https://blog.dansec.red/vendors/databricks/Recent content in Databricks on DanSec DailyHugoen-gbTue, 31 Mar 2026 00:00:00 +0000https://blog.dansec.red/posts/2026-03-31-cybersecurity-news/Tue, 31 Mar 2026 00:00:00 +0000https://blog.dansec.red/posts/2026-03-31-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li>The Dutch Ministry of Finance took its treasury banking portal and some systems offline following a detected cyberattack, as investigations into the breach continue.</li> <li>Healthcare IT firm CareCloud disclosed a data breach exposing sensitive patient data and causing an eight-hour network disruption.</li> <li>The European Commission reported a cyber intrusion and data theft, with the ShinyHunters group claiming to have stolen over 350GB of information from Commission cloud systems.</li> <li>The FBI confirmed Iranian hackers compromised the personal email account of Kash Patel, noting the data accessed was outdated.</li> <li>Researchers report that nearly 66 billion stolen identity records are now circulating on criminal forums, a 23% increase from the previous year.</li> <li>Stolen tax documents are being actively sold on the dark web, with prices ranging from $4 to $20 per identity.</li> <li>TeamPCP supply chain campaign continues to expand, with Telnyx targeted and Databricks investigating an alleged compromise. The campaign involves dual ransomware operations and data leaks, including AstraZeneca data.</li> </ul> <h2 id="newly-discovered-vulnerabilities">Newly Discovered Vulnerabilities</h2> <ul> <li>Citrix NetScaler ADC and Gateway appliances are affected by a critical memory leak vulnerability (CVE-2026-3055) that is being actively exploited to obtain sensitive data, including authenticated administrative session IDs. CISA has ordered U.S. federal agencies to patch the flaw by Thursday.</li> <li>F5 BIG-IP APM vulnerability (CVE-2025-53521), initially classified as a high-severity DoS, has been reclassified as a critical remote code execution (RCE) vulnerability. Active exploitation has been observed, with attackers deploying webshells on unpatched devices.</li> <li>A previously unknown vulnerability in OpenAI ChatGPT allowed exfiltration of sensitive conversation data without user consent. Additionally, a critical vulnerability in OpenAI Codex was discovered that could have enabled compromise of GitHub tokens.</li> <li>A critical, alleged “no-click” vulnerability in Telegram, reportedly triggered by a corrupted sticker and rated 9.8 CVSS, is being disputed by Telegram.</li> <li>A newly identified RoadK1ll WebSocket implant enables lateral movement within breached networks.</li> <li>Axios npm package versions 1.14.1 and 0.30.4 were compromised in a supply chain attack, pushing a malicious dependency.</li> <li>Apple added a security feature in macOS Tahoe 26.4 to block potentially harmful commands in Terminal, specifically targeting ClickFix attack vectors.</li> </ul> <h2 id="notable-threat-actor-activity">Notable Threat Actor Activity</h2> <ul> <li>Russian-origin CTRL remote access toolkit is being distributed via malicious LNK files masquerading as private key folders. The toolkit hijacks RDP sessions using FRP tunnels.</li> <li>Russian APT Star Blizzard is using the DarkSword iOS exploit kit in campaigns targeting government, higher education, financial, legal, and think tank sectors.</li> <li>Iranian state-affiliated threat group Handala Hack has been linked to recent attacks, and Iran-linked groups are increasingly turning to high-volume, low-impact cyberattacks, often leveraging AI.</li> <li>The ShinyHunters group claimed responsibility for the European Commission data theft.</li> <li>TeamPCP is running dual ransomware operations and leveraging compromised software supply chains to target multiple organisations.</li> </ul> <h2 id="trends-tools-or-tactics-of-interest">Trends, Tools, or Tactics of Interest</h2> <ul> <li>Secrets sprawl is accelerating, with GitGuardian reporting a significant increase in exposed secrets across public Git repositories in 2025.</li> <li>The DeepLoad malware loader, distributed via ClickFix social engineering, uses AI-assisted code obfuscation and WMI persistence to evade detection and steal browser credentials.</li> <li>LLMs (Large Language Models) are increasingly used by attackers and defenders; however, improper use can inadvertently weaken access controls due to errors or hallucinations in generated policy code.</li> <li>Application control bypass techniques are being used for data exfiltration, highlighting ongoing risks of data loss even where backup policies are robust.</li> <li>AI-powered SOC agents are being evaluated for their impact on alert fatigue and operational efficiency, with Gartner providing guidance on assessment.</li> <li>Manufacturing and healthcare sectors continue to struggle with access management, often viewing it as a roadblock, while attackers exploit weak password practices.</li> </ul> <h2 id="regulatory-or-policy-developments-affecting-the-security-industry">Regulatory or Policy Developments Affecting the Security Industry</h2> <ul> <li>CISA issued a directive requiring U.S. federal agencies to patch Citrix NetScaler appliances against an actively exploited vulnerability by Thursday.</li> <li>Apple has implemented mandatory age checks for certain UK users and introduced new macOS security features to counter emerging threats like ClickFix.</li> </ul>