Cursor on DanSec Daily

Cybersecurity Brief – 2026-11-02

Mon, 02 Nov 2026 00:00:00 +0000

Major Incidents or Breaches

Google, with industry partners, dismantled the XCPE Android botnet, which had enrolled over 1.3 million TV set-top boxes. The backdoor was attributed with high confidence to Videostrong, a manufacturer that allegedly sold access to criminal groups. Google has banned the company from its ecosystem ^[1]^[48]^[70].
Hackers disrupted refrigeration systems at supermarkets across several European countries in a second wave of attacks, remotely changing temperature settings and causing food spoilage and operational disruptions ^[10]^[35]^[39]^[50].
The FBI confirmed that North Korean state-sponsored group TraderTraitor was responsible for the $6.3 billion Binance cryptocurrency heist, the largest such theft on record. Over 600 associated crypto addresses have been flagged, and laundering activity is ongoing ^[15]^[23]^[40]^[43]^[53]^[65].
Chainalysis suffered a data breach after attackers used “offensive agentic techniques” involving AI-driven methods to access internal systems and tools ^[21]^[44]^[52].
The Florida Department of Education reported a breach of its student aid website, potentially exposing SSNs and other sensitive data of 4.9 million individuals ^[17].
Online retailer Revolve disclosed a breach impacting at least 180,000 people, with theft of personal and payment card information ^[18].
DebugBear, a website monitoring service, suffered a DNS hijack via its domain registrar, leading to compromise of customer accounts. Polymarket, a prediction market affected by the incident, is returning $3.9 million to impacted traders ^[22]^[31].
Synology warned customers of ongoing C3RB3R ransomware attacks targeting NAS devices and urged immediate updates ^[13].
BTCPay Server maintainers warned that outdated instances are being targeted for hot wallet cryptocurrency thefts ^[8].
Trezor advised that some hardware wallets sold by a reseller may contain a seed-stealing implant, placing owners’ recovery phrases at risk ^[51].
Applebee’s customer data was exposed due to an embedded password left in its app, allowing unauthorised access ^[67].
Russia’s federal statistics agency, Rosstat, confirmed a cyberattack claimed by Belarusian and Ukrainian hackers, resulting in the theft of sensitive government data ^[32].
Emergency alert systems in both Ukraine and Russia were hijacked, with attackers spreading fake nuclear attack warnings ^[34]^[38].

Newly Discovered Vulnerabilities

Two additional zero-day vulnerabilities in Ivanti Connect Secure (CVE-2026-111357 and CVE-2026-118527) have been patched after being chained in active attacks since at least October 1. CISA added both to its Known Exploited Vulnerabilities catalog and issued remediation guidance to federal agencies ^[14]^[24]^[47]^[71].
Over 1,000 GitLab servers remain unpatched and exposed to a maximum-severity remote code execution flaw that is being actively exploited ^[12].
Two critical vulnerabilities in Langflow, an open-source AI agent builder, allow unauthenticated attackers to bypass authentication and execute arbitrary code on servers ^[3].
The maintainer of BTCPay Server highlighted that outdated versions are susceptible to attacks draining hot cryptocurrency wallets ^[8].
Trezor identified a seed-stealing implant in some Safe 5 hardware wallets distributed by a third-party reseller ^[51].
A recent vulnerability in Linux’s implementation of Multipath TCP (RFC 8684) was noted, though technical details remain limited ^[63].
Applebee’s app contained an embedded password, exposing customer data to unauthorised access ^[67].

Notable Threat Actor Activity

North Korean APT group TraderTraitor was attributed by the FBI as responsible for the Binance cryptocurrency heist, with ongoing laundering of stolen funds ^[15]^[23]^[40]^[43]^[53]^[65].
An Iran-aligned threat actor, DarkBlinders, conducted a cyber espionage campaign targeting Israeli and Iraqi Kurdish government cloud environments between August and October 2026 ^[2].
The Bitter group, linked to India, deployed PapRAT malware in cyber-espionage campaigns targeting South and Southeast Asian organisations, leveraging three distinct infection chains including one without a malware executable ^[26]^[42].
Cybercriminals posed as IT support staff on Microsoft Teams to social engineer employees, gain remote access, and abuse insecure Active Directory Certificate Services settings to steal company data ^[5].
Cybersecurity researchers disclosed a campaign targeting government Linux servers with SysGoRAT malware and suspected AI-generated scripts ^[6].
Hackers hijacked DNS records at DebugBear’s domain registrar to compromise customer accounts, targeting Polymarket for financial theft ^[22]^[31].
C3RB3R ransomware operators increased attacks on Synology NAS devices, exploiting unpatched systems ^[13].
Chainalysis breach involved attackers using AI-powered “offensive agentic” methods to access internal tools ^[21]^[44]^[52].

Trends, Tools, or Tactics of Interest

VOLTA-AUTODOXER (VOLTA), a new Windows infostealer, uses large language models (Claude, Gemini, Kimi) to rank stolen victim data by potential financial value, representing a novel use of AI in cybercrime ^[7]^[49].
There is a notable rise in attacks using AI and LLMs, including LLMjacking, where attackers compromise cloud and model resources to monetise stolen API tokens, costing organisations over $100,000 per day in illicit charges ^[37]^[69].
The CyberStrikeAI framework was observed in real-world attacks, automating post-exploitation phases against educational institutions ^[62].
The use of AI agents in security operations is increasing, with 40% of security teams using them daily and another 56% testing them ^[4].
A malicious Claude code extension was distributed in a supply chain attack against Cursor, performing host reconnaissance and attempting to establish a reverse SSH tunnel ^[20].
Thieves exploited the Trigger AI workflow tool to steal environment variables, highlighting risks in workflow automation platforms ^[36].
Attackers increasingly target existing customer relationships in digital fraud, with 81% of attacks focusing on established accounts ^[61].
Hundreds of AI apps and websites, primarily from Chinese-language developers, were found to have hidden sexually abusive deepfake features ^[29].
A significant increase in critical software security bugs was noted, with 3% of all recorded critical bugs discovered in the last month, suggesting a rapid acceleration in vulnerability discovery ^[30].
Armadin’s testing found that 88% of critical and high-severity vulnerabilities in client environments were not covered by vendor advisories ^[41].

Regulatory or Policy Developments Affecting the Security Industry

CISA directed federal agencies to remediate the newly exploited Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527) and added them to its Known Exploited Vulnerabilities catalog ^[24]^[47].
Google introduced a $250,000 bug bounty for “root-in-cloud” exploits, rewarding high-impact research that demonstrates full administrative control in cloud environments ^[19].
CISA announced the start of Critical Infrastructure Security and Resilience Month 2026, aiming to raise awareness and drive action around critical infrastructure protection ^[72].

Sources

Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access - thehackernews.com
Google disrupts XCPE botnet, bans the company behind it - helpnetsecurity.com
Shutting the Door on the XCPE Botnet - cloud.google.com
Hackers disrupt refrigeration systems at European supermarkets - bleepingcomputer.com
Second wave of suspected cyberattacks hits supermarket freezers across Europe - therecord.media
Frozen part II: Hackers remotely defrost produce in Euro supermarkets ... again - theregister.com
Second wave of refrigeration cyberattacks hits European supermarkets - helpnetsecurity.com
FBI links $6.3 billion Binance crypto heist to North Korean hackers - bleepingcomputer.com
FBI Flags Over 600 Addresses Tied to North Korea’s Binance Heist - securityweek.com
FBI pins $6.3B Binance crypto heist on North Korean hackers - theregister.com
FBI Attributes Binance Heist to North Korea’s TraderTraitor - infosecurity-magazine.com
FBI pins $6.3 billion Binance crypto heist on North Korea while scammers circle anxious users - helpnetsecurity.com
2nd November – Threat Intelligence Report - research.checkpoint.com
Chainalysis Discloses Data Breach Following AI-Driven Cyberattack - securityweek.com
Chainalysis Warns Customers After “Offensive Agentic” Security Incident - infosecurity-magazine.com
Chainalysis breached using “offensive agentic techniques” - helpnetsecurity.com
Florida Student Aid Website Hack Puts Data of 4.9 Million People at Risk - securityweek.com
Revolve Data Breach Impacts at Least 180,000 People - securityweek.com
Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack - securityweek.com
Polymarket pledges to give $3.9 million back to victims after site compromise - therecord.media
Synology warns of C3RB3R ransomware attacks targeting NAS devices - bleepingcomputer.com
BTCPay Server warns of hot wallet crypto thefts on outdated instances - bleepingcomputer.com
Trezor warns some of its wallets may hide a seed-stealing implant - helpnetsecurity.com
Applebee’s customer data exposed by password left in app - malwarebytes.com
Russia's statistics agency confirms cyberattack claimed by Belarusian and Ukrainian hackers - therecord.media
Russian and Ukrainian hackers hijack emergency apps to spread fake nuclear attack warnings - therecord.media
Nuclear threats and street brawls: Russia, Ukraine report attacks on their emergency alert apps - theregister.com
Ivanti patches two more Connect Secure zero-days chained in attacks - bleepingcomputer.com
Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain - securityweek.com
CISA to federal agencies: Remediate exploited Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527) - helpnetsecurity.com
Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527) - rapid7.com
Over 1,000 GitLab servers vulnerable to ongoing RCE attacks - bleepingcomputer.com
Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on Servers - thehackernews.com
Mutipath TCP: Use and Detection, (Mon, Nov 2nd) - isc.sans.edu
DarkBlinders Compromises Israeli Target and Iraqi Kurdish Government Cloud Environment - thehackernews.com
PapRAT Cyber Espionage Campaign Leaves a 'Bitter' Taste in South Asia - darkreading.com
Bitter Deploys PapRAT in Asian Cyber-Espionage Campaign - infosecurity-magazine.com
Attackers Pose as IT Support on Microsoft Teams, Abuse AD CS to Steal Company Data - thehackernews.com
Government Linux Servers Targeted With SysGoRAT and Suspected AI-Generated Scripts - thehackernews.com
New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value - thehackernews.com
AI-powered infostealer picks out the most profitable parts of your stolen data - helpnetsecurity.com
Token thieves costing companies $100K+ per day in illicit LLM charges - theregister.com
The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources - cloud.google.com
CyberStrikeAI in the wild: the use of AI in real-world attacks on organizations - securelist.com
Is Your SOC Ready for AI Agents? A Maturity Check Before You Deploy - thehackernews.com
Malicious Claude Code Extension Served in Cursor Supply Chain Attack - securityweek.com
Thieves pilfer environment variables from Trigger AI workflow tool - theregister.com
Report: Most Fraud Attacks Target Existing Customer Relationships - blog.knowbe4.com
Hundreds of Mundane AI Apps Are Hiding Sexually Abusive Deepfake Features - wired.com
AI Vulnerability Finding - schneier.com
Armadin Tests Find 88% of Severe Flaws Outside Vendor Advisories - infosecurity-magazine.com
Google Introduces $250,000 Root-in-Cloud Bug Bounty Reward - securityweek.com
CISA Kicks Off Critical Infrastructure Security and Resilience Month 2026 - cisa.gov

Cybersecurity Brief – 2026-10-31

Sat, 31 Oct 2026 00:00:00 +0000

Major Incidents or Breaches

Chainalysis suffered a cybersecurity incident in which an external actor accessed internal tools and non-sensitive customer data, including customer names, email addresses, and user IDs. The attack reportedly leveraged “offensive agentic techniques”^[1]^[9].
Fashion retailer Resolve disclosed a breach resulting in the theft of customer payment card information^[27].
The Florida Department of Education revealed that 4.9 million individuals had their Social Security numbers leaked following a breach of the Florida Student Financial Aid website^[28].
Trezor warned of a suspected hardware implant in a Trezor Safe 5 wallet sold by a reseller in Southeast Asia, potentially enabling cryptocurrency theft^[11].
A malicious version of Anthropic’s Claude Code extension was distributed via the Cursor marketplace for approximately 11 hours, exposing up to 5,000 developers to malware that planted persistent SSH backdoors^[12]^[18]^[23]^[32]^[47].
Apple notified users in 99 countries of mercenary spyware infections, ahead of international negotiations on guidelines for the use of commercial hacking tools^[35].

Newly Discovered Vulnerabilities

Attackers are chaining three Ivanti Connect Secure vulnerabilities to gain unauthenticated root access. Two of these flaws were recently added to CISA’s Known Exploited Vulnerabilities catalog^[2].
A critical Linux kernel vulnerability affecting MPTCP servers allows unauthenticated remote attackers to execute commands as root^[10].
TeamViewer patched a vulnerability where a remote computer could attack the computer controlling it during a session^[6].
A high-severity remote code execution flaw in WordPress Core, not yet assigned a CVE, has been targeted in nearly 63,000 attack attempts within 24 hours of patch release^[7].
An origin-validation flaw in BeyondTrust Remote Support (CVE-2026-102764) allows unauthenticated attackers to upload files and achieve remote code execution as the appliance OS user^[49].
Over 22.6 million exposed instances are potentially affected by critical PHP flaws exploited in PHP2Shell attacks, which have successfully compromised Palo Alto firewalls but not WordPress^[15]^[41].
Flaws in SS7 and Diameter signaling protocols allow attackers to track phone locations, intercept communications, and impersonate subscribers without compromising the device itself^[13].

Notable Threat Actor Activity

Chinese state-sponsored group Vapor Panda used the AI-powered, Go-based ARTEX penetration testing framework to compromise over 200 organizations in at least 14 countries, with 140 sensitive targets breached in 11 days^[5]^[34].
Syrian hacker Ahmad Umar Agha, associated with the Syrian Electronic Army and pro-Assad cyber operations, was sentenced in the US to 42 months in prison for attacks on Western media, businesses, and government entities^[14]^[29]^[38].
Threat actors launched approximately 8,226 network-layer DDoS attacks per hour in Q3, totalling 18.2 million attacks, representing a 38 percent increase according to Cloudflare^[4].
A new infostealer malware dubbed Volta-Autodoxer uses AI to collect credentials, credit card data, sessions, and other sensitive information, and leverages LLMs to profile and prioritize victims’ assets^[22]^[45].
Romance scammers are targeting US citizens to act as money mules, leveraging social engineering techniques to facilitate laundering operations^[39].
A criminal group spent over $7,000 on AI services to enhance extortion attacks, leaving digital evidence of their activities^[30].

Trends, Tools, or Tactics of Interest

AI-powered penetration testing frameworks, such as ARTEX, are being adopted by state-sponsored actors for rapid and scalable compromise of high-value targets^[5]^[34].
The use of large language models (LLMs) by infostealer malware, as demonstrated by Volta-Autodoxer, is enabling automated victim profiling and prioritization of stolen data^[22]^[45].
The supply chain attack on the Claude Code extension for Cursor highlights the risks of malicious code distribution via third-party marketplaces, with attackers using persistent SSH backdoors to maintain access to developer systems^[12]^[18]^[23]^[47].
Fake Chrome extensions, including PDF and search tools, hijacked searches for 13.4 million users by routing queries through attacker-controlled servers^[46].
Abandoned or “undead” software projects continue to pose security risks due to unmaintained infrastructure and vulnerable domains^[21].
Attackers are exploiting help desk impersonation and abusing Active Directory Certificate Services (AD CS) through authentication relay and Kerberos attacks to escalate privileges^[48].
Passkeys are increasingly adopted but attackers are shifting tactics to target areas around authentication rather than the authenticator itself^[17].

Regulatory or Policy Developments Affecting the Security Industry

The US Department of Justice raised privacy concerns regarding the potential sale of Character.AI chat data, recommending the appointment of a consumer privacy ombudsman to advise on data handling and sale terms^[26].
The Pall Mall Process, an international negotiation on guidelines for the use of commercial hacking tools, is nearing finalization as Apple issues spyware notifications globally^[35].
General Motors agreed to a $220 million settlement regarding multistate allegations of improper driver tracking^[31].
A new framework, RAID-AI, has been introduced to help organizations assess and improve their resilience to ransomware attacks targeting AI systems^[33].

Sources

Chainalysis Confirms Intrusion Into Internal Tools and Exposure of Customer Identity Data - thehackernews.com
Chainalysis discloses data breach from "offensive agentic techniques" - bleepingcomputer.com
Fashion retailer Resolve says hackers stole payment card information - therecord.media
Florida warns that 4.9 million people had Social Security numbers leaked in financial aid site breach - therecord.media
Trezor warns of suspected crypto-theft implant in hardware wallet - bleepingcomputer.com
Malicious Claude Code extension on Cursor planted SSH backdoors - bleepingcomputer.com
Devs Hit by Trojanized Claude Code Extension for Cursor - darkreading.com
A Supply Chain Attack Put Malicious Anthropic Claude Extensions on Thousands of Devices - wired.com
Anthropic: That Claude Code extension compromise… couldn't be us - theregister.com
Inside a malicious Claude Code-branded extension and its persistent SSH backdoor - microsoft.com
Apple notifications alert victims in 99 countries about mercenary spyware infections - cyberscoop.com
Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access - thehackernews.com
Critical Linux kernel flaw allows remote root attacks on MPTCP servers - bleepingcomputer.com
TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them - thehackernews.com
WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours - thehackernews.com
Rapid7 Analysis: Unauthenticated File Upload to RCE in BeyondTrust Remote Support (CVE-2026-102764) - rapid7.com
PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress - securityweek.com
This month in security with Tony Anscombe – October 2026 edition - welivesecurity.com
SS7 and Diameter Attacks: How Signaling Flaws Expose Your Phone - bleepingcomputer.com
Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide - thehackernews.com
China-backed threat group used agentic AI pentesting tool to compromise 140 sensitive targets in 11 days - cyberscoop.com
Syrian Hacker Gets Prison Time in US After Over a Decade on the Run - securityweek.com
Syrian Electronic Army hacker gets prison time for attacks on Western targets - therecord.media
Syrian hacker who served Assad regime gets 42 months in US prison - cyberscoop.com
Cloudflare Reports 18.2 Million Network-Layer DDoS Attacks in Q3, Up 38% - thehackernews.com
Spooky New Infostealer Malware Uses AI to ‘Autodox’ Victims - wired.com
Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer - blog.talosintelligence.com
Warning: Romance Scammers Are Targeting US Citizens For Money Laundering - blog.knowbe4.com
Crim spent $7K+ on AI services in extortion attacks, then left evidence for all to see - theregister.com
Fake PDF and search tools hijacked searches for 13.4 million Chrome users - malwarebytes.com
Undead Software Projects Continue to Raise Security Risks - darkreading.com
From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths - microsoft.com
Passkeys Are Better Than Passwords. But They Are Not Enough. - securityweek.com
DOJ raises privacy concerns over potential sale of Character.AI chats - therecord.media
GM cracks the petty cash box for multistate driver tracking settlement - theregister.com
New Framework Puts Ransomware Resilience for AI Systems in Focus - infosecurity-magazine.com

Cybersecurity Brief – 2026-10-30

Fri, 30 Oct 2026 00:00:00 +0000

Major Incidents or Breaches

Binance, the world’s largest cryptocurrency exchange, suffered a record-setting security breach resulting in the theft of approximately $6.3 billion in digital assets. The incident has been linked to the compromise of a DevOps engineer’s laptop, and blockchain investigators attribute the attack to North Korean threat actors, specifically the TraderTraitor group. Nearly $3 billion in assets were reportedly frozen in response to the breach, which was executed in under 20 minutes ^[7]^[15]^[17]^[32]^[42]^[47]^[49]^[54]^[61]^[79].
Polymarket, a prediction market platform, temporarily halted trading after hackers compromised a third-party service and distributed a cryptocurrency-draining JavaScript, resulting in the theft of approximately $2.5 million from user accounts. The attack leveraged a supply chain vector via a website monitoring tool ^[20]^[29]^[45].
A searchable database containing records of more than 41,000 current and former US Department of Homeland Security employees and contractors was leaked, exposing contact details and sensitive job information ^[66]^[74]^[80].
Belgium’s tax agency confirmed a cyberattack that forced it to pull services offline and extend tax deadlines ^[52].
Japan Airlines disclosed a third-party data breach at Amadeus’s Passenger Service System, exposing data of about 92,000 customers ^[19].
An employee at RIZAP Inc. in Japan uploaded health records of 726 individuals to a personal AI chat, resulting in a sensitive data exposure incident ^[71].
The University of New Mexico Health reported a cyberattack, with a ransomware group claiming responsibility ^[69].
The Florida Department of Education revealed a breach of its student financial aid website, potentially exposing personal information, including Social Security numbers, of approximately 4.9 million people ^[70].
Frontline school software suffered a breach exposing student Social Security numbers and Medicaid IDs ^[73].

Newly Discovered Vulnerabilities

A highly critical authorization bypass vulnerability in Drupal Commerce Core, tracked as CVE-2026-118539, is being actively exploited in the wild to target online stores ^[5]^[14]^[28].
A maximum-severity remote code execution vulnerability in GitLab, CVE-2026-97229, is now being exploited against unpatched servers, including Alpine Linux deployments ^[6]^[12]^[30].
The Linux kernel is affected by a critical TCP flaw, CVE-2026-98432, rated 9.8 CVSS, impacting major distributions such as Ubuntu and Red Hat Enterprise Linux ^[9].
Cisco Catalyst SD-WAN Controllers are being targeted via CVE-2026-20127, an authentication-bypass vulnerability exploited to deploy custom KeyDrift malware ^[6]^[22].
TeamViewer is affected by an integer overflow vulnerability, CVE-2026-111585, which could allow malicious hosts to execute arbitrary code on support technicians’ systems ^[31].
Researchers found critical vulnerabilities in five AI developer tools, with flaws in OpenAI and Microsoft products still unpatched, primarily involving embedded browsers ^[50].
Critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, are being targeted for remote code execution in web server environments ^[81]^[77].
A fresh unauthenticated race condition vulnerability in WordPress is under active exploitation, allowing remote code execution ^[27].

Notable Threat Actor Activity

North Korean threat actors, specifically the TraderTraitor group, are linked to the $6.3 billion Binance heist. Microsoft also reports increased adoption of AI tools by North Korean actors to enhance attack speed and efficiency ^[32]^[42]^[54]^[79]^[82].
A suspected Chinese-nexus actor compromised a US government-affiliated network by chaining a custom PHP2Shell exploit to gain root access to Palo Alto Networks firewall servers ^[51]^[53]^[67].
UAT-11473, a newly tracked APT group, exploited a Cisco SD-WAN flaw to deploy custom KeyDrift malware ^[22].
Belarusian state hackers, identified as the “FrostyNeighbor” APT, launched a destructive data-wiping attack in Ukraine, aligning with Russian cyber objectives ^[36]^[67].
The Syrian Electronic Army hacker “Th3Pr0” was sentenced to 42 months in US federal prison for a hacking conspiracy that involved posting a fake tweet, triggering a $136 billion market drop ^[3]^[56].
Threat actors are distributing malicious loaders and cryptocurrency miners disguised as AI desktop applications for Anthropic Claude and OpenAI ChatGPT, abusing signed executables ^[10].
A trojanized version of Anthropic’s Claude Code extension was distributed via the Cursor Marketplace, planting a persistent SSH backdoor on developer machines ^[4]^[59].
A campaign abusing Hugging Face models for crypto mining has resurfaced, hijacking GPU servers and deploying backdoors ^[18].
Attackers exploited a fake cryptocurrency trading app on the Apple App Store, resulting in the theft of $23,000 from 27 Solana wallets ^[21].
A bulletproof hosting provider, Virtualine, lost its domain to an FBI seizure after supporting ransomware and infostealer operators ^[26].

Trends, Tools, or Tactics of Interest

Attackers are increasingly leveraging supply chain attacks, as seen in the Polymarket incident and the trojanized Claude Code extension ^[20]^[29]^[4]^[59].
There is a growing trend of threat actors exploiting vulnerabilities in widely used open-source and enterprise platforms, including Drupal, GitLab, Linux, PHP, WordPress, and Cisco SD-WAN ^[5]^[6]^[9]^[12]^[14]^[22]^[27]^[28]^[30]^[31]^[50]^[77]^[81].
AI is being adopted both as an attack vector and as a defensive tool. North Korean threat actors are integrating AI into their tradecraft, while Google and Anthropic highlight AI models capable of discovering and exploiting vulnerabilities. AI-assisted remediation and agent verification tools are being launched for enterprise security ^[34]^[40]^[57]^[58]^[60]^[82].
Phishing campaigns themed around Anthropic are bypassing leading secure email gateway solutions ^[37].
Attackers are abusing legitimate communication channels, such as Microsoft Teams and phone calls, to conduct vishing and social engineering attacks that result in remote access session compromises ^[62].
Chrome extensions with over 13 million installs were found hijacking search queries for ad revenue ^[23].
Smart TVs and IoT devices continue to present significant security risks due to unpatched vulnerabilities and data tracking ^[65].
Criminal groups rapidly rebuild fake shopping sites after takedowns, often reusing web assets and infrastructure ^[64].
Malware operators are using victims’ OpenAI API keys to execute AI queries via NIK C2 malware ^[55].

Regulatory or Policy Developments Affecting the Security Industry

The UK’s Ofcom has outlined four possible age-verification methods for enforcing the under-16 social media ban, including photo ID, bank checks, and face scans ^[78].
The UK Investigatory Powers Commissioner’s Office reported that GCHQ cannot account for thousands of data storage devices, expressing concern over the agency’s asset management and related security implications ^[43]^[48].
Australia’s Signals Directorate disrupted the Amadey malware operation, severing criminal access to approximately 180,000 infected computers ^[72].

Sources

Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen - thehackernews.com
Binance links $6.3 billion crypto theft to compromised DevOps laptop - bleepingcomputer.com
Binance probes potential $5.8 billion crypto-theft hack - bleepingcomputer.com
$6 Billion Binance Hack Bears Hallmarks of North Korea’s TraderTraitor - securityweek.com
The $6.3 Billion Binance Hack Was Pulled Off in Just 20 Minutes - wired.com
Binance hit by record $6.3 billion crypto hack, scrambles to freeze funds - therecord.media
In the year AI re-wrote the infosec rulebook, it’s comforting to know crypto exchanges still have bad security - theregister.com
Binance Hit by Record-Breaking $6.3bn Hack in Largest Cryptocurrency Heist in History - infosecurity-magazine.com
Binance hit by $6.3 billion theft in what could be the biggest crypto heist on record - helpnetsecurity.com
Binance hit by largest-ever crypto theft, with $6.3 billion stolen - malwarebytes.com
Polymarket halts trading after crypto-draining script breach, $2.5M traced - bleepingcomputer.com
$2 Million+ Drained From Polymarket Traders in New Supply Chain Attack - securityweek.com
Polymarket confirms cyberattack on third-party provider after outages - therecord.media
Leaked DHS employee archive, Icepick, faces challenges to stay online - cyberscoop.com
DHS personnel leak exposes contact details and sensitive job information - databreaches.net
Hackers steal and publish data on 41,000 Homeland Security workers - malwarebytes.com
Belgium's tax agency confirms cyberattack, pulls services offline - theregister.com
Japan Airlines suffers third-party data breach exposing passenger info - bleepingcomputer.com
A RIZAP Employee Uploaded 726 People’s Health Records to a Personal AI Chat - databreaches.net
UNM Health addresses cyberattack in New Mexico after ransomware group claims responsibility - databreaches.net
Florida education department says data breach may affect 4.9 million people - databreaches.net
Student SSNs and Medicaid IDs Exposed in Frontline School Software Breach - databreaches.net
Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw - thehackernews.com
Drupal warns of critical Commerce Core flaw exploited in attacks - bleepingcomputer.com
Drupal Commerce Core Vulnerability Exploited Against Online Stores - securityweek.com
CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV - thehackernews.com
CISA says max severity GitLab flaw now exploited in the wild - bleepingcomputer.com
Max-Severity GitLab Vulnerability Exploited Against Alpine Linux - securityweek.com
Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions - thehackernews.com
Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware - bleepingcomputer.com
TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ Machines - securityweek.com
Researchers find bugs in 5 AI developer tools, with OpenAI and Microsoft flaws still unpatched - theregister.com
Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29) - unit42.paloaltonetworks.com
A quiet week in infosec <.< - blog.talosintelligence.com
Fresh WordPress Vulnerability in Attackers’ Crosshairs - securityweek.com
Tracking AI adoption in North Korean threat actor tradecraft - microsoft.com
Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers - theregister.com
Chinese Actor Compromises US Government Network Via Chained PHP2Shell Exploit - infosecurity-magazine.com
Risky Bulletin: Belarusian state hackers get on the data-wiping train - news.risky.biz
As Russia's Cyberwar Evolves, Belarus Steps Forward - darkreading.com
Syrian Hacker Behind Fake Tweet That Triggered $136 Billion Market Drop Gets 42 Months in Prison - thehackernews.com
Assad regime hacker who caused $136 billion market drop sentenced to 42 months - helpnetsecurity.com
Fake ChatGPT and Claude Apps Abuse Signed Executables to Deploy Crypto Miners - thehackernews.com
Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor - thehackernews.com
Claude Code extension poisoned with persistent SSH backdoor - helpnetsecurity.com
Hugging Face malware campaign returns to hijack GPUs for crypto mining - bleepingcomputer.com
Fake crypto app on Apple App Store linked to $23K wallet theft - bleepingcomputer.com
Bulletproof Host Virtualine Loses Its Domain to FBI Seizure - securityweek.com
Google Touts Powerful Cybersecurity Capabilities in Gemini 4 Carbon Model - securityweek.com
Claude Model Builds Exploits Across Major Browsers & OSes - darkreading.com
Shufti ties AI agent actions to verified owners and permissions - helpnetsecurity.com
Bedrock Data routes data exposure fixes to owners and verifies results - helpnetsecurity.com
Open-weight AI model GLM-5.3 cheated its way to correct answers - helpnetsecurity.com
Anthropic-Themed Phishing Emails Bypass Top Security Tools - darkreading.com
Fake IT help desk callers got by on little more than names and email addresses - helpnetsecurity.com
Chrome extensions with 13.4 million installs caught hijacking searches - bleepingcomputer.com
Smart TVs can harbor unpatched security flaws and track what you watch - helpnetsecurity.com
Scammers rebuild fake shopping sites within hours of a takedown - helpnetsecurity.com
NIK C2 Malware Can Use Victims’ OpenAI Keys for AI Queries - infosecurity-magazine.com
Photo ID, bank checks, face scan? The UK’s age-check options - malwarebytes.com
British spy agency cannot account for thousands of data storage devices, watchdog says - therecord.media
British intelligence agency misplaced 'thousands' of storage devices, years later still can't say how many - theregister.com
Australia severs criminal access to 180,000 computers after breaching Amadey malware backend - databreaches.net

Cybersecurity Brief – 2026-10-29

Thu, 29 Oct 2026 00:00:00 +0000

Major Incidents or Breaches

Sony Network Communications, a subsidiary ISP, confirmed a data breach exposing approximately 2.5 to 2.6 million customer records, including personal information, 54,401 email account passwords, and 16 bank account records ^[22]^[29].
Over 41,000 US Department of Homeland Security (DHS) employee records, including undercover ICE agents, were leaked online by a hacktivist group, exposing names, offices, contact details, and assignments. The data was reportedly stolen from an Okta single sign-on system earlier in 2026 and published by DDoSecrets ^[28]^[43]^[66]^[72].
The Belgian Federal Public Service Finance temporarily suspended tax services following a cyberattack, which occurred just before a filing deadline ^[45].
Japan Airlines disclosed a breach affecting about 2,000 customers, with stolen passport numbers, frequent flyer numbers, email addresses, and phone numbers ^[48].
The University of New Mexico restored hospital systems after a cyberattack that forced ambulance diversions and class cancellations at its medical school ^[46].

Newly Discovered Vulnerabilities

A critical vulnerability in UEFI firmware, widely used in servers and data centers, allows attackers to execute code early in the boot process, impacting most servers globally ^[42].
Cisco released patches for a high-severity flaw in ASA and FTD VPN software that has been actively exploited to crash firewalls via remote, unauthenticated access. This marks the second exploited Cisco firewall VPN zero-day since August ^[6]^[19]^[31].
A flaw in Telegram for Android allowed attackers to execute code on a victim’s device when answering a voice call. Only an ordinary phone number was needed for exploitation ^[3].
Attackers attempted to exploit a critical GitLab vulnerability (CVE-2026-9783) on Alpine Linux’s GitLab server shortly after a patch was released ^[8].
Adobe, Veeam, and Juniper Networks issued patches for critical vulnerabilities that could lead to arbitrary code execution, authorization bypass, and privilege escalation ^[26].
Oracle E-Business Suite flaw CVE-2026-101767 is under active exploitation attempts, with decoys recording exploratory exploits ^[63]^[52].
Apple released a security update for older iPhones and iPads, backporting a fix for a CoreGraphics flaw reportedly exploited in targeted attacks ^[90].
Researchers demonstrated that logic bugs alone, without memory corruption, can be chained to escape the Microsoft Edge sandbox and execute code on Windows systems ^[14].
Researchers found vulnerabilities in the browsers built into several AI coding assistants (VS Code, Cursor, Copilot, Codex, Claude Desktop), allowing web pages to break out of the assistant’s browser sandbox ^[61].

Notable Threat Actor Activity

The China-linked APT group Volt Typhoon used a covert, ephemeral access network known as “Silent Train,” built from rapidly rotating chains of compromised devices, to conduct zero-day exploitation and strategic intrusions targeting hundreds of critical infrastructure networks ^[12]^[23]^[62]^[74]^[30].
Volt Typhoon also exploited a Cisco Catalyst SD-WAN flaw to deploy custom malware (KeyDrift) designed to steal encryption keys, with infrastructure overlapping the Silent Train network ^[9]^[30]^[87].
Chinese state-sponsored actors exploited a VMware ESX zero-day logging flaw (CVE-2026-41709) to reduce audit trail visibility, allowing operations by attackers with administrative privileges to go unlogged ^[10]^[33].
A suspected China-nexus threat actor leveraged PHP2Shell vulnerabilities to root 25 servers and breach a US government-affiliated network, including chaining with a high-severity Fragnesia Linux kernel privilege escalation bug ^[11]^[15]^[17].
The GOLD OGRE threat group used AI in the development, orchestration, and execution of Aur0ra ransomware operations ^[84].
A Ukrainian affiliate of Hive and Nefilim ransomware gangs was sentenced to 70 months in US prison for attacks targeting businesses and hospitals ^[34]^[53].
Attackers used fake ChatGPT and Claude projects to distribute Yoba malware, hiding malicious code behind signed binaries ^[60].
Malicious Firefox extensions impersonated popular crypto wallets to steal recovery phrases and private keys ^[89].
A threat actor impersonated AI bots from OpenAI, Anthropic, and Meta to scan for exposed credentials ^[39].
Attackers abused legitimate Mobile Device Management (MDM) platforms to deploy rogue remote management tools, turning device management into a pathway for remote access and persistence ^[93].
GitHub issues were weaponized in a supply chain attack campaign targeting 61 public repositories in less than an hour, exploiting vulnerable workflows ^[50].

Trends, Tools, or Tactics of Interest

AI is increasingly used both offensively and defensively in cybersecurity. Google introduced Gemini 4 Carbon, a frontier AI model outperforming predecessors in vulnerability discovery, exploitation, and patching ^[1]^[64].
Cisco open sourced Project Quarry, a rules language to detect AI agent attacks that emerge across sequences of benign actions ^[25].
Cisco Talos observed a new AI-enabled command-and-control framework in the wild, dubbed NIK C2 ^[86].
AI agents are now capable of controlling authenticated browsers, interacting with corporate applications, and accessing sensitive data while mimicking legitimate users ^[16].
The supply chain attack campaign “GhostAction” shifted toward targeting developer endpoints and cloud access, indicating evolving tactics among cybercrime groups ^[37].
Online scam volumes have doubled and now outpace phishing, with over six million scam detections in Q2 2026 ^[55].
Phishing remains the leading initial access technique, while ransomware and pre-ransomware cases have increased, with finance and public administration being the top-targeted industries ^[85].
Attackers are increasingly hiding malware behind signed binaries of AI tools to evade detection ^[60].
Credential exposure continues to be a significant risk, with 26,400 valid cloud and AI credentials found in public Gitee repositories ^[5].
Attackers are turning GitHub issues into attack vectors for supply chain campaigns, automating exploitation of vulnerable workflows ^[50].
The use of AI-enabled tools such as Gemini 4 Carbon and NIK C2, as well as AI-assisted attack orchestration by groups like GOLD OGRE, demonstrates the growing sophistication of threat actors ^[1]^[64]^[84]^[86].

Regulatory or Policy Developments Affecting the Security Industry

The UK released a shortlist of age verification methods for its upcoming under-16 social media ban, noting that some adults will also require verification ^[49].
The UK Information Commissioner’s Office (ICO) reprimanded Staffordshire Police following a serious breach of personal information related to domestic abuse cases ^[56].
CREST published a framework advocating a whole-ecosystem approach to strengthening cyber resilience across the financial services sector ^[54].
The US National Institute of Standards and Technology (NIST) published guidance for federal agencies on prioritizing post-quantum cryptography adoption to meet the 2031 transition deadline ^[57].
Microsoft again urged Entra ID administrators to migrate users to phishing-resistant authentication methods ahead of the planned retirement of SMS and voice authentication in February 2027 ^[24].
A federal appellate court ruled that West Virginia’s law barring disclosure of public officials’ personal data is unconstitutional ^[47].
US law enforcement seized the primary domain of Virtualine, a major bulletproof hosting provider used to facilitate cybercrime and ransomware operations ^[20]^[71].

Sources

Sony ISP subsidiary data breach exposes 2.5 million customer records - bleepingcomputer.com
Hackers Steal 2.6 Million Records From Sony’s Japanese ISP So-net - securityweek.com
Over 41,000 DHS Employee Records Leaked Online - securityweek.com
Massive Leak Exposes 41,000 Homeland Security Workers—Including Undercover ICE Agents - wired.com
Hacktivists leak 41,000 DHS staff records, revealing undercover ICE agents - helpnetsecurity.com
Leak site publishes data on more than 41,000 DHS employees obtained by hacktivists - cyberscoop.com
Cyberattack disrupts Belgian tax services before filing deadline - therecord.media
Japan Airlines warns of data breach as country grapples with multiple cyber incidents - therecord.media
University of New Mexico restores hospital systems, urges no contact with hackers - therecord.media
Most Servers on the Planet Are Vulnerable to This Firmware Code-Execution Flaw - wired.com
Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls - thehackernews.com
New Cisco firewall zero-day exploited to crash SSL VPN devices - bleepingcomputer.com
Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August - securityweek.com
Telegram Android Flaw Lets Attackers Run Code When Users Answer Voice Calls - thehackernews.com
Attacker Tried to Exploit Alpine Linux’s GitLab via CVSS 10.0 Flaw Its Ruby Left Open - thehackernews.com
Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities - securityweek.com
Exploitation attempts against recently patched Oracle EBS flaw have begun (CVE-2026-101767) - helpnetsecurity.com
Oracle celebrates end of Cybersecurity Awareness Month with quadruple trouble - theregister.com
Have an older iPhone or iPad? Apple has a security update for you - malwarebytes.com
Researcher Reveals How Logic Bugs Alone Cracked Microsoft Edge in $175,000 Pwn2Own Win - thehackernews.com
Researchers broke the browsers built into VS Code, Cursor, Copilot, Codex and Claude Desktop - helpnetsecurity.com
Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns - thehackernews.com
Volt Typhoon hides zero-day attacks using 'Silent Train' framework - bleepingcomputer.com
Volt Typhoon targeted enterprise control planes via ever-changing “Silent Train” relay network - helpnetsecurity.com
Researchers uncover Volt Typhoon’s covert, ephemeral network - cyberscoop.com
Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network - securityweek.com
Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys - thehackernews.com
Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN - blog.talosintelligence.com
China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility - thehackernews.com
Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day - securityweek.com
Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces - thehackernews.com
PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network - thehackernews.com
CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks - bleepingcomputer.com
AI used in Aur0ra ransomware testing and execution - sophos.com
Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison - securityweek.com
Serial ransomware crook gets 70 months behind bars for Nefilim, Hive roles - theregister.com
Attackers Hide Malware Behind Signed ChatGPT and Claude Binaries - infosecurity-magazine.com
Malicious Firefox extensions impersonate popular crypto wallets - malwarebytes.com
Attacker Relentlessly Scans for Credentials by Impersonating AI Bots - darkreading.com
Managed for Malice: How Attackers Turn MDM into Remote Access - huntress.com
Attackers turn GitHub issues into supply chain campaign against 61 public repos in less than an hour - theregister.com
Google's Gemini 4 Carbon Leads Benchmarks for Finding, Exploiting, and Patching Vulnerabilities - thehackernews.com
Google says Gemini 4 Carbon beats its predecessors at finding and fixing security flaws - helpnetsecurity.com
Cisco Open Sources Quarry to Catch AI Agent Attacks Hidden in Harmless Steps - securityweek.com
NIK C2: The new AI-enabled command-and-control framework - blog.talosintelligence.com
3 Ways AI Agents Already Operate in Your Browser - bleepingcomputer.com
GhostAction Hacking Wave Fizzles, But Attackers Lurk on in GitHub - darkreading.com
Online Scam Volumes Double to Overtake Phishing - infosecurity-magazine.com
IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases - blog.talosintelligence.com
26,400 Valid Cloud and AI Credentials Found Exposed in Public Gitee Repositories - thehackernews.com
Shortlist of age checks for the UK's under-16 social media ban is out, 'some' adults will need verifying - theregister.com
ICO Reprimands Staffordshire Police After Domestic Abuse Breach - infosecurity-magazine.com
CREST Urges Whole-Ecosystem Approach to Financial Cyber Resilience - infosecurity-magazine.com
NIST Publishes Guidance to Meet Federal Post-Quantum Deadlines - infosecurity-magazine.com
Microsoft urges Entra ID admins to migrate users to passkeys - bleepingcomputer.com
Court strikes down West Virginia law barring disclosure of public officials’ personal data - therecord.media
Police seize Virtualine bulletproof service tied to ransowmare, cybercrime - bleepingcomputer.com
Officials seize domain of top bulletproof hosting provider Virtualine - cyberscoop.com

Cybersecurity Brief – 2026-08-31

Mon, 31 Aug 2026 00:00:00 +0000

Major Incidents or Breaches

McKesson, a major healthcare company, has confirmed a data breach after the ShinyHunters extortion group claimed responsibility for stealing 284 million records, which reportedly include patient data. The company is responding as the attacker’s deadline for extortion approaches ^[22]^[32].
Berlin city administration has confirmed data theft following a ransomware attack by the Rhysida group. Rhysida claims to have exfiltrated over 5TB of data, including personal information and credentials, and is attempting to extort the city. Berlin authorities have stated they will not pay the ransom ^[11]^[29].
Manchester Airports Group is the subject of a data breach claim by the extortion group FulcrumSec, which alleges theft of over 80GB of data and plans to leak it online ^[27]^[31].
Boston Scientific continues to recover from a cyberattack that caused global network disruption. CrowdStrike and other firms are assisting with the investigation ^[26].

Newly Discovered Vulnerabilities

ServiceNow has patched three critical code injection vulnerabilities that could allow attackers to execute arbitrary code and access or tamper with data ^[21].
Kaspersky has patched a vulnerability in its Endpoint Security product after the exploit “HardBreacher” was released by the threat group Nightmare Eclipse ^[20].
A critical Ruby on Rails vulnerability, named KindaRails2Shell, allows attackers to perform arbitrary file reads to extract secrets and execute code remotely. This flaw is actively being targeted by attackers ^[25].
A security researcher has disclosed nine vulnerabilities affecting ATM encryption and authentication software, highlighting systemic weaknesses in the software supply chain for ATM systems ^[17].

Notable Threat Actor Activity

The threat actor known as Silver Fox is distributing the ValleyRAT backdoor disguised as signed Chinese adware. The malware is run under trusted processes and users are sometimes tricked into adding it to antivirus exclusions ^[1]^[4].
The Aurora (Aur0ra) ransomware group has used SpaceX’s AI-powered coding assistant, Cursor, in attacks against at least ten targets ^[5].
The China-linked cyber espionage group Fire Ant has expanded operations to compromise Cisco IOS XR routers, using them to steal credentials and blind security logs. Fire Ant has also been observed creating unexplained GRE tunnel interfaces on compromised routers, turning them into spying platforms ^[7]^[9].

Trends, Tools, or Tactics of Interest

There is increased use of AI-powered tools and agents in cyberattacks, as demonstrated by Aurora ransomware’s use of Cursor and the need for security teams to treat AI agents as highly privileged identities following incidents involving Hugging Face and Claude ^[5]^[23]^[24].
Offensive security toolkits such as Praetorian are consolidating established workflows into portable Go-based tools, supporting direct pipelines and shared SDKs for red team operations ^[19].
JSCeal, a stealer targeting cryptocurrency applications, is being delivered as compiled V8 bytecode executed by a bundled Node.js runtime, representing a novel malware delivery technique ^[30].

Regulatory or Policy Developments Affecting the Security Industry

A judge has ruled that the Pentagon’s measures against Anthropic, which labeled the company as a supply chain risk, were illegal and baseless. This decision is part of an ongoing legal dispute between Anthropic and the US government ^[28].
The US Department of Justice has corrected a previous statement regarding Chinese cyberattacks, clarifying that US agencies were targets but not confirmed victims ^[8].

Sources

McKesson Confirms Data Breach as Attacker Deadline Looms - securityweek.com
McKesson confirms cyber incident after ShinyHunters claims patient-data theft - malwarebytes.com
Berlin confirms data theft after Rhysida ransomware attack claims - bleepingcomputer.com
Berlin Won’t Pay Extortion Group Claiming Data Theft - securityweek.com
Extortion Group Claims Manchester Airports Group Data Breach - securityweek.com
31th August – Threat Intelligence Report - research.checkpoint.com
Boston Scientific Still Recovering From Cyberattack - securityweek.com
ServiceNow Patches 3 Critical Code Injection Vulnerabilities - securityweek.com
Nightmare Eclipse Drops ‘HardBreacher’ Kaspersky Product Exploit - securityweek.com
Critical Ruby on Rails Vulnerability in Attackers’ Crosshairs - securityweek.com
ATM Flaws Reveal Key Weaknesses in the Software Supply Chain - wired.com
ValleyRAT masquerading as adware - securelist.com
ValleyRAT Backdoor Hides in Signed Adware That Users Add to Antivirus Exclusions - thehackernews.com
Aurora Ransomware Operators Use Cursor AI in Attacks Against 10 Targets - thehackernews.com
China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs - thehackernews.com
Chinese Fire Ant hackers turn Cisco routers into spying platforms - bleepingcomputer.com
What the Hugging Face Incident Teaches Security Leaders About AI Agent Access - securityweek.com
Anthropic Warns Claude Users of Infostealer Malware Infections - securityweek.com
Praetorian – Offensive Security Tools Built Around Portable Go Workflows - darknet.org.uk
Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode - research.checkpoint.com
Judge Says Pentagon’s Measures Against Anthropic Were ‘Illegal and Baseless’ - securityweek.com
DoJ Corrects China Hacking Claim, Says U.S. Agencies Were Targets, Not Victims - thehackernews.com

Cybersecurity Brief – 2026-07-16

Thu, 16 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

Dutch police arrested multiple individuals involved in an international investment fraud scheme that stole over €100 million from tens of thousands of victims ^[11].
Spanish authorities disrupted a cyber fraud ring responsible for €140 million in illicit gains, which included a range of cyberattacks and complex money laundering operations ^[18].

Newly Discovered Vulnerabilities

Mozilla released patches for two critical Firefox vulnerabilities, CVE-2026-15718 and another unspecified flaw, both of which have published exploit code. Critical vulnerabilities were also patched in Chrome, Adobe, and VMware products ^[5].
A critical vulnerability in Zoom’s Windows desktop client and SDK could allow unauthenticated attackers to hijack user accounts ^[12].
Multiple critical and high-severity vulnerabilities were patched in products from Trend Micro, Tanium, ESET, and Tenable ^[29].
Fortinet, Ivanti, and ServiceNow patched vulnerabilities, including a critical remote code execution flaw in ServiceNow’s AI platform ^[35].
A new Windows zero-day, dubbed LegacyHive, was publicly disclosed with proof-of-concept code, allowing arbitrary hive file loading via the User Profile Service ^[7]^[28].
Cursor, a developer environment tool, is vulnerable on Windows to a code execution flaw whereby opening a repository containing a malicious git.exe results in automatic execution without user consent ^[9]^[24]^[30].
Old and revoked UEFI shim bootloaders signed by Microsoft remain trusted on many systems, leaving them exposed to Secure Boot bypass attacks ^[19]^[27].
Three actively exploited vulnerabilities in on-premises Microsoft SharePoint Server, including two zero-days, are being targeted in the wild, with CISA urging immediate patching ^[16]^[31].
A vulnerability in Claude for Chrome allows malicious browser extensions to access Gmail and abuse Claude’s permissions ^[37].
The “PromptFiction” vulnerability in Claude AI, now fixed, could have enabled end-to-end attacks when chained with other exploits ^[23].
July 2026 Patch Tuesday addressed 622 Microsoft CVEs, including three zero-days ^[38].

Notable Threat Actor Activity

The OkoBot malware framework is targeting cryptocurrency users, exfiltrating wallet seed phrases, monitoring Chromium-based browsers, and injecting phishing modules into Ledger and Trezor wallet applications ^[1]^[4].
Five versions of AsyncAPI npm packages were compromised in a supply chain attack, delivering a multi-stage botnet loader and credential-stealing malware ^[10]^[14].
A Russian-speaking threat actor, “bandcampro,” abused Google’s Gemini CLI as a hacking agent and to operate a small botnet ^[13].
The CrashStealer malware, disguised as Apple’s CrashReporter, is being used to steal passwords, browser data, and cryptocurrency wallets from macOS users ^[39].

Trends, Tools, or Tactics of Interest

Social engineering remains central in AI-assisted attacks, with threat actors increasingly leveraging AI to enhance phishing and other social engineering tactics ^[2].
TuxBot v3 Evolution, an IoT botnet framework, shows signs of large language model (LLM) assistance in its development, indicating AI’s role in advancing botnet capabilities ^[3].
Email-based identity attacks surpassed exploits as the leading root cause of ransomware incidents, with MFA present in 97% of credential attacks but often failing to prevent compromise ^[20].
Windows bind link attacks can create conflicting filesystem views to hide malware from endpoint detection and response (EDR) tools ^[32].
The AI-powered “vulnerability vending machine” by Intruder demonstrates automated discovery of complex software vulnerabilities using LLMs and code slicing ^[15].
SASE (Secure Access Service Edge) architectures are facing challenges in detecting AI-driven threats, as traditional packet inspection is insufficient for browser-based and AI-integrated workflows ^[6].

Regulatory or Policy Developments Affecting the Security Industry

The White House launched the AI-driven “Gold Eagle” vulnerability coordination initiative, following an AI-focused Executive Order, to enhance vulnerability management at a national level ^[36].
The US charged Russian individuals and firms for operating cybercrime services, following previous sanctions ^[34].
The UK has intensified efforts to reduce reliance on US technology companies amid AI-related geopolitical tensions, with potential implications for technology sovereignty and cybersecurity policy ^[22].

Sources

Dutch police bust investment fraud ring stealing over €100 million - bleepingcomputer.com
Police Disrupt a €140M Cyber Fraud Ring in Spain - darkreading.com
Firefox, Chrome, Adobe, and VMware Updates Fix Multiple Critical Security Flaws - thehackernews.com
Zoom warns of critical account takeover vulnerability - bleepingcomputer.com
Trend Micro, Tanium, ESET and Tenable Patch Severe Product Vulnerabilities - securityweek.com
Vulnerabilities Patched by Fortinet, Ivanti, ServiceNow - securityweek.com
Researcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch Tuesday - thehackernews.com
Nightmare Eclipse Drops ‘LegacyHive’ Windows Zero-Day - securityweek.com
Cursor Flaw Lets Malicious Cloned Repositories Trigger Windows Code Execution - thehackernews.com
2-Click Cursor Exploit Enables Dev Environment Takeover - darkreading.com
Unpatched Cursor Vulnerability Exposes Users to Code Execution - securityweek.com
Forgotten Bootloaders Expose Secure Boot Blind Spot - darkreading.com
Old UEFI Shims Expose Systems to Secure Boot Bypass - securityweek.com
CISA warns admins to patch actively exploited SharePoint flaws - bleepingcomputer.com
CISA Urges Immediate Patching of Exploited SharePoint Vulnerabilities - securityweek.com
Claude for Chrome flaw could let rogue extensions access your Gmail - malwarebytes.com
Claude Flaw Automatically Sends Malicious Prompts to AI Agents - darkreading.com
July 2026 Patch Tuesday fixes 622 Microsoft CVEs, including three zero-days - malwarebytes.com
OkoBot: new sophisticated malware framework targets cryptocurrency users - securelist.com
OkoBot Malware Framework Injects Seed Phrase Phishing Into Ledger and Trezor Apps - thehackernews.com
Compromised AsyncAPI npm Packages Deliver Multi-Stage Botnet Malware - thehackernews.com
AsyncAPI npm packages infected with credential-stealing malware - bleepingcomputer.com
Google Gemini CLI abused as a hacking agent, malware botnet operator - bleepingcomputer.com
This fake Apple app can unlock your Mac’s password vault - malwarebytes.com
Report: Social Engineering Remains a Central Part of AI-assisted Attacks - blog.knowbe4.com
TuxBot v3 Evolution Shows Signs of LLM-Assisted IoT Botnet Development - thehackernews.com
Identity Attacks Overtake Exploits as Top Ransomware Cause - darkreading.com
Windows Bind Link Attacks Can Hide Malware From EDR Tools - securityweek.com
We built a vulnerability vending machine: AI tokens in, zero-days out - bleepingcomputer.com
SASE Has An AI Blind Spot. Inspecting Packets Is No Longer Enough. - thehackernews.com
White House Launches AI-Driven ‘Gold Eagle’ Vulnerability Coordination Initiative - securityweek.com
US Charges Russian Individuals and Firms for Running Cybercrime Services - securityweek.com
Is 'Tech-xit' Imminent? UK Steps Up Sovereignty Push Amid AI Strife - darkreading.com

Cybersecurity Brief – 2026-07-15

Wed, 15 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

SonicWall confirmed active exploitation of two zero-day vulnerabilities (CVE-2026-15409 and CVE-2026-15410) in SMA 1000 series appliances, enabling remote code execution and administrative command execution. Patches have been released and users are urged to update immediately ^[3]^[15]^[41].
Progress Software attributed the emergency shutdown of ShareFile Storage Zone Controllers to a high-severity zero-day vulnerability and issued security updates to address the flaw ^[21].
Nearly 300 fake GitHub repositories have been published by threat actors impersonating legitimate software projects to distribute infostealer malware ^[17].
The Spanish Police dismantled a cybercrime and money-laundering organisation responsible for €140 million in investment fraud and BEC attacks, arresting four individuals ^[16].
xAI’s Grok Build CLI was found to be uploading entire Git repositories, including full commit histories, to a Google Cloud Storage bucket operated by xAI, rather than just necessary files ^[13].
LastPass and Bitwarden users are being targeted by a phishing campaign using fake security alerts to direct them to fraudulent sites ^[22].
The D1R cybercrime group claimed to have stolen data from Synopsys and Bosch, threatening to leak it unless a ransom is paid. Synopsys reports no evidence of breach ^[43].

Newly Discovered Vulnerabilities

Microsoft released a record-breaking Patch Tuesday update, addressing 622 vulnerabilities (including 570 in Windows), with at least two zero-days under active exploitation affecting Active Directory and SharePoint Server, and a publicly disclosed BitLocker bug. Over 60 flaws were rated critical ^[4]^[18]^[19]^[30]^[36]^[39]^[42].
SAP patched multiple critical vulnerabilities in NetWeaver Application Server ABAP (CVSS 9.9), Commerce Cloud, and AppRouter that could allow attackers to access, modify data, cause system unavailability, and desynchronise requests and responses ^[5]^[26]^[47].
Researchers disclosed two access control flaws in RabbitMQ that could allow attackers to leak OAuth client secrets and expose enterprise queue metadata ^[8].
Eleven old Microsoft-signed Linux UEFI shims have been discovered that can be abused to bypass Secure Boot on most modern systems ^[9].
A critical vulnerability remains unpatched in the Claude for Chrome extension, allowing rogue browser extensions to trigger access to Gmail, Google Docs, and Calendar data via Claude tasks ^[6]^[46].
Adobe patched critical ColdFusion vulnerabilities that could allow remote code execution or privilege escalation ^[44].
VMware patched seven severe vulnerabilities in its Avi Load Balancer, including authentication bypass, remote code execution, privilege escalation, and directory traversal ^[45].
Critical vulnerabilities were patched in Chrome 150 and Firefox 152. Public exploit code exists for Firefox flaws, but no in-the-wild exploitation has been observed ^[40].
Researchers found a vulnerability in the Cursor IDE that allows automatic execution of malicious code from poisoned repositories ^[35].
Automated Frequency Coordination systems for 6 GHz Wi-Fi were found to trust client-side data by default, enabling location spoofing and potential disruption of critical systems ^[31].

Notable Threat Actor Activity

At least two threat actors are using OAuth client ID spoofing to validate stolen Microsoft Entra credentials in cloud campaigns, evading detection ^[12].
LabubaRAT, a previously undocumented Rust-based remote access trojan, is masquerading as NVIDIA software to gain persistence and control over Windows hosts ^[7].
Multiple state-sponsored Russian APTs are targeting critical infrastructure routers, exploiting poorly secured devices across sector networks ^[48].
A threat actor is distributing infostealer malware via hundreds of fake GitHub repositories impersonating legitimate projects ^[17].
The D1R group claimed responsibility for alleged attacks on Synopsys and Bosch, demanding ransom for stolen data ^[43].
A trusted ransomware negotiator was discovered to have secretly assisted the BlackCat ransomware gang in extorting victims, constituting an insider threat ^[51].

Trends, Tools, or Tactics of Interest

The ClickFix social engineering technique has emerged as the leading malware delivery method, involving user interaction to copy and execute malicious commands. The ecosystem is now available for rent at scale, can evade AV and EDR, and relies on YARA analysis for detection ^[1]^[34].
AI tools are being leveraged by scammers to geolocate individuals based on social media photos, enabling more targeted social engineering attacks ^[2].
Two new phishing kits, Jalisco and OmegaLord, are targeting Microsoft 365 accounts and using techniques to bypass multi-factor authentication ^[25].
New phishing campaigns are targeting LastPass and Bitwarden users with fake security alerts to lure victims to malicious sites ^[22].
Crypto wallet browser extensions were found to leak address and tracking information, enabling linkage and tracking of users ^[10].
AI-driven security agents are increasingly influencing security operations by summarising findings and prioritising remediation, but most tools remain fragmented ^[11].
Picus described the use of TTP chaining for vulnerability validation without running live exploits, supporting safer risk assessment ^[23].
Cybercriminals are combining FaceTime social engineering with unpatched devices to steal credentials and drain bank accounts ^[50].

Regulatory or Policy Developments Affecting the Security Industry

The US Treasury Department’s OFAC sanctioned two individuals and one entity for enabling ransomware attacks against US organisations, targeting VPN and malware providers ^[28].
US federal prosecutors unsealed charges against three Russian nationals accused of providing bulletproof hosting services to ransomware gangs responsible for over $62 million in damages ^[14].
Nigeria advanced rules mandating the disclosure of cyberattacks by organisations, aligning with a global trend towards required transparency ^[29].
Microsoft announced that passkeys will become the default authentication method for Entra ID enterprise identity service starting September 2026 ^[24].
Several US state governments are moving to legislate transparency in the deployment of frontier AI models, responding to increased independence and reduced human oversight in AI systems ^[33].

Sources

Two SonicWall SMA 1000 Zero-Days Exploited, One Could Enable Admin Commands - thehackernews.com
SonicWall warns of SMA1000 flaws exploited in zero-day attacks, patch now - bleepingcomputer.com
SonicWall Issues Urgent SMA Patch Warning for Two Zero-Day Exploits - securityweek.com
Progress confirms ShareFile zero-day flaw behind Storage Zone shutdown - bleepingcomputer.com
Nearly 300 GitHub repos pose as legit software to push malware - bleepingcomputer.com
Spanish Police take down €140 million cyber fraud ring, arrest four - bleepingcomputer.com
Grok Build Uploaded Entire Git Repositories to xAI Storage, Not Just Files It Read - thehackernews.com
LastPass, Bitwarden users targeted with fake security alerts - bleepingcomputer.com
Synopsys Finds No Evidence of Data Breach Amid Bosch Hack Claims - securityweek.com
Microsoft Patches Record 622 Flaws, Including Two Zero-Days Under Active Attack - thehackernews.com
Microsoft releases Windows 10 KB5099539 extended security update - bleepingcomputer.com
Microsoft July 2026 Patch Tuesday fixes massive 570 flaws, 3 zero-days - bleepingcomputer.com
Records Are Made to Be Broken: Patch Tuesday Raises Triage Stakes - darkreading.com
Microsoft Patches a Record 570 Security Flaws - krebsonsecurity.com
Microsoft Patch Tuesday July 2026 - The AI Acopolypse is Here , (Tue, Jul 14th) - isc.sans.edu
Microsoft Patches Record 622 Vulnerabilities, Including Two Exploited Zero-Days - securityweek.com
SAP Patches CVSS 9.9 NetWeaver ABAP Flaw That Could Expose or Modify Data - thehackernews.com
SAP warns of critical flaws in NetWeaver and Commerce Cloud - bleepingcomputer.com
SAP Patches Critical Vulnerabilities in NetWeaver, Approuter, Commerce Cloud - securityweek.com
RabbitMQ Flaws Could Leak OAuth Secrets and Expose Cross-Tenant Queue Metadata - thehackernews.com
11 Old Microsoft-Signed Linux UEFI Shims Could Let Attackers Bypass Secure Boot - thehackernews.com
Researchers Say Claude for Chrome Flaw Lets Rogue Extensions Trigger Gmail Reads - thehackernews.com
Unpatched Claude for Chrome Flaw Lets Extensions Read Gmail, Calendar - securityweek.com
Adobe Patches Critical ColdFusion Vulnerabilities - securityweek.com
7 Severe Vulnerabilities Patched in VMware Avi Load Balancer - securityweek.com
Critical Vulnerabilities Patched With Fresh Chrome 150, Firefox 152 Updates - securityweek.com
Cursor IDE Auto-Executes Malicious Code in Poisoned Repos - darkreading.com
6 GHz Wi-Fi Flaws Could Disrupt Critical Systems - darkreading.com
OAuth Client ID Spoofing Lets Attackers Validate Stolen Microsoft Entra Credentials - thehackernews.com
LabubaRAT Masquerades as NVIDIA Software to Control Windows Hosts - thehackernews.com
US, Allies Warn of Russian Cyberattacks Targeting Critical Infrastructure Routers - securityweek.com
The inside job that cost ransomware victims millions - malwarebytes.com
ClickFix Social Engineering is Now the Leading Malware Delivery Method - blog.knowbe4.com
ClickFix's Mushrooming Ecosystem Demands New Defense Tactics - darkreading.com
Scammers Can Use AI Tools to Pinpoint Your Location Based on a Photo - blog.knowbe4.com
New phishing kits target Microsoft 365 accounts, evade MFA - bleepingcomputer.com
Study of 85 Crypto Wallet Extensions Finds Address Leaks and Cross-Site Tracking Risks - thehackernews.com
How Pentera Turns AI Security Workflows into Validation Engines - thehackernews.com
You Don't Have to Run an Exploit to Know If You're Vulnerable - bleepingcomputer.com
Warning: Scammers are using FaceTime to empty bank accounts - malwarebytes.com
US sanctions VPN, malware providers for enabling ransomware attacks - bleepingcomputer.com
US charges alleged operators of Russian bulletproof hosting service - bleepingcomputer.com
Nigeria Deepens Cybersecurity Efforts as Cybercriminals See More Profits - darkreading.com
Microsoft Entra ID gets passkeys default authentication starting September - bleepingcomputer.com
Frontier AI: The Genie's Out of the Bottle, but Where's the Rulebook? - darkreading.com

Cybersecurity Brief – 2026-07-03

Fri, 03 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

Google, in coordination with the FBI and industry partners, disrupted the NetNut residential proxy network, which relied on millions of compromised home devices to anonymize cybercriminal and nation-state activity. Hundreds of domains associated with NetNut were seized, significantly degrading the network’s operations ^[4]^[25]^[26].
A dual US-Estonian citizen alleged to be a member of the Scattered Spider hacking collective was extradited to the United States to face charges ^[18].
European Parliament members investigating Pegasus spyware were themselves targeted, with Citizen Lab confirming Pegasus infection on one investigator’s phone ^[24].

Newly Discovered Vulnerabilities

A critical vulnerability in the Cursor AI code editor (DuneSlide) allows zero-click prompt injection attacks that escape the editor’s sandbox and can execute arbitrary code at the operating system level ^[27].
A new WinRAR security flaw has been patched that could allow attackers to take control of a user’s computer. The lack of automatic updates in WinRAR increases the risk of unpatched systems ^[37].
A vulnerability in Apple’s Hide My Email feature, first reported a year ago, remains unpatched and exposes user email addresses ^[35].

Notable Threat Actor Activity

Ransomware groups, including those associated with Anubis, are exploiting the Citrix Bleed 2 (CVE-2025-5777) vulnerability for initial access and are also leveraging bring-your-own-vulnerable-driver (BYOVD) and supply chain credential theft tactics ^[5]^[28].
The threat actor ToddyCat is deploying new Umbrij malware that abuses OAuth to access Gmail accounts via the Google API, enabling covert email access ^[7].
Attackers linked to the FortiBleed campaign have harvested credentials from hundreds of thousands of FortiGate firewalls and are collaborating with the INC and Lynx ransomware gangs, also exploiting a Nextcloud zero-day vulnerability ^[21]^[30].
Ransomware operators are running campaigns that impersonate Interpol, targeting small businesses globally using basic social engineering techniques ^[22].
KnowBe4 ThreatLabs tracked phishing campaigns targeting the FIFA World Cup 2026, with cybercriminals leveraging the event for credential theft and malware distribution ^[3].
ClickFix and ConsentFix attacks are hijacking Microsoft 365 accounts in seconds by exploiting OAuth flows and fake prompts to bypass MFA protections ^[13]^[36].
Fake Google and Cloudflare verification pages are distributing multiple malware families, including infostealers and a new malware loader, through ClickFix-style social engineering ^[36].

Trends, Tools, or Tactics of Interest

Immediate exploitation of newly disclosed vulnerabilities, such as CitrixBleed, is increasing, with attackers using public proof-of-concept code to target NetScaler appliances ^[28].
The first fully autonomous ransomware attack orchestrated by an AI agent (JADEPUFFER) was observed, exploiting a Langflow RCE vulnerability to automate a database ransomware campaign from start to finish ^[9].
ConsentFix and ClickFix attacks demonstrate a trend of using rapid OAuth token theft and social engineering to bypass MFA and compromise cloud accounts ^[13]^[36].
Opera has introduced a Paste Protect feature to mitigate ClickFix-style attacks by blocking malicious command execution via social engineering ^[17].
Context manipulation attacks, such as BioShocking, can trick agentic browsers into exfiltrating sensitive credentials by bypassing their safety guardrails ^[33].
Compromise assessment projects highlight persistent threats, missed incidents, and gaps in incident response across organizations, emphasizing the need for improved detection and response practices ^[1].
Identity lifecycle management models are being challenged by the proliferation of AI agents, which lack traditional employment records and departure dates, complicating access governance ^[8].
IBM and Red Hat have launched Project Lightwell, assigning 20,000 engineers to address open-source software supply chain risks identified by Anthropic’s Mythos AI bug-finding technology ^[23].
There is a shift in cybercrime pressure toward small and medium-sized businesses in Australia as larger institutions improve safeguards and regulatory compliance ^[19].

Regulatory or Policy Developments Affecting the Security Industry

The Court of Justice of the European Union dismissed Google’s final appeal against a €4.1 billion antitrust fine related to Android’s promotion of Chrome and search, upholding significant regulatory action against the company ^[12].
The Trump administration lifted restrictions on Anthropic’s Claude AI models following cybersecurity concerns, making Claude Fable 5 widely available again ^[31].
Apple has revised its long-standing patch policy to accelerate patch cycles in response to attackers leveraging AI to reduce time to exploit, indicating a move toward more rapid security updates ^[20].

Sources

Google Disrupts NetNut Residential Proxy Network Spanning 2 Million Home Devices - thehackernews.com
FBI Seizes NetNut Proxy Platform, Popa Botnet - krebsonsecurity.com
Google, FBI Disrupt NetNut Residential Proxy Network Powered by Millions of Devices - securityweek.com
Alleged Scattered Spider hacker extradited to the United States - bleepingcomputer.com
EU Politicians Investigated Pegasus Spyware. Then It Ended Up on One of Their Phones - wired.com
Critical Cursor AI Code Editor Flaws Could Lead to OS-Level Remote Code Execution - securityweek.com
WinRAR flaw could allow attackers to take control of your computer - malwarebytes.com
Apple’s Hide My Email doesn’t hide it very well - malwarebytes.com
Ransomware Groups Turn to Citrix Bleed 2, BYOVD, and Supply Chain Credentials - thehackernews.com
New CitrixBleed Vulnerability Exploited Immediately After Public Disclosure - securityweek.com
ToddyCat-Linked Umbrij Malware Abuses OAuth to Access Gmail via Google API - thehackernews.com
FortiBleed Actors Collaborating With Inc, Lynx Ransomware Gangs - darkreading.com
FortiBleed Campaign Linked to INC, Lynx Ransomware Attacks - securityweek.com
Ransomware Thugs Masquerade as Interpol to Entice Small Biz - darkreading.com
Cybercriminals Are Targeting the FIFA World Cup 2026 - blog.knowbe4.com
ConsentFix and ClickFix: How Microsoft 365 Accounts are Hijacked in 3 Seconds - bleepingcomputer.com
Fake Google and Cloudflare verification pages spread multiple malware families - malwarebytes.com
AI Agent Exploits Langflow RCE to Automate Database Ransomware Attack - thehackernews.com
Opera rolls out Paste Protect feature to fight ClickFix attacks - bleepingcomputer.com
‘BioShocking’ Attack Tricks AI Browsers Into Stealing Credentials - securityweek.com
Missed incidents, persistent threats, and response gaps: Insights from compromise assessment projects - securelist.com
Identity Lifecycle Management Wasn't Built for AI Agents - thehackernews.com
Anthropic's AI Finds Bugs. IBM Bets $5B It Can Fix Them. - darkreading.com
Aussies Face Reduced Cybercrime Risk, as Pressure Shifts to SMBs - darkreading.com
Google loses final appeal to overturn €4.1 billion EU fine - bleepingcomputer.com
Trump Administration Lifts Restrictions on Anthropic’s Claude Models After Cybersecurity Alarm - securityweek.com
Apple Reverses Age-Old Patch Policy to Keep Up With AI - darkreading.com

Cybersecurity Brief – 2026-07-02

Thu, 02 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

Medtronic has notified customers of a data breach resulting from unauthorized access to personal data, attributed to the ShinyHunters threat actor group ^[19].
Kubota North America Corporation disclosed that hackers had access to parts of its network systems for over a month earlier this year ^[21].
The US Department of Homeland Security confirmed a breach of the Homeland Security Information Network (HSIN), a sensitive information-sharing platform used by government agencies ^[23].
Over 900 Oracle E-Business Suite instances have been found exposed online and are subject to ongoing attacks exploiting a critical security flaw ^[27].

Newly Discovered Vulnerabilities

Adobe released patches for multiple critical vulnerabilities in ColdFusion and Campaign Classic, including seven flaws rated CVSS 10.0 that could lead to arbitrary code execution ^[13]^[37].
Citrix issued patches for NetScaler appliances, addressing six vulnerabilities including a new HTTP/2 Bomb attack and a high-severity CitrixBleed-style information disclosure bug ^[38].
Apple released security updates for iOS, macOS, and Safari, addressing dozens of vulnerabilities affecting WebKit, the kernel, WebRTC, and other components ^[40].
Google released a Chrome update fixing 382 security bugs, with 15 rated as critical ^[46].
Argo CD has an unpatched vulnerability in its repo-server component that allows unauthenticated attackers to execute code if they can access the component ^[8].
Microsoft SharePoint Server vulnerability CVE-2026-45659 has been added to the CISA Known Exploited Vulnerabilities catalog following reports of active exploitation ^[7].
Progress Kemp LoadMaster is affected by a critical pre-authentication remote code execution flaw that is currently seeing active exploitation attempts ^[15].

Notable Threat Actor Activity

Kaspersky researchers identified a large-scale campaign using compromised ScreenConnect software, distributed via SEO-poisoned sites, to deliver AsyncRAT malware ^[1]^[10].
The FortiBleed credential theft campaign has been linked to the INC and Lynx ransomware groups, indicating that stolen Fortinet credentials are intended to facilitate future network intrusions and ransomware attacks ^[20].
A 19-year-old suspected member of the Scattered Spider hacking group has been extradited from Finland to the US to face hacking and fraud charges ^[9].
The Ousaban banking trojan is targeting users in Spain and Portugal with phishing PDF lures to infect Windows systems ^[12].
A new campaign is delivering the PureLogs information stealer through a multi-stage malware chain leveraging Blogger pages and social engineering ^[11].
Multiple weaponized proof-of-concept (PoC) exploits on GitHub are distributing the ChocoPoC remote access trojan, targeting vulnerability researchers ^[6]^[22].

Trends, Tools, or Tactics of Interest

Attackers are using fingerprinting via user-agent data to adapt phishing payloads to the victim’s device and operating system, increasing compromise rates ^[30].
ClickFix, a social engineering technique, is reported as a dominant method for malware delivery ^[31].
AI-generated browser ransomware has been observed abusing the Chromium API across Windows, Linux, macOS, and Android, combining novel attack paths with real browser capabilities ^[16]^[43].
A fake Perplexity Chrome extension, “Search for perplexity ai,” was found to be spying on user searches and requires manual removal ^[44].
Large language models (LLMs) are being exploited for “phantom squatting,” where hallucinated domains for legitimate brands are registered by attackers for supply chain attacks ^[32].
Two vulnerabilities in the AI code editor Cursor could allow prompt injection to escape the sandbox and execute arbitrary commands on a developer’s machine ^[14].
Phishing attacks have exposed employee data at 86 percent of Fortune 100 companies in the past year, with technology, airline, and automotive sectors most affected ^[4].
Hackers conducted over 81 million password-spraying login attempts against Microsoft 365 accounts in a two-week period ^[25].

Regulatory or Policy Developments Affecting the Security Industry

Microsoft announced it is accelerating its post-quantum cryptography roadmap, targeting a transition by 2029 due to advances in quantum computing ^[18].
The US Federal Trade Commission fined Amazon $2.25 million for withholding transaction records from identity theft victims, impacting fraud investigations ^[29].
Microsoft introduced new Teams admin policies requiring organizer approval for external AI bots in meetings, enhancing control over automated participants ^[36].

Sources

Medtronic notifies customers impacted by ShinyHunters data breach - bleepingcomputer.com
Kubota says hackers had month-long access to network systems - bleepingcomputer.com
DHS confirms hackers breached HSIN info-sharing platform - bleepingcomputer.com
Over 900 Oracle E-Business instances exposed to ongoing attacks - bleepingcomputer.com
Adobe Patches 7 CVSS 10.0 Flaws in ColdFusion and Campaign Classic - thehackernews.com
Adobe Patches Critical ColdFusion, Campaign Classic Vulnerabilities - securityweek.com
Citrix Patches NetScaler Vulnerabilities, Including New ‘HTTP/2 Bomb’ Attack - securityweek.com
Apple Patches Dozens of Vulnerabilities Across iOS, macOS, and Safari - securityweek.com
Chrome needs another whopper update to fix 382 security bugs - malwarebytes.com
Unpatched Argo CD Repo-Server Flaw Could Let Attackers Take Over Kubernetes Clusters - thehackernews.com
SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation - thehackernews.com
Progress Kemp LoadMaster Pre-Auth RCE Flaw Faces Active Exploitation Attempts - thehackernews.com
The SOC Files: ScreenConnect masked as freeware. An inside look at a large-scale campaign - securelist.com
SEO-Poisoned Software Sites Abuse ScreenConnect to Deploy AsyncRAT - thehackernews.com
FortiBleed credential-theft campaign linked to Lynx ransomware - bleepingcomputer.com
19-Year-Old Scattered Spider Suspect Extradited to Face U.S. Hacking Charges - thehackernews.com
Ousaban Banking Trojan Targets Iberian Bank Users with Fake PDF Lures - thehackernews.com
VEIL#DROP Malware Chain Uses Blogger Platform to Deliver PureLogs Stealer - thehackernews.com
New ChocoPoC RAT Targets Vulnerability Researchers via Fake PoC Exploit Repos - thehackernews.com
New ChocoPoC malware targets researchers via trojanized PoC exploits - bleepingcomputer.com
Crafty Phishing Campaigns Auto-Adapt to Victim's Device, OS - darkreading.com
And the Winner in Dominant Malware Delivery? ClickFix - darkreading.com
AI-Generated Browser Ransomware Abuses Chromium API on Windows, Linux, macOS, Android - thehackernews.com
Browser-Only Ransomware: From LLM Hallucinations to a Practical Attack Technique - research.checkpoint.com
Fake Perplexity Chrome extension spies on your searches - malwarebytes.com
'Phantom Squatting': An Emerging AI-Driven Supply Chain Threat - darkreading.com
Critical Cursor Flaws Could Let Prompt Injection Escape Sandbox and Run Commands - thehackernews.com
Phishing Exposes Employee Data at 86% of Fortune 100 Companies - blog.knowbe4.com
Hackers target Microsoft 365 accounts with 81 million login attempts - bleepingcomputer.com
Microsoft Accelerates Post-Quantum Cryptography Shift to 2029 - thehackernews.com
Amazon fined $2.25M for withholding evidence from fraud victims - bleepingcomputer.com
Microsoft Adds New Teams Controls to Block Unauthorized AI Bots From Meetings - securityweek.com

Cybersecurity Brief – 2026-04-17

Fri, 17 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

The ShinyHunters extortion group leaked data from 13.5 million McGraw Hill user accounts, obtained after breaching the company’s Salesforce environment.
Cookeville Regional Medical Center in Tennessee reported a data breach affecting 337,000 individuals after a Rhysida ransomware attack that resulted in 500GB of data theft.
A new campaign in the Czech Republic is actively targeting workers with the previously undocumented PowMix botnet, using randomized C2 traffic.
ZionSiphon malware has been identified as targeting operational technology in water treatment and desalination facilities, aiming to sabotage operations.
A DHL-themed phishing campaign is distributing remote access software designed to facilitate further malware deployment, including ransomware.
Attackers are exploiting a critical vulnerability in Marimo reactive Python notebook to deploy NKAbuse malware via Hugging Face Spaces.
A fake Slack installer is being used to provide attackers with a hidden desktop environment on victim machines for data and account access.
The ShinyHunters group leaked data from 13.5 million McGraw Hill user accounts, stolen via a Salesforce breach.
A data breach at Cookeville Regional Medical Center affected 337,000 individuals due to a ransomware attack.

Newly Discovered Vulnerabilities

Cisco released patches for four critical vulnerabilities in Identity Services Engine (ISE) and Webex Services, which could allow remote code execution or user impersonation. One Webex flaw requires customer action to be fully remediated.
A high-severity vulnerability in Apache ActiveMQ Classic (CVE-2026-34197) is under active exploitation and has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog.
Splunk Enterprise patched a vulnerability allowing low-privileged users to upload files to a temporary directory and achieve remote code execution.
A critical vulnerability in Cursor AI could be exploited through chained prompt injection and sandbox bypass, enabling shell access to developer machines.
Three recently disclosed Windows zero-days are being actively exploited to gain SYSTEM or elevated administrator privileges.
A second Microsoft Defender zero-day, “RedSun,” with a published proof-of-concept, enables SYSTEM privilege escalation.
Microsoft’s April 2026 security updates are causing reboot loops on some Windows domain controllers.
A 17-year-old remote code execution vulnerability in Microsoft Excel has been highlighted as still present and exploitable.

Notable Threat Actor Activity

Operation PowerOFF, an international law enforcement effort, seized 53 DDoS-for-hire domains, arrested four individuals, and identified 75,000 DDoS service users across 21 countries, exposing 3 million criminal accounts.
The North Korean threat group Sapphire Sleet is using fake job offers and fraudulent Zoom updates to deliver ClickFix malware, targeting macOS users to steal credentials and sensitive data.
U.S. nationals were sentenced for operating a “laptop farm” supporting North Korean IT workers in obtaining jobs at over 100 U.S. companies, including defense contractors.
Adware previously considered benign, “Dragon Boss,” was updated to establish persistence and disable Windows Defender, facilitating future malware delivery.
The Lumma Stealer malware is being used in conjunction with the Sectop RAT (ArechClient2) for credential theft and remote access.
A new cybercrime platform, ATHR, is enabling automated voice phishing (vishing) attacks using both human operators and AI agents to harvest credentials.
Hackers are exploiting a Marimo notebook flaw to deploy NKAbuse malware hosted on Hugging Face Spaces.

Trends, Tools, or Tactics of Interest

AI is increasingly being integrated into security operations, with mixed results: KnowBe4 reports improved administration and lower cyber risk using AI agents, while most “AI SOCs” are noted as only improving triage speed rather than reducing workload.
Google is expanding the use of Gemini AI models to detect and block malicious ads as threat actors evolve their tactics to evade detection.
Social engineering through software supply chain attacks continues, with Obsidian plugin abuse delivering PHANTOMPULSE RAT in targeted attacks on finance and cryptocurrency sectors.
Forgotten or unmanaged non-human identities (e.g., service accounts, API keys) are cited as a leading cause of cloud breaches, accounting for 68% in 2024.
A Taboola pixel approved by a bank was found to redirect logged-in banking sessions to a Temu tracking endpoint without consent or security review.
Two-factor authentication is being promoted as a needed security layer beyond traditional IT environments due to increasing threat actor sophistication.
OpenAI has expanded access to its GPT‑5.4‑Cyber model, designed to support defenders in cybersecurity operations.
Malware campaigns are increasingly leveraging trojanized installers (e.g., Slack) and themed phishing emails (e.g., DHL, iCloud) to distribute remote access tools and steal credentials.

Regulatory or Policy Developments Affecting the Security Industry

NIST announced it will limit enrichment of CVEs in the National Vulnerability Database due to a 263% increase in submissions, prioritizing those in the CISA KEV catalog and critical software.
Microsoft’s original Windows Secure Boot certificate is expiring, requiring coordinated updates across the Windows ecosystem.
The EU has launched an anonymous online age verification app, making it freely available to companies for compliance with age-restriction regulations.

Cybersecurity Brief – 2026-01-07

Wed, 07 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Jaguar Land Rover (JLR) reported a 43% decline in third-quarter wholesale volumes following a cyberattack in September 2025.
Sedgwick confirmed a security breach at its federal contractor subsidiary, Sedgwick Government Solutions.
Two malicious Chrome extensions, installed by approximately 900,000 users, were found exfiltrating ChatGPT and DeepSeek conversations and browsing data.
NordVPN denied a breach after a threat actor leaked data allegedly sourced from the company; an internal investigation is ongoing.
Researchers linked dozens of major data breaches to a single initial access broker using credentials exfiltrated by information stealers.
A phishing campaign is actively abusing Google Cloud Integration Application infrastructure to steal Microsoft 365 credentials, bypassing standard email filters.

Newly Discovered Vulnerabilities

A critical remote code execution vulnerability (CVE-2026-0625, CVSS 9.3) in legacy D-Link DSL gateway routers is under active exploitation. The affected devices are out of support.
An unpatched firmware flaw in the TOTOLINK EX200 wireless range extender allows remote authenticated attackers full device takeover.
A critical Dolby vulnerability (CVE-2025-54957) in Android, discovered by Google researchers, has been patched.
AI-powered VS Code forks (Cursor, Windsurf, Google Antigravity, Trae) recommend non-existent extensions, creating a supply chain risk in the Open VSX ecosystem.

Notable Threat Actor Activity

The Kimwolf Android botnet, an Aisuru malware variant, has infected over two million hosts by exploiting vulnerabilities in residential proxy networks to target internal devices.
Scattered Lapsus$ Hunters (ShinyHunters) were lured into a honeypot using synthetic data and fake accounts, allowing researchers to gather intelligence on their infrastructure and tactics.
A campaign named PHALT#BLYX targets the hospitality sector with fake booking emails that redirect hotel staff to counterfeit blue screen of death (BSoD) pages, leading to DCRat remote access trojan infections.
Chinese threat actors increased cyberattacks on Taiwan’s energy sector tenfold in 2025 compared to the previous year, according to Taiwan’s National Security Bureau.
An initial access broker has been linked to numerous major data breaches using credentials harvested by information-stealing malware.

Trends, Tools, or Tactics of Interest

Generative AI is accelerating credential attacks against Active Directory, enabling faster and more effective password cracking.
AI-generated images and videos are being used in misinformation campaigns during breaking news events, complicating verification and increasing the risk of disinformation.
Paid AI-powered tools capable of generating “undressed” images are becoming more accessible and mainstream via platforms such as X (formerly Twitter).
The ClickFix campaign uses legitimate Microsoft tools and social engineering (fake BSoD errors) to deploy DCRat RAT, particularly targeting the hospitality industry.
Tailsnitch, a new tool for auditing Tailscale configurations, has been released to improve overlay network security.
Debate continues around whether prompt injection and sandbox-related issues in Microsoft Copilot constitute true security vulnerabilities or are inherent limitations of AI systems.
Cyber risk management is shifting focus toward resilience and rapid recovery rather than solely prevention.

Regulatory or Policy Developments

Disney was fined $10 million by the FTC for violating children’s privacy laws by mislabeling kid-focused YouTube videos.
Microsoft canceled its planned daily limit of 2,000 external recipients for Exchange Online bulk email senders.
Thirty significant cybersecurity M&A deals were announced in December 2025, involving major industry players such as Akamai, Red Hat, Checkmarx, Silent Push, and ServiceNow.

Cybersecurity Brief – 2026-01-06

Tue, 06 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Brightspeed, a major US broadband provider, is investigating claims of a security breach and data theft made by the Crimson Collective extortion gang. The group alleges theft of personal information of over 1 million customers.
Sedgwick confirmed a cyberattack on a file transfer system at its government subsidiary, affecting agencies it serves.
Ledger notified customers of a data breach at third-party payment processor Global-e, resulting in exposure of personal data.
Multiple corporate data theft incidents have been linked to threat actor Zestix, who breached ShareFile, Nextcloud, and OwnCloud instances and is offering stolen data from dozens of companies.
Artisans’ Bank and VeraBank, two US banks, disclosed security incidents.
NordVPN denied breach claims, stating that attackers only accessed dummy data from a third-party automated testing platform.
No evidence of cyberattack was found in the communications failure that grounded flights in Greece.

Newly Discovered Vulnerabilities

n8n, an open-source workflow automation platform, disclosed a critical vulnerability (CVSS 9.9) allowing authenticated users to execute arbitrary system commands.
The “@adonisjs/bodyparser” npm package is affected by a critical vulnerability (CVSS 9.2) enabling arbitrary file writes on servers.
A critical ‘MongoBleed’ vulnerability in MongoDB allows unauthenticated attackers to extract passwords and tokens via a memory leak. The flaw is under active attack.
VSCode IDE forks, including Cursor, Windsurf, Google Antigravity, and Trae, expose users to attacks via non-existent “recommended extensions” that can be abused for malicious purposes.
Risks associated with newer IP-based KVM devices have been highlighted, as out-of-band access could introduce security concerns.
WhatsApp metadata leak through device fingerprinting was reported, with Meta rolling out fixes.

Notable Threat Actor Activity

Russia-aligned group UAC-0184 targeted Ukrainian military and government entities by delivering malicious ZIP archives via the Viber messaging platform.
The Kimwolf Android botnet has infected over 2 million devices, leveraging exposed ADB interfaces and residential proxy networks for DDoS attacks, app installs, and proxy bandwidth resale.
Zestix is offering for sale corporate data stolen from cloud file-sharing platforms.
The Crimson Collective extortion gang claimed responsibility for the Brightspeed breach.
US cyber professionals pleaded guilty to working as affiliates of the ALPHV/BlackCat ransomware group.
The RondoDox botnet has expanded operations by exploiting React2Shell vulnerabilities, targeting Next.js servers for cryptomining and botnet payload delivery.
New VVS Stealer malware, written in Python, is targeting Discord accounts to harvest credentials and tokens.

Trends, Tools, or Tactics of Interest

The ClickFix social engineering campaign is targeting the European hospitality sector, using fake Windows Blue Screen of Death (BSOD) screens to trick users into executing malware.
Threat actors are increasingly abusing cloud file-sharing platforms for corporate data theft.
The Kimwolf botnet demonstrates the growing use of residential proxy networks for botnet expansion and monetization.
AI-powered IDEs recommending non-existent extensions present a new supply chain risk vector.
Agentic AI adoption is raising identity management challenges, with AI agents acting as a new class of identity that CISOs must manage.
CISA’s Known Exploited Vulnerabilities (KEV) catalog expanded by 20% in 2025, now including 1,484 entries, with 24 new vulnerabilities known to be exploited by ransomware groups.
Automated License Plate Reader (ALPR) surveillance is discussed as a privacy and security concern.
Ineffectiveness of AI guardrails was highlighted following an incident involving Grok generating inappropriate content.

Regulatory or Policy Developments Affecting the Security Industry

The early release of Ilya Lichtenstein, convicted for the Bitfinex cryptocurrency exchange hack, under the US First Step Act, was reported.

Cybersecurity Brief – 2025-11-18

Tue, 18 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

Eurofiber France disclosed a data breach after hackers exploited a vulnerability in its ticket management system, resulting in exfiltration of customer information. The breach was discovered after the attacker attempted to sell the data.
Princeton University reported a data breach on 10 November 2025, exposing personal information of alumni, donors, faculty, and students.
DoorDash confirmed a data breach involving compromise of names, addresses, email addresses, and phone numbers after an employee was targeted in a social engineering attack.
The Pennsylvania Attorney General’s office confirmed a data breach following an August 2025 ransomware attack by the INC Ransom group, with personal and medical information stolen.
Logitech confirmed a data breach after being listed by the Cl0p ransomware group. The incident is linked to the Oracle E-Business Suite exploitation.
Dutch police seized approximately 250 servers used by a bulletproof hosting service that provided infrastructure for cybercriminals.

Newly Discovered Vulnerabilities

Google released security updates for Chrome to address two vulnerabilities, including CVE-2025-xxxx, a V8 zero-day flaw under active exploitation, reportedly by a commercial spyware vendor.
A critical remote code execution vulnerability in Fortinet FortiWeb WAF is being actively exploited in the wild, allowing unauthenticated attackers to execute administrative commands.
The RondoDox botnet is exploiting CVE-2025-24893, a critical RCE vulnerability in XWiki Platform. Widespread exploitation has been observed, including by botnets, crypto miners, and custom tools.
Seven malicious npm packages are abusing the Adspect cloud-based service to redirect researchers while leading victims to malicious payloads.
A vulnerability in DoorDash’s email systems allowed attackers to send spoofed, official-looking emails from DoorDash servers, creating a significant phishing risk. DoorDash has since patched the issue.
Researchers identified a security weakness in the AI-powered coding tool Cursor, enabling credential-stealing attacks via a malicious MCP server hijacking the internal browser.

Notable Threat Actor Activity

The Dragon Breath threat actor is using a multi-stage loader (RONINGLOADER) to disable security tools and deploy a modified Gh0st RAT in recent campaigns.
Iranian state-sponsored APTs are targeting defense and government officials, including their family members, in ongoing campaigns to increase pressure on primary targets.
The Aisuru botnet launched a 15.72 Tbps DDoS attack against Microsoft Azure, leveraging over 500,000 IP addresses.
The EVALUSION ClickFix campaign is deploying Amatera Stealer and NetSupport RAT via social engineering techniques.
Cl0p ransomware group continues to exploit Oracle E-Business Suite (CVE-2025-61882), with associated data breaches including Logitech.
Scammers are sending fake copyright violation messages to steal X (formerly Twitter) logins.

Trends, Tools, or Tactics of Interest

Phishing attacks are increasingly shifting to non-email channels, with LinkedIn and other platforms now accounting for 1 in 3 phishing incidents.
ClickFix social engineering tactics are being widely adopted in malware distribution campaigns.
Malicious packages in open-source repositories such as npm are using cloud-based redirectors to evade detection and target victims.
Bulletproof hosting services remain a critical enabler for cybercriminal infrastructure, as evidenced by recent law enforcement action in the Netherlands.
Attackers are leveraging vulnerabilities in widely used platforms (e.g., XWiki, FortiWeb, Oracle E-Business Suite) for large-scale exploitation.
DDoS attacks are increasing in scale and sophistication, as demonstrated by the recent record-setting attack on Microsoft Azure.

Regulatory or Policy Developments Affecting the Security Industry

In the US, five individuals pleaded guilty to assisting North Korean IT workers in obtaining employment at US companies by providing false identities and remote access to company laptops, highlighting ongoing law enforcement efforts against supply chain and insider threats.
Microsoft released an out-of-band Windows 10 update (KB5072653) to address issues with installing Extended Security Updates, ensuring continued compliance for organizations relying on legacy systems.

Cybersecurity Brief – 2025-10-22

Wed, 22 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

The PassiveNeuron cyber-espionage campaign has been reported targeting high-profile servers in government, industrial, and financial sectors across Asia, Africa, and Latin America. Attackers are deploying custom Neursite and NeuralExecutor APT implants alongside Cobalt Strike to maintain persistence and exfiltrate data.
CISA has confirmed active exploitation of an Oracle E-Business Suite SSRF vulnerability (CVE-2025-61884) and has added it to its Known Exploited Vulnerabilities catalog.
Over 73,000 WatchGuard Firebox devices are impacted by a critical flaw in the Fireware OS iked process, allowing unauthenticated remote code execution.
Myanmar military authorities have shut down a major cybercrime centre, detaining over 2,000 individuals involved in global cyberscam operations.

Newly Discovered Vulnerabilities

TP-Link Omada gateway devices are affected by four newly disclosed vulnerabilities, including two critical flaws enabling remote code execution and a critical pre-auth OS command injection. Security updates have been released.
Cursor and Windsurf IDEs have been found to contain over 94 n-day vulnerabilities inherited from outdated Chromium and V8 JavaScript engine components.
CISA has issued warnings about exploited vulnerabilities in Apple, Kentico, and Microsoft products, involving code execution, authentication bypass, and privilege escalation.
A supply chain attack has been identified targeting VS Code extensions with ‘GlassWorm’ malware, which leverages invisible Unicode characters for obfuscation and uses blockchain-based infrastructure for resilience.

Notable Threat Actor Activity

The PolarEdge botnet is actively targeting Cisco, ASUS, QNAP, and Synology routers in an expanding campaign, as documented by researchers.
Russian state-backed group Star Blizzard has increased deployment of evolving malware families (NoRobot, MaybeRobot), using complex delivery chains that begin with compromised “I am not a robot” CAPTCHA pages.
Fraud campaigns targeting streaming platforms are increasingly using generative AI and bots to create and promote fake content.

Trends, Tools, or Tactics of Interest

Email phishing campaigns in 2025 are leveraging PDF attachments with QR codes, password-protected PDFs, calendar phishing, and advanced phishing sites capable of validating email addresses.
Vidar Stealer 2.0 has been released, featuring multi-threaded data theft and enhanced evasion capabilities, reinforcing its position as a leading malware-as-a-service operation.
Hackers exploited 34 zero-day vulnerabilities on the first day of Pwn2Own Ireland 2025, demonstrating continued interest and success in vulnerability research.
Social engineering attacks are targeting Salesforce accounts via fake support calls.
Research from Anthropic indicates that poisoning AI models can be achieved with as few as 250 malicious documents, highlighting the susceptibility of AI systems to data poisoning.
Streaming fraudsters are increasingly using AI tools and bots for large-scale manipulation.
Electronic warfare and GPS interference are affecting a wide range of commercial sectors beyond aviation, including shipping, agriculture, and finance.

Regulatory or Policy Developments Affecting the Security Industry

CISA has updated its Known Exploited Vulnerabilities list to include recent vulnerabilities affecting Oracle, Apple, Kentico, and Microsoft products.
Meta has introduced new tools and warnings on WhatsApp and Messenger to help protect users from scams.
Allan Friedman, a leading figure in Software Bill of Materials (SBOM) advocacy, has joined NetRise as a strategic advisor to advance supply chain visibility.
Veeam has announced the acquisition of Securiti AI for $1.7 billion, aiming to unify data resilience with data security, privacy, and governance.
Dataminr is set to acquire ThreatConnect for $290 million to combine data signal analysis with internal threat intelligence capabilities.

Cybersecurity Brief – 2025-09-12

Fri, 12 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

The UK train operator LNER disclosed a data breach involving a third-party supplier, resulting in the compromise of customer contact information and other data.
Panama’s Ministry of Economy and Finance reported a cyberattack claimed by the INC ransomware group, with indications that at least one computer was compromised.
Cornwell Quality Tools suffered a ransomware attack attributed to the Cactus group, impacting approximately 100,000 individuals.
Vyro AI experienced a data leak, attributed to poor cyber hygiene, exposing proprietary or sensitive data.
Apple issued warnings to customers targeted in a recent series of spyware attacks, as confirmed by the French national CERT (CERT-FR).
Microsoft Exchange Online experienced an outage in North America, disrupting email access for customers.
Meta faces whistleblower allegations of ignoring child sex abuse risks within its VR “metaverse” environment.

Newly Discovered Vulnerabilities

A critical use-after-free vulnerability in Google Chrome was patched, which could have allowed code execution.
Cisco patched high-severity vulnerabilities in IOS XR that could allow ISO image verification bypass and denial-of-service attacks.
A security weakness in the AI-powered Cursor code editor was disclosed, enabling silent code execution when opening malicious repositories.
A new Spectre-like attack, VMScape, was identified that allows a malicious VM to leak cryptographic keys from a QEMU hypervisor on AMD and Intel CPUs.
A critical access control vulnerability (CVE-2024-40766) in SonicWall SSLVPN devices is being actively exploited.
Apple CarPlay was found to have a remote code execution exploit that remains unaddressed in most vehicles.
Researchers demonstrated that the ThrottleStop.sys driver can be weaponized by the Gentlemen ransomware to disable antivirus and EDR solutions.

Notable Threat Actor Activity

The Akira ransomware group is actively exploiting the SonicWall SSLVPN vulnerability (CVE-2024-40766) and related misconfigurations to gain initial access to targeted environments.
Fake browser extensions, including “Madgicx Plus” and “SocialMetrics,” are being distributed via malicious ads and websites to hijack Meta Business Accounts and steal sensitive data.
The Vidar infostealer has resurfaced with new evasion techniques and enhanced data exfiltration capabilities.
AI-backed malware, attributed to the EvilAI group, is leveraging legitimate-sounding productivity apps to deliver Trojans with advanced evasion against antivirus solutions.
A phishing campaign is abusing iCloud Calendar invites sent via Apple infrastructure to deliver PayPal-themed phishing messages.
Scam text messages impersonating Bureau of Motor Vehicles are targeting motorists for personal and banking information.
Romance scams continue, with a recent case involving an “astronaut-in-distress” scenario resulting in financial loss to an elderly victim.

Trends, Tools, or Tactics of Interest

Attackers are increasingly leveraging legitimate credentials and simple login methods rather than exploiting technical vulnerabilities, highlighting a trend of “logging in” rather than “hacking in.”
AI-generated deepfake scams are rising, prompting the FBI and American Bankers Association to issue joint guidance for awareness and mitigation.
Jailbreaking of AI models remains a challenge, with the UAE’s K2 Think AI model being compromised through its own transparency features hours after release.
The use of malvertising and fake browser extensions to hijack business accounts is increasing.
Memory Integrity Enforcement, a new security architecture in Apple’s latest iPhones, aims to mitigate memory-related vulnerabilities.
Google Pixel 10 devices now support the C2PA standard for verifying the authenticity and provenance of digital media.
Microsoft has added malicious link warnings to Teams private chats to enhance user protection.
Security researchers are focusing on AI pen testing, including social engineering and behavioral manipulation techniques for large language models.
The security of browser extensions remains a significant concern, with risks of data exfiltration and adversary-in-the-middle (AitM) attacks.
Overloaded SOCs are increasingly turning to AI for alert triage and automation, though concerns remain about AI introducing new risks if not properly overseen.

Regulatory or Policy Developments Affecting the Security Industry

U.S. Senator Ron Wyden has urged the Federal Trade Commission to investigate Microsoft for alleged “gross cybersecurity negligence” related to ransomware incidents, specifically referencing Windows security and Kerberoasting attacks.
The European Union imposed financial sanctions on Stark Industries Solutions Ltd., a bulletproof hosting provider, though the company continues to operate by evading these sanctions.

Cybersecurity Brief – 2025-09-11

Thu, 11 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Jaguar Land Rover (JLR) confirmed a data breach following a recent cyberattack that forced system shutdowns and operational disruptions. Some company data was stolen in the incident.
The New York Blood Center began notifying affected individuals about a data breach resulting from a ransomware attack, confirming user data was stolen.
Plex, a media streaming platform, reported a data breach and advised users to reset their passwords.
The largest known supply-chain attack in the NPM ecosystem impacted approximately 10% of all cloud environments. Despite the scale, attackers reportedly gained little financial benefit.
An open-source developer known as “qix” disclosed a compromise of their GitHub account after being socially engineered to surrender access credentials.
A DDoS mitigation service provider in Europe was targeted by a distributed denial-of-service attack peaking at 1.5 billion packets per second.

Newly Discovered Vulnerabilities

Microsoft released patches for 80 vulnerabilities, including a publicly disclosed flaw, an SMB privilege escalation vulnerability, and Azure bugs rated CVSS 10.0.
Fortinet, Ivanti, and Nvidia issued security updates addressing high-severity vulnerabilities that could allow remote code execution, privilege escalation, information disclosure, and configuration tampering.
Rockwell Automation published eight security advisories as part of ICS Patch Tuesday, with additional advisories from Siemens, Schneider Electric, Phoenix Contact, and CISA.
A weakness in the Cursor AI code editor was identified, allowing repositories to automatically execute malicious code on a developer’s device when opened.

Notable Threat Actor Activity

Chinese APT groups have been linked to multiple high-profile incidents:
- A Chinese APT deployed the previously undocumented EggStreme fileless malware framework to compromise a Philippines-based military company.
- APT41, a China-linked group, is conducting ongoing cyber espionage campaigns targeting U.S. trade officials amid 2025 negotiations, as formally warned by the U.S. House Select Committee on China.
- Chinese state-backed actors have been observed posing as a U.S. congressman in spear-phishing attacks.
AsyncRAT is being distributed via compromised ConnectWise ScreenConnect installations to steal credentials and cryptocurrency.
Hacktivist and APT groups targeting Russian organizations have been analyzed and classified into three clusters based on their tactics, techniques, and procedures (TTPs).
The U.S. announced a $10 million reward for information leading to the arrest of Volodymyr Tymoshchuk, accused of deploying LockerGoga, MegaCortex, and Nefilim ransomware against hundreds of organizations.

Trends, Tools, or Tactics of Interest

The use of “shadow AI”-unauthorized or unmanaged AI tools by employees-is highlighted as an increasing security risk for organizations.
A new Phishing-as-a-Service kit, Salty2FA, has emerged, targeting U.S. and EU enterprises and focusing on bypassing two-factor authentication.
Two new malware families were identified:
- CHILLYHELL, a modular macOS backdoor with multiple persistence mechanisms, password brute-forcing, payload dropping, and multi-protocol communication.
- ZynorRAT, a Go-based remote access trojan capable of targeting macOS, Windows, and Linux systems.
BASE64 encoding over DNS is being used as a data exfiltration technique by certain backdoors.
Google is implementing C2PA Content Credentials in the Pixel 10 camera and Google Photos to verify image authenticity and counter AI-generated fakes.
Students are increasingly posing insider threats within the education sector, often unintentionally but at a scale challenging for security teams.
Social engineering remains a significant vector, as demonstrated by the Scattered Spider group breaching Clorox through phone-based help desk manipulation, leading to $380 million in damages.

Regulatory or Policy Developments Affecting the Security Industry

CISA presented its vision for the Common Vulnerabilities and Exposures (CVE) program, indicating ongoing evolution in vulnerability management and disclosure processes.
Apple introduced Memory Integrity Enforcement (MIE) in new iPhone models, providing always-on memory safety protections for the kernel and over 70 userland processes.
The U.S. is increasing scrutiny and financial incentives related to ransomware operators, exemplified by the $10 million reward targeting a Ukrainian ransomware actor.
The number of U.S. investors in commercial spyware companies increased sharply in 2024, with new countries identified as linked to the proliferation of such tools.

Cybersecurity Brief – 2025-08-06

Wed, 06 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Pandora, the Danish jewelry retailer, confirmed a data breach after customer information was stolen in connection with ongoing Salesforce data theft attacks. The company warned customers of potential phishing attempts using their stolen data.
Cisco disclosed a data breach affecting Cisco.com user accounts after a voice phishing (vishing) attack targeted a company representative. Stolen data includes names, email addresses, and phone numbers.
PBS suffered a data breach resulting in the exposure of corporate contact information for employees and affiliates, which was subsequently leaked on Discord servers.

Newly Discovered Vulnerabilities

Google released security updates for Android, addressing six vulnerabilities in its August 2025 update. Two patched Qualcomm vulnerabilities (including an Adreno GPU flaw) were confirmed as actively exploited in the wild.
Adobe issued emergency patches for two zero-day vulnerabilities in Adobe Experience Manager (AEM) Forms on JEE. Proof-of-concept exploit chains allowing unauthenticated remote code execution had been published.
CISA added three legacy D-Link router vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog following reports of active exploitation.
A critical vulnerability (CVE-2025-54136, “MCPoison”) was disclosed in the Cursor AI-powered code editor, enabling persistent remote code execution via malicious MCP file swaps post-approval. This flaw poses a software supply chain risk.
SonicWall warned administrators to disable SSLVPN on Gen 7 firewalls amid a surge in ransomware attacks exploiting a suspected zero-day vulnerability. The company is actively investigating.
Public exploits for Microsoft SharePoint vulnerabilities (CVE-2025-53770, CVE-2025-53771) have been observed in the wild, with attackers reportedly stealing machine keys.

Notable Threat Actor Activity

A widespread phishing campaign is targeting Instagram users with fake notifications about failed login attempts, aiming to harvest credentials.
A global campaign leveraging 15,000 fake TikTok Shop domains is distributing malware and stealing cryptocurrency via AI-driven scams. Threat actors are using trojanized apps and credential theft tactics.
ClickFix social engineering attacks, which employ CAPTCHAs and sophisticated narratives to evade detection, have seen increased adoption over the past year, facilitating cross-platform malware infections.
Ransomware gangs are suspected of exploiting a SonicWall firewall zero-day in recent attacks.
The cybercrime underground continues to rely heavily on traditional attack methods, including phishing and social engineering, despite increasing professionalization and organisation.

Trends, Tools, or Tactics of Interest

Automated and AI-driven adversarial testing is gaining prominence, with vendors showcasing solutions at Black Hat USA 2025 and commentary on the transformation of penetration testing through AI.
Microsoft unveiled Project Ire, an autonomous AI agent capable of reverse engineering software to detect malware.
Attackers are increasingly using vishing (voice phishing) to compromise corporate accounts, as demonstrated in the Cisco breach.
HTTP request smuggling remains a relevant attack vector, with recent educational content highlighting its exploitation potential.
The distinction between misconfigurations and vulnerabilities in SaaS environments is being emphasised, as confusion between the two can result in overlooked security risks.
Security operations centers (SOCs) continue to struggle with alert fatigue, with industry discussion focused on strategies to reduce false positives and improve incident detection.
The rapid proliferation of AI-assisted development tools is raising concerns about software supply chain security and the challenge of securing code produced by non-traditional developers.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft announced an increase in the prize pool for its Zero Day Quest hacking contest to $5 million, incentivizing research into high-impact vulnerabilities, particularly in cloud and AI security.

Cybersecurity Brief – 2025-08-05

Tue, 05 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Chanel has suffered a data breach as part of a broader wave of attacks targeting Salesforce data, joining other organisations affected by this campaign.
Northwest Radiologists disclosed a data breach impacting 350,000 individuals, with personal information stolen in an incident dating back to January 2025.
Russia’s largest airline, Aeroflot, was reportedly attacked, according to Check Point’s latest threat intelligence report.

Newly Discovered Vulnerabilities

SonicWall is investigating a potential zero-day vulnerability in its SSL VPN devices after a surge in targeted attacks, notably by the Akira ransomware group.
NVIDIA patched multiple critical vulnerabilities in its Triton Inference Server for Windows and Linux. These flaws could allow unauthenticated remote code execution, model theft, data leaks, and response manipulation on AI servers.
A previously undocumented Linux backdoor, dubbed “Plague,” was discovered. The malware, implemented as a malicious PAM module, enables persistent SSH access, bypasses authentication, and removes traces of SSH sessions. It is reported to have evaded detection for over a year.
Proton fixed a vulnerability in its Authenticator iOS app where TOTP secrets were logged in plaintext, potentially exposing multi-factor authentication codes.
Several vulnerabilities were patched in the AI code editor Cursor, which previously allowed attackers to modify sensitive MCP files and execute arbitrary code without user approval.

Notable Threat Actor Activity

Vietnamese threat actors are distributing a Python-based information stealer known as PXA Stealer. The campaign has compromised over 4,000 IP addresses and stolen 200,000 passwords globally.
Akira ransomware operators have escalated attacks using SonicWall SSL VPN devices, leveraging a suspected zero-day for initial access.
Ransomware gangs are exploiting a Microsoft SharePoint vulnerability chain, resulting in breaches of at least 148 organisations.
North Korean IT workers continue to seek fraudulent employment at Western companies, as highlighted in a new FBI advisory.
The “ClickTok” campaign is targeting TikTok Shop users with phishing and trojanised apps, leading to crypto wallet theft and spyware infections.
Mozilla warned of an ongoing phishing campaign targeting add-on developers via its official AMO repository.

Trends, Tools, or Tactics of Interest

Attackers are leveraging Microsoft Teams calls for social engineering, convincing users to install the Matanbuchus malware loader, which is often a precursor to ransomware deployment.
Threat actors are increasingly utilising generative AI tools to enhance offensive cyber operations, including social engineering and malware development.
Recent malware campaigns are adopting advanced evasion techniques, such as blending into legitimate developer workflows and documenting themselves to appear benign.
The proliferation of shadow IT remains a concern, with employees installing unauthorised plugins and tools, increasing organisational risk.
Cisco demonstrated that AI guardrails can be bypassed, allowing sensitive data to be extracted from chatbots trained on proprietary content.

Regulatory or Policy Developments Affecting the Security Industry

CISA and FEMA announced over $100 million in grants to help US states, tribes, and localities enhance cybersecurity resilience.
Illumina agreed to a $9.8 million settlement over allegations that its gene sequencing products supplied to the US government contained cybersecurity vulnerabilities.
Sean Cairncross has been confirmed by the US Senate as National Cyber Director.
Darktrace has acquired Mira Security, contributing to ongoing consolidation in the cybersecurity sector, with 44 M&A deals announced in July 2025.

Cybersecurity Brief – 2025-08-02

Sat, 02 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Akira ransomware has been observed exploiting SonicWall SSL VPN devices in a surge of attacks since late July 2025, reportedly targeting fully-patched devices and suggesting exploitation of a likely zero-day vulnerability.
Pi-hole disclosed a data breach resulting from exploitation of a vulnerability in the GiveWP WordPress donation plugin, exposing donor names and email addresses.
A malicious npm package, @kodane/patch-manager, generated using AI, was identified and removed after it was used to drain Solana cryptocurrency funds from over 1,500 victims.
Microsoft is investigating whether the ToolShell exploit was leaked via the Microsoft Active Protections Program (MAPP).
Russian state-sponsored APT group Secret Blizzard (Nobelium) conducted adversary-in-the-middle (AitM) attacks at the ISP level targeting foreign embassies in Moscow, leading to malware infections on diplomatic devices.
An Apple ID phishing scam in Ohio led to an in-person theft of $27,000 from a victim.

Newly Discovered Vulnerabilities

A high-severity remote code execution vulnerability, dubbed CurXecute, affecting almost all versions of the AI-powered Cursor code editor, has been patched. The flaw allowed attackers to execute commands via prompt injection.
SonicWall SSL VPN devices are reportedly being exploited via a previously unknown (zero-day) vulnerability in ongoing Akira ransomware attacks.
Recent vulnerabilities in Microsoft SharePoint Server have been exploited by threat actors to deploy bespoke command-and-control frameworks.

Notable Threat Actor Activity

Akira ransomware operators are actively exploiting SonicWall SSL VPN devices, with evidence suggesting the use of a zero-day vulnerability.
Threat actors are using fake Microsoft OAuth applications, leveraging the Tycoon Kit, to breach Microsoft 365 accounts and facilitate credential harvesting.
The threat actor Storm-2603 is exploiting Microsoft SharePoint vulnerabilities to deploy a DNS-controlled backdoor using a custom C2 framework (AK47 C2) as part of Warlock and LockBit ransomware campaigns.
Russian APT Secret Blizzard is conducting sophisticated AitM attacks against foreign diplomatic targets in Moscow.

Trends, Tools, or Tactics of Interest

Increased use of AI by attackers, including the creation of malicious npm packages for cryptocurrency theft.
Prompt injection remains a practical and exploitable attack vector against AI-powered developer tools.
Only about half of the code generated by large language models (LLMs) is considered secure, raising ongoing concerns about the security of AI-generated code.
The SIEM market is undergoing transformation as XDR platforms and generative AI impact security analytics.
New malware techniques such as “Shade BIOS” allow malware to persist and operate independently of the operating system, evading traditional detection and remediation.
Cybercriminals are increasingly targeting Gen Z, recognising young, digitally native workers as a distinct and vulnerable attack surface.

Regulatory or Policy Developments Affecting the Security Industry

The US Department of Homeland Security (DHS) has launched over $100 million in funding to strengthen community cyber defences.
A bipartisan US Senate bill has been introduced to create a national strategy for quantum cybersecurity migration, aimed at preparing federal agencies for quantum computing threats.
ISC2 has launched a new security certificate programme focused on AI expertise, covering AI fundamentals, ethics, and associated risks.
Microsoft has increased the maximum reward for its .NET bug bounty programme to $40,000 for valid reports of remote code execution or privilege escalation vulnerabilities.
Meta is sponsoring the upcoming Pwn2Own Ireland 2025 hacking contest, with a $1 million reward for a demonstrated zero-click WhatsApp exploit.

Cybersecurity Brief – 2025-07-15

Tue, 15 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Louis Vuitton has notified customers in the UK, South Korea, Turkey, and possibly other countries of a data breach affecting their personal information.
McDonald’s has suffered a data breach resulting in the exposure of customer data.
Two versions of the Gravity Forms WordPress plugin, distributed via the official download page, were compromised in a supply chain attack, with malware injected into the plugin.
A malicious Visual Studio Code extension for the Cursor AI IDE led to the theft of $500,000 in cryptocurrency from a Russian crypto firm, after infecting devices with remote access tools and infostealers.
India’s Central Bureau of Investigation (CBI) dismantled a transnational cybercrime syndicate responsible for a £390,000 UK tech support scam, arresting key operatives at a Noida call center.

Newly Discovered Vulnerabilities

Multiple Gigabyte motherboard models have UEFI firmware vulnerabilities that allow attackers to bypass Secure Boot and install persistent bootkit malware invisible to the operating system and capable of surviving OS reinstalls.
Vulnerabilities in Gigabyte firmware could allow attackers to disable Secure Boot and execute code during the early boot phase, facilitating backdoor deployment.
A vulnerability in train End-of-Train and Head-of-Train radio systems allows remote attackers to trigger train brakes; this issue has been known in the industry for 20 years.
CISA has added the recently disclosed CitrixBleed 2 vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, designating it as an unacceptable risk.
Google Gemini AI assistant is vulnerable to prompt-injection attacks, allowing attackers to craft invisible, malicious prompts that can be used to display phishing messages, including when summarising emails in Google Workspace.

Notable Threat Actor Activity

The Interlock ransomware group is distributing a new PHP-based variant of its remote access trojan (RAT) using a delivery mechanism called FileFix, in campaigns targeting multiple industries. The group is leveraging the KongTuke Traffic Distribution System (TDS) and legitimate websites for web-inject campaigns to gain control of victim devices.
Cybercriminals are impersonating major news outlets (CNN, BBC, CNBC) via sponsored ads and fake news websites to lure victims into investment scams.
Scattered Spider threat actor arrests have been reported, indicating law enforcement action against this group.
Exposed Git repositories continue to be a source of sensitive data leaks across enterprises, representing a persistent but often overlooked risk.

Trends, Tools, or Tactics of Interest

There is a reported increase in honeypot log volumes, indicating a rise in scanning and malicious activity observed on internet-facing systems.
The UserAssist Windows artifact, including previously undocumented binary data structures, has been detailed for forensic and incident response purposes, with a new parsing tool released.
Attackers are increasingly targeting supply chains, as evidenced by the compromise of the Gravity Forms WordPress plugin.
The use of prompt-injection attacks against AI assistants is an emerging tactic for phishing and social engineering.

Regulatory or Policy Developments Affecting the Security Industry

The UK National Cyber Security Centre (NCSC) has launched the Vulnerability Research Initiative (VRI), a new programme to strengthen collaboration with external cybersecurity experts for vulnerability discovery and reporting.

Cybersecurity Brief – 2025-07-11

Fri, 11 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Four individuals were arrested in the UK for cyberattacks targeting major retailers Marks & Spencer, Co-op, and Harrods. The suspects are believed to be connected to the Scattered Spider group, which has also targeted airlines and other sectors.
Qantas confirmed a data breach affecting 5.7 million customers. Exposed information includes names, addresses, email addresses, phone numbers, and other personal data.
Nippon Steel’s NS Solutions subsidiary suffered a breach exposing customer and employee data. There is currently no evidence of the data being leaked on dark web sites.
Ingram Micro experienced a ransomware attack that disrupted online ordering for customers. The company has since restored operations.
McDonald’s suffered a data exposure incident involving its AI-powered job application bot, which allowed access to applicant data using a weak default password.

Newly Discovered Vulnerabilities

CISA added CVE-2025-5777, a critical vulnerability in Citrix NetScaler ADC and Gateway, to its Known Exploited Vulnerabilities (KEV) catalog, citing active exploitation.
A critical remote code execution vulnerability was discovered in the open-source mcp-remote project, affecting over 437,000 downloads.
Multiple critical vulnerabilities, dubbed “PerfektBlue,” were identified in the BlueSDK Bluetooth stack used by Mercedes, Volkswagen, and Skoda vehicles. These flaws could allow remote code execution and potential access to critical vehicle systems.
A high-severity flaw, CVE-2025-3648, was disclosed in the ServiceNow platform. Exploitation could lead to data exposure via misconfigured access control lists (ACLs).
AMD disclosed a new class of vulnerabilities called Transient Scheduler Attacks, impacting a wide range of its CPUs and potentially allowing information disclosure.
A 6-year-old Oracle vulnerability affecting eSIM technology was disclosed, enabling potential spying and device takeover across millions of phones.
The Model Context Protocol (MCP) ecosystem, widely adopted for integrating AI models with external data, was found to have critical security vulnerabilities opening new attack vectors.

Notable Threat Actor Activity

Scattered Spider, a data theft and extortion group, has shifted its targeting to the aviation and transportation sectors, according to warnings from the FBI and cybersecurity experts.
Kaspersky identified malicious open-source packages for Cursor AI that deploy the Quasar backdoor and a cryptocurrency stealer.
Ongoing social engineering campaigns are using fake gaming and AI startup firms on Telegram and Discord to distribute malware targeting cryptocurrency users.
A new ZuRu malware variant is propagating via trojanized versions of the Termius macOS app, targeting developers.
Deepfake attacks are being used to impersonate high-profile political figures, such as Marco Rubio, to attempt to extract government secrets.
A Russian professional basketball player was arrested in France at the request of the US for allegedly acting as a negotiator for a ransomware gang.

Trends, Tools, or Tactics of Interest

AI-driven attacks are becoming more sophisticated, faster, and pervasive, with increased use of generative AI in offensive operations.
SSH tunneling, specifically direct-tcp requests, is highlighted as an active technique.
Force Push Scanner is a new tool for red teams to identify leaked secrets in ephemeral GitHub commits.
Anubis, an open-source self-hosted firewall, is being used to block AI bots from scraping website content.
SIM swap fraud is reportedly increasing, highlighting ongoing risks to mobile-based authentication.
Microsoft replaced the default JScript engine with JScript9Legacy in Windows 11 version 24H2 and later, aiming to improve scripting security.

Regulatory or Policy Developments

The FBI issued guidance on CJIS (Criminal Justice Information Services) compliance, emphasizing password hygiene, multi-factor authentication, and access control for law enforcement data handlers.
The U.S. Department of Homeland Security is advising law enforcement to treat certain protest activities as violent tactics, including livestreaming and skateboarding, potentially affecting policing and surveillance practices.
CISA’s update to the KEV catalog with Citrix NetScaler CVE-2025-5777 signals heightened regulatory attention to actively exploited enterprise vulnerabilities.

Cybersecurity Brief – 2025-07-02

Wed, 02 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Qantas disclosed a cyberattack involving unauthorised access to a third-party platform containing customer data.
Kelly Benefits reported a 2024 data breach impacting 550,000 customers’ personal information.
Esse Health notified over 263,000 patients of a breach in April that compromised personal and health information.
Johnson Controls began notifying individuals affected by a 2023 ransomware attack that impacted global operations.
The International Criminal Court is investigating a new “sophisticated” cyberattack on its systems.

Newly Discovered Vulnerabilities

Google patched a Chrome zero-day vulnerability (CVE-2025-6554) that is being actively exploited in the wild, the fourth such Chrome zero-day addressed in 2025.
Researchers identified a critical vulnerability in Anthropic’s Model Context Protocol (MCP) Inspector project, exposing developer machines to remote exploits.
A new flaw in IDEs such as Visual Studio Code, Visual Studio, IntelliJ IDEA, and Cursor allows malicious extensions to bypass verified status, undermining extension security controls.
A new FileFix attack has been observed that executes malicious JScript while bypassing Windows Mark of the Web (MoTW) protections by exploiting browser handling of saved HTML webpages.

Notable Threat Actor Activity

Unknown threat actors are weaponizing Vercel’s v0 generative AI tool to rapidly create fake login pages for phishing at scale.
Tactical overlaps have been observed between TA829 (linked to RomCom RAT) and the UNK_GreenSec cluster, including shared infrastructure and the use of a loader dubbed TransferLoader.
The Silver Fox group is suspected of targeting Taiwanese entities using sideloading techniques to deliver Gh0stRAT variants, leveraging lures related to DeepSeek’s LLM.
North Korean IT workers have infiltrated technology, manufacturing, and transportation sectors globally to steal funds and data, with the U.S. DoJ arresting a facilitator, seizing 29 domains, and disrupting 21 “laptop farms” across 16 states.
The U.S. Treasury sanctioned Russian hosting provider Aeza Group and four operators for providing bulletproof hosting to ransomware and infostealer operators.

Trends, Tools, or Tactics of Interest

Attackers are exploiting AI and generative tools (e.g., Vercel’s v0) to automate and scale phishing campaigns.
Threat actors are increasingly targeting browsers through zero-day vulnerabilities and malicious extensions, highlighting browser security as an enterprise risk.
FileFix attacks demonstrate continued evolution in bypassing Windows security features, specifically MoTW.
Sideloading remains a prevalent technique for malware delivery, as seen in Silver Fox’s campaign.
Concerns are raised over the potential manipulation of large language models (LLMs) for phishing, similar to previous SEO poisoning tactics.
Cyber insurers have shifted assessment practices in response to the uptick in ransomware incidents, focusing on previously overlooked security weaknesses.

Regulatory or Policy Developments

The U.S. Department of Justice and Treasury have taken coordinated action against North Korean cyber-enabled financial operations and Russian cybercrime infrastructure.
The U.S. Senate has removed a ban on state-level AI regulations from a tax bill, allowing states to enact their own AI legislation in the absence of a federal framework.
AT&T launched a “Wireless Lock” feature to help protect customers from SIM swapping attacks by restricting changes to account information and phone number porting.

Cybersecurity Brief – 2025-05-10

Sat, 10 May 2025 00:00:00 +0000

Major Incidents or Breaches

Ascension Healthcare Breach: Ascension, a major US healthcare provider, disclosed a data breach affecting over 430,000 patients, exposing personal and healthcare information.
Insight Partners Data Breach: Ongoing investigation reveals the impact of the breach at venture capital firm Insight Partners is larger than initially anticipated, with affected customers being notified incrementally.
Japanese Financial Account Compromise: Hackers breached nearly 5,000 Japanese financial accounts in April, conducting almost $2 billion in fraudulent trades across nine securities firms.
LockBit Ransomware Gang Breach: LockBit’s affiliate panel was compromised, leaking sensitive operational data including Bitcoin addresses, private victim chats, and user credentials.

Newly Discovered Vulnerabilities

Firefox ESR 115.11 PDF.js Vulnerability: High-risk arbitrary JavaScript execution vulnerability identified in PDF.js within Firefox ESR 115.11, enabling potential remote code execution.
Apache ActiveMQ 6.1.6 Denial of Service: Medium-risk vulnerability in Apache ActiveMQ 6.1.6 allows attackers to trigger denial of service conditions.

Notable Threat Actor Activity

Proxy Botnet Takedown: US and Dutch authorities dismantled a botnet of over 7,000 IoT and end-of-life devices used as residential proxies (Anyproxy and 5socks). Four foreign nationals (three Russian, one Kazakhstani) have been charged.
Chinese APT Targeting SAP NetWeaver: Ongoing exploitation of a critical SAP NetWeaver vulnerability has been linked to a Chinese threat actor, according to Forescout Vedere Labs.
North Korean OtterCookie Campaign: Updated OtterCookie v4 malware, used by North Korean actors, now features enhanced VM detection and capabilities for Chrome and MetaMask credential theft.
Initial Access Brokers in Brazil: Campaigns targeting Brazilian executives leverage NF-e-themed spam and trial versions of legitimate remote monitoring and management (RMM) tools to gain initial access.
Hacktivist Campaigns (#OpIndia): Following the Pahalgam attack, hacktivists have united under the #OpIndia banner, escalating cyber activity in the India-Pakistan conflict context.

Trends, Tools, and Tactics

Malicious npm Packages: Over 3,200 users of the macOS version of the Cursor AI code editor were infected with backdoored npm packages designed for credential theft.
Phishing Kit Sophistication: Emergence of advanced phishing kits capable of auto-generating customised login pages to evade detection and increase success rates.
Password and Passkey Risks: Even with passkey adoption, residual password vulnerabilities persist, highlighting the need for comprehensive credential management.
Polymorphic Browser Extension Threats: New threats targeting password managers via polymorphic browser extensions pose significant risks to credential security.
Vulnerability Management Challenges: Security teams continue to struggle with the reactive nature of vulnerability management and patching delays due to policy constraints.
AI Security Risks: Increased deployment of AI agents introduces new attack surfaces, including risks of data leaks and identity theft.

Regulatory or Policy Developments

German Law Enforcement Action: German authorities shut down the eXch cryptocurrency mixer, seizing assets linked to cybercrime proceeds and laundering activities.
US Border Surveillance Expansion: US Customs and Border Protection plans to expand facial recognition for vehicle exits, while the US surveillance watchdog recommends transparency and voluntary participation for airport facial recognition programmes.
Google AI Countermeasures: Google is rolling out on-device AI protections (Gemini Nano LLM) in Chrome and Android to detect and block scams, including tech support scams, enhancing user protection through automated detection.

Other Notable Industry Updates

Rapid7 MDR Launch: Rapid7 has introduced a new Managed Detection & Response (MDR) service for enterprise customers.