackers Are Turning Developer Tools Into Malware Delivery Channels - thehackernews.com
  23. Chinese Hackers Abused Google Workspace Rules to Steal Research and Defense Emails - thehackernews.com
  24. Ukrainian Man Pleads Guilty in US to Conti Ransomware Charges - securityweek.com
  25. FBI, Google Dismantle ‘Outsider Enterprise’ Phishing Service - securityweek.com
  26. Dozens of malicious wallpapers found on Steam Workshop: gamers’ accounts at risk - securelist.com
  27. 152 Chrome Wallpaper Extensions with 105K Installs Linked to Adware and Fake Traffic - thehackernews.com
  28. Popular WordPress Plugin Scripts Tampered to Plant Hidden Backdoors on Sites - thehackernews.com
  29. OptinMonster WordPress plugin hacked in CDN supply-chain attack - bleepingcomputer.com
  30. Inside a malicious infrastructure delivering EtherRAT, phishing pages, and malicious software - malwarebytes.com
  31. Vibe coders are gonna vibe code: How CISOs are tackling code sprawl - bleepingcomputer.com
  32. Windows version of SprySOCKS Linux malware used to attack govt orgs - bleepingcomputer.com
  33. FBI: Fraudsters use couriers to steal money in crypto scams - bleepingcomputer.com
  34. DOJ seizes CFAKE, SOCFAKE deepfake nude sites under TAKE IT DOWN Act - bleepingcomputer.com
  35. US Cracks Down on Anthropic AI Models Amid Abuse Concerns - darkreading.com
  36. Claude Fable 5 and Mythos 5 “abruptly disabled” after US gov. ban - malwarebytes.com