Major Incidents or Breaches

  • Shell is investigating a potential security incident following claims by the Clop ransomware group that it stole 89GB of data from the company [11].
  • The ShinyHunters extortion group breached RingCentral, exposing personal information of 1.6 million accounts, including names, addresses, email addresses, and phone numbers [12][23].
  • A data breach at Beacon CRM impacted over 1,000 charities, reportedly due to a compromised AWS access key found in public JavaScript build artifacts [24].
  • The Scottish Government’s prosecutor’s office suffered a data breach linked to a third-party service provider, with the potential to affect additional agencies [15].
  • Four individuals were arrested in Brazil and three charged in Europe for exploiting a service provider vulnerability, enabling €30 million in fraudulent bank withdrawals [7].

Newly Discovered Vulnerabilities

  • A maximum-severity remote code execution vulnerability in SAP Commerce Cloud, patched three days ago, is now being actively targeted in attacks [10].
  • Hackers are exploiting an authentication bypass flaw in macOS Screen Sharing to deploy Monero cryptocurrency miners, following the release of public exploit code [8].
  • Researchers identified a new variant of the CoolClient backdoor used by APT group HoneyMyte, now featuring a kernel-mode Windows rootkit that hides processes, files, and network connections [1].

Notable Threat Actor Activity

  • Attackers have compromised hotel Wi-Fi routers in multiple US cities, redirecting users to Microsoft 365 phishing sites [2].
  • The Evooo1Bot Linux botnet, based on Mirai, is targeting internet-facing gateway devices to turn them into SOCKS5 traffic relay nodes [5].
  • Threat actors are increasingly abusing trusted workflows to conduct scams, as highlighted in a new report [3].
  • The Clop ransomware gang claimed responsibility for the alleged Shell data theft [11].
  • The ShinyHunters group was identified as responsible for the RingCentral breach [12][23].

Trends, Tools, or Tactics of Interest

  • Google Workspace attacks are increasingly leveraging stolen OAuth tokens to access Gmail, Drive, and connected systems, bypassing traditional phishing vectors [9].
  • The National Institute of Standards and Technology is exploring the use of AI to manage the rising volume of vulnerabilities discovered through AI-augmented research and scanning [14].
  • Anthropic is developing watermarking methods to identify AI-generated text from its Claude model [6].
  • WhatsApp is testing an on-device AI feature that warns users about potential scam messages [26].
  • Apple has detailed its use of iPhone alerts for users targeted by mercenary spyware, via Threat Notifications [25].
  • Cyera’s acquisition of Oasis Security aims to integrate data security and identity management for AI agents, focusing on context-driven privileged access [17].
  • Over 95 percent of organisations affected in a recent compromise were exposed before malicious LiteLLM packages were published, with Trivy identified as the root cause [21].

Regulatory or Policy Developments Affecting the Security Industry

  • Google Cloud announced a roadmap to achieve post-quantum cryptography readiness by 2029, with interim milestones in 2027 and 2028 [22].
  • New York City lawmakers are proposing restrictions on the deployment of biometric surveillance technologies at public venues such as Madison Square Garden [18].

[1]: https://securelist.com/honeymyte-coolclient-driver-rootkit/121028/ [2]: https://blog.knowbe4.com/warning-compromised-hotel-routers-send-users-to-phishing-sites [3]: https://blog.knowbe4.com/attackers-abuse-trusted-workflows [5]: https://www.bleepingcomputer.com/news/security/new-evooo1bot-linux-botnet-turns-routers-into-traffic-relay-nodes/ [6]: https://www.bleepingcomputer.com/news/artificial-intelligence/how-anthropic-plans-to-watermark-claudes-ai-generated-text/ [7]: https://www.bleepingcomputer.com/news/security/hackers-arrested-over-30m-bank-fraud-exploiting-service-provider-flaw/ [8]: https://www.bleepingcomputer.com/news/security/hackers-exploit-macos-screen-sharing-flaw-to-deploy-monero-miner/ [9]: https://www.bleepingcomputer.com/news/security/the-modern-attack-chain-rethinking-google-workspace-security-in-the-age-of-ai/ [10]: https://www.bleepingcomputer.com/news/security/max-severity-sap-commerce-cloud-flaw-now-targeted-in-attacks/ [11]: https://www.bleepingcomputer.com/news/security/shell-investigates-potential-incident-after-clop-data-theft-claims/ [12]: https://www.bleepingcomputer.com/news/security/ringcentral-data-breach-exposed-info-of-16-million-accounts/ [14]: https://www.darkreading.com/vulnerabilities-threats/ai-driven-bug-tsunami-nist-looks-to-ai [15]: https://www.darkreading.com/cyberattacks-data-breaches/scottish-govt-data-breach-prosecutors-office [17]: https://www.darkreading.com/identity-access-management-security/cyera-oasis-security-acquisition-ai-agent-control [18]: https://www.wired.com/story/new-york-city-lawmakers-push-to-ban-the-scan-at-msg/ [21]: https://www.securityweek.com/trivy-not-litellm-behind-the-2500-org-compromise/ [22]: https://www.securityweek.com/google-cloud-sets-out-post-quantum-roadmap-with-2029-readiness-goal/ [23]: https://www.securityweek.com/1-6-million-likely-impacted-by-ringcentral-data-breach/ [24]: https://www.securityweek.com/over-1000-charities-hit-by-beacon-crm-data-breach/ [25]: https://www.malwarebytes.com/blog/news/2026/08/apple-now-uses-iphone-alerts-for-targets-of-mercenary-spyware [26]: https://www.malwarebytes.com/blog/news/2026/08/whatsapp-is-testing-a-new-warning-for-scam-messages

Sources#

  1. Shell investigates 'potential incident' after Clop data theft claims - bleepingcomputer.com
  2. RingCentral data breach exposed info of 1.6 million accounts - bleepingcomputer.com
  3. 1.6 Million Likely Impacted by RingCentral Data Breach - securityweek.com
  4. Over 1,000 Charities Hit by Beacon CRM Data Breach - securityweek.com
  5. Scottish Govt Suffers Potentially Widening Data Breach at Prosecutor's Office - darkreading.com
  6. Hackers arrested over €30M bank fraud exploiting service provider flaw - bleepingcomputer.com
  7. Max severity SAP Commerce Cloud flaw now targeted in attacks - bleepingcomputer.com
  8. Hackers exploit macOS Screen Sharing flaw to deploy Monero miner - bleepingcomputer.com
  9. APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit - securelist.com
  10. Warning: Compromised Hotel Routers Send Users to Phishing Sites - blog.knowbe4.com
  11. New Evooo1Bot Linux botnet turns routers into traffic relay nodes - bleepingcomputer.com
  12. Report: Scams Are Surging as Attackers Abuse Trusted Workflows - blog.knowbe4.com
  13. The Modern Attack Chain: Rethinking Google Workspace Security in the Age of AI - bleepingcomputer.com
  14. Amid AI-Driven Bug-Hunt Tsunami, NIST Looks to … AI - darkreading.com
  15. How Anthropic plans to watermark Claude's AI-generated text - bleepingcomputer.com
  16. WhatsApp is testing a new warning for scam messages - malwarebytes.com
  17. Apple now uses iPhone alerts for targets of mercenary spyware - malwarebytes.com
  18. Cyera's Oasis Security Buy Is All About AI Agent Control - darkreading.com
  19. Trivy, Not LiteLLM Behind the 2,500 Org Compromise - securityweek.com
  20. Google Cloud Sets Out Post-Quantum Roadmap With 2029 Readiness Goal - securityweek.com
  21. New York City Lawmakers Push to ‘Ban the Scan’ at MSG - wired.com