Major Incidents or Breaches

  • RingCentral suffered a data breach impacting 1.6 million accounts, with personal information including names, addresses, email addresses, and phone numbers stolen by the ShinyHunters extortion group and subsequently published online [11][23].
  • Beacon CRM experienced a data breach affecting over 1,000 charities. The breach was traced to a compromised AWS access key exposed in publicly available JavaScript build artifacts [24].
  • ShipMonk, a logistics provider, was breached, resulting in the theft of shipping information for 14,000 Trezor customers. Exposed data includes names, addresses, email addresses, and phone numbers [25].
  • The Scottish Government reported a data breach at the prosecutor’s office, attributed to a third-party provider, with concerns that other agencies serviced by the same provider may also be affected [15].
  • Shell is investigating a potential security incident following claims by the Clop ransomware group that it stole 89GB of data from the company [10].
  • Four individuals were arrested in Brazil and three charged in Europe for conducting a €30 million bank fraud by exploiting a vulnerability at a service provider, which enabled unauthorised withdrawals from customer accounts [6].
  • A former data analyst at Brightly Software was sentenced to two years in prison for stealing company data and attempting to extort $2.5 million from the employer [12].

Newly Discovered Vulnerabilities

  • A new variant of the CoolClient backdoor, used by APT group HoneyMyte, was discovered with a kernel-mode Windows rootkit driver capable of hiding malicious processes, files, and network connections from security tools and analysts [1].
  • Hackers are actively exploiting a macOS authentication bypass vulnerability in Screen Sharing, with public exploit code available and attacks resulting in the deployment of Monero cryptocurrency miners [7].
  • A maximum-severity remote code execution vulnerability in SAP Commerce Cloud, patched three days ago, is already being targeted in active attacks [9].

Notable Threat Actor Activity

  • The Clop ransomware group has claimed responsibility for the alleged data theft from Shell, stating it exfiltrated 89GB of sensitive data [10].
  • The ShinyHunters extortion group was behind the RingCentral breach, stealing and publishing personal data of 1.6 million users [11][23].
  • APT group HoneyMyte has upgraded its CoolClient backdoor with a kernel-level rootkit, enhancing its ability to evade detection [1].

Trends, Tools, or Tactics of Interest

  • Attackers are compromising hotel Wi-Fi routers to redirect users to Microsoft 365 phishing sites, with incidents observed in multiple US cities [2].
  • Threat actors are increasingly abusing trusted business workflows to conduct scams, leveraging the inherent trust in established processes to facilitate attacks [3].
  • There is a surge in the volume of vulnerabilities discovered, attributed to AI-augmented research and automated scanning tools [14].
  • Public exploit code for a macOS Screen Sharing authentication bypass vulnerability is being used to deploy cryptominers, highlighting rapid weaponisation of new flaws [7].
  • Google Workspace attacks are evolving, with attackers using stolen OAuth tokens to access Gmail, Drive, and connected systems, bypassing traditional phishing entry points [8].
  • Over 2,500 organisations were compromised due to issues related to Trivy, not the previously suspected LiteLLM packages, clarifying the source of a widespread supply chain incident [21].
  • WhatsApp is testing an on-device AI feature that warns users about potential scam messages [27].
  • Apple now provides iPhone alerts to users targeted by mercenary spyware, describing how its Threat Notifications system works [26].
  • AI-generated content detection is advancing, with Anthropic planning to watermark text produced by its Claude AI model [5].

Regulatory or Policy Developments Affecting the Security Industry

  • Google Cloud has published its post-quantum cryptography roadmap, aiming for full readiness by 2029, with intermediate milestones in 2027 and 2028 [22].
  • New York City lawmakers are advocating for stricter regulations on the use of biometric surveillance in public venues, specifically targeting practices at Madison Square Garden [18].

Sources#

  1. RingCentral data breach exposed info of 1.6 million accounts - bleepingcomputer.com
  2. 1.6 Million Likely Impacted by RingCentral Data Breach - securityweek.com
  3. Over 1,000 Charities Hit by Beacon CRM Data Breach - securityweek.com
  4. 14,000 Trezor Customers Impacted by Data Breach at ShipMonk - securityweek.com
  5. Scottish Govt Suffers Potentially Widening Data Breach at Prosecutor's Office - darkreading.com
  6. Shell investigates 'potential incident' after Clop data theft claims - bleepingcomputer.com
  7. Hackers arrested over €30M bank fraud exploiting service provider flaw - bleepingcomputer.com
  8. Data analyst sent to prison for stealing data, extorting employer - bleepingcomputer.com
  9. APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit - securelist.com
  10. Hackers exploit macOS Screen Sharing flaw to deploy Monero miner - bleepingcomputer.com
  11. Max severity SAP Commerce Cloud flaw now targeted in attacks - bleepingcomputer.com
  12. Warning: Compromised Hotel Routers Send Users to Phishing Sites - blog.knowbe4.com
  13. Report: Scams Are Surging as Attackers Abuse Trusted Workflows - blog.knowbe4.com
  14. Amid AI-Driven Bug-Hunt Tsunami, NIST Looks to … AI - darkreading.com
  15. The Modern Attack Chain: Rethinking Google Workspace Security in the Age of AI - bleepingcomputer.com
  16. Trivy, Not LiteLLM Behind the 2,500 Org Compromise - securityweek.com
  17. WhatsApp is testing a new warning for scam messages - malwarebytes.com
  18. Apple now uses iPhone alerts for targets of mercenary spyware - malwarebytes.com
  19. How Anthropic plans to watermark Claude's AI-generated text - bleepingcomputer.com
  20. Google Cloud Sets Out Post-Quantum Roadmap With 2029 Readiness Goal - securityweek.com
  21. New York City Lawmakers Push to ‘Ban the Scan’ at MSG - wired.com