https://blog.dansec.red/vendors/covenant-health/Recent content in Covenant Health on DanSec DailyHugoen-gbSat, 03 Jan 2026 00:00:00 +0000https://blog.dansec.red/posts/2026-01-03-cybersecurity-news/Sat, 03 Jan 2026 00:00:00 +0000https://blog.dansec.red/posts/2026-01-03-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li>Covenant Health confirmed a data breach impacting nearly 478,000 individuals, with attribution to the Qilin ransomware group. Data was stolen from systems in May 2025.</li> <li>Ongoing cryptocurrency thefts have been traced to the 2022 LastPass breach, with attackers draining wallets years after the theft of encrypted vaults.</li> <li>Trust Wallet reported that approximately $8.5 million was stolen from over 2,500 crypto wallets, likely linked to the &ldquo;Shai-Hulud&rdquo; NPM supply chain attack in November, described as an industry-wide compromise.</li> </ul> <h2 id="newly-discovered-vulnerabilities">Newly Discovered Vulnerabilities</h2> <ul> <li>Over 10,000 Fortinet firewalls remain exposed to a five-year-old two-factor authentication (2FA) bypass vulnerability that is actively being exploited.</li> <li>The Kimwolf botnet is exploiting an undisclosed vulnerability that has been under attack for several months, with Internet-wide security advisories issued.</li> <li>The RondoDox botnet is exploiting the React2Shell vulnerability to compromise vulnerable Next.js servers, with a campaign noted in December.</li> <li>Thousands of requests have targeted a dozen vulnerabilities in Adobe ColdFusion servers in a coordinated campaign observed by GreyNoise during the Christmas 2025 holiday.</li> </ul> <h2 id="notable-threat-actor-activity">Notable Threat Actor Activity</h2> <ul> <li>Transparent Tribe has launched a new wave of remote access trojan (RAT) attacks targeting Indian government, academic, and strategic entities.</li> <li>The Qilin ransomware group was responsible for the data theft from Covenant Health.</li> <li>Two US cybersecurity professionals pleaded guilty to acting as affiliates of the BlackCat/Alphv ransomware group, participating in ransomware attacks.</li> <li>Cybercriminals are abusing Google Cloud Application Integration to send multi-stage phishing emails that impersonate legitimate Google-generated messages.</li> </ul> <h2 id="trends-tools-or-tactics-of-interest">Trends, Tools, or Tactics of Interest</h2> <ul> <li>AI-driven threats are predicted to rise, with a growing shift in the industry focus from prevention to resilience and an emphasis on advanced security measures.</li> <li>Attack Surface Management (ASM) tools are generating large volumes of asset inventory data and alerts, raising concerns about actionable ROI.</li> <li>AI technologies made scams more convincing throughout 2025, with rapid advancements leading to systems that can evade meaningful human oversight.</li> <li>Protest surveillance tactics are shifting from cooperation to antagonism and political marketing, affecting privacy and civil liberties.</li> </ul> <h2 id="regulatory-or-policy-developments-affecting-the-security-industry">Regulatory or Policy Developments Affecting the Security Industry</h2> <ul> <li>CTOs and industry experts are prioritising the formal governance of AI and quantum technologies, as well as enhancements in supply chain and managed cloud provider (MCP) security, for 2026.</li> </ul>