Major Incidents or Breaches

  • Berlin’s city administration confirmed data theft following a Rhysida ransomware attack, with cybercriminals attempting extortion after listing the city on a data leak site [18].
  • Hackers stole personal and health information affecting 9.5 million individuals from Aesto Health’s AWS infrastructure [33].
  • McKesson, a healthcare company, acknowledged a data breach after ShinyHunters claimed to have stolen hundreds of millions of records [42].
  • Nutex Health notified the SEC of a ransomware attack that compromised patient, employee, provider, business, and financial data [31].
  • Anthropic users were impacted by infostealer attacks, with session cookies stolen to gain access to Claude AI accounts and consume usage [19][41].
  • METR, an AI evaluation non-profit, suffered the theft of an API key, leading to the consumption of approximately $600,000 in AI credits [4].
  • Five Venezuelan nationals pleaded guilty in the US to ATM jackpotting attacks that involved attempting to physically install malware on ATMs to dispense cash [10][30].
  • The Cronos blockchain network was restarted after a price-manipulation exploit on the Tectonic lending platform enabled the theft of $74 million [12].

Newly Discovered Vulnerabilities

  • Nearly 22,000 Microsoft Exchange servers remain unpatched and exposed to a high-severity authentication bypass vulnerability, allowing attackers to hijack user mailboxes [9].
  • Two critical vulnerabilities in PaperCut NG and MF print management software (CVE-2026-82078 and CVE-2026-81578) are being actively exploited in data theft attacks; CISA has added these to its Known Exploited Vulnerabilities (KEV) catalog [11][35].
  • A critical authentication bypass vulnerability in JFrog Artifactory (CVE-2026-82329) is being exploited in the wild just days after disclosure [32].
  • WatchGuard patched three critical vulnerabilities in its Fireware OS iked process that could allow unauthenticated remote code execution [34].
  • ServiceNow patched three critical code injection vulnerabilities that could allow attackers to execute arbitrary code and access or tamper with data [37].
  • A critical flaw in Langflow (CVE-2026-0768) is under active exploitation, allowing unauthenticated remote execution of arbitrary Python code [6][29].
  • Kaspersky patched a vulnerability in its Endpoint Security product exploited by the Nightmare Eclipse group using the ‘HardBreacher’ technique [36].
  • Critical vulnerabilities in Ruby on Rails are being exploited for credential-probing and command and control activity [6].
  • JSCeal, a stealer targeting cryptocurrency applications, is delivered as compiled V8 bytecode and executed by a bundled Node.js runtime [38].

Notable Threat Actor Activity

  • Mirage Kitten, an Iran-linked threat actor, is targeting aviation and FinTech sectors across the Middle East and Africa with new malware families NodeRabbit (Node.js) and PollCat (JavaScript) [1].
  • The Russia-aligned UAC-0099 group is using a new technique, GuardBreaker, to plant nuclear weapon prompts in malware aimed at disrupting AI analysis in Ukraine [5].
  • North Korean threat actors are expanding job fraud operations beyond IT into healthcare and sales, seeking illicit employment in new sectors [7].
  • The Chinese Fire Ant group is using Cisco routers as spying platforms by establishing unauthorized GRE tunnel interfaces [16].
  • Rhysida ransomware is actively extorting the city of Berlin following a successful attack [18].
  • The Nightmare Eclipse group is exploiting a Kaspersky Endpoint Security vulnerability with a tool called ‘HardBreacher’ [36].

Trends, Tools, or Tactics of Interest

  • Abuse of enterprise collaboration tools by threat actors has increased fourfold in the past year as attackers use these platforms to evade detection [2].
  • The TerminalFix campaign, a variant of ClickFix, uses fake Cloudflare CAPTCHA prompts to trick users into executing malicious PowerShell commands, establishing reverse tunnels for deeper network access [13][20][40].
  • Infostealers are being used to hijack AI service accounts such as Anthropic’s Claude by stealing session cookies, enabling unauthorized access and usage [19][41].
  • Attackers are exploiting critical vulnerabilities in Langflow and Rails for credential harvesting and establishing command and control channels [6][29].
  • A router backdoor was observed where devices shipped with remote access enabled, allowing attackers to collect traffic and credentials and then erase logs [8].
  • Researchers demonstrated that AI models, such as Claude, can be used to port PLC exploits between device models quickly, reducing the barrier for industrial exploit development [28].
  • Job fraud tactics by North Korean actors are diversifying to include healthcare and sales roles [7].
  • JSCeal stealer is delivered in compiled V8 bytecode format and executed by a bundled Node.js runtime, targeting cryptocurrency users [38].

Regulatory or Policy Developments Affecting the Security Industry

  • CISA added the actively exploited PaperCut vulnerabilities (CVE-2026-82078 and CVE-2026-81578) to its Known Exploited Vulnerabilities catalog, signaling increased urgency for patching [35].
  • Nutex Health disclosed its ransomware breach to the SEC, reflecting regulatory requirements for timely breach notification [31].

[1]: securelist.com
[2]: blog.knowbe4.com
[4]: thehackernews.com
[5]: thehackernews.com
[6]: thehackernews.com
[7]: thehackernews.com
[8]: thehackernews.com
[9]: bleepingcomputer.com
[10]: bleepingcomputer.com
[11]: bleepingcomputer.com
[12]: bleepingcomputer.com
[13]: bleepingcomputer.com
[16]: bleepingcomputer.com
[18]: bleepingcomputer.com
[19]: darkreading.com
[20]: darkreading.com
[29]: securityweek.com
[30]: securityweek.com
[31]: securityweek.com
[32]: securityweek.com
[33]: securityweek.com
[34]: securityweek.com
[35]: securityweek.com
[36]: securityweek.com
[37]: securityweek.com
[38]: research.checkpoint.com
[40]: malwarebytes.com
[41]: malwarebytes.com
[42]: malwarebytes.com

Sources#

  1. Berlin confirms data theft after Rhysida ransomware attack claims - bleepingcomputer.com
  2. 9.5 Million Impacted by Aesto Health Data Breach - securityweek.com
  3. McKesson confirms cyber incident after ShinyHunters claims patient-data theft - malwarebytes.com
  4. Ransomware Gang Claims Nutex Health Data Breach - securityweek.com
  5. Anthropic Users Hit by Infostealer Attacks, Session Thefts - darkreading.com
  6. Infostealers are hijacking Claude accounts at users’ expense - malwarebytes.com
  7. Attackers Steal METR API Key and Consume AI Credits Worth About $600,000 - thehackernews.com
  8. Five Venezuelans plead guilty to ATM jackpotting attacks in US - bleepingcomputer.com
  9. Five Venezuelans Plead Guilty in US Court to ATM Jackpotting - securityweek.com
  10. Cronos blockchain restarts after $74 million Tectonic exploit - bleepingcomputer.com
  11. Nearly 22,000 Microsoft Exchange servers vulnerable to hijack attacks - bleepingcomputer.com
  12. Recently patched PaperCut zero-days used in data theft attacks - bleepingcomputer.com
  13. PaperCut Exploitation Escalates to Active Intrusions - securityweek.com
  14. Critical JFrog Artifactory Vulnerability Reportedly Exploited in the Wild - securityweek.com
  15. WatchGuard Patches Critical Vulnerabilities - securityweek.com
  16. ServiceNow Patches 3 Critical Code Injection Vulnerabilities - securityweek.com
  17. Attackers Exploit Critical Langflow and Rails Flaws in Credential-Probing and C2 Activity - thehackernews.com
  18. Hackers Start Exploiting Critical Langflow Vulnerability - securityweek.com
  19. Nightmare Eclipse Drops ‘HardBreacher’ Kaspersky Product Exploit - securityweek.com
  20. Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode - research.checkpoint.com
  21. Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set - securelist.com
  22. Russia-Aligned UAC-0099 Plants Nuclear Weapon Prompt in Malware to Disrupt AI Analysis - thehackernews.com
  23. North Korean Job Fraud Expands Beyond IT Into Healthcare and Sales - thehackernews.com
  24. Chinese Fire Ant hackers turn Cisco routers into spying platforms - bleepingcomputer.com
  25. Attackers Abuse Enterprise Collaboration Tools to Avoid Detection - blog.knowbe4.com
  26. Microsoft warns of TerminalFix attacks deploying reverse tunnels - bleepingcomputer.com
  27. 'TerminalFix' Campaign Weaponizes PowerShell for Enterprise Attacks - darkreading.com
  28. TerminalFix looks like ClickFix, but delivers a very different payload - malwarebytes.com
  29. ⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off-Task, Router Backdoors and More - thehackernews.com
  30. Experiment: Porting a PLC Exploit With AI Takes Hours and Hundreds of Dollars - securityweek.com