Brightly Software on DanSec Daily

Cybersecurity Brief – 2026-08-15

Sat, 15 Aug 2026 00:00:00 +0000

Major Incidents or Breaches

RingCentral suffered a data breach impacting 1.6 million accounts, with personal information including names, addresses, email addresses, and phone numbers stolen by the ShinyHunters extortion group and subsequently published online ^[11]^[23].
Beacon CRM experienced a data breach affecting over 1,000 charities. The breach was traced to a compromised AWS access key exposed in publicly available JavaScript build artifacts ^[24].
ShipMonk, a logistics provider, was breached, resulting in the theft of shipping information for 14,000 Trezor customers. Exposed data includes names, addresses, email addresses, and phone numbers ^[25].
The Scottish Government reported a data breach at the prosecutor’s office, attributed to a third-party provider, with concerns that other agencies serviced by the same provider may also be affected ^[15].
Shell is investigating a potential security incident following claims by the Clop ransomware group that it stole 89GB of data from the company ^[10].
Four individuals were arrested in Brazil and three charged in Europe for conducting a €30 million bank fraud by exploiting a vulnerability at a service provider, which enabled unauthorised withdrawals from customer accounts ^[6].
A former data analyst at Brightly Software was sentenced to two years in prison for stealing company data and attempting to extort $2.5 million from the employer ^[12].

Newly Discovered Vulnerabilities

A new variant of the CoolClient backdoor, used by APT group HoneyMyte, was discovered with a kernel-mode Windows rootkit driver capable of hiding malicious processes, files, and network connections from security tools and analysts ^[1].
Hackers are actively exploiting a macOS authentication bypass vulnerability in Screen Sharing, with public exploit code available and attacks resulting in the deployment of Monero cryptocurrency miners ^[7].
A maximum-severity remote code execution vulnerability in SAP Commerce Cloud, patched three days ago, is already being targeted in active attacks ^[9].

Notable Threat Actor Activity

The Clop ransomware group has claimed responsibility for the alleged data theft from Shell, stating it exfiltrated 89GB of sensitive data ^[10].
The ShinyHunters extortion group was behind the RingCentral breach, stealing and publishing personal data of 1.6 million users ^[11]^[23].
APT group HoneyMyte has upgraded its CoolClient backdoor with a kernel-level rootkit, enhancing its ability to evade detection ^[1].

Trends, Tools, or Tactics of Interest

Attackers are compromising hotel Wi-Fi routers to redirect users to Microsoft 365 phishing sites, with incidents observed in multiple US cities ^[2].
Threat actors are increasingly abusing trusted business workflows to conduct scams, leveraging the inherent trust in established processes to facilitate attacks ^[3].
There is a surge in the volume of vulnerabilities discovered, attributed to AI-augmented research and automated scanning tools ^[14].
Public exploit code for a macOS Screen Sharing authentication bypass vulnerability is being used to deploy cryptominers, highlighting rapid weaponisation of new flaws ^[7].
Google Workspace attacks are evolving, with attackers using stolen OAuth tokens to access Gmail, Drive, and connected systems, bypassing traditional phishing entry points ^[8].
Over 2,500 organisations were compromised due to issues related to Trivy, not the previously suspected LiteLLM packages, clarifying the source of a widespread supply chain incident ^[21].
WhatsApp is testing an on-device AI feature that warns users about potential scam messages ^[27].
Apple now provides iPhone alerts to users targeted by mercenary spyware, describing how its Threat Notifications system works ^[26].
AI-generated content detection is advancing, with Anthropic planning to watermark text produced by its Claude AI model ^[5].

Regulatory or Policy Developments Affecting the Security Industry

Google Cloud has published its post-quantum cryptography roadmap, aiming for full readiness by 2029, with intermediate milestones in 2027 and 2028 ^[22].
New York City lawmakers are advocating for stricter regulations on the use of biometric surveillance in public venues, specifically targeting practices at Madison Square Garden ^[18].

Sources

RingCentral data breach exposed info of 1.6 million accounts - bleepingcomputer.com
1.6 Million Likely Impacted by RingCentral Data Breach - securityweek.com
Over 1,000 Charities Hit by Beacon CRM Data Breach - securityweek.com
14,000 Trezor Customers Impacted by Data Breach at ShipMonk - securityweek.com
Scottish Govt Suffers Potentially Widening Data Breach at Prosecutor's Office - darkreading.com
Shell investigates 'potential incident' after Clop data theft claims - bleepingcomputer.com
Hackers arrested over €30M bank fraud exploiting service provider flaw - bleepingcomputer.com
Data analyst sent to prison for stealing data, extorting employer - bleepingcomputer.com
APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit - securelist.com
Hackers exploit macOS Screen Sharing flaw to deploy Monero miner - bleepingcomputer.com
Max severity SAP Commerce Cloud flaw now targeted in attacks - bleepingcomputer.com
Warning: Compromised Hotel Routers Send Users to Phishing Sites - blog.knowbe4.com
Report: Scams Are Surging as Attackers Abuse Trusted Workflows - blog.knowbe4.com
Amid AI-Driven Bug-Hunt Tsunami, NIST Looks to … AI - darkreading.com
The Modern Attack Chain: Rethinking Google Workspace Security in the Age of AI - bleepingcomputer.com
Trivy, Not LiteLLM Behind the 2,500 Org Compromise - securityweek.com
WhatsApp is testing a new warning for scam messages - malwarebytes.com
Apple now uses iPhone alerts for targets of mercenary spyware - malwarebytes.com
How Anthropic plans to watermark Claude's AI-generated text - bleepingcomputer.com
Google Cloud Sets Out Post-Quantum Roadmap With 2029 Readiness Goal - securityweek.com
New York City Lawmakers Push to ‘Ban the Scan’ at MSG - wired.com

Cybersecurity Brief – 2026-08-14

Fri, 14 Aug 2026 00:00:00 +0000

Major Incidents or Breaches

Trezor disclosed a data breach affecting nearly 14,000 customers after its shipping and logistics provider, ShipMonk, was compromised. Exposed data includes names, addresses, email addresses, and phone numbers, increasing the risk of targeted phishing attacks against Trezor users ^[12]^[20].
A former data analyst contractor for Brightly Software was sentenced to two years in prison after stealing company data and attempting to extort $2.5 million from his employer ^[4].
Apple sent new “Threat Notification” alerts to users who were targeted by mercenary spyware attacks, indicating ongoing campaigns leveraging sophisticated surveillance tools against high-risk individuals ^[5].
The Jewelbug hacker group has been observed breaching government webmail accounts for espionage purposes while simultaneously conducting cryptocurrency fraud operations ^[8]^[17].
Ukrainian authorities shut down 94 fraudulent call centers involved in investment scams and bank account access fraud, seizing millions in cash ^[6].

Newly Discovered Vulnerabilities

A critical remote code execution vulnerability (CVE-2026-59310) in VMware vCenter Syslog Server is being actively exploited to deploy reverse SSH tools, providing attackers persistence and remote access. The vulnerability is the subject of a global threat campaign, and patching alone may not fully mitigate the threat ^[11]^[16]^[29].
An unpatched SQL injection vulnerability in GeoServer is being exploited in the wild, allowing attackers to achieve remote code execution ^[21].
WordPress 7.0.4 patched a remote code execution vulnerability that could be exploited by users with Author-level or higher permissions via malicious Postscript files ^[25].
Adobe Commerce released a patch for CVE-2026-71362, a vulnerability that saw exploitation attempts immediately after disclosure ^[24].
Fortinet released patches for authentication flaws in FortiWeb and FortiManager that could allow attackers to log in with arbitrary credentials or impersonate FortiGate appliances ^[27].
Microsoft patched the LegacyHive Windows zero-day vulnerability, which was disclosed after the July 2026 Patch Tuesday ^[9].

Notable Threat Actor Activity

The Iran-linked APT42 group is conducting AI-assisted spear phishing campaigns targeting US organizations, leveraging artificial intelligence to enhance the effectiveness of their attacks ^[3].
Akira ransomware affiliates have been observed disabling endpoint detection and response (EDR) by rebooting compromised systems into Safe Mode with Networking, enabling data theft even when encryption fails ^[7].
Initial access brokers are using vishing (voice phishing) attacks through Microsoft Teams to gain entry for ransomware gangs ^[2].
The Jewelbug group is simultaneously engaged in state espionage and financially motivated cybercrime, including cryptocurrency theft ^[8]^[17].

Trends, Tools, or Tactics of Interest

The rise of “Shadow AI” is being identified as a new dimension of Shadow IT, with employees using unapproved AI tools and services in the workplace, increasing organizational risk ^[1].
AI coding tools are introducing unvetted or hallucinated open source dependencies at a pace that exceeds current security review capabilities, raising supply chain risks ^[13].
Multiple “AI watermark remover” tools have appeared online following the introduction of watermarking in Anthropic’s Claude model, though most cannot reliably remove watermarks, highlighting rapid attempts to circumvent AI content authenticity measures ^[10].
AmnesiaStealer, a Rust-based macOS infostealer, is capable of harvesting passwords, keychain data, browser information, and cookies, expanding the threat landscape for macOS users ^[22].
New Android malware combines social engineering, a remote access trojan, and NFC relay capabilities to enable real-time fraudulent use of victims’ bank cards ^[31].
WhatsApp has rolled out a “Scam Alert” feature using a local machine learning model to flag potential scam messages for users ^[15].

Regulatory or Policy Developments Affecting the Security Industry

The White House issued a memo instructing the National Coordination Center to establish a program allowing private security companies to apply for approval to conduct offensive hack-back operations against foreign cybercrime gangs. Contracts may require a $1 million bond to ensure compliance with operational requirements ^[14]^[28].
Over 3,000 lawsuits have been filed by parents against Meta, TikTok, Google, and Snap, challenging the design of social media platforms and their impact on youth safety ^[32].

Sources

Trezor discloses data breach affecting nearly 14,000 customers - bleepingcomputer.com
14,000 Trezor Customers Impacted by Data Breach at ShipMonk - securityweek.com
Data analyst sent to prison for stealing data, extorting employer - bleepingcomputer.com
Apple sends new ‘Threat Notification’ alerts over mercenary spyware attacks - bleepingcomputer.com
Hackers breach govt webmail while running parallel crypto fraud - bleepingcomputer.com
'Jewelbug' APT Balances State Espionage & Cryptocurrency Theft - darkreading.com
Ukraine shuts down 94 fraudulent call centers, seize millions in cash - bleepingcomputer.com
Critical VMware vCenter RCE flaw exploited for reverse SSH access - bleepingcomputer.com
Global Threat Campaign Hits Critical VMware vCenter Flaw - darkreading.com
Critical VMware vCenter Vulnerability in Attackers’ Crosshairs - securityweek.com
Hackers Exploiting Unpatched GeoServer Zero-Day - securityweek.com
WordPress 7.0.4 Patches Remote Code Execution Vulnerability - securityweek.com
Adobe Commerce Bug Targeted Immediately After Disclosure - securityweek.com
Fortinet Patches Authentication Flaws in FortiWeb and FortiManager - securityweek.com
Microsoft patches LegacyHive Windows zero-day vulnerability - bleepingcomputer.com
Iranian APT Launches AI-Assisted Spear Phishing Attacks - blog.knowbe4.com
Akira hackers disable EDR with Safe Mode, steal data but fail to encrypt - bleepingcomputer.com
Warning: Vishing Attacks Open the Door to Ransomware Gangs - blog.knowbe4.com
Shadow AI: The New Frontier of Shadow IT - blog.knowbe4.com
Who Vets AI’s Code? The Scale Challenge Facing Open Source Ingestion - bleepingcomputer.com
AI 'watermark removers' flood the web. Almost none can prove they work. - bleepingcomputer.com
AmnesiaStealer macOS Malware Steals Data, Controls Browser Sessions - securityweek.com
New Android malware lets criminals use your bank card in real time - malwarebytes.com
WhatsApp rolls out new feature that flags potential scam messages - bleepingcomputer.com
White House taps security firms for offensive hack-back operations - bleepingcomputer.com
White House Mobilizes Security Firms for Operations Against Foreign Cybercrime Gangs - securityweek.com
Parents take on Meta, TikTok, Google, and Snap in 3,000 youth safety lawsuits - malwarebytes.com

Cybersecurity Brief – 2026-03-20

Fri, 20 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

Navia Benefit Solutions disclosed a data breach impacting approximately 2.7 million individuals, with sensitive information exposed to attackers.
Security firm Aura reported a breach affecting 900,000 records after an employee was targeted via phone phishing, leading to data theft from a marketing tool.
Marquis confirmed a data breach affecting 672,000 individuals, with previous estimates suggesting over 1.6 million may be impacted.
Medical technology company Stryker suffered a destructive cyberattack that wiped around 80,000 devices. The FBI subsequently seized Handala hacktivist group’s data leak sites used to publicise the breach.
Bitrefill, a crypto-powered gift card store, attributed a recent cyberattack to North Korean Lazarus (Bluenoroff) group activity.
Ex-data analyst convicted of stealing company data and attempting to extort $2.5 million from Brightly Software while still employed as a contractor.

Newly Discovered Vulnerabilities

A critical “PolyShell” vulnerability affects all Magento Open Source and Adobe Commerce stable version 2 installations, enabling unauthenticated remote code execution and account takeover.
Ubiquiti patched two vulnerabilities in the UniFi Network Application, including a maximum-severity flaw that could allow account takeover.
A critical Microsoft SharePoint vulnerability, patched in January, is now being actively exploited in the wild.
ScreenConnect issued an update to address a critical vulnerability exposing machine keys, now adding encrypted storage and management for enhanced protection.

Notable Threat Actor Activity

Russian APT28 (GRU-linked) is exploiting a Zimbra Collaboration Suite vulnerability in attacks targeting Ukrainian government entities, leveraging insufficient sanitization of CSS content in HTML emails.
Multiple threat actors have been using the DarkSword iOS exploit kit, which chains six vulnerabilities (including three zero-days), for full device takeover since at least November 2025. Apple has issued warnings to users of older, unpatched iPhones.
North Korean Lazarus (Bluenoroff) group is linked to the cyberattack on Bitrefill.
Iranian threat actors prepared cyberattack infrastructure over a six-month period, including the use of US-based shell companies, to increase their operational resilience ahead of recent kinetic events.

Trends, Tools, or Tactics of Interest

EDR killer malware continues to evolve, with 54 EDR killers leveraging the Bring Your Own Vulnerable Driver (BYOVD) technique to exploit 35 signed vulnerable drivers and disable endpoint security solutions.
New Android malware family “Perseus” is actively targeting devices for takeover and financial fraud, monitoring user notes apps to extract sensitive data such as passwords and recovery phrases.
Speagle malware is hijacking the legitimate Cobra DocGuard program to exfiltrate data via compromised servers.
Recent DDoS botnet takedowns (Aisuru, Kimwolf, JackSkid, Mossad) highlight the continued threat from large-scale IoT botnets, with over 3 million infected devices used in record-breaking 31.4 Tbps attacks.
MCP (Model Code Provider) security issues in LLM (Large Language Model) environments are considered architectural and not easily patchable, posing ongoing risks.
Attackers are increasingly targeting password reset workflows for privilege escalation; security guidance has been issued to harden these processes.
Criminals are actively trading stolen tax records on dark web forums during tax season, with tax forms selling for as little as $20.

Regulatory or Policy Developments

The US Department of Justice, in cooperation with Canadian and German authorities, dismantled the infrastructure behind several major IoT botnets, including Aisuru, Kimwolf, JackSkid, and Mossad.
CISA issued advisories urging organisations to secure Microsoft Intune endpoint management systems, following their exploitation in the Stryker cyberattack.
Major providers are piloting quantum-safe HTTPS, reducing certificate size and improving both latency and transparency.