iRhythm on DanSec Daily

Cybersecurity Brief – 2026-10-12

Mon, 12 Oct 2026 00:00:00 +0000

Major Incidents or Breaches

Ledger confirmed that cryptocurrency hardware wallets sold via Southeast Asian reseller CryptoBilis were compromised with unauthorized hardware implants, resulting in theft of user funds. Ledger has paused sales through the reseller pending investigation ^[4]^[8].
Retail giant Ahold Delhaize took systems offline following a cybersecurity incident affecting its network ^[11].
iRhythm disclosed a data breach impacting at least 360,000 individuals, with hackers stealing personal information including names, addresses, email addresses, dates of birth, and phone numbers ^[22].
A cyberattack targeted Danfoss refrigeration controllers, remotely defrosting refrigerators and disrupting operations at multiple French supermarket chains ^[9].
Denmark’s government disclosed a breach involving unauthorized access to sensitive information ^[26].
A security failure involving the use of the password “123456” resulted in the exposure of almost 9 million individuals’ personal data ^[27].

Newly Discovered Vulnerabilities

A critical pre-authenticated SSRF vulnerability (CVE-2026-102255) in SonicWall Secure Mobile Access (SMA) 1000 appliances is under active exploitation, with at least 135 exploitation attempts reported shortly after disclosure ^[5]^[24].
The Bricksforge WordPress plugin is affected by a maximum-severity vulnerability (CVE-2026-85097) enabling unauthenticated remote code execution, which is being actively exploited in the wild ^[6]^[19].
GitLab warned of a maximum-severity code execution vulnerability in its CI/CD Regular Expression Compiler, urging users to patch immediately to prevent remote code execution ^[12].

Notable Threat Actor Activity

CyberXero has been linked to an AI-augmented initial access campaign that targeted WordPress sites, e-commerce platforms, and critical infrastructure, resulting in the theft of over 628,000 Ukrainian records. The campaign leveraged AI coding tools such as Claude Code ^[7].
Oleg Korniev, identified as a leader of the YMCO cybercrime money mule network, pleaded guilty in the US for operating a 15,000-mule laundering operation supporting hackers in moving illicit funds ^[21].
A ransomware response expert was arrested in connection with the ShinyHunters FBI hack investigation ^[2]^[23].

Trends, Tools, or Tactics of Interest

Generative AI is increasingly being leveraged by threat actors for deepfakes and sophisticated social engineering attacks, raising concerns over trust and verification in digital communications ^[1].
The emergence of personal AI agents in enterprise environments is introducing new privacy and security challenges, with issues around bot identification and potential misuse ^[3].
Malware authors are embedding hidden instructions in phishing emails to manipulate AI assistants, potentially causing users to act on malicious content they would otherwise ignore ^[28].
A new Windows malware loader, AvisLoader, employs encrypted peer-to-peer communications to enhance resilience against command-and-control disruption ^[10].
The numbat tool provides endpoint visibility and forensics for AI coding agents, including session reconstruction and limited blocking capabilities ^[17].

Regulatory or Policy Developments Affecting the Security Industry

Let’s Encrypt has reduced the default certificate validity period to 64 days, with a further reduction to 45 days planned for February 2027, impacting certificate renewal practices ^[25].
Microsoft reminded users that Windows 11 23H2 Enterprise, Education, and IoT Enterprise editions will reach end of support in 30 days, after which security updates will cease ^[13].
IonQ announced the acquisition of zero trust firm Elisity in an all-stock deal valued up to $1.3 billion, integrating least-privilege access technology into its security portfolio ^[18].

Sources

Ledger Finds Unauthorized Hardware Implant in CryptoBilis-Sold Wallet Amid Fund Theft Reports - thehackernews.com
Ledger confirms spy chip implant behind wallet crypto thefts - bleepingcomputer.com
Retail giant Ahold Delhaize takes systems offline after cyberattack - bleepingcomputer.com
iRhythm Data Breach Impacts at Least 360,000 People - securityweek.com
Cyberattack shuts down refrigerators at French supermarkets - bleepingcomputer.com
12th October – Threat Intelligence Report - research.checkpoint.com
How “123456” became the key to almost 9 million personal records - malwarebytes.com
Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch - thehackernews.com
Critical SonicWall Vulnerability Exploited Days After Disclosure - securityweek.com
Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE - thehackernews.com
Bricksforge WordPress Plugin Vulnerability Exploited in the Wild - securityweek.com
GitLab warns of max severity code execution vulnerability - bleepingcomputer.com
CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records - thehackernews.com
Mastermind of 15,000-Mule Cybercrime Laundering Network Pleads Guilty in US - securityweek.com
⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More - thehackernews.com
Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe - securityweek.com
[Cybersecurity Awareness Month] Trust, but Verify: Navigating the Era of AI Deepfakes - blog.knowbe4.com
Bring Your Own Agent: Your Employees' Assistants Are Already Logged In - thehackernews.com
Phishing emails are baiting your AI assistant - malwarebytes.com
Inside AvisLoader: A Windows Malware Loader Built to Resist Disruption - bleepingcomputer.com
numbat – Endpoint Visibility and Forensics for AI Coding Agents - darknet.org.uk
Let’s Encrypt Cuts Default Certificate Validity to 64 Days Ahead of 45-Day Switch - securityweek.com
Microsoft: Windows 11 23H2 reaches end of support in 30 days - bleepingcomputer.com
IonQ to Acquire Zero Trust Firm Elisity for Up to $1.3 Billion - securityweek.com

Cybersecurity Brief – 2026-06-17

Wed, 17 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Kodak has confirmed a data breach after hackers gained access to company data, with the ShinyHunters extortion gang claiming responsibility. External cybersecurity experts have been engaged to investigate the incident ^[12].
iRhythm, a digital health company, confirmed data theft and a ransom demand after a breach affecting cardiac patients’ medical data ^[35]^[42].
The cybercrime group FulcrumSec claims to have stolen 1.3TB of data from pharmaceutical company Novo Nordisk ^[40].
More than 200 members of Peter Thiel’s ‘Dialog’ Society were exposed through a leak associated with a retreat registration app ^[28].

Newly Discovered Vulnerabilities

Three recently patched vulnerabilities in Fortinet FortiSandbox are being actively exploited in the wild, exposing up to 30,000 devices to compromise. At least one of the flaws was only patched last week ^[9]^[21]^[34].
CISA has warned of an actively exploited maximum-severity vulnerability in the Widget Factory Joomla Content Editor (JCE) that allows PHP code execution ^[4]^[33].
A critical vulnerability in a cPanel plugin (CVE-2026-54420) is being actively exploited, with CISA mandating US government agencies to secure affected servers within three days ^[19].
A flaw in the Google Cloud Vertex AI SDK for Python allowed attackers to hijack machine learning model uploads and execute code in Google’s infrastructure via bucket squatting ^[5].
Chrome and Firefox have received updates to patch multiple critical and high-severity memory safety vulnerabilities that could lead to remote code execution ^[32].
Oracle released its June 2026 Critical Security Patch Update, addressing 245 vulnerabilities across multiple product lines ^[31].
Microsoft is working on a patch for a Defender zero-day vulnerability named “RoguePlanet,” which was disclosed a week ago ^[11].

Notable Threat Actor Activity

The ShinyHunters extortion gang is implicated in the Kodak breach ^[12].
The ransomware and data extortion group Vice Society may be linked to the ClickFix campaign, which is delivering malware loaders such as BabaDeda Loader, Lorem Ipsum Loader, and Potemkin via compromised WordPress sites ^[6]^[27].
DragonForce ransomware operators have used a custom malware, ‘Backdoor.Turn,’ to conceal command-and-control traffic within Microsoft Teams relay infrastructure ^[20].
FishMonger, a China-nexus threat group, has deployed a Windows variant of the SprySOCKS backdoor, previously observed only on Linux, against government targets in Honduras, Taiwan, Thailand, and Pakistan ^[10]^[25].
At least 15 malicious plugins on the JetBrains Marketplace were designed to steal AI API keys from developers ^[13].

Trends, Tools, or Tactics of Interest

The new Rokarolla Android banking trojan targets 217 banking and cryptocurrency applications, utilizes 137 remote commands, and achieves full device control and persistence. It is distributed via fake TikTok and Chrome downloads ^[7]^[14]^[26].
GhostTree attack uses recursive NTFS junctions to create numerous valid Windows file paths, causing Microsoft Defender folder scans to never complete and enabling malware to evade detection ^[17].
The Phantom Stealer malware executes entirely in memory and incorporates anti-analysis techniques to target browser credentials ^[23].
Steam Workshop, via the Wallpaper Engine app, is being abused to distribute malware hidden in wallpaper packages ^[15].
Fileless and evasive malware techniques, as seen in both Phantom Stealer and GhostTree, are increasingly being leveraged to avoid detection by endpoint security tools ^[17]^[23].
144 npm packages associated with the Mastra namespace were compromised via a hijacked contributor account, impacting open-source AI development ecosystems ^[3].
ClickFix campaigns are expanding malware delivery with new loaders and fake update lures, exploiting compromised WordPress sites ^[6]^[27].
94 percent of security incidents involve anonymized infrastructure, and security teams remain largely reactive despite increased access to enrichment and threat intelligence data ^[8].

Regulatory or Policy Developments Affecting the Security Industry

The UK government will require individuals to verify their age with an ID upload or facial scan before creating new social media accounts, effectively banning under-16s from user-to-user social media platforms from spring 2027. Privacy and security experts have raised concerns about age-verification and privacy implications ^[16]^[22].
The US government has imposed export restrictions on Anthropic’s Claude Fable 5 and Mythos 5 AI models, drawing criticism from the security community ^[24]^[29].
US federal authorities have taken down sites hosting nonconsensual deepfake images of famous women ^[43].

Sources

Kodak confirms data breach claimed by ShinyHunters extortion gang - bleepingcomputer.com
iRhythm Confirms Data Stolen in Hack - securityweek.com
Cardiac patients’ medical data stolen and held to ransom - malwarebytes.com
Cybercrime Group Claims Novo Nordisk Hack - securityweek.com
Leak Exposes Members of Peter Thiel’s Secretive ‘Dialog’ Society - wired.com
Attackers Exploit Three Fortinet FortiSandbox Flaws, One Patched Last Week - thehackernews.com
Critical Fortinet FortiSandbox flaws now exploited in attacks - bleepingcomputer.com
3 Recently Patched Fortinet FortiSandbox Vulnerabilities in Hacker Crosshairs - securityweek.com
CISA Warns of Actively Exploited Joomla JCE Flaw Allowing PHP Code Execution - thehackernews.com
Joomla, LiteSpeed Vulnerabilities Exploited in Attacks - securityweek.com
CISA warns of another cPanel plugin flaw exploited in attacks - bleepingcomputer.com
Google Vertex AI SDK Flaw Let Attackers Hijack Model Uploads via Bucket Squatting - thehackernews.com
Chrome and Firefox Updated to Patch Critical, High-Severity Vulnerabilities - securityweek.com
Oracle’s Second Monthly Security Updates Deliver 245 Patches - securityweek.com
Microsoft working on Defender patch for RoguePlanet zero-day - bleepingcomputer.com
ClickFix Campaigns Expand Malware Delivery With New Loaders and Fake Update Lures - thehackernews.com
'Lorem Ipsum' Malware Pivots to ClickFix Delivery - darkreading.com
Ransomware gang abuses Microsoft Teams relays to hide malicious traffic - bleepingcomputer.com
China-Linked SprySOCKS Backdoor Expands to Windows with Driver-Based Stealth - thehackernews.com
SprySOCKS Windows Variant Abuses Kernel Drivers to Evade Detection - darkreading.com
Malicious JetBrains Marketplace plugins steal AI API keys from developers - bleepingcomputer.com
New Rokarolla Android Malware Steals PINs, SMS Codes, and Crypto Wallet Funds - thehackernews.com
New Rokarolla Android malware targets 217 banking, crypto apps - bleepingcomputer.com
Rokarolla Android Trojan Levels Up to Full Device Control, Persistence - darkreading.com
GhostTree Attack Abused Recursive Windows Junctions to Hide Malware - bleepingcomputer.com
Fileless Phantom Stealer Targets Browser Credentials - darkreading.com
Steam Workshop abused to spread malware via Wallpaper Engine app - bleepingcomputer.com
144 Mastra npm Packages Compromised via Hijacked Contributor Account - thehackernews.com
Survey: 94% of Incidents Involve Anonymized Infrastructure. Teams Are Still Reactive - thehackernews.com
UK to require ID or face scan before you can make social media accounts - bleepingcomputer.com
UK Social Media Ban for Minors Has Privacy Experts Worried - darkreading.com
Security Community Slams US Ban on Exporting Mythos, Fable - darkreading.com
‘Dangerous’ AI Models Are Coming No Matter What - wired.com
Deepfake posting sites depicting famous women taken down by feds - malwarebytes.com

Cybersecurity Brief – 2026-06-16

Tue, 16 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

The Council of Europe is investigating claims by the ShinyHunters extortion group that it has stolen and is threatening to leak 297 GB of data, including employee personal information ^[21]^[42].
The Infinite Campus K-12 student information system suffered a data breach by ShinyHunters, resulting in the theft of personal information from more than 137,000 school staff accounts ^[26].
Novo Nordisk, the pharmaceutical company behind Ozempic, disclosed that hackers breached its IT systems and accessed personal data ^[40].
French government officials confirmed a breach of the Tchap messaging platform, affecting approximately 73,000 government accounts, with the attacker claiming theft of messages and user data ^[41].
iRhythm Holdings, a digital healthcare company, reported a data breach in which hackers stole patients’ personal and health information from third-party-hosted business applications ^[16].
Chinese espionage actors breached REDCap servers at a North American medical institution, deploying InfiniteRed malware to steal sensitive research data ^[24]^[29]^[37].
Mackay Sugar, Australia’s second-largest sugar producer, was forced to shut down mills following a ransomware attack attributed to the group “The Gentlemen” ^[36].
The University of Nottingham, a UK research university, experienced a cyber incident, as noted in a threat intelligence bulletin ^[44].

Newly Discovered Vulnerabilities

Cisco released security updates for a vulnerability in Catalyst SD-WAN Manager (CVE-2026-20262), which was actively exploited in the wild to escalate privileges and perform arbitrary file writes ^[5]^[20]^[35].
The US CISA added a LiteSpeed cPanel Plugin vulnerability to its Known Exploited Vulnerabilities catalog, as it allows root privilege escalation and is being actively exploited ^[6].
A vulnerability chain in LiteLLM, an AI gateway, allows a default low-privilege account to escalate to admin and execute code on the server by chaining three flaws ^[9].
A critical vulnerability chain dubbed “SearchLeak” in Microsoft 365 Copilot Enterprise allowed attackers to steal emails, files, and MFA codes in a single click via a trusted Microsoft link. The vulnerability has been patched ^[10]^[25]^[28].
The SimpleHelp remote management software contains a vulnerability in the OpenID Connect authentication protocol that enables unauthenticated attackers to create privileged technician accounts ^[18].

Notable Threat Actor Activity

The North Korean ScarCruft (APT37) group used spear-phishing emails impersonating Microsoft Account security notifications to deliver the NarwhalRAT malware ^[4].
North Korean threat actors are leveraging developer tools as malware delivery channels in campaigns attributed to the Contagious Interview (Famous Chollima, Hexagon Geometry) cluster ^[8].
Chinese state-linked espionage group UNC6508 conducted a year-long campaign targeting North American medical, academic, and defense research networks, stealing sensitive emails and research data by abusing Google Workspace and exploiting REDCap credentials ^[7]^[24]^[29]^[37].
The ShinyHunters extortion group claimed responsibility for data breaches at the Council of Europe and Infinite Campus ^[21]^[26]^[42].
Ransomware group “The Gentlemen” was identified as responsible for the attack on Mackay Sugar in Australia ^[36].
Oleksii Oleksiyovych Lytvynenko, a Ukrainian national, pleaded guilty in the US to charges related to the development of a loader for the Conti ransomware gang ^[39].
The FBI and Google dismantled the “Outsider Enterprise” phishing service, which used over 9,000 phishing sites and stole nearly 4 million credit cards, causing approximately $1.9 billion in losses ^[43].

Trends, Tools, or Tactics of Interest

Malware is being distributed through dozens of malicious wallpapers on Steam Workshop, putting gamers’ accounts at risk ^[1].
A network of 152 Chrome wallpaper extensions with over 105,000 installs was found distributing adware and generating fake traffic ^[13].
Trusted JavaScript files in popular WordPress plugins (PushEngage, OptinMonster, TrustPulse) were tampered with in a CDN supply-chain attack to plant hidden backdoors on sites ^[14]^[19].
A malicious infrastructure was uncovered delivering EtherRAT, phishing pages, and various malware via a vast network of sites ^[45].
There is an increasing trend of employees developing automations and apps with AI tools outside traditional security oversight, leading to code sprawl and shadow tooling concerns for CISOs ^[23].
The Windows variant of the SprySOCKS Linux malware is being used in attacks against government organizations in at least four countries ^[15].
The FBI warned that fraudsters are using couriers in cryptocurrency investment scams to physically collect money from victims ^[22].

Regulatory or Policy Developments Affecting the Security Industry

The US Department of Justice seized the CFAKE.com and SOCFAKE.com deepfake nude sites under the TAKE IT DOWN Act, targeting nonconsensual AI-generated content ^[17].
The US government ordered Anthropic to suspend access to its Claude Fable 5 and Mythos 5 AI models for foreign nationals due to export control concerns and fears of abuse ^[32]^[46].

Sources

Council of Europe investigates ShinyHunters data breach claims - bleepingcomputer.com
ShinyHunters Claims Council of Europe Hack - securityweek.com
Infinite Campus data breach affects 137,000 school staff accounts - bleepingcomputer.com
Ozempic Maker Novo Nordisk Says Hackers Breached IT Systems - securityweek.com
French Government Messaging Platform Breached by Mysterious ‘Misere’ Hacker - securityweek.com
iRhythm discloses data breach, says hackers stole patient info - bleepingcomputer.com
Chinese hackers breach REDCap servers, steal medical research - bleepingcomputer.com
China-Nexus Actor Spy on US Researchers Undetected for a Year - darkreading.com
Chinese Hackers Target Medical, Military, and AI Research in North America - securityweek.com
Ransomware Attack Shuts Down Mills of Australia’s Second-Largest Sugar Producer - securityweek.com
15th June – Threat Intelligence Report - research.checkpoint.com
Cisco Releases Security Updates for Actively Exploited SD-WAN Manager Flaw - thehackernews.com
Cisco fixes SD-WAN vManage flaw exploited in zero-day attacks - bleepingcomputer.com
Cisco Patches Another SD-WAN Zero-Day Exploited in Attacks - securityweek.com
CISA Flags LiteSpeed cPanel Plugin Flaw Exploited for Root Privilege Escalation - thehackernews.com
LiteLLM Vulnerability Chain Lets Low-Privilege Users Take Over AI Gateway Servers - thehackernews.com
One-Click Microsoft 365 Copilot Flaw Could Have Let Attackers Steal Emails, Files, and MFA Codes - thehackernews.com
New attack turned Microsoft 365 Copilot into 1-click data theft tool - bleepingcomputer.com
Copilot 'SearchLeak' Attack Allows 1-Click Data Theft - darkreading.com
SimpleHelp bug lets hackers create rogue remote support accounts - bleepingcomputer.com
Fake Microsoft Alerts Used to Deploy North Korean NarwhalRAT Malware - thehackernews.com
North Korean Hackers Are Turning Developer Tools Into Malware Delivery Channels - thehackernews.com
Chinese Hackers Abused Google Workspace Rules to Steal Research and Defense Emails - thehackernews.com
Ukrainian Man Pleads Guilty in US to Conti Ransomware Charges - securityweek.com
FBI, Google Dismantle ‘Outsider Enterprise’ Phishing Service - securityweek.com
Dozens of malicious wallpapers found on Steam Workshop: gamers’ accounts at risk - securelist.com
152 Chrome Wallpaper Extensions with 105K Installs Linked to Adware and Fake Traffic - thehackernews.com
Popular WordPress Plugin Scripts Tampered to Plant Hidden Backdoors on Sites - thehackernews.com
OptinMonster WordPress plugin hacked in CDN supply-chain attack - bleepingcomputer.com
Inside a malicious infrastructure delivering EtherRAT, phishing pages, and malicious software - malwarebytes.com
Vibe coders are gonna vibe code: How CISOs are tackling code sprawl - bleepingcomputer.com
Windows version of SprySOCKS Linux malware used to attack govt orgs - bleepingcomputer.com
FBI: Fraudsters use couriers to steal money in crypto scams - bleepingcomputer.com
DOJ seizes CFAKE, SOCFAKE deepfake nude sites under TAKE IT DOWN Act - bleepingcomputer.com
US Cracks Down on Anthropic AI Models Amid Abuse Concerns - darkreading.com
Claude Fable 5 and Mythos 5 “abruptly disabled” after US gov. ban - malwarebytes.com