Firefox on DanSec Daily

Cybersecurity Brief – 2026-10-29

Thu, 29 Oct 2026 00:00:00 +0000

Major Incidents or Breaches

Sony Network Communications, a subsidiary ISP, confirmed a data breach exposing approximately 2.5 to 2.6 million customer records, including personal information, 54,401 email account passwords, and 16 bank account records ^[22]^[29].
Over 41,000 US Department of Homeland Security (DHS) employee records, including undercover ICE agents, were leaked online by a hacktivist group, exposing names, offices, contact details, and assignments. The data was reportedly stolen from an Okta single sign-on system earlier in 2026 and published by DDoSecrets ^[28]^[43]^[66]^[72].
The Belgian Federal Public Service Finance temporarily suspended tax services following a cyberattack, which occurred just before a filing deadline ^[45].
Japan Airlines disclosed a breach affecting about 2,000 customers, with stolen passport numbers, frequent flyer numbers, email addresses, and phone numbers ^[48].
The University of New Mexico restored hospital systems after a cyberattack that forced ambulance diversions and class cancellations at its medical school ^[46].

Newly Discovered Vulnerabilities

A critical vulnerability in UEFI firmware, widely used in servers and data centers, allows attackers to execute code early in the boot process, impacting most servers globally ^[42].
Cisco released patches for a high-severity flaw in ASA and FTD VPN software that has been actively exploited to crash firewalls via remote, unauthenticated access. This marks the second exploited Cisco firewall VPN zero-day since August ^[6]^[19]^[31].
A flaw in Telegram for Android allowed attackers to execute code on a victim’s device when answering a voice call. Only an ordinary phone number was needed for exploitation ^[3].
Attackers attempted to exploit a critical GitLab vulnerability (CVE-2026-9783) on Alpine Linux’s GitLab server shortly after a patch was released ^[8].
Adobe, Veeam, and Juniper Networks issued patches for critical vulnerabilities that could lead to arbitrary code execution, authorization bypass, and privilege escalation ^[26].
Oracle E-Business Suite flaw CVE-2026-101767 is under active exploitation attempts, with decoys recording exploratory exploits ^[63]^[52].
Apple released a security update for older iPhones and iPads, backporting a fix for a CoreGraphics flaw reportedly exploited in targeted attacks ^[90].
Researchers demonstrated that logic bugs alone, without memory corruption, can be chained to escape the Microsoft Edge sandbox and execute code on Windows systems ^[14].
Researchers found vulnerabilities in the browsers built into several AI coding assistants (VS Code, Cursor, Copilot, Codex, Claude Desktop), allowing web pages to break out of the assistant’s browser sandbox ^[61].

Notable Threat Actor Activity

The China-linked APT group Volt Typhoon used a covert, ephemeral access network known as “Silent Train,” built from rapidly rotating chains of compromised devices, to conduct zero-day exploitation and strategic intrusions targeting hundreds of critical infrastructure networks ^[12]^[23]^[62]^[74]^[30].
Volt Typhoon also exploited a Cisco Catalyst SD-WAN flaw to deploy custom malware (KeyDrift) designed to steal encryption keys, with infrastructure overlapping the Silent Train network ^[9]^[30]^[87].
Chinese state-sponsored actors exploited a VMware ESX zero-day logging flaw (CVE-2026-41709) to reduce audit trail visibility, allowing operations by attackers with administrative privileges to go unlogged ^[10]^[33].
A suspected China-nexus threat actor leveraged PHP2Shell vulnerabilities to root 25 servers and breach a US government-affiliated network, including chaining with a high-severity Fragnesia Linux kernel privilege escalation bug ^[11]^[15]^[17].
The GOLD OGRE threat group used AI in the development, orchestration, and execution of Aur0ra ransomware operations ^[84].
A Ukrainian affiliate of Hive and Nefilim ransomware gangs was sentenced to 70 months in US prison for attacks targeting businesses and hospitals ^[34]^[53].
Attackers used fake ChatGPT and Claude projects to distribute Yoba malware, hiding malicious code behind signed binaries ^[60].
Malicious Firefox extensions impersonated popular crypto wallets to steal recovery phrases and private keys ^[89].
A threat actor impersonated AI bots from OpenAI, Anthropic, and Meta to scan for exposed credentials ^[39].
Attackers abused legitimate Mobile Device Management (MDM) platforms to deploy rogue remote management tools, turning device management into a pathway for remote access and persistence ^[93].
GitHub issues were weaponized in a supply chain attack campaign targeting 61 public repositories in less than an hour, exploiting vulnerable workflows ^[50].

Trends, Tools, or Tactics of Interest

AI is increasingly used both offensively and defensively in cybersecurity. Google introduced Gemini 4 Carbon, a frontier AI model outperforming predecessors in vulnerability discovery, exploitation, and patching ^[1]^[64].
Cisco open sourced Project Quarry, a rules language to detect AI agent attacks that emerge across sequences of benign actions ^[25].
Cisco Talos observed a new AI-enabled command-and-control framework in the wild, dubbed NIK C2 ^[86].
AI agents are now capable of controlling authenticated browsers, interacting with corporate applications, and accessing sensitive data while mimicking legitimate users ^[16].
The supply chain attack campaign “GhostAction” shifted toward targeting developer endpoints and cloud access, indicating evolving tactics among cybercrime groups ^[37].
Online scam volumes have doubled and now outpace phishing, with over six million scam detections in Q2 2026 ^[55].
Phishing remains the leading initial access technique, while ransomware and pre-ransomware cases have increased, with finance and public administration being the top-targeted industries ^[85].
Attackers are increasingly hiding malware behind signed binaries of AI tools to evade detection ^[60].
Credential exposure continues to be a significant risk, with 26,400 valid cloud and AI credentials found in public Gitee repositories ^[5].
Attackers are turning GitHub issues into attack vectors for supply chain campaigns, automating exploitation of vulnerable workflows ^[50].
The use of AI-enabled tools such as Gemini 4 Carbon and NIK C2, as well as AI-assisted attack orchestration by groups like GOLD OGRE, demonstrates the growing sophistication of threat actors ^[1]^[64]^[84]^[86].

Regulatory or Policy Developments Affecting the Security Industry

The UK released a shortlist of age verification methods for its upcoming under-16 social media ban, noting that some adults will also require verification ^[49].
The UK Information Commissioner’s Office (ICO) reprimanded Staffordshire Police following a serious breach of personal information related to domestic abuse cases ^[56].
CREST published a framework advocating a whole-ecosystem approach to strengthening cyber resilience across the financial services sector ^[54].
The US National Institute of Standards and Technology (NIST) published guidance for federal agencies on prioritizing post-quantum cryptography adoption to meet the 2031 transition deadline ^[57].
Microsoft again urged Entra ID administrators to migrate users to phishing-resistant authentication methods ahead of the planned retirement of SMS and voice authentication in February 2027 ^[24].
A federal appellate court ruled that West Virginia’s law barring disclosure of public officials’ personal data is unconstitutional ^[47].
US law enforcement seized the primary domain of Virtualine, a major bulletproof hosting provider used to facilitate cybercrime and ransomware operations ^[20]^[71].

Sources

Sony ISP subsidiary data breach exposes 2.5 million customer records - bleepingcomputer.com
Hackers Steal 2.6 Million Records From Sony’s Japanese ISP So-net - securityweek.com
Over 41,000 DHS Employee Records Leaked Online - securityweek.com
Massive Leak Exposes 41,000 Homeland Security Workers—Including Undercover ICE Agents - wired.com
Hacktivists leak 41,000 DHS staff records, revealing undercover ICE agents - helpnetsecurity.com
Leak site publishes data on more than 41,000 DHS employees obtained by hacktivists - cyberscoop.com
Cyberattack disrupts Belgian tax services before filing deadline - therecord.media
Japan Airlines warns of data breach as country grapples with multiple cyber incidents - therecord.media
University of New Mexico restores hospital systems, urges no contact with hackers - therecord.media
Most Servers on the Planet Are Vulnerable to This Firmware Code-Execution Flaw - wired.com
Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls - thehackernews.com
New Cisco firewall zero-day exploited to crash SSL VPN devices - bleepingcomputer.com
Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August - securityweek.com
Telegram Android Flaw Lets Attackers Run Code When Users Answer Voice Calls - thehackernews.com
Attacker Tried to Exploit Alpine Linux’s GitLab via CVSS 10.0 Flaw Its Ruby Left Open - thehackernews.com
Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities - securityweek.com
Exploitation attempts against recently patched Oracle EBS flaw have begun (CVE-2026-101767) - helpnetsecurity.com
Oracle celebrates end of Cybersecurity Awareness Month with quadruple trouble - theregister.com
Have an older iPhone or iPad? Apple has a security update for you - malwarebytes.com
Researcher Reveals How Logic Bugs Alone Cracked Microsoft Edge in $175,000 Pwn2Own Win - thehackernews.com
Researchers broke the browsers built into VS Code, Cursor, Copilot, Codex and Claude Desktop - helpnetsecurity.com
Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns - thehackernews.com
Volt Typhoon hides zero-day attacks using 'Silent Train' framework - bleepingcomputer.com
Volt Typhoon targeted enterprise control planes via ever-changing “Silent Train” relay network - helpnetsecurity.com
Researchers uncover Volt Typhoon’s covert, ephemeral network - cyberscoop.com
Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network - securityweek.com
Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys - thehackernews.com
Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN - blog.talosintelligence.com
China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility - thehackernews.com
Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day - securityweek.com
Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces - thehackernews.com
PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network - thehackernews.com
CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks - bleepingcomputer.com
AI used in Aur0ra ransomware testing and execution - sophos.com
Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison - securityweek.com
Serial ransomware crook gets 70 months behind bars for Nefilim, Hive roles - theregister.com
Attackers Hide Malware Behind Signed ChatGPT and Claude Binaries - infosecurity-magazine.com
Malicious Firefox extensions impersonate popular crypto wallets - malwarebytes.com
Attacker Relentlessly Scans for Credentials by Impersonating AI Bots - darkreading.com
Managed for Malice: How Attackers Turn MDM into Remote Access - huntress.com
Attackers turn GitHub issues into supply chain campaign against 61 public repos in less than an hour - theregister.com
Google's Gemini 4 Carbon Leads Benchmarks for Finding, Exploiting, and Patching Vulnerabilities - thehackernews.com
Google says Gemini 4 Carbon beats its predecessors at finding and fixing security flaws - helpnetsecurity.com
Cisco Open Sources Quarry to Catch AI Agent Attacks Hidden in Harmless Steps - securityweek.com
NIK C2: The new AI-enabled command-and-control framework - blog.talosintelligence.com
3 Ways AI Agents Already Operate in Your Browser - bleepingcomputer.com
GhostAction Hacking Wave Fizzles, But Attackers Lurk on in GitHub - darkreading.com
Online Scam Volumes Double to Overtake Phishing - infosecurity-magazine.com
IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases - blog.talosintelligence.com
26,400 Valid Cloud and AI Credentials Found Exposed in Public Gitee Repositories - thehackernews.com
Shortlist of age checks for the UK's under-16 social media ban is out, 'some' adults will need verifying - theregister.com
ICO Reprimands Staffordshire Police After Domestic Abuse Breach - infosecurity-magazine.com
CREST Urges Whole-Ecosystem Approach to Financial Cyber Resilience - infosecurity-magazine.com
NIST Publishes Guidance to Meet Federal Post-Quantum Deadlines - infosecurity-magazine.com
Microsoft urges Entra ID admins to migrate users to passkeys - bleepingcomputer.com
Court strikes down West Virginia law barring disclosure of public officials’ personal data - therecord.media
Police seize Virtualine bulletproof service tied to ransowmare, cybercrime - bleepingcomputer.com
Officials seize domain of top bulletproof hosting provider Virtualine - cyberscoop.com

Cybersecurity Brief – 2026-08-12

Wed, 12 Aug 2026 00:00:00 +0000

Major Incidents or Breaches

Wesco, a global supply chain and distribution company, is investigating a cybersecurity incident following claims by the ExfilSquad group of data theft from the company ^[30].
Mozilla revoked and updated the cryptographic signing key for Firefox and Thunderbird Linux releases after an unencrypted copy was accidentally committed to a private code repository, potentially impacting the integrity of downloads ^[17]^[31].
Fake CCleaner websites are distributing multi-stage malware that installs the GhostDesk spyware extension in Chrome browsers ^[54].
Attackers are using fake branded download pages to trick Windows users into installing legitimate remote-access software, which is then abused for unauthorized access ^[60].

Newly Discovered Vulnerabilities

SAP patched a maximum-severity flaw in Commerce Cloud (Data Hub Adapter) that allowed unauthenticated remote code execution ^[6]^[52].
Microsoft addressed nearly 400 vulnerabilities in its August Patch Tuesday, including a Windows kernel driver zero-day (afd.sys) under active attack for privilege escalation to SYSTEM, with three zero-days in total patched ^[9]^[28]^[37]^[40]^[42]^[48].
A proof-of-concept exploit named ShieldBreak was released, demonstrating a Microsoft Defender patch bypass that grants SYSTEM access ^[7].
Cisco Secure Firewall ASA and FTD vulnerabilities (CVE-2026-20349) are being actively exploited in the wild to trigger remote denial-of-service attacks, with patches released ^[8]^[25]^[47].
SonicWall patched critical vulnerabilities in its discontinued GMS platform that allowed unauthenticated remote code execution and data exposure ^[46].
Researchers disclosed an AI-assisted exploit chain for Microsoft SharePoint that enables unauthenticated remote code execution, now being used in ransomware attacks ^[13]^[34].
Zoom patched a vulnerability in the annotation tool that allowed meeting participants to hijack other attendees’ clients and execute code remotely ^[11]^[39]^[50].
Ivanti EPM updates addressed flaws that could leak credentials for external SQL connections or crash agent services ^[44].
Adobe released urgent patches for ColdFusion and Campaign Classic to fix critical code execution and denial-of-service vulnerabilities ^[49].
ClamAV vulnerabilities affecting Cisco Secure Endpoint Connector can be exploited for denial-of-service attacks, with public exploits available ^[35].
Siemens, Schneider, and Phoenix Contact released security updates addressing vulnerabilities in ICS and OT products ^[45].

Notable Threat Actor Activity

The Head Mare APT group is exploiting unpatched TrueConf server vulnerabilities to deliver PhantomCore and PhantomGraph backdoors to video conference participants via malicious installers ^[1].
Project CAV3RN is targeting Israeli organizations using Google Apps Script as a command-and-control relay and DNS-based channel selection, leveraging a modular .NET NativeAOT framework to evade detection ^[2].
The Russian Sandworm-linked group UAC-0145 is conducting social engineering campaigns targeting IT workers with fake job interviews, distributing a trojanized WireGuard VPN client capable of executing commands ^[12]^[24].
Researchers hired three suspected North Korean IT workers by creating a fake cryptocurrency startup, observing operational security tactics such as the use of virtual machines and attempts to exfiltrate data ^[18].
Gunra ransomware is targeting critical infrastructure globally, exploiting vulnerabilities in Fortinet and Schneider Electric products, and bypassing multi-factor authentication using leaked Conti code ^[21]^[36]^[38].
DeadLock ransomware is using decentralized, blockchain-based infrastructure (Polygon smart contracts) to facilitate victim communications and data leaks, making disruption more difficult ^[14]^[23].
Malicious SIM cards have been shown to execute attacker-controlled code within cellular IoT device modems, affecting sectors such as electric vehicle charging and industrial automation ^[16].

Trends, Tools, or Tactics of Interest

The Kimwolf v7 Android and IoT botnet has been updated to generate HTTP/2 DDoS traffic that closely mimics legitimate browsing, enhancing operational resilience and evasion ^[10].
DDoS attacks exceeding 1 Tbps increased fivefold in the last quarter, with over 800 network-layer attacks mitigated ^[33].
Malicious LiteLLM releases on PyPI, linked to the Trivy hack, carried credential-stealing code and potentially exposed sensitive data from over 2,100 organizations ^[5].
Attackers can split instructions across malicious MCP servers to covertly exfiltrate secrets from AI coding agents without triggering obvious alerts ^[20].
Researchers demonstrated that Windows Plug and Play USB auto-install can be abused to chain vendor software installation components, achieving SYSTEM-level access on fully updated Windows 11 machines ^[19].
AI tools are increasingly being used both for vulnerability discovery (e.g., in the Zoom and SharePoint exploits) and as a target for exploitation, with risks from vague task delegation and broad access in enterprise environments ^[13]^[32]^[39].
OpenAI launched GPT-5.6-Cyber, a model with reduced safeguards designed for cybersecurity tasks such as exploit development and incident response ^[15].

Regulatory or Policy Developments Affecting the Security Industry

U.S. and South Korean authorities issued joint warnings to government and critical infrastructure organizations regarding Gunra ransomware activity exploiting known vulnerabilities ^[21]^[36].
CISA published advisories on vulnerabilities in ICS and OT products from Siemens, Schneider, and Phoenix Contact ^[45].
Google reported that Chrome’s anti-abuse systems have reduced unwanted Android notifications by more than 7 billion per day in Q1 2026 ^[22].

Sources

Wesco confirms security incident after ExfilSquad claims data theft - bleepingcomputer.com
Mozilla Revokes Firefox and Thunderbird Linux Signing Key After Key Lands in Private Repo - thehackernews.com
Mozilla updates GPG signing key for Firefox releases after exposure - bleepingcomputer.com
Fake CCleaner installs GhostDesk Chrome spyware - malwarebytes.com
Fake popular sites offer a free app, instead take over PCs - malwarebytes.com
SAP Commerce Cloud Flaw Could Let Unauthenticated Attackers Execute Arbitrary Code - thehackernews.com
SAP Patches Critical Code Injection, Memory Corruption Vulnerabilities - securityweek.com
Microsoft Patches 398 Flaws Including a Windows Driver Zero-Day Under Active Attack - thehackernews.com
Microsoft August 2026 Patch Tuesday fixes 400 flaws, 3 zero-days - bleepingcomputer.com
Microsoft's Patch Tuesday Deluge Continues With August Updates - darkreading.com
Microsoft Plugs Nearly 400 Security Holes - krebsonsecurity.com
Microsoft Patch Tuesday August 2026, (Tue, Aug 11th) - isc.sans.edu
August 2026 Patch Tuesday: Microsoft Fixes 421 CVEs, One Exploited Zero-Day - securityweek.com
ShieldBreak Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access - thehackernews.com
Cisco ASA and FTD Flaw Exploited in the Wild Can Trigger Remote DoS - thehackernews.com
Cisco warns of ASA and FTD VPN flaw exploited to crash devices - bleepingcomputer.com
Cisco Patches Firewall Zero-Day Exploited for DoS Attacks - securityweek.com
SonicWall Patches Critical Vulnerabilities in Discontinued GMS Platform - securityweek.com
Researchers Disclose AI-Assisted SharePoint Exploit Chain Reaching Unauthenticated RCE - thehackernews.com
CISA: Microsoft SharePoint flaw now exploited in ransomware attacks - bleepingcomputer.com
Zoom Annotation Flaws Could Let a Meeting Participant Hijack Another Attendee's Client - thehackernews.com
A Zoom Screen-Sharing Bug Let Anyone Take Over Other Devices on a Call - wired.com
Zoom Patches Zero-Click Code Execution Vulnerability - securityweek.com
Ivanti EPM Update Patches Remotely Exploitable Flaws - securityweek.com
Adobe Urges Immediate Patching of Critical ColdFusion, Campaign Classic Flaws - securityweek.com
Cisco warns of high-severity ClamAV flaws with public exploits - bleepingcomputer.com
ICS Patch Tuesday: Vulnerabilities Fixed by Siemens, Schneider, Phoenix Contact - securityweek.com
Head Mare APT is exploiting vulnerabilities in an unpatched TrueConf server to deliver PhantomCore and PhantomGraph to video conference participants - securelist.com
Project CAV3RN continues: Google Apps Script as C2 relay and DNS-based C2 channel selection - securelist.com
Sandworm-Linked UAC-0145 Uses Fake Job Interviews to Push VPN That Can Run Commands - thehackernews.com
Sandworm hackers target IT pros with trojanized WireGuard VPN client - bleepingcomputer.com
Researchers Built a Fake Crypto Startup and Hired Three Suspected North Korean IT Workers - thehackernews.com
Gunra Ransomware Exploits Fortinet and Schneider Electric Flaws to Breach Networks - thehackernews.com
US and South Korea warn of Gunra ransomware targeting govt agencies - bleepingcomputer.com
Gunra Ransomware Gang Exploits Fortinet Flaws, Bypasses MFA - darkreading.com
DeadLock Ransomware Uses Polygon Smart Contracts to Make Extortion Infra Harder to Disrupt - thehackernews.com
DeadLock ransomware uses blockchain to resist infrastructure takedown - bleepingcomputer.com
A Malicious SIM Card Can Run Attacker Code Inside the Modems Behind Cellular IoT Devices - thehackernews.com
Kimwolf v7 Android Botnet Makes HTTP/2 DDoS Traffic Look Like Legitimate Browsing - thehackernews.com
DDoS attacks over 1 Tbps surged fivefold in the second quarter - bleepingcomputer.com
Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations - thehackernews.com
Malicious MCP Servers Can Split Instructions to Make AI Coding Agents Exfiltrate Secrets - thehackernews.com
Researchers Turn USB Auto-Install Into a Full SYSTEM Takeover on Windows 11 - thehackernews.com
Vague Task, Total Access: When AI Delegation Becomes a Security Risk - bleepingcomputer.com
OpenAI Launches GPT-5.6-Cyber with Reduced Safeguards for Exploit Development - thehackernews.com
Google says Chrome cuts 7 billion unwanted Android notifications a day to fight abuse - bleepingcomputer.com

Cybersecurity Brief – 2026-04-30

Thu, 30 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

Multiple official SAP-related npm packages were compromised in a supply chain attack attributed to TeamPCP, resulting in credential-stealing malware being distributed to developers.
Checkmarx confirmed data theft from its GitHub environment following a supply chain attack, with exfiltration occurring on March 30.
The Quick Page/Post Redirect WordPress plugin, active on over 70,000 sites, was found to contain a dormant backdoor for five years, enabling arbitrary code injection.
Ukrainian authorities arrested three individuals accused of hijacking and selling over 610,000 Roblox accounts, generating $225,000 in illicit profits.
European law enforcement dismantled a cryptocurrency investment fraud ring responsible for losses exceeding €50 million.
Anthropic’s Claude Opus LLM was leveraged to insert malicious npm dependencies, facilitating a new wave of DPRK-linked attacks.
Vercel suffered a breach due to a compromised third-party OAuth integration, highlighting risks of OAuth sprawl and downstream impact.

Newly Discovered Vulnerabilities

Google patched a CVSS 10-rated remote code execution vulnerability in the “@google/gemini-cli” npm package and the “google-github-actions/run-gemini-cli” GitHub Actions workflow.
cPanel and WHM released emergency updates for a critical authentication bypass vulnerability affecting most versions, which could allow unauthorised control panel access.
GitHub fixed a critical RCE vulnerability (CVE-2026-3854) that could have exposed millions of private repositories.
Two authentication bypass vulnerabilities in the Qinglong open-source task scheduler are being actively exploited to deploy cryptominers on servers.
A fresh LiteLLM vulnerability was exploited shortly after disclosure, allowing database read and potential modification.
38 vulnerabilities were identified in the OpenEMR medical software, including issues enabling database compromise, RCE, and data theft.
Chrome 147 and Firefox 150 security updates addressed critical and high-severity code execution vulnerabilities.
Researchers highlighted five exploitation methods for PhantomRPC, which Microsoft has classified as “moderate” and does not intend to patch.

Notable Threat Actor Activity

The Silver Fox group is targeting organisations in Russia and India via tax authority impersonation, distributing ValleyRAT and the new ABCDoor backdoor.
North Korean (DPRK) threat actors are using AI-assisted malware insertion, fake companies, and RATs to compromise npm packages and developer environments.
Iranian group Handala targeted US troops in Bahrain with WhatsApp messages threatening drone and missile attacks.
Lotus Wiper malware was deployed in attacks against Venezuelan energy firms and utilities, utilising advanced living-off-the-land and data deletion techniques.
TeamPCP was identified as responsible for the SAP npm supply chain attack and is linked to deployment of Vect 2.0 ransomware, which functions as a wiper due to a design flaw.

Trends, Tools, or Tactics of Interest

Threat actors are increasingly leveraging AI (including LLMs) to automate malware insertion, reconnaissance, and attack workflows, directly integrating AI into the kill chain.
AI-powered reverse engineering tools were used to identify high-severity vulnerabilities, such as the recent GitHub bug.
OAuth sprawl and third-party integrations are being exploited for lateral movement and supply chain compromise, as evidenced by the Vercel breach.
Exposed RDP and VNC servers, including those controlling ICS/OT environments, remain a significant attack surface, with tens of thousands identified as internet-facing.
Dormant backdoors in widely used software (e.g., WordPress plugins) highlight risks of long-term supply chain compromise.

Regulatory or Policy Developments

CISA added actively exploited ConnectWise ScreenConnect and Microsoft Windows vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue and issued a directive for federal agencies to patch a Windows zero-day.
CISA and US government partners released a guide to accelerate zero trust adoption in operational technology (OT) environments.

Cybersecurity Brief – 2026-01-15

Thu, 15 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Kyowon Group, a major South Korean conglomerate, confirmed a ransomware attack resulting in operational disruption and potential exposure of customer data.
Cloud marketplace Pax8 inadvertently exposed internal business information, including MSP customer data, to fewer than 40 UK-based partners via email.
Robo-advisor Betterment disclosed a breach where a threat actor accessed customer information and sent scam crypto-related messages.
Free Mobile and its parent company, Free, were fined €42 million by the French CNIL for inadequate protection of customer data related to a 2024 breach.

Newly Discovered Vulnerabilities

Fortinet patched a critical unauthenticated remote code execution vulnerability in FortiSIEM. Public exploit code and technical details for this flaw have been released.
Additional critical vulnerabilities in Fortinet products, including FortiFone, were disclosed and patched, with risks of configuration leaks and code execution.
Chrome 144 and Firefox 147 released patches for high-severity vulnerabilities, addressing 26 security defects including code execution risks.
Microsoft’s January 2026 Patch Tuesday addressed 114 Windows vulnerabilities, including one actively exploited in the wild.
A DLL side-loading vulnerability in the open-source c-ares library is being actively exploited to bypass security controls and deploy malware.

Notable Threat Actor Activity

Microsoft and law enforcement disrupted the RedVDS cybercrime-as-a-service platform, which facilitated phishing, BEC, account takeover, and fraud, and was linked to over $40 million in losses.
Researchers null-routed over 550 command-and-control servers associated with the AISURU/Kimwolf botnet, which had infected over two million devices since October 2025.
A major phishing campaign abused Google’s infrastructure, targeting over 3,000 organizations (primarily in manufacturing) to bypass email security defenses.
Magecart skimming attacks are targeting online checkouts using major payment networks such as AmEx, Diners Club, and Mastercard.
The newly emerged Sicarii Ransomware-as-a-Service operation began advertising across underground forums in December 2025.
Predator spyware has been found to use failed attacks for intelligence gathering to improve future exploit attempts.
Fake “account restricted” comments are being posted on LinkedIn as part of phishing campaigns to steal user credentials.

Trends, Tools, or Tactics of Interest

Microsoft was the most impersonated brand in phishing attacks during Q4 2025, followed by Facebook, Roblox, McAfee, and Steam.
OAuth phishing attacks using the ConsentFix technique are evolving, with attackers hijacking Microsoft accounts via browser-based authorization flows.
The “Reprompt” attack technique allowed hijacking of Microsoft Copilot sessions for sensitive data exfiltration.
AI agents are increasingly being integrated into core workflows, raising concerns about privilege escalation pathways.
64% of third-party applications on leading websites now access sensitive data without business justification, up from 51% in 2024.
Attackers are leveraging legitimate open-source software downloads to conceal remote backdoors.
The “VoidLink” modular malware framework is targeting Linux systems, designed for stealthy, long-term access in cloud-first environments.
Infection campaigns are repeatedly adding scheduled tasks and increasing communication with persistent C2 domains.

Regulatory or Policy Developments

The French CNIL imposed a €42 million fine on Free Mobile and Free for failing to adequately protect customer data in a 2024 breach incident.
An investor lawsuit related to the CrowdStrike outage was dismissed due to lack of evidence of investor fraud.

Cybersecurity Brief – 2025-08-08

Fri, 08 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Bouygues Telecom confirmed a data breach affecting 6.4 million customers, exposing personal information.
Air France and KLM disclosed a breach via a third-party customer service platform, compromising customer names, email addresses, phone numbers, and other non-financial data.
Chanel notified clients of a third-party breach impacting customer data, joining other luxury brands affected by similar incidents.
Google, Adidas, and other organisations suffered breaches after employees were tricked via phone calls into granting access to Salesforce data, attributed to ShinyHunters.
Mozilla’s Firefox add-on store was targeted by the “GreedyBear” campaign, which uploaded 150 malicious extensions that drained cryptocurrency wallets, stealing an estimated $1 million.
TeaOnHer, a dating advice app, was found leaking user personal data.
Recent ransomware attacks against SonicWall Gen 7 firewalls with SSL VPN enabled were linked to exploitation of an older, patched vulnerability, not a zero-day.

Newly Discovered Vulnerabilities

Microsoft disclosed CVE-2025-53786, a high-severity privilege escalation flaw in on-premise Exchange Server hybrid deployments, allowing attackers to gain elevated privileges in Exchange Online. Both Microsoft and CISA have issued advisories; CISA mandated emergency patching for US federal agencies.
Security flaws were reported in Axis Communications video surveillance products, exposing over 6,500 servers to potential remote takeover.
Researchers discovered a privilege escalation issue in Amazon ECS, allowing IAM hijacking and cross-resource access via an undocumented protocol.
New HTTP request smuggling/desync attacks exploiting HTTP/1.1 vulnerabilities impacted major CDNs and millions of websites.
Two malicious npm packages masquerading as WhatsApp developer tools were discovered, containing destructive data-wiping code targeting developer systems.
Researchers found that encryption algorithms used in law enforcement and military radios may be easily cracked, potentially allowing eavesdropping.

Notable Threat Actor Activity

SocGholish malware operators are utilising Traffic Distribution Systems (Parrot TDS, Keitaro TDS) to redirect users to malicious content, delivering access to ransomware groups including LockBit and Evil Corp.
ShinyHunters resurfaced, conducting low-tech social engineering attacks to breach Salesforce data at major corporations.
The Silver Fox APT group demonstrated operations blending espionage and cybercrime, attributed to Chinese threat actors.
North Korean IT scammers’ operational details were leaked, revealing structured targeting and internal surveillance.
Eight ransomware groups, including RansomHub, have adopted a new EDR killer tool, an evolution of EDRKillShifter, to disable endpoint detection and response solutions during attacks.
Akira ransomware attacks targeting SonicWall firewalls exploited a known vulnerability, not a zero-day.

Trends, Tools, or Tactics of Interest

The FBI warned of attackers sending physical packages containing malicious QR codes (“quishing”) to initiate phishing campaigns via postal mail.
Surge in vishing scams, where attackers impersonate service providers offering discounts in exchange for upfront fees.
Rise in Python and Go supply chain attacks, with malicious packages discovered that deliver cross-platform malware and trigger remote data wipes.
Increased use of AI in both offensive and defensive cloud security operations, with AI now central to evolving attack and defence strategies.
150+ malicious Firefox extensions highlight the ongoing risk in browser extension ecosystems.
Clickjacking campaigns on adult sites are being used to manipulate Facebook user engagement.
EDR killer tools are being actively distributed across multiple ransomware operations for disabling security controls.

Regulatory or Policy Developments Affecting the Security Industry

CISA issued an emergency directive requiring all US Federal Civilian Executive Branch agencies to patch Microsoft Exchange Server CVE-2025-53786 by Monday.
The founders of Samourai Wallet pleaded guilty to laundering over $200 million for cybercriminals and agreed to forfeit the proceeds.
A court found Meta accessed sensitive health data from the Flo app without user consent.
The Alliance for Creativity and Entertainment (ACE) took offline Rare Breed TV, a major illegal IPTV service, following a financial settlement.