Cellebrite on DanSec Daily

Cybersecurity Brief – 2026-06-27

Sat, 27 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Polymarket customers lost approximately $3 million after hackers injected a malicious script into the platform’s frontend via a third-party vendor compromise. Polymarket has stated it will fully reimburse affected customers ^[16]^[31].
The Klue-Salesforce breach has impacted roughly two dozen companies, with affected organizations notifying their customers of the incident ^[27].
Exposed records from the Dialog group included personal information of a senior White House intelligence official and an active-duty special operations officer, prompting a Pentagon review ^[25].

Newly Discovered Vulnerabilities

A high-severity vulnerability in Amazon Q Developer allowed malicious repositories to execute code and steal developers’ cloud credentials. AWS has patched the flaw and issued an advisory ^[7]^[26].
CVE-2026-46331, also known as “pedit COW,” is an out-of-bounds write flaw in the Linux kernel’s traffic-control subsystem that enables local privilege escalation to root ^[6].
DirtyClone is a newly disclosed Linux kernel privilege escalation vulnerability in the DirtyFrag family. Researchers have published a working exploit for the flaw ^[9].
The US Cybersecurity and Infrastructure Security Agency (CISA) has added a critical remote code execution vulnerability affecting PTC Windchill PDMlink and PTC FlexPLM to its Known Exploited Vulnerabilities (KEV) catalog, as web shell attacks exploiting this flaw continue ^[8].
CISA has set an urgent deadline for federal agencies to patch an actively exploited vulnerability in Cisco Unified Communications Manager Server ^[15].

Notable Threat Actor Activity

Russian intelligence-linked hackers have evolved their phishing campaign targeting Signal users. The latest tactics involve tricking victims into providing Signal Backup Recovery Keys, granting attackers access to message histories ^[3]^[14].
The Turla group, a Russian APT, has deployed the StockStay backdoor in espionage operations against Ukrainian government and military targets ^[32].
A Chinese-speaking APT has been linked to the deployment of a new custom backdoor, TinyRCT, in attacks against government entities and critical infrastructure in Southeast Asia ^[5].
A newly observed campaign is delivering SharkLoader malware, which acts as a loader for deploying Cobalt Strike Beacon on compromised systems ^[4].
Cybersecurity researchers have detected a supply chain attack involving the Miasma malware family, which targeted npm packages and GitHub Actions ^[11].
Microsoft reported a phishing campaign targeting hotels and hospitality organizations in Europe and Asia, using photo-themed ZIP files to deliver a Node.js implant ^[12].
Threat actors are impersonating legitimate companies by creating fraudulent OpenAI tenants and inviting cybersecurity firm employees, aiming to collect sensitive corporate information ^[17].
Malware campaigns are installing malicious Chrome extensions via phishing to steal Chrome session cookies and hijack user accounts on Windows devices ^[33].
Russian authorities used Cellebrite forensic tools to extract data from an opposition activist’s iPhone, despite Cellebrite’s earlier claims of halting sales to Russia ^[13]^[28].

Trends, Tools, or Tactics of Interest

There is a continued rise in supply chain attacks, as evidenced by recent incidents involving npm packages, GitHub Actions, and third-party vendor compromises ^[11]^[16]^[31].
Attackers are increasingly targeting backup and recovery mechanisms within secure messaging platforms, as seen in the Signal phishing campaigns ^[3]^[14].
The use of Cobalt Strike Beacon remains prevalent in new malware loader campaigns, such as those involving SharkLoader ^[4].
AI agents are being integrated into enterprise identity governance, inheriting permissions and traversing systems with minimal oversight ^[10].
Confidence in autonomous penetration testing tools powered by AI is declining, with organizations experimenting but relying less on these technologies ^[19].
The Open Source Sustainability Initiative has launched to help enterprises manage and secure aging open source projects and maintain regulatory compliance ^[21].
The Linux Foundation has announced Akrites, a new open source security project to support vulnerability reporting, patching, and disclosure in open source software ^[30].

Regulatory or Policy Developments Affecting the Security Industry

CISA continues to mandate urgent patching of actively exploited vulnerabilities in widely used enterprise products, including Cisco Unified Communications Manager Server and PTC Windchill ^[8]^[15].
The Open Source Sustainability Initiative aims to address regulatory compliance challenges related to end-of-life open source software ^[21].

Sources

Polymarket customers lose $3 million in supply-chain attack - bleepingcomputer.com
$3 Million Reportedly Stolen in Polymarket Hack - securityweek.com
More Klue Breach Victims Identified as Hackers Get Hacked - securityweek.com
The Pentagon Is Looking Into the Dialog Data Exposure for Unmasking National Security Officials - wired.com
Amazon Q Developer Flaw Could Let Malicious Repos Run Code via MCP Configs - thehackernews.com
Amazon Q Flaw Enabled Cloud Credential Theft via Malicious Repositories - securityweek.com
New Linux pedit COW Exploit Enables Root Access by Poisoning Cached Binaries - thehackernews.com
New DirtyClone Linux Kernel Flaw Lets Local Users Gain Root via Cloned Packets - thehackernews.com
CISA Adds Exploited PTC Windchill RCE Flaw to KEV as Web Shell Attacks Continue - thehackernews.com
CISA sets urgent deadline to fix Cisco flaw exploited in attacks - bleepingcomputer.com
FBI Warns Russian Intelligence Hackers Target Signal Backup Recovery Keys - thehackernews.com
FBI: Russian hackers now target Signal backup recovery keys - bleepingcomputer.com
Russian APT Deploys ‘StockStay’ Backdoor Against Ukrainian Targets - securityweek.com
Chinese-Speaking APT Deploys New TinyRCT Backdoor in Southeast Asia Campaign - thehackernews.com
New SharkLoader Malware Deploys Cobalt Strike in StrikeShark Cyberattacks - thehackernews.com
Miasma Malware Targets npm Packages and GitHub Actions in Supply Chain Attack - thehackernews.com
Microsoft Warns of Photo ZIP Phishing Campaign Targeting Hotels with Node.js Implant - thehackernews.com
Cybersecurity firms targeted by fraudulent OpenAI organization invites - bleepingcomputer.com
Malware steals Chrome session cookies to take over your accounts - malwarebytes.com
Russia Used Cellebrite on Jailed Activist's iPhone Months After Sales Cutoff - thehackernews.com
In Other News: Chinese Mythos-Like AI, Tata Electronics Breach, Snyk Layoffs - securityweek.com
Guardian Agents: The Next Layer of Identity Governance - thehackernews.com
AI Decline? Confidence in Autonomous Penetration Testing Falls - darkreading.com
New Initiative Tackles Security for End-of-Life Open Source Software - darkreading.com
Linux Foundation Unveils New Open Source Security Project Akrites - securityweek.com

Cybersecurity Brief – 2026-02-19

Thu, 19 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Figure Technology Solutions suffered a data breach impacting nearly one million accounts, exposing personal and contact information.
Betterment’s data breach is more severe than initially reported, with leaked data including sensitive personal and financial details.
A vast online database containing billions of records, including Social Security Numbers, was found exposed and accessible, posing significant identity theft risks.

Newly Discovered Vulnerabilities

Grandstream GXP1600 series VoIP phones are affected by a critical unauthenticated remote code execution vulnerability (CVE-2026-2329), allowing attackers root-level access and enabling call interception, toll fraud, and user impersonation.
Four widely used Microsoft Visual Studio Code extensions (collectively over 125 million installs) were found to contain multiple vulnerabilities, potentially enabling threat actors to compromise developer environments.
Multiple Honeywell CCTV products used in critical infrastructure are vulnerable to an authentication bypass flaw, allowing unauthorized access to video feeds and account hijacking.
Dell RecoverPoint for Virtual Machines is affected by a maximum severity zero-day vulnerability (CVE-2026-22769), exploited since mid-2024 by a China-linked threat group (UNC6201) for lateral movement, persistence, and malware deployment.
Foxit and Apryse PDF platforms contained 16 vulnerabilities that could be exploited for account takeover and data exfiltration via malicious documents or URLs.
CISA has added a vulnerability in TeamT5’s ThreatSonar Anti-Ransomware to its Known Exploited Vulnerabilities (KEV) catalog; the issue was patched in 2024 but is being actively exploited.

Notable Threat Actor Activity

The China-nexus threat actor UNC6201 has exploited Dell RecoverPoint for VMs zero-day since mid-2024.
Kenyan authorities reportedly used Cellebrite’s forensic extraction tool against a dissident’s mobile device while in custody.
Telegram underground channels rapidly weaponized SmarterMail vulnerabilities (e.g., CVE-2024-XXXX), sharing PoCs and stolen credentials shortly after public disclosure.
New Keenadu Android malware has been found preinstalled on thousands of devices and distributed via Google Play and other app stores.
Hackers are actively exploiting a vulnerability in TeamT5’s ThreatSonar Anti-Ransomware product.
AI platforms such as Grok and Microsoft Copilot are being abused as covert communication channels for malware command-and-control (C2) activity.

Trends, Tools, or Tactics of Interest

AI and quantum advancements are driving recommendations for substantially longer passwords (25+ characters) to withstand brute-force and future cryptanalytic attacks.
AI-powered chatbots are being weaponized for scams, including a fake “Gemini” chatbot used to pitch fraudulent “Google Coin” schemes.
Phishing campaigns are leveraging fake Google Forms sites to harvest Google login credentials from job seekers.
Anti-phishing heuristic rules in Microsoft Exchange Online mistakenly blocked legitimate emails and Teams messages, disrupting business communications.
Microsoft 365 Copilot bug has caused confidential emails to be summarized by the AI assistant, bypassing organizations’ data loss prevention policies.
A significant percentage (over 40%) of South Africans reported being scammed in 2025, highlighting the prevalence of scalable, low-friction scams.
Underground threat communities are accelerating the weaponization of disclosed vulnerabilities, as evidenced by rapid exploitation of SmarterMail flaws.
Malware campaigns are increasingly using steganography, such as embedding payloads in image files.

Regulatory or Policy Developments Affecting the Security Industry

CISA has issued warnings regarding active exploitation of vulnerabilities in Honeywell CCTV products and TeamT5 ThreatSonar Anti-Ransomware, urging immediate patching and mitigation.
CISA’s KEV catalog continues to expand with newly exploited vulnerabilities, reinforcing mandatory remediation timelines for federal and critical infrastructure entities.

Cybersecurity Brief – 2025-06-06

Fri, 06 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

The Interlock ransomware group claimed responsibility for a cyberattack on Kettering Health, leaking data allegedly stolen from the healthcare network’s systems.
A threat actor has re-released data from the 2021 AT&T breach, this time combining files to directly link Social Security numbers and birth dates to 49 million phone numbers.
Two members of the ViLE gang were sentenced for breaching a US federal law enforcement web portal and conducting an extortion scheme.
The U.S. Department of Justice seized cryptocurrency funds and 145 clearnet and dark web domains associated with the BidenCash carding marketplace.
Cisco Talos researchers reported a destructive ‘PathWiper’ attack using new wiper malware against an unnamed critical infrastructure organization in Ukraine.
Thousands of Asus routers have been compromised and incorporated into botnets.
Cybercriminals are exploiting a simple technique to steal Salesforce business data for extortion purposes.
The FBI issued an alert that the BADBOX 2.0 Android malware campaign has infected over 1 million consumer IoT devices, converting them into residential proxies for malicious use.

Newly Discovered Vulnerabilities

Hackers are actively exploiting CVE-2025-49113, a critical vulnerability in the Roundcube open-source webmail application, enabling remote code execution. Technical details have been disclosed and exploits are for sale.
Cisco warned of a static credential vulnerability (CVSS 9.9) in Identity Services Engine (ISE) cloud deployments on AWS, Azure, and Oracle Cloud, resulting in shared credentials across instances running the same software release and cloud platform.
ConnectWise issued a patch for an unspecified vulnerability affecting ScreenConnect customers, though details about the flaw and timeline of exploitation remain unclear.
Several popular Google Chrome extensions were found to transmit data over HTTP and hard-code sensitive credentials, leaking API keys and user data.

Notable Threat Actor Activity

The Silent Ransom Group (SRG) is targeting law firms with IT-themed social engineering attacks and callback phishing emails, according to an FBI alert.
BladedFeline, an Iran-aligned APT group with likely ties to OilRig/APT34, has been conducting cyberespionage campaigns targeting Kurdish and Iraqi government officials. ESET research indicates the group has maintained long-term access to targeted networks for up to eight years, deploying Whisper and Spearal malware.
The Bitter APT group, assessed as state-backed and aligned with Indian government interests, is expanding its geographic scope and evolving its tactics for intelligence gathering.
A phishing campaign using copyright infringement lures is targeting European countries, as reported by Cybereason.
Sophos researchers identified a campaign distributing backdoored malware targeting novice cybercriminals via GitHub repositories, with links to other campaigns dating back to August 2022.

Trends, Tools, or Tactics of Interest

Q1 2025 threat statistics show a significant increase in attacks on both non-mobile (Windows, macOS, IoT) and mobile platforms, including ransomware, miners, adware, and unwanted apps.
AI is increasingly being embedded into threat detection and response tools, but hallucinations and inaccurate guidance remain a risk for security operations teams.
Proxy services are capitalizing on Ukraine’s loss of IP address space, with significant portions of the country’s internet resources now under Russian control or sold to brokers.
Cybercriminals are leveraging compromised consumer IoT devices as residential proxies for malicious activity, as highlighted by the BADBOX 2.0 campaign.
The DShield honeypot network is introducing changes to allow greater customization and data analysis.
There is a trend of cybercriminals leveraging simple but effective social engineering and phishing techniques to steal sensitive business data, as seen in Salesforce data theft and callback phishing attacks.

Regulatory or Policy Developments Affecting the Security Industry

Germany’s data protection authority (BfDI) fined Vodafone GmbH €45 million ($51.4 million) for privacy and security violations.
Cellebrite, a digital forensics firm, is set to acquire virtualization vendor Corellium for $170 million, which may have implications for mobile device forensics and privacy.
The US continues to debate the appropriate regulatory approach to AI, with commentary emphasizing the need to balance innovation and security without waiting for political consensus.