Conduent on DanSec Daily

Cybersecurity Brief – 2026-02-27

Fri, 27 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

ManoMano, a major European DIY retail chain, has suffered a data breach impacting 38 million customers. The breach was caused by the compromise of a third-party service provider.
French football club Olympique de Marseille confirmed an attempted cyberattack following a data leak, with a threat actor claiming responsibility for breaching the club’s systems.
Conduent, a US-based business process services company, has revised the impact of its third-party breach to 25 million affected Americans.
A new malicious NuGet package, “StripeApi,” was discovered impersonating a legitimate Stripe library to steal API tokens, targeting the financial sector.
Google API keys previously considered harmless can now be abused to access private Gemini AI data if exposed in client-side code.
Anthropic patched vulnerabilities in its Claude AI code interpreter that could have allowed silent compromise of developer devices through malicious configuration files.

Newly Discovered Vulnerabilities

Trend Micro patched two critical remote code execution vulnerabilities in Apex One endpoint security products for Windows, and addressed a total of eight critical and high-severity issues across Windows and macOS versions.
A critical vulnerability in Juniper Networks’ PTX Series routers running Junos OS Evolved allows unauthenticated remote code execution with root privileges, enabling full router takeover.
Cisco disclosed and patched a maximum-severity zero-day vulnerability (CVE-2026-20127) in its SD-WAN software, which had been exploited for three years by a sophisticated threat actor, allowing authentication bypass and administrative access.
Zyxel patched a critical remote code execution vulnerability in the UPnP function affecting multiple device models.
Four vulnerabilities were disclosed in Gardyn smart garden products, allowing remote hacking; CISA has issued an advisory on these flaws.

Notable Threat Actor Activity

Google’s Threat Intelligence Group reported that nation-state actors are using Gemini and other AI tools to enhance phishing, malware development, and social engineering campaigns.
A previously undocumented threat cluster, UAT-10027, has been targeting US education and healthcare sectors since December 2025, deploying the Dohdoor backdoor.
The Aeternum C2 botnet loader was revealed to use encrypted command storage on the Polygon blockchain, making its command-and-control infrastructure highly resistant to takedown.
Microsoft observed a coordinated campaign targeting developers via malicious Next.js repositories purporting to be legitimate, delivering in-memory malware and establishing persistence.
Fake Zoom and Google Meet scams are distributing the legitimate Teramind monitoring tool as malware by exploiting trusted branding.
CISA released an updated analysis of the RESURGE malware, highlighting continued stealthy and active operations.
The US Treasury sanctioned Russian exploit broker Operation Zero, which acquired eight zero-day exploits from a US defense contractor.

Trends, Tools, or Tactics of Interest

Ransomware payment rates have dropped to a record low of 28% despite an increase in the number of attacks, indicating a shift in victim response and negotiation strategies.
Threat actors are increasingly leveraging AI-based tools, such as Gemini and Claude, to automate and refine attack techniques.
Blockchain technology is being adopted for resilient command-and-control infrastructure, as demonstrated by the Aeternum C2 botnet.
There is a rise in attacks targeting developers, including via malicious open-source packages and fake technical assessment repositories.
Open source project IronCurtain has been released, aiming to constrain and secure AI assistant agents to prevent unintended actions.

Regulatory or Policy Developments Affecting the Security Industry

Apple iPhone and iPad devices have been cleared for handling classified information by NATO, having been added to the NATO Information Assurance Product Catalogue (NIAPC).
The US government has imposed sanctions on Russian exploit broker Operation Zero for trafficking zero-day exploits.
A lawsuit (Marquis v. SonicWall) is raising questions about liability in third-party breaches, with a FinTech company holding a firewall provider responsible for breach damages.
New York Attorney General filed a lawsuit against Valve Corporation, alleging illegal gambling promotion through game loot boxes targeting minors.
Industry experts are recommending immediate preparation for post-quantum cryptography (PQC) to counter future risks of encrypted data theft and decryption.

Cybersecurity Brief – 2026-02-12

Thu, 12 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

The Conduent data breach has impacted at least 25 million individuals, including nearly 17,000 Volvo Group employees whose data was exposed.
The AgreeTo Outlook add-in was hijacked and used as a phishing kit, resulting in the theft of over 4,000 Microsoft account credentials.
A surge in LummaStealer infections has been reported, linked to campaigns using the CastleLoader malware and the ClickFix social engineering technique.

Newly Discovered Vulnerabilities

Apple released updates for all platforms (iOS, iPadOS, macOS, tvOS, watchOS, visionOS), addressing 71 vulnerabilities, including a zero-day exploited in sophisticated attacks against targeted individuals.
Microsoft issued security updates for 59 vulnerabilities, including six zero-days that are actively exploited. Notable fixes include a remote code execution flaw in Windows 11 Notepad and vulnerabilities affecting Windows Secure Boot and other core components.
Intel and AMD collectively addressed over 80 vulnerabilities across their chipsets in recent advisories.
Ivanti patched vulnerabilities in Endpoint Manager, including a high-severity authentication bypass that could be exploited remotely without authentication.

Notable Threat Actor Activity

APT36 and SideCopy have launched campaigns targeting Indian defense and government-aligned organizations, deploying cross-platform remote access trojans (RATs) affecting both Windows and Linux environments.
North Korea’s UNC1069 is increasingly targeting Web3 and cryptocurrency firms, employing large language models (LLMs), deepfakes, legitimate platforms, and ClickFix techniques.
The SSHStalker botnet is leveraging IRC-based command-and-control channels and legacy Linux kernel exploits to control compromised systems.
The Crazy ransomware gang is abusing legitimate employee monitoring tools and the SimpleHelp remote support tool to maintain persistence, evade detection, and facilitate ransomware deployment in corporate environments.

Trends, Tools, or Tactics of Interest

Campaigns involving RenEngine and HijackLoader have distributed LummaStealer via complex infection chains since March 2025.
There is increased abuse of AI models, with Google reporting that attackers are using Gemini AI for all stages of cyberattacks. Model extraction and distillation attacks are being observed using legitimate API access.
Spam and phishing trends for 2025 include increased use of scam QR codes, ClickFix attacks, and lures involving ChatGPT subscriptions.
Intentionally vulnerable training applications (e.g., OWASP Juice Shop, DVWA, Hackazon, bWAPP) are being targeted in cloud environments, exposing organizations to crypto-mining attacks.
The first known malicious Microsoft Outlook add-in supply chain attack has been observed in the wild.
WSL (Windows Subsystem for Linux) continues to be exploited within the malware ecosystem to facilitate cross-platform attacks.
Arrests have been made in the Netherlands related to the sale of JokerOTP, a phishing automation tool capable of intercepting multi-factor authentication (MFA) one-time passcodes.

Regulatory or Policy Developments Affecting the Security Industry

Nevada has introduced a new statewide data classification policy, categorizing data as “public,” “sensitive,” “confidential,” or “restricted,” following a recent cyberattack.
Microsoft announced plans to refresh Windows Secure Boot certificates in June 2026, replacing certificates that have been in use for over 15 years.

Cybersecurity Brief – 2026-02-11

Wed, 11 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Warlock (Storm-2603) ransomware gang breached SmarterTools by exploiting an unpatched SmarterMail server on 29 January 2026.
Volvo Group North America reported a customer data exposure due to a breach at Conduent, an IT services provider.
Dutch Data Protection Authority and the Council for the Judiciary in the Netherlands confirmed cyberattacks exploiting Ivanti zero-day vulnerabilities, leading to exposure of employee contact data.

Newly Discovered Vulnerabilities

Microsoft’s February 2026 Patch Tuesday addressed 58–60 vulnerabilities, including six zero-days (three actively exploited security feature bypass flaws) and three publicly disclosed vulnerabilities. Updates apply to Windows, Microsoft Edge, and other Microsoft products.
Fortinet released patches for a critical SQL injection vulnerability in FortiClientEMS (CVE identifier not specified) that allows unauthenticated remote code execution.
Adobe fixed 44 vulnerabilities in its Creative Cloud applications, several of which are critical and could allow arbitrary code execution.
SAP patched 26 new and one updated vulnerability in CRM, S/4HANA, and NetWeaver products, including critical issues.
Siemens, Schneider, Aveva, and Phoenix Contact issued patches for vulnerabilities in their industrial control systems as part of ICS Patch Tuesday.
Microsoft began rolling out new Secure Boot certificates in Windows updates to replace expiring 2011 certificates, ahead of their June 2026 expiration.

Notable Threat Actor Activity

North Korea-linked UNC1069 targeted cryptocurrency organizations using AI-generated lures and new malware for Windows and macOS, including the ClickFix technique and tailored AI-generated video content.
DPRK (North Korean) IT operatives are impersonating professionals on LinkedIn, applying for remote jobs using hijacked LinkedIn accounts to infiltrate organizations.
Transparent Tribe (APT36), a Pakistan-linked group, is conducting a three-pronged cyber espionage campaign against Indian defense and government sectors, deploying GETA, ARES, and Desk RAT malware.
A newly documented Linux botnet, SSHStalker, is leveraging IRC for command-and-control communications.
A malicious 7-Zip website is distributing a trojanized installer that converts infected devices into residential proxy nodes.

Trends, Tools, or Tactics of Interest

Reynolds ransomware incorporates a bring-your-own-vulnerable-driver (BYOVD) technique to disable EDR (Endpoint Detection and Response) security tools during attacks.
Ransomware actors are shifting from simple encryption to maintaining persistent, “resident” access within victim environments.
ZeroDayRAT, a commercial spyware kit marketed on Telegram, enables full compromise of Android and iOS devices, granting access to SIM, location data, SMS, and facilitating MFA bypass and account takeover.
Surge in AI-enabled social engineering: AI-generated romance scams and “pig butchering” investment frauds are increasingly difficult to detect, as highlighted by recent law enforcement action against a $73M scheme.
Phishing attacks are increasingly leveraging trusted platforms, with LinkedIn direct messages being used to target executives.
Tax-related phishing and scams are prevalent during the tax season, with attackers impersonating IRS communications.
Operational Technology (OT) attacks are employing “living-off-the-plant” techniques, using native tools and protocols to evade detection.
Cloud incident response is being streamlined through automation and AI-driven tools, such as Tines, to reduce mean time to resolution (MTTR).

Regulatory or Policy Developments Affecting the Security Industry

The European Commission unconditionally approved Google’s $32B acquisition of Wiz, a major cloud security provider.
Discord will restrict user profiles to teen-appropriate mode by default unless age is verified, to enhance child safety on the platform.
Microsoft announced plans to introduce mobile-style app permission prompts in Windows 11, requiring explicit user consent before apps can access sensitive resources such as files, cameras, and microphones.

Cybersecurity Brief – 2025-10-31

Fri, 31 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

Ribbon Communications, a major telecom services provider with clients including the US government and global telecom firms, disclosed a breach of its IT network by nation-state actors, with access dating back to December 2023.
Conduent, a business process outsourcing (BPO) giant, confirmed a 2024 data breach impacting over 10.5 million individuals. Stolen data includes names, addresses, dates of birth, Social Security numbers, and health and insurance information. A ransomware gang has claimed responsibility.
The Canadian Centre for Cyber Security reported that hackers tampered with industrial control systems (ICS) at a water facility and an oil and gas firm, warning of increasing hacktivist activity targeting internet-exposed ICS environments.

Newly Discovered Vulnerabilities

CISA added a high-severity zero-day vulnerability affecting Broadcom VMware Tools and VMware Aria Operations to its Known Exploited Vulnerabilities Catalog. The flaw is being actively exploited by China-linked threat actors, and federal agencies have been ordered to patch immediately.
A critical authentication bypass vulnerability (CVE-2025-54603) was patched in Claroty products, which exposed operational technology (OT) environments and critical infrastructure to potential disruption and data theft.
A severe exploit targeting the Chromium Blink rendering engine was disclosed, allowing attackers to crash Chromium-based browsers instantly via a malicious URL.
Researchers highlighted a DNS poisoning flaw, supply-chain attack vectors, and new malware strains in the npm ecosystem, including over 130 packages delivering infostealers and PhantomRaven malware stealing GitHub tokens from developers.
A Living-off-the-Land (LotL) attack technique was detailed, leveraging Windows’ native AI stack to hide malware in trusted AI data files.

Notable Threat Actor Activity

Russian ransomware gangs are increasingly adopting the open-source AdaptixC2 command-and-control framework for advanced attacks.
China-linked hackers are actively exploiting VMware vulnerabilities in live attacks.
LinkedIn is being abused for targeted phishing campaigns against finance executives, using fake executive board invitations to steal Microsoft credentials.
Multiple malicious npm packages, including those delivering PhantomRaven malware, have been downloaded over 100,000 times, targeting developer credentials and tokens.

Trends, Tools, or Tactics of Interest

There is a surge in NFC relay malware in Eastern Europe, with over 760 Android apps identified as capable of stealing payment card data via NFC relay attacks.
Attackers are increasingly leveraging supply-chain attacks, with npm registry being a recurring target for infostealer distribution.
AI and machine learning defenses are scaling up: Google reports its built-in Android AI blocks over 10 billion scam messages and calls monthly.
Security researchers note a rise in attackers focusing on fewer, high-impact targets and exploiting defender blind spots.
Living-off-the-Land (LotL) tactics are evolving, with attackers embedding malware in trusted system components like Windows AI stacks to evade detection.
Social engineering tactics are being refined, with threat actors exploiting “Contact Us” forms and public data to craft more effective phishing and business email compromise (BEC) attacks.

Regulatory or Policy Developments

CISA and NSA, with global partners, released new security guidance for hardening Microsoft Exchange servers to address persistent exploitation risks.
CISA mandated immediate patching of the VMware Tools vulnerability for federal agencies due to active exploitation.
Guidance and warnings from Canadian authorities emphasize the need for increased ICS/OT security amid rising hacktivist threats.

Cybersecurity Brief – 2025-04-15

Tue, 15 Apr 2025 00:00:00 +0000

Newly Discovered Vulnerabilities and Attacks

Gladinet’s Triofox and CentreStack are under active exploitation due to a critical RCE vulnerability, impacting seven organizations.
ResolverRAT, a new remote access trojan, targets healthcare and pharmaceutical sectors through phishing and DLL side-loading attacks.
Cybersecurity researchers have identified a phishing campaign using real-time checks to validate victim emails before credential theft.

Data Breaches and Security Incidents

Hertz Corporation confirms a data breach where customer information and driver’s licenses were stolen in Cleo zero-day data theft attacks.
Conduent, a govtech giant, discloses client data was stolen in a January 2025 cyberattack.

Regulatory and Policy Developments

Meta resumes E.U. AI training using public user data after regulatory approval, aiming to train AI models with public data shared by adults in the European Union.
Microsoft issues Windows updates to fix Active Directory policy issues and advises users to ignore WinRE installation errors.
The CA/Browser Forum votes to reduce SSL/TLS certificate lifespans to 47 days by 2029 to enhance security.

Notable Threat Actors and Tools

Fortinet zero-day bug may lead to arbitrary code execution, with a threat actor posting about the exploit after Fortinet warned of active vulnerabilities.
Chinese APTs exploit EDR “visibility gap” for cyber espionage, targeting network blind spots like firewalls, IoT devices, and the cloud.
Cybersecurity firm Prodaft buys hacker forum accounts to spy on cybercriminals and enhance threat intelligence capabilities.

Industry Impacts and Recommendations

Cybersecurity in the AI era is evolving rapidly, with attackers leveraging AI for automation and sophisticated attacks, highlighting the need for defenders to evolve quickly.
Wazuh, an open-source XDR platform, enhances DevSecOps by providing real-time threat detection, compliance, and vulnerability scanning for stronger security strategies.