Gogs on DanSec Daily

Cybersecurity Brief – 2026-06-09

Tue, 09 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

SoFi confirmed a data breach at its Hong Kong subsidiary following unauthorised access to a third-party vendor database containing customer information ^[15].
The University of Oxford disclosed a data breach after its CareerConnect careers platform, managed by third-party provider Group GTI, was compromised ^[23].
Lansing Community College reported a breach impacting 174,000 individuals, with hackers accessing personal data from college systems ^[39].
DentaQuest, a US dental benefits administrator, suffered a breach exposing sensitive data, as reported in recent threat intelligence ^[40].
Silent Ransom Group targeted US law firms in escalating extortion attacks, using vishing, IT impersonation, and in-person intrusions to steal data ^[24].
Meta and WhatsApp detected and blocked new spear-phishing attacks linked to NSO Group, and Meta is pursuing a federal court contempt order against the spyware vendor for violating a no-hacking order ^[7]^[18]^[36].
Pirated PC games are being used to distribute password-stealing malware, with over 400,000 devices reportedly infected worldwide ^[42].

Newly Discovered Vulnerabilities

A critical authentication bypass vulnerability in Check Point Remote Access VPN and Mobile Access deployments using IKEv1 has been exploited in zero-day attacks by the Qilin ransomware gang. CISA has ordered US federal agencies to patch within three days ^[8]^[12]^[22]^[25]^[32].
BerriAI LiteLLM is affected by CVE-2026-42271, a high-severity flaw now being exploited in the wild, enabling unauthenticated remote code execution ^[5].
A one-character use-after-free vulnerability in the Linux kernel allows local privilege escalation to root and container escape. Exploits are now public ^[6].
Google patched a new Chrome zero-day vulnerability (CVE-2026-11645) exploited in the wild, marking the fifth such patch this year ^[13]^[33].
Gogs patched a critical zero-day vulnerability enabling remote code execution on Internet-facing instances and access to all repositories ^[19].
Ubiquiti UniFi OS is vulnerable to a chain of three bugs allowing unauthenticated remote code execution with root privileges ^[20].
Everest Forms, a popular WordPress plugin, has a vulnerability being exploited in the wild for remote code execution ^[38].

Notable Threat Actor Activity

The Qilin ransomware gang has been confirmed as the threat actor exploiting the Check Point VPN zero-day vulnerability in active attacks ^[22]^[25]^[32].
The Miasma supply chain campaign has evolved into the Hades attack, involving 37 malicious wheel artifacts across 19 PyPI packages, delivering the Bun credential stealer ^[4]^[27].
The Shai-Hulud supply chain attack compromised 19 science-focused PyPI packages, distributing malware to steal developer secrets ^[17]^[27].
NSO Group has been linked to new WhatsApp spear-phishing campaigns, which were detected and blocked by Meta and WhatsApp ^[7]^[18]^[36].
Silent Ransom Group is escalating its tactics against US law firms, combining vishing, impersonation, and physical intrusion ^[24].

Trends, Tools, or Tactics of Interest

AI-enabled social engineering attacks are increasing, with threat actors leveraging AI to bypass technical security controls and significantly boost phishing campaign volume ^[1]^[9]^[41].
A new side-channel attack called FROST allows malicious websites to track user browser and app activity via SSD timing using only JavaScript, requiring no native code or browser extensions ^[3].
Supply chain attacks via poisoned open-source packages, particularly on PyPI, continue to escalate with evolving tactics and the targeting of developer secrets ^[4]^[17]^[27]^[31].
Android malware (NFCShare) is being distributed as fake banking app updates on GitHub, targeting users with credential-stealing payloads ^[14].
Attackers are increasingly hiding password-stealing malware in cracked and pirated PC games, resulting in large-scale infections ^[42].

Regulatory or Policy Developments Affecting the Security Industry

CISA has mandated that US federal agencies patch the critical Check Point VPN vulnerability within three days due to confirmed exploitation by ransomware actors ^[12].
An extension of the Geneva Conventions is being considered to impose restrictions on cyberwarfare during ceasefire conditions, aiming to address current loopholes in international conflict law ^[26].

Sources

SoFi confirms third-party data breach at Hong Kong subsidiary - bleepingcomputer.com
Oxford University discloses data breach after careers platform hack - bleepingcomputer.com
174,000 Impacted by Lansing Community College Data Breach - securityweek.com
8th June – Threat Intelligence Report - research.checkpoint.com
Silent Ransom Group Hits US Law Firms in Escalating Extortion Attacks - darkreading.com
Meta Blocks NSO Group's New WhatsApp Phishing Attack, Files Contempt Order - thehackernews.com
WhatsApp says it disrupted new NSO spyware phishing attacks - bleepingcomputer.com
WhatsApp Catches Spyware Firm NSO Defying No-Hacking Court Order - securityweek.com
Pirated PC games are delivering password-stealing malware - malwarebytes.com
Critical Check Point VPN Flaw Exploited to Bypass Passwords in IKEv1 Setups - thehackernews.com
CISA gives feds 3 days to patch Check Point VPN bug exploited as zero-day - bleepingcomputer.com
Check Point links VPN zero-day attacks to Qilin ransomware gang - bleepingcomputer.com
Check Point VPN Flaw Exploited Since Early May - darkreading.com
Check Point VPN Zero-Day Exploited in Qilin Ransomware Attacks - securityweek.com
LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE - thehackernews.com
One-Character Linux Kernel Flaw Enables Local Root Access, Exploits Now Public - thehackernews.com
Google patches new Chrome zero-day flaw exploited in the wild - bleepingcomputer.com
Google Patches 5th Chrome Zero-Day Exploited in 2026 - securityweek.com
Gogs patches critical zero-day enabling remote code execution - bleepingcomputer.com
Critical UniFi OS bug lets hackers gain root without authentication - bleepingcomputer.com
Everest Forms Vulnerability Exploited to Hack WordPress Sites - securityweek.com
Hades PyPI Attack: 19 Packages Poisoned to Auto-Run Bun Credential Stealer - thehackernews.com
'Hades' Campaign Against PyPI Puts New Spin on Shai-Hulud - darkreading.com
New Shai-Hulud attack trojanizes 19 science-focused PyPI packages - bleepingcomputer.com
Report: AI-Enabled Social Engineering Attacks Are on the Rise - blog.knowbe4.com
AI Phishing Is Crushing SOCs with Alert Volume: How to Reduce Tier 1 Overload - thehackernews.com
Americans lost nearly $900 million to AI-powered scams, FBI says - malwarebytes.com
New FROST Attack Lets Websites Track What Sites and Apps You Open via SSD Timing - thehackernews.com
TeamPCP Supply Chain Campaign: Activity Through 2026-06-07, (Mon, Jun 8th) - isc.sans.edu
NFCShare Android malware spreads via fake banking app updates on GitHub - bleepingcomputer.com
Iran Signed a Ceasefire — Its Hackers Didn't - darkreading.com

Cybersecurity Brief – 2026-05-30

Sat, 30 May 2026 00:00:00 +0000

Major Incidents or Breaches

Charter Communications suffered a data breach affecting 4.9 million accounts, with the ShinyHunters extortion group responsible for stealing and leaking personal information from the US telecom giant in early April ^[16]^[25].
Dutch authorities disrupted a malware botnet comprising 17 million infected devices and seized over 200 servers supporting the operation ^[12].
23andMe, now Chrome Holding Co., is facing a lawsuit from the California Attorney General over a 2023 breach that exposed sensitive customer genetic and personal information ^[10]^[28].
Trump Mobile reportedly exposed customer data in a recent breach ^[24].

Newly Discovered Vulnerabilities

Palo Alto Networks reported that CVE-2026-0257, a medium-severity authentication bypass vulnerability in PAN-OS and Prisma Access, is under active exploitation ^[3].
Researchers disclosed a vulnerability in OpenAI ChatGPT that exploits trust in Markdown links and images, potentially enabling phishing attacks via web summaries ^[4].
A critical argument injection flaw in Gogs, a Git server, allows authenticated attackers to achieve remote code execution via malicious pull requests. The vulnerability has a CVSS score of 9.4 and is considered a zero-day ^[27].
Google Chrome version 148 update addresses 151 vulnerabilities, including critical-severity issues that could lead to remote code execution ^[29].
An exploit chain in a popular cloud automation service combined over-permissioned roles, secrets discovery, and non-human identities, exposing the risk of major compromise in complex cloud integrations ^[19].

Notable Threat Actor Activity

The ShinyHunters extortion gang was responsible for the Charter Communications breach, leaking over 42 million records ^[16]^[25].
A previously undocumented Russia-linked threat actor, GREYVIBE, has been carrying out persistent AI-powered cyberattacks against Ukraine and related entities since at least August 2025 ^[6].
Threat actors are abusing ChatGPT’s content-sharing feature to host fake outage pages, tricking users into downloading malware disguised as a desktop application ^[9].
An unknown threat actor used a large language model (LLM) agent for post-compromise actions after exploiting the Marimo CVE-2026-39987 vulnerability ^[5].
Cybercriminals are impersonating Signal Support in phishing campaigns to steal backup recovery keys, enabling access to victims’ entire message archives ^[30].
Malicious NuGet packages masquerading as a Sicoob SDK were discovered stealing banking credentials, while npm packages targeted cloud secrets ^[8].
Phishing campaigns are targeting the 2026 FIFA World Cup, leveraging event interest for malicious activity ^[24].
The criminal gang known as “The Com” is conducting cyberattacks to financially support violence and sexual exploitation ^[20].

Trends, Tools, or Tactics of Interest

DDoS attacks are increasingly being offered as subscription-based services, featuring pricing tiers, support, and reseller programs, reflecting the professionalization of the DDoS-as-a-Service market ^[11].
The rise of “shadow AI” is evidenced by employees developing and deploying full AI-powered applications into production systems without adequate oversight, resulting in increased exposure and risk ^[7].
There is a trend toward attackers leveraging LLM agents for post-exploitation activities, as seen in the Marimo CVE-2026-39987 incident ^[5].
Attackers are exploiting cloud integration misconfigurations, particularly through over-permissioned roles and secrets exposure, to compromise automation services ^[19].
MokN raised $15 million for a “phish-back” platform that uses decoy access points to lure attackers and capture compromised credentials ^[26].

Regulatory or Policy Developments Affecting the Security Industry

The California Attorney General has initiated legal action against 23andMe (now Chrome Holding Co.) for failing to protect customer data in the wake of its 2023 breach ^[10]^[28].
Google Chrome has rolled out Device Bound Session Credentials (DBSC) to all users, providing enhanced protection against session cookie theft and account takeover ^[13].
Asia’s cyber insurance market is showing signs of increased activity and growth after historically slow uptake ^[18].
The US Cybersecurity and Infrastructure Security Agency (CISA) has responded to recent supply chain attacks, highlighting ongoing government engagement in addressing such threats ^[24].

Sources

Charter Communications data breach affects 4.9 million accounts - bleepingcomputer.com
Charter Communications Data Breach Could Impact Nearly 5 Million - securityweek.com
Dutch govt disrupts malware botnet with 17 million infected devices - bleepingcomputer.com
California AG sues 23andMe over 2023 breach exposing health data - bleepingcomputer.com
California Sues 23andMe, Alleging It Failed to Protect User Data in 2023 Breach - securityweek.com
In Other News: Trump Mobile Data Breach, FIFA World Cup Phishing, CISA Responds to Supply Chain Attacks - securityweek.com
PAN-OS GlobalProtect Authentication Bypass (CVE-2026-0257) Under Active Exploitation - thehackernews.com
ChatGPhish Vulnerability Turns ChatGPT Web Summaries Into a Phishing Surface - thehackernews.com
Gogs Zero-Day Exposes Servers to Remote Code Execution - securityweek.com
Chrome 148 Update Patches 151 Vulnerabilities - securityweek.com
With Complex Cloud Integrations, Small Errors Lead to Major Compromises - darkreading.com
New Russia-Linked GREYVIBE Targets Ukraine with AI-Powered Cyberattacks - thehackernews.com
ChatGPT share links abused to host fake outage pages to deliver malware - bleepingcomputer.com
Attackers Use LLM Agent for Post-Exploitation After Marimo CVE-2026-39987 Exploit - thehackernews.com
Signal users targeted in backup-stealing phishing attacks - malwarebytes.com
Malicious Sicoob NuGet Steals Banking Credentials as npm Packages Target Cloud Secrets - thehackernews.com
'The Com' Cyberattacks Support Violence & Sexploitation - darkreading.com
From $5 Attacks to Botnet-Powered Platforms: Inside the DDoS-as-a- Service Market - bleepingcomputer.com
What 2,000 Exposed Vibe-Coded Apps Reveal About the Limits of Most Security Stacks - thehackernews.com
MokN Raises $15 Million for Phish-Back Platform - securityweek.com
Google Chrome adds session cookie theft protection for all users - bleepingcomputer.com
Asia's Cyber Insurance Market Shows Signs of Life - darkreading.com

Cybersecurity Brief – 2026-05-29

Fri, 29 May 2026 00:00:00 +0000

Major Incidents or Breaches

Charter Communications suffered a data breach impacting 4.9 million accounts, with the ShinyHunters extortion group claiming responsibility for stealing personal information in early April ^[10].
Carnival Corporation confirmed a data breach affecting nearly 6 million people, also attributed to the ShinyHunters group, with exposed data including personal details of customers ^[20]^[34]^[42].
Customer data from more than 350 hotels worldwide was accessed as part of reservation-hijacking spear-phishing scams, enabling realistic phishing attacks against hotel guests ^[29].

Newly Discovered Vulnerabilities

A critical, unpatched zero-day vulnerability in Gogs, a self-hosted Git service, allows authenticated users to execute arbitrary code on affected instances. This vulnerability is accessible on Internet-facing deployments ^[5]^[16].
A critical authentication bypass vulnerability (CVE-2026-35616) in FortiClient Endpoint Management Server (EMS) has been actively exploited by threat actors to deploy credential-stealing malware. Fortinet released hotfixes in April after zero-day exploitation was detected ^[6]^[15]^[36].
A security flaw in Gitea exposed 30,000 deployments to attacks, allowing attackers to pull private container images and potentially access source code, credentials, and infrastructure ^[39].

Notable Threat Actor Activity

The North Korean state-sponsored group Kimsuky deployed new tools, including HTTPSpy, HelloDoor, and VS Code Tunnels, in attacks targeting South Korean military and corporate entities ^[4].
The Russian-linked threat cluster GreyVibe has been targeting Ukrainian organizations using AI-generated lures and custom malware, leveraging tools such as ChatGPT and Gemini to enhance their operations ^[12]^[32].
The ShinyHunters extortion gang claimed responsibility for large-scale breaches at Charter Communications and Carnival Corporation, stealing millions of customer records ^[10]^[20]^[34]^[42].

Trends, Tools, or Tactics of Interest

The BTMOB Android remote access trojan is being distributed via a malware-as-a-service model, offering a builder interface for custom phishing payloads and enabling full device takeover, financial theft, data exfiltration, and remote access. It is spreading across Brazil and Latin America ^[13]^[26]^[35].
AI is increasingly being used by both defenders and attackers. GreyVibe uses ChatGPT and Gemini for attack lures, while new security tools such as Google’s AI Threat Defense platform and Edamame’s AI agent monitoring platform are being launched to counter AI-powered threats and monitor AI coding agents for intent drift and secret theft ^[12]^[32]^[38]^[41].
Fake ChatGPT download sites are distributing malware to both Windows and Mac users, with payloads tailored to each platform ^[44].
The FBI issued a warning about fake FIFA websites ahead of the 2026 World Cup, which are being used for fraud schemes including stealing personal and financial information and selling fake tickets ^[14].

Regulatory or Policy Developments Affecting the Security Industry

Microsoft publicly advocated for Coordinated Vulnerability Disclosure (CVD), urging security researchers to work with vendors before publicizing zero-day vulnerabilities ^[7].
IBM and Red Hat announced a $5 billion investment in Project Lightwell, aiming to secure open source software supply chains and address vulnerabilities without disrupting production systems ^[37].

Sources

Charter Communications data breach affects 4.9 million accounts - bleepingcomputer.com
Carnival Cruise confirms data breach affecting nearly 6 million people - bleepingcomputer.com
Carnival Data Breach Exposed 6 Million People - securityweek.com
Carnival confirms data breach impacting nearly 6 million - malwarebytes.com
Scammers Are Using Your Real Hotel Reservations to Trick You With Spear-Phishing Attacks - wired.com
Critical Gogs RCE Vulnerability Lets Any Authenticated User Execute Arbitrary Code - thehackernews.com
New Gogs zero-day flaw lets hackers get remote code execution - bleepingcomputer.com
Threat Actors Exploit Critical FortiClient EMS Flaw to Deploy Credential Stealer - thehackernews.com
Hackers exploit FortiClient EMS flaw to push infostealer malware - bleepingcomputer.com
Critical FortiClient EMS Vulnerability Exploited in Fresh Attacks - securityweek.com
Gitea Vulnerability Exposed 30,000 Deployments to Attacks - securityweek.com
Kimsuky Deploys HTTPSpy, Expands Arsenal with HelloDoor and VS Code Tunnels - thehackernews.com
GreyVibe hackers use ChatGPT, Gemini to power cyberattacks - bleepingcomputer.com
Russia-Linked ‘GreyVibe’ Attackers Use AI to Supercharge Cyberattacks - securityweek.com
BTMOB Android malware service generates custom phishing payloads - bleepingcomputer.com
BTMOB RAT Spreads Across Brazil, LatAm via MaaS Model - darkreading.com
New BTMOB Android Malware Enables Full Device Takeover - securityweek.com
New Edamame Platform Aims to Catch AI Coding Agents Going Off the Rails - securityweek.com
Google Unveils AI Threat Defense Platform to Fight AI-Powered Cyberattacks - securityweek.com
Fake ChatGPT download site infects Windows and Mac users with malware - malwarebytes.com
FBI warns of fake FIFA websites running World Cup fraud schemes - bleepingcomputer.com
Microsoft Slams Public Zero-Day Disclosures Amid GitHub Researcher Account Removal - thehackernews.com
IBM and Red Hat Commit $5 Billion to Secure Open Source Supply Chains Under “Project Lightwell” - securityweek.com

Cybersecurity Brief – 2026-01-13

Tue, 13 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Target Corporation: Hackers claim to have stolen and are selling internal source code from Target, with samples published online. Target’s development server has been taken offline.
University of Hawaii Cancer Center: Ransomware attack in August 2025 resulted in theft of participant data, including documents with Social Security numbers dating back to the 1990s.
Endesa (Spanish Energy Provider): Data breach disclosed, with hackers accessing customer contract-related information, including personal details.
BreachForums: The notorious cybercriminal forum was breached, exposing data on 324,000 administrators and members.
Manage My Health (New Zealand): Identified as a top breach in recent threat intelligence reporting, affecting patient portals and healthcare data.
Instagram: Data leak incident where user data appeared on the dark web, coinciding with a password reset vulnerability (see below).
Apex Legends: Live matches disrupted as threat actors hijacked player characters, disconnected users, and changed nicknames.

Newly Discovered Vulnerabilities

n8n Workflow Automation Platform:
- “Ni8mare” vulnerability impacts nearly 60,000 online instances; maximum-severity flaw remains largely unpatched.
- Supply chain attack observed, with malicious npm packages masquerading as integrations to steal OAuth credentials from developers.
Gogs (Git Service): High-severity remote code execution (RCE) flaw exploited in zero-day attacks. CISA has ordered US federal agencies to patch.
Instagram: Password reset vulnerability allowed third parties to send reset emails to users, contributing to a recent data leak.
Telegram: Hidden proxy links can expose user IP addresses with a single click due to how proxy links are handled. Telegram has announced plans for a fix.

Notable Threat Actor Activity

GoBruteforcer Botnet: New campaigns target over 50,000 Linux servers, especially those supporting cryptocurrency and blockchain projects, exploiting weak credentials and AI-generated configurations.
APT28 (Russia): Targeting energy research and defense collaboration entities by impersonating webmail and VPN portals (Microsoft OWA, Google, Sophos VPN).
Kimsuky (North Korea): FBI flagged QR-code phishing (“quishing”) campaigns targeting US and foreign government agencies, NGOs, and academia.
LLM/AI Service Exploitation: Multiple campaigns targeting exposed large language model (LLM) endpoints and misconfigured proxy servers to access sensitive APIs and data.
VoidLink Malware: Discovery of a stealthy, cloud-native Linux malware framework, attributed to a Chinese threat cluster, designed for persistence and evasion in cloud environments.
Facebook Credential Theft: Increased use of “browser-in-the-browser” (BitB) phishing techniques to steal Facebook login credentials over the past six months.

Trends, Tools, or Tactics of Interest

Supply Chain Attacks: Growing use of malicious npm packages for credential theft, specifically targeting workflow automation platforms.
Botnet Evolution: GoBruteforcer botnet demonstrates ongoing adaptation, now preying on servers with weak or AI-generated credentials.
AI and LLM Security: Surge in attacks against exposed LLM endpoints and APIs, highlighting expanding attack surfaces in organizations’ AI deployments.
Phishing Techniques: Rise in “quishing” (QR-code phishing) and “browser-in-the-browser” attacks, increasing the sophistication of credential theft campaigns.
Healthcare AI Adoption: Anthropic launched Claude AI for healthcare, introducing HIPAA-ready tools for providers and payers, reflecting broader AI integration in sensitive sectors.
Endpoint Security Expansion: Hexnode announced entry into endpoint security with its new XDR (Extended Detection and Response) platform.

Regulatory or Policy Developments Affecting the Security Industry

CISA Directive: US federal agencies ordered to patch Gogs RCE vulnerability exploited in active attacks.
EU Regulatory Review: The European Union set a February deadline for its verdict on Google’s $32B acquisition of Wiz, following US approval.
Deepfake Regulation: Global regulators are scrutinizing Grok, an AI tool, over its role in generating illegal sexual deepfake content, including child sexual abuse material.
Privacy and Cybersecurity Law Complexity: Ongoing analysis indicates compliance challenges will persist into 2026, with limited progress on comprehensive federal cybersecurity legislation.

Cybersecurity Brief – 2025-12-12

Fri, 12 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

The Pierce County Library suffered a data breach in April 2025, resulting in the theft of personal information belonging to 340,000 patrons, employees, and their family members.
The UK Information Commissioner’s Office fined LastPass £1.2 million over the 2022 data breach that impacted 1.6 million users, citing failure to implement adequate security measures.
Over 700 internet-facing Gogs servers have been compromised via an unpatched zero-day vulnerability, with attackers exploiting the flaw for remote code execution and file overwrites outside repositories.
Hackers exploited an undocumented cryptographic vulnerability in Gladinet CentreStack and Triofox products, enabling remote code execution attacks.
Multiple malware campaigns have been observed:
- Malicious Visual Studio Code Marketplace extensions (19 identified) have been distributing trojans hidden in fake PNG files since February, targeting developers.
- React2Shell attacks are delivering a range of malware, including cryptocurrency miners, Linux backdoors, botnet malware, and post-exploitation implants.
- DroidLock Android malware is locking users out of their devices and demanding ransom for file and device access restoration.

Newly Discovered Vulnerabilities

A high-severity, actively exploited XXE (XML External Entity) vulnerability has been flagged in OSGeo GeoServer and added to CISA’s Known Exploited Vulnerabilities (KEV) catalog.
An unpatched zero-day in Gogs, a self-hosted Git service, allows attackers to overwrite files outside repositories, leading to remote code execution. The vulnerability is a bypass for a previously disclosed RCE flaw.
An undocumented cryptographic flaw in Gladinet CentreStack and Triofox enables remote code execution and is being actively exploited.
Notepad++ released version 8.8.9 to address a security weakness in its WinGUp update mechanism, which allowed attackers to push malicious update files.
Google released emergency patches for a new Chrome zero-day (the eighth in 2025), described as a V8 type-confusion issue already being exploited in the wild. The specific CVE and affected component remain undisclosed.
IBM patched over 100 vulnerabilities this week, including several critical issues in third-party dependencies.

Notable Threat Actor Activity

The WIRTE APT group is targeting government and diplomatic entities in the Middle East using a new malware suite named AshTag, installed via AshenLoader DLL sideloading.
Hamas-linked hackers are conducting espionage campaigns against Middle Eastern diplomats, deploying increasingly sophisticated malware.
Researchers detailed NANOREMOTE, a backdoor for Windows that uses the Google Drive API for covert command-and-control communications.

Trends, Tools, or Tactics of Interest

AI-driven cyberattacks are automating reconnaissance, generating malware variants, and evading detection at speeds that challenge traditional network defenses.
Attackers are leveraging trusted platforms for C2 communications, such as NANOREMOTE’s use of Google Drive API.
The Mythic post-exploitation framework’s network traffic and agent-to-C2 communication patterns have been analyzed, resulting in new detection rules for network defense.
ConsentFix, a new attack variant, abuses the Azure CLI OAuth app to hijack Microsoft accounts, bypassing passwords and, in some cases, multi-factor authentication.
Browser add-ons, software updates, and developer tool ecosystems (e.g., VSCode Marketplace) are increasingly being used as vectors for malware distribution.
DLL sideloading continues to be a favored technique for malware delivery, as seen in recent WIRTE activity.
Doxers are impersonating law enforcement to trick tech firms into handing over private user data using spoofed emails and falsified documents.

Regulatory or Policy Developments Affecting the Security Industry

The UK ICO imposed a £1.2 million fine on LastPass for inadequate security leading to the 2022 breach.
In the US, President Trump signed an executive order blocking individual states from enacting their own AI regulations, centralizing AI policy at the federal level.
Microsoft expanded its bug bounty program to reward reports of critical vulnerabilities in any of its online services, including those built on third-party code.