Cybersecurity Brief – 2026-04-28

Tue, 28 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

Checkmarx has confirmed that data from its GitHub repositories was leaked on the dark web following a supply chain attack on March 23. The TeamPCP supply chain campaign has been linked to this and other concurrent compromises, including Bitwarden CLI and xinference PyPI.
Home security provider ADT suffered a breach affecting 5.5 million individuals, with the ShinyHunters extortion group claiming responsibility for stealing personal information.
Medtronic, a major medical device manufacturer, confirmed a breach after hackers claimed to have accessed up to 9 million records. The ShinyHunters group is also linked to this incident.
Itron, an energy and water management firm, reported unauthorized access to its systems detected on April 13.
Vercel disclosed a security incident, as noted in Checkpoint’s latest threat intelligence bulletin.
The elementary-data package on PyPI (with 1.1 million monthly downloads) was compromised to distribute information-stealing malware targeting developer data and cryptocurrency wallets.

Newly Discovered Vulnerabilities

Microsoft patched a privilege escalation flaw in Entra ID’s AI agent administrative role, which could enable service principal takeover.
Microsoft confirmed active exploitation of Windows Shell vulnerability CVE-2026-32202, which has been patched.
An unpatched Windows ‘PhantomRPC’ flaw was disclosed, with five exploit paths allowing privilege escalation via RPC architectural weaknesses.
An incomplete Windows patch left systems vulnerable to zero-click attacks, previously exploited by Russia-linked APT28 against Ukraine and EU targets.
A 15-year-old OpenSSH flaw was disclosed, allowing full root shell access due to certificate principal parsing issues.
A race condition vulnerability in Linux PackageKit, dubbed ‘Pack2TheRoot’, enables unprivileged users to escalate privileges during package installation.
Firefox vulnerability CVE-2026-6770, now patched in Firefox 150 and Tor 15.0.10, allowed fingerprinting of Tor users.

Notable Threat Actor Activity

PhantomCore, a pro-Ukrainian hacktivist group, has been actively targeting Russian TrueConf video conferencing servers since September 2025.
UNC6692, a newly identified threat actor, is conducting campaigns using Microsoft Teams, AWS S3 buckets, and custom “Snow” malware variants (Snowbelt, Snowglaze, Snowbasin). Their tactics include social engineering, email bombing, and cloud resource abuse.
ShinyHunters has claimed responsibility for the recent breaches of ADT and Medtronic, threatening to leak stolen data.
Silk Typhoon: A Chinese national alleged to be part of this group was extradited to the US for cyberespionage activities targeting US interests.

Trends, Tools, or Tactics of Interest

Researchers discovered 73 malicious Visual Studio Code extensions on the Open VSX repository delivering GlassWorm v2 malware, with the campaign leveraging “sleeper” extensions that activate malicious payloads post-update.
Malicious prompt injection attacks against AI systems are increasing, though most remain low in sophistication according to Google.
Deepfake voice attacks are becoming more prevalent, with reports showing that as little as three seconds of audio can enable successful cloning for fraud schemes.
The “fast16” malware framework, dating back 20 years and predating Stuxnet, has been uncovered and is believed to have been used in early cyber sabotage operations.
The Robinhood account creation process was exploited to send phishing messages via legitimate notification emails.
Supply chain attacks remain a key threat, with concurrent compromises (Checkmarx, Bitwarden CLI, xinference PyPI, npm worm “CanisterSprawl”) reported as part of ongoing campaigns.
Americans lost over $2.1 billion to social media scams in 2025, according to the FTC.
Canadian authorities arrested three individuals in Toronto for operating an “SMS blaster” device to send mass phishing texts.

Regulatory or Policy Developments

The US government has launched a sweeping crackdown on Southeast Asian cyberscam operations and imposed sanctions on a Cambodian senator for involvement.

Cybersecurity Brief – 2026-04-25

Sat, 25 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

ADT, a major home security provider, confirmed a data breach after the ShinyHunters extortion group threatened to leak stolen data unless a ransom was paid.
Medical data of 500,000 UK Biobank volunteers was listed for sale on Alibaba, despite existing access controls.
NASA disclosed that employees were targeted and duped in a spear-phishing campaign orchestrated by a Chinese national posing as a U.S. researcher, with the intent to compromise U.S. defense software.
A U.S. federal civilian agency’s Cisco Firepower device was compromised with the Firestarter backdoor, which remains persistent even after applying security patches.
Bitwarden’s NPM package was compromised in a supply chain attack attributed to TeamPCP, involving the Shai-Hulud worm.
Over 10,000 Zimbra Collaboration Suite servers remain vulnerable to active exploitation of a cross-site scripting (XSS) flaw.
26 malicious apps impersonating popular cryptocurrency wallets were discovered on the Apple App Store, targeting users’ recovery phrases and private keys.

Newly Discovered Vulnerabilities

PhantomRPC: A newly discovered privilege escalation technique in Windows RPC allows attackers to create fake RPC servers to escalate privileges.
Pack2TheRoot: A vulnerability in the Linux PackageKit daemon allows local users to install or remove system packages and gain root access.
Four new exploited vulnerabilities affecting SimpleHelp, Samsung MagicINFO 9 Server, and D-Link DIR-823X routers were added to CISA’s Known Exploited Vulnerabilities (KEV) catalog.
CrowdStrike patched a critical LogScale vulnerability, and Tenable fixed a high-severity flaw in Nessus.

Notable Threat Actor Activity

The ShinyHunters extortion group is behind the ADT breach and subsequent ransom threat.
The BlackFile extortion group has been linked to a surge of data theft and vishing attacks targeting retail and hospitality sectors since February 2026.
Tropic Trooper is targeting Chinese-speaking individuals using a trojanized SumatraPDF reader to deploy the AdaptixC2 post-exploitation agent via GitHub.
North Korea’s Lazarus Group continues to target macOS users through the ClickFix tool for initial access and data theft.
TeamPCP is linked to the Bitwarden NPM package supply chain attack.
A Chinese threat actor conducted a spear-phishing campaign targeting NASA employees and U.S. defense software.

Trends, Tools, or Tactics of Interest

AI-powered phishing attacks have significantly increased in the past six months, evolving from broad campaigns to highly personalized, 1-to-1 attacks.
Attackers are leveraging supply chain vulnerabilities, as evidenced by the Bitwarden NPM compromise.
The Firestarter malware demonstrates advanced persistence capabilities, surviving firmware updates and security patches on Cisco ASA and Firepower devices.
There is a rise in malicious crypto wallet apps on legitimate platforms, with 26 such apps found on the Apple App Store.
The use of trojanized legitimate software (e.g., SumatraPDF) and abuse of GitHub for payload delivery is being seen in targeted attacks.
Shadow IT, SaaS, and shadow AI/agents continue to present significant organizational risks.

Regulatory or Policy Developments

Article 9 of the EU’s Digital Operational Resilience Act (DORA) establishes authentication and access control as legal obligations for financial entities.
CISA set a May 2026 deadline for U.S. federal agencies to remediate newly listed exploited vulnerabilities in its KEV catalog.
Microsoft will roll out Entra passkey support for phishing-resistant passwordless authentication to Windows devices, starting late April.
Microsoft now allows IT administrators to uninstall Copilot from enterprise devices via a new policy setting.
The Trump administration announced intentions to crack down on Chinese companies exploiting U.S.-developed AI models.
A new U.S. bill is under consideration to address concerns about warrantless surveillance powers under a key federal spy program.

ADT on DanSec Daily

Cybersecurity Brief – 2026-04-28

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments

Cybersecurity Brief – 2026-04-25

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments