Gartner on DanSec Daily

Cybersecurity Brief – 2026-11-03

Tue, 03 Nov 2026 00:00:00 +0000

Major Incidents or Breaches

Harvard University disclosed that a breach of its Alumni Affairs and Development systems in November 2025 resulted in the exposure of data linked to over 850,000 unique email addresses ^[16].
Frontline Education reported a data breach affecting more than 1.3 million school district staff and students, with attackers exploiting a flaw in third-party software ^[20].
The UK-based school estate suffered a ransomware attack by a 3AM affiliate, which encrypted approximately 37 out of nearly 50 systems accessed from an unmanaged host. The attack is suspected to have used AI-assisted tactics ^[13]^[28].
Financial technology platform Sageworks, operated by Abrigo, was taken offline due to a suspected cyberattack, with borrower-facing capabilities still unavailable following the incident ^[18].
Mercado Bitcoin, Brazil’s largest cryptocurrency exchange, confirmed a cyberattack that led to the theft of more than $46 million ^[36].
Synology reported ransomware attacks targeting its NAS devices by exploiting a previously patched DSM vulnerability, urging customers to update their systems ^[5].
BTCPay Server users reported theft of Bitcoin and Litecoin from hot wallets due to exploitation of a server vulnerability. At least $1.63 million has been traced to attackers, and users are urged to update to the latest version ^[4]^[43].
Over 100 European supermarkets in Belgium, Sweden, Estonia, Ireland, and Luxembourg experienced a second wave of cyberattacks on refrigeration systems, resulting in tampered temperature settings and the removal of food from shelves ^[6]^[27]^[44]^[67].
Videostrong, a Chinese device manufacturer, was found to have intentionally shipped more than 1.3 million Android TV boxes with pre-installed backdoors, creating a botnet used for criminal purposes. The XCPE botnet was dismantled through a coordinated industry and law enforcement effort ^[10]^[19]^[25]^[31]^[40]^[47]^[60]^[77].

Newly Discovered Vulnerabilities

Red Hat released patches for a critical use-after-free vulnerability in the Linux kernel’s IPv4 TCP code (CVSS 9.8) affecting RHEL 8, 9, and 10. Ubuntu provided fixes for testing ^[1].
Siemens SIMATIC IoT2050 Advanced devices are under active attack due to exploitation of CVE-2026-58115, a maximum-severity authentication flaw, allowing remote command execution and backdoor installation ^[7].
Node-RED, a widely used OT programming tool, is being actively exploited via CVE-2026-58115, an authentication bypass vulnerability. Attackers are deploying Linux bots and webshells on unprotected servers ^[23]^[39]^[52].
Barracuda Networks warned of two critical vulnerabilities in its devices that could allow attackers to execute commands with root privileges. Customers are urged to patch immediately ^[11].
The CryptoPayment Gateway WordPress plugin is being targeted due to an unpatched maximum-severity security vulnerability that can expose wallet credentials ^[8].
Android’s November 2026 security updates patched over 200 vulnerabilities, including a critical remote code execution flaw in the Framework component ^[22].
Google introduced a new $250,000 Cloud Vulnerability Reward Program (VRP) payout for high-impact “Root-in-Cloud” bugs affecting its cloud architecture ^[15].
OpenAI increased its top bug bounty payout to $172,000, with bonuses for high-quality vulnerability reports ^[56].

Notable Threat Actor Activity

The Russia-aligned Gorbag APT group has been targeting Ukrainian organizations, including courts and city councils, using spearphishing attachments and self-deleting information-stealer malware. The group has been active since at least February 2025 ^[3]^[34]^[54].
Chinese threat actors used the open-source, multi-agent AI penetration-testing framework ARTEX in attacks against more than 200 organizations across 14 countries. These attacks were conducted in an automated fashion over 11 days ^[17]^[53].
BYOD ransomware gang claimed responsibility for a cyber incident at Michigan State University, following a previous attack on the University of Michigan hospital ^[37].
Police in Europe arrested seven suspects and seized over 100 servers in a crackdown on an investment fraud network responsible for more than €4 million in losses ^[14]^[49].
Russia’s Interior Ministry dismantled the infrastructure of the VasyGrek cybercrime group and detained three suspects ^[33].

Trends, Tools, or Tactics of Interest

AI is increasingly being used by both state and criminal threat actors for automated attacks, vulnerability discovery, and scaling offensive operations. The UK NCSC and other sources highlight that AI-powered ransomware and cyberattacks against critical infrastructure are expected to rise significantly by 2028 ^[24]^[35]^[38]^[45]^[48]^[53]^[80]^[85]^[86].
Reports indicate the emergence of “LLMjacking,” where criminals hijack access to large language models (LLMs) in cloud environments, resulting in illicit charges of up to $1 million for affected businesses ^[42]^[46]^[55].
The 3AM ransomware affiliate used suspected AI-generated loops to revise commands during the UK school estate attack, suggesting partial automation in ransomware operations ^[13]^[28].
NATO’s Crossed Swords exercise introduced AI agents and OpenAI Daybreak into joint cyber and kinetic operations training, indicating a trend toward integrating AI in both attack and defense scenarios ^[26].
Gartner predicts that by 2028, security operations centers (SOCs) will have 50 percent more engineers than analysts, as AI agents take over routine alert handling ^[12].
Attackers are exploiting misconfigured or forgotten internet-facing assets, including OT devices, as illustrated by recent Node-RED and Siemens IoT2050 incidents ^[7]^[23]^[39]^[52]^[50]^[59].
The Binance breach highlighted the risks of weak system separation and inadequate controls, demonstrating how a single compromised endpoint can lead to systemic losses ^[29].

Regulatory or Policy Developments Affecting the Security Industry

The UK National Cyber Security Centre (NCSC) issued a warning that AI-powered attacks on UK critical infrastructure are expected within the next two years, urging organizations to invest in resilience and address longstanding vulnerabilities ^[24]^[35]^[38]^[45]^[48]^[85]^[86].
Business groups are campaigning for long-term renewal of the US CISA 2015 information sharing law, seeking its extension in the upcoming defense authorization bill ^[61].

Sources

Harvard University data breach exposed info of 851,000 accounts - bleepingcomputer.com
Frontline Education Data Breach Impacts Over 1.3 Million - securityweek.com
UK school estate hit by 3AM ransomware in suspected AI-assisted attack - bleepingcomputer.com
3AM Affiliate Embraces AI-Like Loops in European School Attack - darkreading.com
Fintech platform Sageworks taken offline after suspected cyberattack - bleepingcomputer.com
Largest crypto exchange in Brazil confirms cyberattack as millions flow out of platform - therecord.media
Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw - thehackernews.com
Hackers Exploit BTCPay Server Flaw to Steal Bitcoin and Litecoin From Hot Wallets - thehackernews.com
Hackers Exploit BTCPay Server Flaw to Steal Cryptocurrency - infosecurity-magazine.com
New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Food - thehackernews.com
Over 100 European Stores Hit as Supermarket Fridge Attacks Return - securityweek.com
Cyber-Attack on Refrigeration Systems Hits Supermarkets Across Europe - infosecurity-magazine.com
Supermarket freezers across Europe hit by second suspected cyber-attack - databreaches.net
Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access - thehackernews.com
Google disrupts million-device XCPE Android malware botnet, bans TV box maker - bleepingcomputer.com
Google Dismantles XCPE Botnet of 1.3 Million Android Devices - securityweek.com
Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies - krebsonsecurity.com
Cops bust botnet of 1.3M infected Android TV boxes - theregister.com
Police and Tech Firms Team Up to Dismantle XCPE Botnet - infosecurity-magazine.com
Google shuts down global botnet running on certified Android devices - cyberscoop.com
A hidden backdoor put 1.3 million TV boxes to work for criminals - malwarebytes.com
Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing - thehackernews.com
Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors - thehackernews.com
Critical Node-RED Flaw Exploited in Attacks - securityweek.com
Max-severity bug in widely used OT programming tool exploited to deliver Linux malware - theregister.com
Attackers exploit critical Node-RED flaw to deploy Linux bot and backdoors (CVE-2026-58115) - helpnetsecurity.com
Barracuda warns of critical flaws allowing root access to devices - bleepingcomputer.com
Attackers Target Unpatched CryptoPayment Gateway Flaw That Can Expose Wallet Credentials - thehackernews.com
Android’s November 2026 Updates Patch Over 200 Vulnerabilities - securityweek.com
Google adds new $250,000 Cloud VRP reward for Root-in-Cloud bugs - bleepingcomputer.com
OpenAI raises top bug bounty payout to $172,000 with bonuses - helpnetsecurity.com
Russia-Aligned Gorbag Hackers Exploit WinRAR Flaw to Deploy Data-Stealing Malware - thehackernews.com
Russia-linked cyber spies target Ukraine's war crimes investigations, military aid routes - therecord.media
Gorbag APT group hits Ukrainian courts and city councils with self-deleting malware - helpnetsecurity.com
Chinese hackers use ARTEX AI in automated attacks against 200 orgs - bleepingcomputer.com
AI agents scale and speed up Chinese-linked attacks - helpnetsecurity.com
Michigan State cyber incident claimed by ransomware gang behind recent hospital attack - therecord.media
Police seizes over 100 servers in investment scam crackdown - bleepingcomputer.com
Police seize over 100 servers linked to investment fraud with more than €4 million in losses - helpnetsecurity.com
Russia dismantles infrastructure of VasyGrek cybercrime group, detains three suspects - therecord.media
UK Cyber Chief Says the UK Will Face AI Cyberattacks on Critical Infrastructure by 2028 - securityweek.com
UK faces ‘unprecedented rise’ in cyberattacks in coming months, warns cyber chief - therecord.media
Britain on notice: AI-powered ransomware attacks to arrive by 2028 - theregister.com
NCSC Chief Warns of Imminent AI Ransomware Threat to UK Critical Infrastructure - infosecurity-magazine.com
UK to face AI-powered cyber attacks within two years, warns NCSC - computerweekly.com
Unit 42 Threat Intelligence Highlights - Nov. 2, 2026 - unit42.paloaltonetworks.com
Cyber chief: UK facing AI-powered attacks on critical infrastructure within two years - ncsc.gov.uk
Artificial intelligence and cyber intrusion - ncsc.gov.uk
Token thieves costing companies $100K+ per day in illicit LLM charges - theregister.com
LLMJacking is Costing Some Businesses Up to $1m, Warns Google - infosecurity-magazine.com
Stolen AI access leaves companies with cloud bills of up to $1 million - helpnetsecurity.com
NATO’s Crossed Swords Exercise Brings AI Agents Into Cyber Operations Training - securityweek.com
Gartner Predicts SOCs Will Have 50% More Engineers Than Analysts by 2028 - bleepingcomputer.com
Novee puts forgotten internet-facing assets through penetration testing - helpnetsecurity.com
CISA’s new strategy runs into America’s blind trust problem - cyberscoop.com
One Compromised Laptop, Billions Lost: The Binance Attack-Path Warning - darkreading.com
Business groups mount fresh campaign for long-term renewal of information sharing law - cyberscoop.com

Cybersecurity Brief – 2025-10-04

Sat, 04 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

Renault and Dacia UK notified customers of a data breach affecting sensitive information, resulting from a compromise at a third-party provider.
Japanese beer company Asahi confirmed a ransomware attack that caused IT disruptions and factory shutdowns.
ShinyHunters launched a new data leak site to extort 39 victims impacted by recent Salesforce breaches, leaking samples of stolen data. The Scattered Lapsus$ Hunters group also resurfaced with threats to publish Salesforce customer data if extortion demands are unmet.
Jaguar Land Rover experienced repeat cyberattacks, reportedly due to incomplete remediation from a previous breach, highlighting ongoing operational and financial impacts.
Hackers who targeted Kido nurseries with ransom demands and posted children’s data online have reportedly removed the data following public backlash.
Dutch authorities arrested two teenagers for alleged pro-Russian espionage, noted as part of a broader Russian hybrid attack campaign in Europe.

Newly Discovered Vulnerabilities

CISA added CVE-2025-4008, a high-severity flaw in Smartbedded Meteobridge, to its Known Exploited Vulnerabilities catalog. The vulnerability allows remote unauthenticated attackers to execute arbitrary commands with root privileges; it was patched in mid-May but is being actively exploited.
An unauthenticated remote code execution (RCE) vulnerability affecting DrayTek routers was patched. The flaw could be exploited via crafted HTTP/S requests to the device’s web interface.
Chrome 141 and Firefox 143 released patches for high-severity vulnerabilities. Chrome addressed issues in WebGPU and Video components, while Firefox fixed flaws in Graphics and JavaScript Engine components.
A new attack, ‘CometJacking,’ exploits URL parameters in Perplexity’s Comet AI browser to access sensitive user data, such as emails and calendars, from connected services.

Notable Threat Actor Activity

The North Korean group “DeceptiveDevelopment” is using social engineering tactics to target job seekers, according to ESET.
The Detour Dog threat actor has been identified as operating DNS-powered malware campaigns distributing Strela Stealer, an information-stealing malware.
The Rhadamanthys Stealer threat actor has updated their stealer to include device fingerprinting and payloads concealed via PNG steganography. They are also advertising additional tools, Elysium Proxy Bot and Crypt Service.
A new self-propagating malware campaign, SORVEPOTEL, is targeting Brazilian WhatsApp users, spreading via trusted contacts on the messaging platform.
The “Cavalry Werewolf” threat actor, with links to YoroTrooper, has targeted Russian public sector entities using the FoalShell and StallionRAT malware families.
UAT-8099, a Chinese-language threat actor, is hijacking reputable websites for SEO fraud and data theft, infecting servers, poisoning sites with SEO spam, and stealing organizational data.
Oracle linked ongoing Clop ransomware extortion attacks to E-Business Suite vulnerabilities patched in July 2025, indicating exploitation of known flaws.
Cybercriminals reportedly offered money to a BBC journalist for cooperation, highlighting ongoing targeting of media professionals.

Trends, Tools, or Tactics of Interest

A Gartner survey found that 62% of organizations experienced a deepfake attack in the past 12 months, indicating a significant increase in the use of deepfakes in cyberattacks.
Signal introduced Sparse Post-Quantum Ratchet (SPQR), a cryptographic protocol designed to protect against quantum computing threats.
Gmail business users can now send end-to-end encrypted emails to recipients on any platform.
Microsoft’s “Windows Speak for Me” voice cloning technology has been identified as a potential vector for attacks, enabling creation of convincing voice replicas for use in SaaS platforms and communications.
Brain-computer interface (BCI) technology is being highlighted for its potential cybersecurity risks as adoption increases.
A free template was released to help CISOs present AI adoption, risks, and controls to boards, reflecting growing governance concerns around GenAI.
MokN, a French cybersecurity startup, introduced a “phish-back” solution that tricks attackers into revealing stolen credentials.
Passwork 7 was released as an on-premises platform for enterprise password and secrets management, addressing credential storage and sharing complexity.

Regulatory or Policy Developments Affecting the Security Industry

ICE (U.S. Immigration and Customs Enforcement) plans to build a 24/7 social media surveillance team, hiring contractors to monitor platforms such as X, Facebook, and TikTok for enforcement purposes.
LinkedIn user data will be used to train AI systems, raising privacy and data protection considerations.
Oneleet and MokN, cybersecurity startups, raised significant funding to expand operations and AI capabilities, indicating continued investment in compliance and anti-phishing technologies.

Cybersecurity Brief – 2025-09-04

Thu, 04 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Jaguar Land Rover experienced a severe cyberattack, forcing the disconnection of systems and causing significant disruption to both retail and manufacturing operations.
Workiva, a major SaaS provider, disclosed a data breach after attackers accessed customer data via a compromised third-party Salesforce CRM system.
Multiple security firms, including Cloudflare, Palo Alto Networks, and Zscaler, were impacted by a breach involving Salesforce, Salesloft, and Drift, resulting in the exposure of customer contact information and case data.
The Pennsylvania Attorney General’s office confirmed a ransomware attack that caused weeks-long outages of email, phone, and web services. No ransom was paid.
Wiz Research reported a data leak at Chinese AI company DeepSeek, exposing over 1 million sensitive log streams.
The US Department of Justice filed a lawsuit against Apitor Technology for exposing children’s geolocation data to a Chinese third party without consent.
Disney agreed to pay $10 million to settle US FTC claims regarding the improper collection of children’s data on YouTube.

Newly Discovered Vulnerabilities

Google released September 2025 Android updates addressing over 100 vulnerabilities, including at least two zero-days (CVE-2025-2355, CVE-2025-2356) that are actively exploited.
A high-severity use-after-free vulnerability in Google Chrome’s V8 JavaScript engine was patched, preventing potential remote code execution.
CISA flagged an actively exploited vulnerability in TP-Link TL-WA855RE Wi-Fi range extenders, allowing attackers to reset and hijack affected devices. CISA recommends retiring these discontinued devices.
Exploit attempts were observed for CVE-2025-5086, a vulnerability in Dassault DELMIA Apriso used in manufacturing environments.
A WhatsApp bug, in conjunction with an Apple zero-day, is being used in targeted zero-click attacks against iPhone users, potentially for spyware deployment.

Notable Threat Actor Activity

An Iran-linked group, identified as Homeland Justice APT and associated with MOIS, conducted a coordinated spear-phishing campaign targeting over 100 embassy and consulate email accounts globally, aiming to spy on diplomats and international organisations.
Russian APT28 (Fancy Bear) is leveraging new ‘NotDoor’ malware to abuse Microsoft Outlook for covert data exfiltration.
North Korean IT worker scams remain a focus of regional countermeasures, with Japan and South Korea collaborating with private sector partners to disrupt these operations.
Malicious npm packages targeting Ethereum smart contract developers were discovered, using blockchain smart contracts to perform malicious actions on compromised systems.
Automated sextortion spyware, identified as a variant of “infostealer” malware, is taking screenshots and webcam photos of victims viewing adult content for extortion purposes.
Threat actors are using X’s Grok AI assistant to bypass link posting restrictions and distribute malicious links on the platform.
PayPal users are being targeted in a sophisticated email scam with the subject “Set up your account profile.”

Trends, Tools, or Tactics of Interest

Threat actors are rapidly adopting AI-powered offensive tools, specifically HexStrike AI, to exploit newly disclosed n-day vulnerabilities, including Citrix flaws, within days of public disclosure.
Increasing use of generative AI by attackers to craft more convincing phishing emails.
Endpoint security is seeing a shift towards AI-driven solutions, as highlighted in the 2025 Gartner Magic Quadrant, with a focus on countering advanced ransomware and phishing attacks.
Research indicates that compromised routers can remain undetected and accessible on the internet for years, highlighting persistent risks to infrastructure.
Geolocation data is being increasingly weaponised in advanced persistent threat (APT) operations and malware, enabling targeted attacks based on physical location.

Regulatory or Policy Developments

CISA, NSA, and 19 international partners released a joint statement outlining a shared vision for the Software Bill of Materials (SBOM), promoting its role in securing global software supply chains.
The US Department of State announced a $10 million bounty for information on three Russian FSB officers involved in cyberattacks against US critical infrastructure.
Law enforcement, in cooperation with the Alliance for Creativity and Entertainment, disrupted Streameast, the world’s largest illegal sports streaming platform, with arrests made in Egypt.