Major Incidents or Breaches

  • Law enforcement and private sector partners have disrupted the infrastructure of the Amadey botnet and Stealc infostealer operations, recovering 27 million stolen credentials and impacting hundreds of command-and-control servers in a coordinated global action known as Operation Endgame [5][8][17][30].
  • The US Department of Justice has seized a cloud computing account linked to subsidiaries of Cambodia-based HuiOne Group, which was allegedly used for cyber scam money laundering [11].
  • A 21-year-old hacker known as “Snoopy” has been sentenced to 18 months in prison for their involvement in the 2022 DraftKings cyberattack, with a requirement to pay approximately $1.8 million in forfeiture and restitution [13][33].

Newly Discovered Vulnerabilities

  • A critical zero-day vulnerability in Cisco Catalyst SD-WAN (CVE-2026-20245) was exploited for at least two months before public disclosure, allowing attackers to gain root access and create rogue accounts through rogue peering and exploitation of the device’s web-based management interface [6][14][20][28].
  • CISA has issued warnings about active exploitation of critical vulnerabilities in Lantronix EDS5000 Series devices and Ubiquiti UniFi OS products, enabling remote, unauthenticated attackers to make system changes, access underlying accounts, and inject commands [7][16][34].
  • Researchers have identified a critical FFmpeg flaw, dubbed PixelSmash, which allows attackers to compromise systems via malicious video files [36].
  • Chrome 149 update addresses 18 severe vulnerabilities, with more than half being use-after-free bugs that could lead to remote code execution [27].
  • A security gap in macOS allows users, including standard non-admin accounts, to disable security and integrated browser tools without requiring administrator privileges or kernel exploits by chaining legitimate OS behaviors [24][32].

Notable Threat Actor Activity

  • A new global campaign named StrikeShark is delivering Cobalt Strike Beacon through a custom loader called SharkLoader [1].
  • The Silent Ransom Group has targeted US law firms using a combination of voice phishing and in-person social engineering to exfiltrate sensitive data [3].
  • The Mistic backdoor has been linked to the ransomware access broker KongTuke, with attacks observed against organizations in insurance, education, IT, and professional services sectors [19].
  • Malicious Microsoft Edge extension “Edgecution” has been used in ransomware attacks to escape the browser sandbox and deploy a Python-based backdoor via abuse of Native Messaging [15].
  • Malicious packages on the OpenClaw (ClawHub) AI skills marketplace were found to bypass security checks and include infostealers and other threats, posing risks to the AI supply chain [23].

Trends, Tools, or Tactics of Interest

  • Attackers are increasingly exploiting weaknesses in CI/CD workflows, with researchers highlighting a new class of flaws (Cordyceps) that expose over 300 GitHub repositories to supply-chain attacks [9].
  • Threat actors are abusing a variety of collaboration channels beyond email, adapting to improved cloud email security and seeking new vectors for social engineering and phishing [4].
  • Service desks remain a favored target for social engineering attacks aimed at obtaining password resets, MFA changes, and unauthorized access to corporate accounts [18].
  • There is a noted rise in cyber threats targeting major events, with the 2026 FIFA World Cup facing persistent cybercrime, social engineering, and infrastructure attacks across host countries [21].
  • Attackers are leveraging information as an attack surface, using tactics such as hidden content injections and cognitive state poisoning to compromise AI and autonomous systems [29][35].

Regulatory or Policy Developments Affecting the Security Industry

  • NIST has opened updated IoT security guidance for public review, aiming to establish cybersecurity requirements for IoT devices used in federal agency networks [26].
  • Google is rolling out new privacy controls for Search services and Google Play, giving users more granular control over saved activity history and personalized recommendations [12].

Sources#

  1. ESET takes part in Operation Endgame to disrupt Amadey and Stealc - welivesecurity.com
  2. Amadey and StealC Malware Network Disrupted, 27M Stolen Credentials Recovered - thehackernews.com
  3. Amadey, StealC malware operations disrupted in Operation Endgame action - bleepingcomputer.com
  4. Microsoft and Allies Smash Shared Infrastructure of Amadey and StealC Malware - securityweek.com
  5. DoJ Seizes Huione Cloud Account Tied to Cyber Scam Money Laundering - thehackernews.com
  6. DraftKings hacker 'Snoopy' sentenced to 18 months in prison - bleepingcomputer.com
  7. Third DraftKings Hacker Sentenced to 18 Months in Prison - securityweek.com
  8. Cisco Catalyst SD-WAN Zero-Day CVE-2026-20245 Exploited to Gain Root Access - thehackernews.com
  9. Mandiant reveals how Cisco SD-WAN zero-day attacks gained root access - bleepingcomputer.com
  10. Attackers Hit Cisco SD-WAN Flaw 2 Months Before Disclosure - darkreading.com
  11. Cisco SD-WAN Zero-Day Exploited Months Before Patching - securityweek.com
  12. CISA Warns Critical Lantronix EDS5000 Flaw Is Being Actively Exploited - thehackernews.com
  13. CISA warns of max severity Ubiquiti flaws exploited in attacks - bleepingcomputer.com
  14. Critical Ubiquiti Vulnerabilities in Attackers’ Crosshairs - securityweek.com
  15. PixelSmash flaw turns video files into attack tools - malwarebytes.com
  16. Chrome 149 Update Resolves 18 Severe Vulnerabilities - securityweek.com
  17. Apple's MacOS Gap Lets Users Disable Security Tools - darkreading.com
  18. macOS Weaknesses Chained to Silently Disable Endpoint Security Agents - securityweek.com
  19. StrikeShark: investigating a new campaign delivering Cobalt Strike through SharkLoader - securelist.com
  20. Extortion Gang Sends In-Person Attackers to Exfiltrate Data - blog.knowbe4.com
  21. Stealthy Mistic backdoor linked to ransomware access broker KongTuke - bleepingcomputer.com
  22. Malicious Edge extension abuses Native Messaging as bridge to malware - bleepingcomputer.com
  23. More Malicious OpenClaw Skills Threaten AI Supply Chain - darkreading.com
  24. Cordyceps CI/CD Flaws Expose 300+ GitHub Repositories to Supply-Chain Attacks - thehackernews.com
  25. Attackers aren’t loyal to any collaboration channel - blog.knowbe4.com
  26. Securing the service desk: Why social engineering attacks keep succeeding - bleepingcomputer.com
  27. 2026 FIFA World Cup Faces Surge in Cyber Threats - darkreading.com
  28. When Information Becomes the Attack Surface – Understanding AI Agent Traps - securityweek.com
  29. Agentic AI Security: Wrong Context, Wrong Decisions at Machine Speed - securityweek.com
  30. NIST Opens Updated IoT Security Guidance to Public Review - securityweek.com
  31. Google releases new privacy controls for activity history, personalization - bleepingcomputer.com