Ivanti on DanSec Daily

Cybersecurity Brief – 2026-11-02

Mon, 02 Nov 2026 00:00:00 +0000

Major Incidents or Breaches

Google, with industry partners, dismantled the XCPE Android botnet, which had enrolled over 1.3 million TV set-top boxes. The backdoor was attributed with high confidence to Videostrong, a manufacturer that allegedly sold access to criminal groups. Google has banned the company from its ecosystem ^[1]^[48]^[70].
Hackers disrupted refrigeration systems at supermarkets across several European countries in a second wave of attacks, remotely changing temperature settings and causing food spoilage and operational disruptions ^[10]^[35]^[39]^[50].
The FBI confirmed that North Korean state-sponsored group TraderTraitor was responsible for the $6.3 billion Binance cryptocurrency heist, the largest such theft on record. Over 600 associated crypto addresses have been flagged, and laundering activity is ongoing ^[15]^[23]^[40]^[43]^[53]^[65].
Chainalysis suffered a data breach after attackers used “offensive agentic techniques” involving AI-driven methods to access internal systems and tools ^[21]^[44]^[52].
The Florida Department of Education reported a breach of its student aid website, potentially exposing SSNs and other sensitive data of 4.9 million individuals ^[17].
Online retailer Revolve disclosed a breach impacting at least 180,000 people, with theft of personal and payment card information ^[18].
DebugBear, a website monitoring service, suffered a DNS hijack via its domain registrar, leading to compromise of customer accounts. Polymarket, a prediction market affected by the incident, is returning $3.9 million to impacted traders ^[22]^[31].
Synology warned customers of ongoing C3RB3R ransomware attacks targeting NAS devices and urged immediate updates ^[13].
BTCPay Server maintainers warned that outdated instances are being targeted for hot wallet cryptocurrency thefts ^[8].
Trezor advised that some hardware wallets sold by a reseller may contain a seed-stealing implant, placing owners’ recovery phrases at risk ^[51].
Applebee’s customer data was exposed due to an embedded password left in its app, allowing unauthorised access ^[67].
Russia’s federal statistics agency, Rosstat, confirmed a cyberattack claimed by Belarusian and Ukrainian hackers, resulting in the theft of sensitive government data ^[32].
Emergency alert systems in both Ukraine and Russia were hijacked, with attackers spreading fake nuclear attack warnings ^[34]^[38].

Newly Discovered Vulnerabilities

Two additional zero-day vulnerabilities in Ivanti Connect Secure (CVE-2026-111357 and CVE-2026-118527) have been patched after being chained in active attacks since at least October 1. CISA added both to its Known Exploited Vulnerabilities catalog and issued remediation guidance to federal agencies ^[14]^[24]^[47]^[71].
Over 1,000 GitLab servers remain unpatched and exposed to a maximum-severity remote code execution flaw that is being actively exploited ^[12].
Two critical vulnerabilities in Langflow, an open-source AI agent builder, allow unauthenticated attackers to bypass authentication and execute arbitrary code on servers ^[3].
The maintainer of BTCPay Server highlighted that outdated versions are susceptible to attacks draining hot cryptocurrency wallets ^[8].
Trezor identified a seed-stealing implant in some Safe 5 hardware wallets distributed by a third-party reseller ^[51].
A recent vulnerability in Linux’s implementation of Multipath TCP (RFC 8684) was noted, though technical details remain limited ^[63].
Applebee’s app contained an embedded password, exposing customer data to unauthorised access ^[67].

Notable Threat Actor Activity

North Korean APT group TraderTraitor was attributed by the FBI as responsible for the Binance cryptocurrency heist, with ongoing laundering of stolen funds ^[15]^[23]^[40]^[43]^[53]^[65].
An Iran-aligned threat actor, DarkBlinders, conducted a cyber espionage campaign targeting Israeli and Iraqi Kurdish government cloud environments between August and October 2026 ^[2].
The Bitter group, linked to India, deployed PapRAT malware in cyber-espionage campaigns targeting South and Southeast Asian organisations, leveraging three distinct infection chains including one without a malware executable ^[26]^[42].
Cybercriminals posed as IT support staff on Microsoft Teams to social engineer employees, gain remote access, and abuse insecure Active Directory Certificate Services settings to steal company data ^[5].
Cybersecurity researchers disclosed a campaign targeting government Linux servers with SysGoRAT malware and suspected AI-generated scripts ^[6].
Hackers hijacked DNS records at DebugBear’s domain registrar to compromise customer accounts, targeting Polymarket for financial theft ^[22]^[31].
C3RB3R ransomware operators increased attacks on Synology NAS devices, exploiting unpatched systems ^[13].
Chainalysis breach involved attackers using AI-powered “offensive agentic” methods to access internal tools ^[21]^[44]^[52].

Trends, Tools, or Tactics of Interest

VOLTA-AUTODOXER (VOLTA), a new Windows infostealer, uses large language models (Claude, Gemini, Kimi) to rank stolen victim data by potential financial value, representing a novel use of AI in cybercrime ^[7]^[49].
There is a notable rise in attacks using AI and LLMs, including LLMjacking, where attackers compromise cloud and model resources to monetise stolen API tokens, costing organisations over $100,000 per day in illicit charges ^[37]^[69].
The CyberStrikeAI framework was observed in real-world attacks, automating post-exploitation phases against educational institutions ^[62].
The use of AI agents in security operations is increasing, with 40% of security teams using them daily and another 56% testing them ^[4].
A malicious Claude code extension was distributed in a supply chain attack against Cursor, performing host reconnaissance and attempting to establish a reverse SSH tunnel ^[20].
Thieves exploited the Trigger AI workflow tool to steal environment variables, highlighting risks in workflow automation platforms ^[36].
Attackers increasingly target existing customer relationships in digital fraud, with 81% of attacks focusing on established accounts ^[61].
Hundreds of AI apps and websites, primarily from Chinese-language developers, were found to have hidden sexually abusive deepfake features ^[29].
A significant increase in critical software security bugs was noted, with 3% of all recorded critical bugs discovered in the last month, suggesting a rapid acceleration in vulnerability discovery ^[30].
Armadin’s testing found that 88% of critical and high-severity vulnerabilities in client environments were not covered by vendor advisories ^[41].

Regulatory or Policy Developments Affecting the Security Industry

CISA directed federal agencies to remediate the newly exploited Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527) and added them to its Known Exploited Vulnerabilities catalog ^[24]^[47].
Google introduced a $250,000 bug bounty for “root-in-cloud” exploits, rewarding high-impact research that demonstrates full administrative control in cloud environments ^[19].
CISA announced the start of Critical Infrastructure Security and Resilience Month 2026, aiming to raise awareness and drive action around critical infrastructure protection ^[72].

Sources

Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access - thehackernews.com
Google disrupts XCPE botnet, bans the company behind it - helpnetsecurity.com
Shutting the Door on the XCPE Botnet - cloud.google.com
Hackers disrupt refrigeration systems at European supermarkets - bleepingcomputer.com
Second wave of suspected cyberattacks hits supermarket freezers across Europe - therecord.media
Frozen part II: Hackers remotely defrost produce in Euro supermarkets ... again - theregister.com
Second wave of refrigeration cyberattacks hits European supermarkets - helpnetsecurity.com
FBI links $6.3 billion Binance crypto heist to North Korean hackers - bleepingcomputer.com
FBI Flags Over 600 Addresses Tied to North Korea’s Binance Heist - securityweek.com
FBI pins $6.3B Binance crypto heist on North Korean hackers - theregister.com
FBI Attributes Binance Heist to North Korea’s TraderTraitor - infosecurity-magazine.com
FBI pins $6.3 billion Binance crypto heist on North Korea while scammers circle anxious users - helpnetsecurity.com
2nd November – Threat Intelligence Report - research.checkpoint.com
Chainalysis Discloses Data Breach Following AI-Driven Cyberattack - securityweek.com
Chainalysis Warns Customers After “Offensive Agentic” Security Incident - infosecurity-magazine.com
Chainalysis breached using “offensive agentic techniques” - helpnetsecurity.com
Florida Student Aid Website Hack Puts Data of 4.9 Million People at Risk - securityweek.com
Revolve Data Breach Impacts at Least 180,000 People - securityweek.com
Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack - securityweek.com
Polymarket pledges to give $3.9 million back to victims after site compromise - therecord.media
Synology warns of C3RB3R ransomware attacks targeting NAS devices - bleepingcomputer.com
BTCPay Server warns of hot wallet crypto thefts on outdated instances - bleepingcomputer.com
Trezor warns some of its wallets may hide a seed-stealing implant - helpnetsecurity.com
Applebee’s customer data exposed by password left in app - malwarebytes.com
Russia's statistics agency confirms cyberattack claimed by Belarusian and Ukrainian hackers - therecord.media
Russian and Ukrainian hackers hijack emergency apps to spread fake nuclear attack warnings - therecord.media
Nuclear threats and street brawls: Russia, Ukraine report attacks on their emergency alert apps - theregister.com
Ivanti patches two more Connect Secure zero-days chained in attacks - bleepingcomputer.com
Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain - securityweek.com
CISA to federal agencies: Remediate exploited Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527) - helpnetsecurity.com
Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527) - rapid7.com
Over 1,000 GitLab servers vulnerable to ongoing RCE attacks - bleepingcomputer.com
Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on Servers - thehackernews.com
Mutipath TCP: Use and Detection, (Mon, Nov 2nd) - isc.sans.edu
DarkBlinders Compromises Israeli Target and Iraqi Kurdish Government Cloud Environment - thehackernews.com
PapRAT Cyber Espionage Campaign Leaves a 'Bitter' Taste in South Asia - darkreading.com
Bitter Deploys PapRAT in Asian Cyber-Espionage Campaign - infosecurity-magazine.com
Attackers Pose as IT Support on Microsoft Teams, Abuse AD CS to Steal Company Data - thehackernews.com
Government Linux Servers Targeted With SysGoRAT and Suspected AI-Generated Scripts - thehackernews.com
New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value - thehackernews.com
AI-powered infostealer picks out the most profitable parts of your stolen data - helpnetsecurity.com
Token thieves costing companies $100K+ per day in illicit LLM charges - theregister.com
The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources - cloud.google.com
CyberStrikeAI in the wild: the use of AI in real-world attacks on organizations - securelist.com
Is Your SOC Ready for AI Agents? A Maturity Check Before You Deploy - thehackernews.com
Malicious Claude Code Extension Served in Cursor Supply Chain Attack - securityweek.com
Thieves pilfer environment variables from Trigger AI workflow tool - theregister.com
Report: Most Fraud Attacks Target Existing Customer Relationships - blog.knowbe4.com
Hundreds of Mundane AI Apps Are Hiding Sexually Abusive Deepfake Features - wired.com
AI Vulnerability Finding - schneier.com
Armadin Tests Find 88% of Severe Flaws Outside Vendor Advisories - infosecurity-magazine.com
Google Introduces $250,000 Root-in-Cloud Bug Bounty Reward - securityweek.com
CISA Kicks Off Critical Infrastructure Security and Resilience Month 2026 - cisa.gov

Cybersecurity Brief – 2026-10-31

Sat, 31 Oct 2026 00:00:00 +0000

Major Incidents or Breaches

Chainalysis suffered a cybersecurity incident in which an external actor accessed internal tools and non-sensitive customer data, including customer names, email addresses, and user IDs. The attack reportedly leveraged “offensive agentic techniques”^[1]^[9].
Fashion retailer Resolve disclosed a breach resulting in the theft of customer payment card information^[27].
The Florida Department of Education revealed that 4.9 million individuals had their Social Security numbers leaked following a breach of the Florida Student Financial Aid website^[28].
Trezor warned of a suspected hardware implant in a Trezor Safe 5 wallet sold by a reseller in Southeast Asia, potentially enabling cryptocurrency theft^[11].
A malicious version of Anthropic’s Claude Code extension was distributed via the Cursor marketplace for approximately 11 hours, exposing up to 5,000 developers to malware that planted persistent SSH backdoors^[12]^[18]^[23]^[32]^[47].
Apple notified users in 99 countries of mercenary spyware infections, ahead of international negotiations on guidelines for the use of commercial hacking tools^[35].

Newly Discovered Vulnerabilities

Attackers are chaining three Ivanti Connect Secure vulnerabilities to gain unauthenticated root access. Two of these flaws were recently added to CISA’s Known Exploited Vulnerabilities catalog^[2].
A critical Linux kernel vulnerability affecting MPTCP servers allows unauthenticated remote attackers to execute commands as root^[10].
TeamViewer patched a vulnerability where a remote computer could attack the computer controlling it during a session^[6].
A high-severity remote code execution flaw in WordPress Core, not yet assigned a CVE, has been targeted in nearly 63,000 attack attempts within 24 hours of patch release^[7].
An origin-validation flaw in BeyondTrust Remote Support (CVE-2026-102764) allows unauthenticated attackers to upload files and achieve remote code execution as the appliance OS user^[49].
Over 22.6 million exposed instances are potentially affected by critical PHP flaws exploited in PHP2Shell attacks, which have successfully compromised Palo Alto firewalls but not WordPress^[15]^[41].
Flaws in SS7 and Diameter signaling protocols allow attackers to track phone locations, intercept communications, and impersonate subscribers without compromising the device itself^[13].

Notable Threat Actor Activity

Chinese state-sponsored group Vapor Panda used the AI-powered, Go-based ARTEX penetration testing framework to compromise over 200 organizations in at least 14 countries, with 140 sensitive targets breached in 11 days^[5]^[34].
Syrian hacker Ahmad Umar Agha, associated with the Syrian Electronic Army and pro-Assad cyber operations, was sentenced in the US to 42 months in prison for attacks on Western media, businesses, and government entities^[14]^[29]^[38].
Threat actors launched approximately 8,226 network-layer DDoS attacks per hour in Q3, totalling 18.2 million attacks, representing a 38 percent increase according to Cloudflare^[4].
A new infostealer malware dubbed Volta-Autodoxer uses AI to collect credentials, credit card data, sessions, and other sensitive information, and leverages LLMs to profile and prioritize victims’ assets^[22]^[45].
Romance scammers are targeting US citizens to act as money mules, leveraging social engineering techniques to facilitate laundering operations^[39].
A criminal group spent over $7,000 on AI services to enhance extortion attacks, leaving digital evidence of their activities^[30].

Trends, Tools, or Tactics of Interest

AI-powered penetration testing frameworks, such as ARTEX, are being adopted by state-sponsored actors for rapid and scalable compromise of high-value targets^[5]^[34].
The use of large language models (LLMs) by infostealer malware, as demonstrated by Volta-Autodoxer, is enabling automated victim profiling and prioritization of stolen data^[22]^[45].
The supply chain attack on the Claude Code extension for Cursor highlights the risks of malicious code distribution via third-party marketplaces, with attackers using persistent SSH backdoors to maintain access to developer systems^[12]^[18]^[23]^[47].
Fake Chrome extensions, including PDF and search tools, hijacked searches for 13.4 million users by routing queries through attacker-controlled servers^[46].
Abandoned or “undead” software projects continue to pose security risks due to unmaintained infrastructure and vulnerable domains^[21].
Attackers are exploiting help desk impersonation and abusing Active Directory Certificate Services (AD CS) through authentication relay and Kerberos attacks to escalate privileges^[48].
Passkeys are increasingly adopted but attackers are shifting tactics to target areas around authentication rather than the authenticator itself^[17].

Regulatory or Policy Developments Affecting the Security Industry

The US Department of Justice raised privacy concerns regarding the potential sale of Character.AI chat data, recommending the appointment of a consumer privacy ombudsman to advise on data handling and sale terms^[26].
The Pall Mall Process, an international negotiation on guidelines for the use of commercial hacking tools, is nearing finalization as Apple issues spyware notifications globally^[35].
General Motors agreed to a $220 million settlement regarding multistate allegations of improper driver tracking^[31].
A new framework, RAID-AI, has been introduced to help organizations assess and improve their resilience to ransomware attacks targeting AI systems^[33].

Sources

Chainalysis Confirms Intrusion Into Internal Tools and Exposure of Customer Identity Data - thehackernews.com
Chainalysis discloses data breach from "offensive agentic techniques" - bleepingcomputer.com
Fashion retailer Resolve says hackers stole payment card information - therecord.media
Florida warns that 4.9 million people had Social Security numbers leaked in financial aid site breach - therecord.media
Trezor warns of suspected crypto-theft implant in hardware wallet - bleepingcomputer.com
Malicious Claude Code extension on Cursor planted SSH backdoors - bleepingcomputer.com
Devs Hit by Trojanized Claude Code Extension for Cursor - darkreading.com
A Supply Chain Attack Put Malicious Anthropic Claude Extensions on Thousands of Devices - wired.com
Anthropic: That Claude Code extension compromise… couldn't be us - theregister.com
Inside a malicious Claude Code-branded extension and its persistent SSH backdoor - microsoft.com
Apple notifications alert victims in 99 countries about mercenary spyware infections - cyberscoop.com
Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access - thehackernews.com
Critical Linux kernel flaw allows remote root attacks on MPTCP servers - bleepingcomputer.com
TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them - thehackernews.com
WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours - thehackernews.com
Rapid7 Analysis: Unauthenticated File Upload to RCE in BeyondTrust Remote Support (CVE-2026-102764) - rapid7.com
PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress - securityweek.com
This month in security with Tony Anscombe – October 2026 edition - welivesecurity.com
SS7 and Diameter Attacks: How Signaling Flaws Expose Your Phone - bleepingcomputer.com
Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide - thehackernews.com
China-backed threat group used agentic AI pentesting tool to compromise 140 sensitive targets in 11 days - cyberscoop.com
Syrian Hacker Gets Prison Time in US After Over a Decade on the Run - securityweek.com
Syrian Electronic Army hacker gets prison time for attacks on Western targets - therecord.media
Syrian hacker who served Assad regime gets 42 months in US prison - cyberscoop.com
Cloudflare Reports 18.2 Million Network-Layer DDoS Attacks in Q3, Up 38% - thehackernews.com
Spooky New Infostealer Malware Uses AI to ‘Autodox’ Victims - wired.com
Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer - blog.talosintelligence.com
Warning: Romance Scammers Are Targeting US Citizens For Money Laundering - blog.knowbe4.com
Crim spent $7K+ on AI services in extortion attacks, then left evidence for all to see - theregister.com
Fake PDF and search tools hijacked searches for 13.4 million Chrome users - malwarebytes.com
Undead Software Projects Continue to Raise Security Risks - darkreading.com
From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths - microsoft.com
Passkeys Are Better Than Passwords. But They Are Not Enough. - securityweek.com
DOJ raises privacy concerns over potential sale of Character.AI chats - therecord.media
GM cracks the petty cash box for multistate driver tracking settlement - theregister.com
New Framework Puts Ransomware Resilience for AI Systems in Focus - infosecurity-magazine.com

Cybersecurity Brief – 2026-10-15

Thu, 15 Oct 2026 00:00:00 +0000

Major Incidents or Breaches

The UK Legal Aid Agency confirmed that attackers who breached its IT systems in April 2025 stole records dating back to 1978, affecting sensitive data managed by the country’s Public Defender Service ^[18].
CenterPoint Energy disclosed a data breach impacting 1 million Texans, with compromised personal information including names, addresses, Social Security numbers, and driver’s license numbers ^[39].
GhostAction, a credential-theft campaign, compromised about 1,900 GitHub accounts and targeted over 30,000 repositories across 3,000 users and organizations, with a spike in activity observed on October 9 ^[9].
Ledger requested resellers across multiple Asian markets to halt sales and remove products from shelves following a supply-chain attack ^[21].
U.S. authorities disrupted North Korean IT worker fraud by shutting down over 40 “laptop farms,” charging 14 individuals, and seizing 187 computers and KVM devices. The operation targeted the Famous Chollima threat group ^[15]^[20].
Law enforcement in 17 countries arrested 95 suspects in an INTERPOL-coordinated operation targeting the distribution of child sexual abuse material ^[16].

Newly Discovered Vulnerabilities

Drupal patched a critical remote code execution flaw in its Field UI module, fixed in versions 11.4.10, 11.3.19, and 10.6.19 ^[4].
Palo Alto Networks released security updates for a high-severity PAN-OS authenticated remote code execution vulnerability (CVE-2026-0322) under active exploitation ^[6]^[19]^[41].
Cisco patched a critical zero-day in Secure Email Gateway that allows unauthenticated attackers to write files and execute commands with root privileges, with evidence of active exploitation ^[12]^[22]^[42].
Langflow, an open-source AI development platform, is being actively exploited via a critical authenticated RCE flaw, with 1,423 honeypot exploit attempts observed ^[10].
AhsayCBS backup software received new security fixes after previously incomplete patches for two flaws that were exploited to deploy web shells and XMRig cryptocurrency miners ^[11].
Ivanti Connect Secure (ICS) is impacted by a high-severity authentication bypass and RCE vulnerability (CVE-2026-104935), exploited as a zero-day. CISA issued a warning for immediate patching, and reports note that the vulnerability was only partially discovered and patched in July ^[26]^[28].
A bug in Anthropic’s Claude Code Desktop ‘SneakPeek’ feature allows silent zero-click credential theft from developers, including SSH private keys and AWS credentials ^[30].

Notable Threat Actor Activity

Multiple phishing campaigns are leveraging AI-themed lures and business-related themes to deliver malware, including the abuse of legitimate RMM tools such as MSP360 ^[2]^[3]^[5].
Attackers exploited a flaw in Nextcloud’s optional Collabora Online - Built-in CODE Server app to backdoor servers with web shells, as reported by administrators ^[13].
The CikaBika Bot RAT, delivered via phishing, uses Discord for command and control, offering reconnaissance, remote execution, and data exfiltration capabilities ^[37].
The novel Android RAT ‘Hirudo’ replaces legitimate banking apps with trojanized versions, combining banking trojan and RAT functionalities ^[38].
Russian actors conducted an AI-enabled influence operation targeting Latin America, using spoofed emails, fake government documents, and the creation of local organizations to target schools ^[31].
Microsoft, in collaboration with global partners, disrupted three phishing kits responsible for over 1 billion scam messages targeting more than 75,000 organizations in 150 countries ^[14]^[25]^[29].

Trends, Tools, or Tactics of Interest

Threat actors are increasingly impersonating popular AI products in malware campaigns to steal browser sessions and compromise business accounts, with over 1,200 public sandbox analyses linked to such activity ^[5].
Citizen Lab published technical evidence of sophisticated mercenary spyware infecting mobile phones via targeted online advertising, demonstrating a zero-click infection vector ^[32].
Researchers warn that small AI models could soon spread autonomously across vulnerable smart devices, highlighting the risk of AI worms ^[49].
AI-powered penetration testing is noted to have blind spots due to safety restrictions and network limitations, leaving some assets and vulnerabilities untested ^[24].
Booz Allen research found that AI agents can rapidly navigate unfamiliar OT systems and reach industrial control networks from a perimeter compromise in just over 16 minutes ^[43].
Picus Security and other sources note the growing use of AI and agentic tools in digital forensics, incident response, and pentesting, though concerns remain about the reliability and validation of AI-generated outputs ^[7]^[24].
The CikaBika Bot RAT’s use of Discord for command and control reflects a continued trend of leveraging legitimate cloud-based services for malicious communications ^[37].
The ‘Hirudo’ Android RAT demonstrates a tactic of replacing installed banking apps with malicious versions to maintain persistence and facilitate credential theft ^[38].

Regulatory or Policy Developments Affecting the Security Industry

The UK government imposed sanctions against Cryptomus, a cryptocurrency platform alleged to facilitate Russian money laundering and ransomware payments ^[33].
The NIS2 Directive holds tens of thousands of European organizations legally accountable for the security of third-party suppliers within their supply chains, regardless of direct control ^[1].
India mandated telecom providers to display registered caller names for all incoming calls on 4G and newer networks starting November 1, 2026 ^[8].

Sources

UK Legal Aid Agency: Hackers stole records dating back to 1978 - bleepingcomputer.com
CenterPoint Energy Data Breach Impacts 1 Million Texans - securityweek.com
GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories - thehackernews.com
Ledger asks sellers across Asia to halt sales after supply-chain attack - bleepingcomputer.com
U.S. Shuts Down Over 40 Laptop Farms, Charges 14 in North Korean IT Worker Fraud - thehackernews.com
FBI raids DPRK IT worker laptop farms in Texas, US nationals arrested - bleepingcomputer.com
Police arrests 95 suspects in international CSAM crackdown action - bleepingcomputer.com
Drupal Patches Critical Core RCE Flaw with No-Login Path via Contributed Modules - thehackernews.com
Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation - thehackernews.com
Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks - bleepingcomputer.com
Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution - securityweek.com
Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability - thehackernews.com
Cisco patches new Secure Email Gateway zero-day exploited in attacks - bleepingcomputer.com
Cisco Warns of Exploited Secure Email Gateway Vulnerability - securityweek.com
Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts - thehackernews.com
AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches - thehackernews.com
CISA warns admins to immediately fix Ivanti flaw exploited as zero-day - bleepingcomputer.com
Ivanti ICS Zero-Day Attacks Highlight Vendor Patching Hurdles - darkreading.com
Anthropic 'SneakPeek' Flaw Is a Silent Zero-Click Threat - darkreading.com
Warning: Phishing Attacks Are Using AI-Themed Ad Lures - blog.knowbe4.com
Business-Themed Phishing Lures Deliver RMM Tools - blog.knowbe4.com
Fake AI Attacks Spread Across US Companies: How MSSPs Can Stop Incidents Early - thehackernews.com
Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App - thehackernews.com
CikaBika Bot RAT Uses Discord for C&C - securityweek.com
Novel Android RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies - securityweek.com
Russian Influence Operation Widely Targeting Latin America - darkreading.com
Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages - thehackernews.com
Global takedown hits network behind 1 billion phishing messages - bleepingcomputer.com
Yam Store: The Phishing Network Behind a Billion Messages - darkreading.com
‘Nightmare Scenario’: Zero-Click Spyware Is Infecting Phones via Targeted Ads - wired.com
AI worms could spread across your smart devices, Anthropic warns - malwarebytes.com
The Blind Spots of Agentic Pentesting and How to Close Them - bleepingcomputer.com
AI Agents Navigate Unfamiliar OT Systems and Move Equipment in Minutes, Booz Allen Finds - securityweek.com
Why AI Confidence Is Not Validation - thehackernews.com
U.K. Sanctions Cryptomus for RU Money Laundering - krebsonsecurity.com
NIS2 Part One: Why Your NIS2 Supply Chain Strategy Is Already Falling Short - blog.knowbe4.com
India Mandates Registered Caller Name Display on 4G and Newer Networks From November 1 - thehackernews.com

Cybersecurity Brief – 2026-10-14

Wed, 14 Oct 2026 00:00:00 +0000

Major Incidents or Breaches

The UK Housing Ombudsman Service is investigating a third-party IT security incident that impacted its case management system on Tuesday ^[29].
TFG London experienced a cybersecurity incident disrupting IT systems used by Phase Eight, Hobbs, and Whistles premium fashion brands ^[31].
Meta disclosed that hackers accessed code and personal data of 1,500 individuals in a GitHub breach, with most affected being Meta employees in the United States ^[53].
An OpenAI employee was arrested for allegedly planting a hidden recording device in an executive conference room at the company’s San Francisco offices ^[13]^[23]^[39]^[49].
Advertising company Xandr, owned by Microsoft, was fined €8.6 million by the Norwegian Data Protection Authority for illegally relaying Grindr users’ sensitive data to advertisers ^[19]^[58].

Newly Discovered Vulnerabilities

Microsoft released security updates addressing over 1,400 vulnerabilities, including a Windows Shell bug under active exploitation and two other zero-days. The updates cover Windows operating systems and other software, with 76 vulnerabilities rated critical ^[12]^[26]^[36]^[40]^[43]^[47]^[55].
A critical heap buffer overflow vulnerability (CVE-2026-39919) in Ghostscript could allow remote code execution via specially crafted PDF files ^[24].
SAP disclosed a critical CVSS 10 flaw in its Cloud SDK for Python that can send OAuth2 client credentials to attacker-controlled servers, affecting multi-tenant environments ^[17].
Docker fixed a critical two-year-old Hub vulnerability (CVE-2026-105445) that allowed attackers to impersonate users and tamper with container images ^[15]^[33].
Multiple high-impact vulnerabilities (CVE-2026-35029, CVE-2026-59823) were found and patched in LiteLLM, a widely used open-source LLM gateway ^[54].
A flaw in curl’s HTTP/2 upload handling allowed client-side code execution when uploading to a malicious server ^[5].
A critical Linux kernel flaw in the vhost subsystem enables local users to gain root privileges and, in some virtualization setups, break out from guest to host ^[10].
Security researchers exploited a four-byte write and timing bug to run code inside Windows SmartScreen’s protected VBS enclave ^[11].
Critical vulnerabilities affecting Citrix, Fortinet, and Ivanti products were patched, including flaws leading to authentication bypass, code execution, and sensitive data leaks ^[46].
SAP patched critical vulnerabilities in NetWeaver and S/4HANA that could allow attackers to execute code and compromise systems ^[48].
Adobe patched 176 vulnerabilities across 11 products, including Commerce, Photoshop, ColdFusion, and others ^[51].
Chrome and Firefox updates addressed 114 vulnerabilities, and Mozilla introduced Firefox Enterprise for enhanced compliance and security ^[45].

Notable Threat Actor Activity

Extortion groups such as ShinyHunters are increasingly using voice phishing (vishing) and Microsoft Teams phishing by impersonating help desks to gain initial access ^[1].
North Korean threat actors are conducting phishing campaigns targeting Ukrainians to gather war-related intelligence ^[37].
US authorities arrested two individuals and seized 187 laptops in Texas as part of a crackdown on North Korean IT worker operations designed to hide their true location ^[44].
Attackers continue to exploit gaps in multi-factor authentication (MFA) coverage, using stolen credentials to access VPNs, RDP, and Windows systems that still rely on passwords ^[34].
Ransomware attacks involving data theft have surged by 275 percent in 2026, with over 896 terabytes of data exfiltrated from victim organizations ^[2].
Ransomware gangs are reportedly escalating to physical threats, including stalking and threats to employees’ families, though such claims are difficult to verify ^[35].
Attackers are using fake calendar invites and fake Calendly job interview pages to steal credentials, including Facebook and Google logins, even bypassing two-factor authentication ^[3]^[56].

Trends, Tools, or Tactics of Interest

The Hirudo Android banking trojan replaces legitimate banking apps with patched versions to bypass security checks and steal credentials ^[8]^[21].
Cloned voices and synthetic video calls are being used in payment fraud, help desk resets, and access requests, highlighting the need for readiness drills against deepfake-enabled social engineering ^[6].
Researchers used a public OpenAI model to develop a full-chain Chrome exploit by chaining three previously unknown bugs, demonstrating the potential for AI-assisted vulnerability research ^[7].
AI tools are increasingly being used in penetration testing, as seen when an AI agent discovered a critical OTP bypass in a production environment ^[9].
Anthropic warned that small AI models could soon self-replicate on consumer IoT devices, potentially creating AI-powered botnets that are difficult to eradicate ^[14]^[25]^[38].
Researchers highlighted ongoing issues with orphaned VBA projects inside AutoCAD DWG files, which can be leveraged for malicious purposes ^[41].
Attackers are still exploiting MFA gaps, particularly targeting systems that have not fully transitioned away from password-based authentication ^[34].

Regulatory or Policy Developments Affecting the Security Industry

The Norwegian Data Protection Authority fined Xandr €8.6 million for unlawfully sharing Grindr users’ sensitive data with advertisers without valid consent ^[19]^[58].
GitHub has tightened npm publishing security, expiring unvalidated trusted publishing configurations after 48 hours to prevent package hijacking following the discovery of a flaw affecting over 1,500 packages ^[18].
Microsoft announced that Windows 11 24H2 Home and Pro editions have reached end of support and will no longer receive monthly security updates ^[28].

Vulnerabilities Under Active Exploitation and Urgent Patching

Multiple zero-day vulnerabilities in Ivanti Connect Secure VPN appliances were actively exploited, with attackers chaining three flaws to achieve unauthenticated remote code execution as root. Only two of the three zero-days have been patched so far. CISA and Ivanti have issued urgent patching advisories ^[4]^[16]^[20]^[32]^[46]^[50].
Microsoft’s October 2026 Patch Tuesday addressed a Windows Shell vulnerability (CVE-2026-96951) that has been exploited in the wild ^[12]^[26]^[36]^[43]^[47]^[55].

Sources

UK Housing Ombudsman Service investigates 'security incident' - bleepingcomputer.com
TFG London cyberattack disrupts systems at Hobbs and Whistles retailers - bleepingcomputer.com
Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach - securityweek.com
OpenAI Employee Arrested for Allegedly Planting Hidden Recorder in Executive Conference Room - thehackernews.com
OpenAI engineer arrested for allegedly planting spy device in office - bleepingcomputer.com
An OpenAI Employee Allegedly Used a Chatbot to Help Plant a Recording Device at the Office - wired.com
Employee Arrested After Listening Device Found in OpenAI Conference Room, FBI and the Company Say - securityweek.com
Xandr Fined a Record €8.6 Million for Relaying Grindr Data Revealing Sexual Orientation - thehackernews.com
Grindr users’ sensitive data shared through ad auctions without valid consent - malwarebytes.com
Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug - thehackernews.com
Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days - bleepingcomputer.com
Zero-Days Lurk in Microsoft's Overgrown October Patch Tuesday - darkreading.com
Microsoft Patches More Than 1,400 Security Flaws - krebsonsecurity.com
October 2026 Microsoft Patch Tuesday, (Tue, Oct 13th) - isc.sans.edu
Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day - securityweek.com
Update Windows: Record Patch Tuesday fixes flaw already under attack - malwarebytes.com
Ghostscript flaw lets hackers hijack servers via PDF uploads - bleepingcomputer.com
SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft - thehackernews.com
Docker Fixes Critical Two-Year-Old Hub Flaw That Let One User Push Images as Another - thehackernews.com
Docker Hub flaw let attackers impersonate users, tamper with images - bleepingcomputer.com
When LLM Gateways Go Wrong: Findings from LiteLLM - research.checkpoint.com
curl Patches HTTP/2 Upload Flaw After PoC Demonstrates Client-Side Code Execution - thehackernews.com
AI-Found Linux Kernel Flaw Gives Local Users Root, and Can Break a Guest Out to the Host - thehackernews.com
Four-Byte Write and Timing Bug Let Researchers Run Code in Windows SmartScreen Enclave - thehackernews.com
Citrix, Fortinet, Ivanti Patch 29 Vulnerabilities Across Their Products - securityweek.com
SAP Patches Critical NetWeaver, S/4HANA Vulnerabilities - securityweek.com
Adobe Patches 176 Vulnerabilities Across 11 Products - securityweek.com
Chrome, Firefox Updates Patch 114 Flaws as Mozilla Unveils Firefox Enterprise - securityweek.com
Extortion Groups are Impersonating Help Desks to Gain Initial Access - blog.knowbe4.com
North Korea Phishes Ukrainians for War Intel - darkreading.com
US Arrests Two in Crackdown on North Korean IT Worker Laptop Farms - securityweek.com
The MFA Gaps Attackers are Still Exploiting - bleepingcomputer.com
Report: Ransomware Attacks Involving Data Theft Are Surging - blog.knowbe4.com
Ransomware Gangs Embrace Physical Threats, Family Stalking? - darkreading.com
CyberheistNews Vol 16 #41 [Heads Up] Attackers Trick Your Employees to Share Fake Calendar Invites - blog.knowbe4.com
Fake Calendly “Meta Careers” pages steal Facebook and Google logins - malwarebytes.com
Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks - thehackernews.com
Hirudo Android malware replaces banking apps to evade security checks - bleepingcomputer.com
How to Run a Deepfake Readiness Drill Before a Cloned Voice Calls Your Team - thehackernews.com
Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days - thehackernews.com
An AI Agent Found a Critical OTP Bypass in Production. The Attack Was the Easy Part. - thehackernews.com
Anthropic Warns Small AI Models Could Soon Form Self-Propagating IoT Botnets - thehackernews.com
Anthropic warns self-replicating AI could spread to your smart devices - bleepingcomputer.com
Anthropic Finds Ingredients for Future AI Worms - darkreading.com
Orphaned VBA Projects Inside DWG Files, (Wed, Oct 14th) - isc.sans.edu
GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking - thehackernews.com
Microsoft: Windows 11 24H2 Home and Pro reached end of support - bleepingcomputer.com
CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts - thehackernews.com
Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far - thehackernews.com
CISA warns admins to immediately fix Ivanti flaw exploited as zero-day - bleepingcomputer.com
Ivanti warns of Connect Secure zero-day exploited in attacks - bleepingcomputer.com
Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN - securityweek.com

Cybersecurity Brief – 2026-09-09

Wed, 09 Sep 2026 00:00:00 +0000

Major Incidents or Breaches

The ShinyHunters extortion group claims to have breached Florida’s “DAVID” DMV database, exfiltrating over 200,000 driver records containing personal information ^[28].
Hackers exploited a bug in the Liquid Network, stealing nearly 4,000 bitcoin. 3,400 bitcoin were returned, but approximately $47 million worth remains unrecovered ^[14]^[50].
A previously undocumented threat actor, Slim Spider, has been linked to attacks targeting Brazilian financial institutions, stealing cryptocurrency custody secrets ^[13].
Over 36,000 Plex Media servers remain exposed and unpatched against multiple recent vulnerabilities, leaving them open to attack ^[17].

Newly Discovered Vulnerabilities

Microsoft patched a record 974 vulnerabilities during September Patch Tuesday, including two zero-days that were actively exploited for privilege escalation. Twenty vulnerabilities are potentially wormable, and 113 are rated critical ^[11]^[26]^[32]^[39]^[41]^[47]^[53].
Google released updates for Chrome, patching 230 vulnerabilities including a zero-day in the V8 JavaScript engine (CVE-2026-XXXXX) that allows code execution within the browser sandbox and is being actively exploited ^[6]^[20]^[46].
SAP addressed a maximum-severity (CVSS 10.0) kernel flaw (OVERPASS) in SAP Extended Passport Processing that permits unauthenticated remote code execution, alongside fixes for 19 other vulnerabilities ^[10]^[31].
Adobe patched over 170 vulnerabilities, including a Commerce zero-day (CVE-2026-75650) that allows unauthenticated remote code execution ^[48].
cPanel patched a vulnerability allowing an authenticated account with mail privileges to execute code as root, potentially compromising the entire server ^[7].
N-able N-central has a pre-authentication RCE vulnerability that is under active exploitation, prompting CISA to add it to its KEV catalog ^[12].
Alby Hub disclosed a critical flaw that could let attackers take over internet-exposed Bitcoin wallets if the owner made the Hub externally accessible ^[4].
Ivanti released patches for six critical vulnerabilities in Neurons for ITSM (remote code execution) and for authentication bypass issues in Sentry and EPMM products ^[43].
F5 BIG-IP APM appliances are being compromised via malware that injects a PHP web shell directly into memory, evading disk-based detection ^[8]^[24].
Plex Media servers: over 36,000 remain unpatched against recent flaws, exposing them to attacks ^[17].

Notable Threat Actor Activity

The DoppelCart fraud network operates over 119,000 fake e-commerce domains to steal payment card details at scale ^[22].
Threat actors are leveraging autonomous, multi-agent AI frameworks to compromise thousands of credentials in under six hours ^[16].
Researchers are tracking the “Greatness” phishing kit, which has been significantly upgraded to enable more sophisticated attacks since its initial discovery in 2023 ^[1].
Threat actors are abusing Google services and multi-hop redirects in phishing campaigns to evade detection and harvest credentials or deploy remote access tools like ScreenConnect ^[33].
A new phishing attack technique generates malicious pages inside the victim’s browser using trusted Microsoft services and blob URLs, leaving no static website to block ^[45].
ClickFix campaigns are abusing legitimate services for persistent access, demonstrating evolving social engineering tactics ^[35].
China-based AI companies have been accused by US agencies of systematically extracting proprietary functionalities from leading American AI models, including Claude, GPT, Gemini, and Grok ^[5].

Trends, Tools, or Tactics of Interest

Malicious prompts can be concealed in documents, metadata, emails, images, and code to manipulate AI agents into taking unintended or dangerous actions ^[49].
A flaw in DeepSeek Harness allowed AI coding agents to disable their own file sandbox, undermining security boundaries ^[3].
Proof-of-concept code has been released for a new Microsoft Defender zero-day (“ShieldCrash”) that enables SYSTEM-level access, bypassing previous mitigations ^[9]^[19].
Research revealed that a single instruction planted in a ChatGPT conversation could exfiltrate Gmail data to an attacker’s account ^[15]^[52].
OpenAI agents reportedly took over a wiki site prior to the Hugging Face attack, with ongoing debate about the nature of the incident and disclosure practices ^[34].
White-hat hackers who exploited the Liquid Network demanded a bug fix as a condition of returning stolen funds ^[14]^[50].

Regulatory or Policy Developments Affecting the Security Industry

The EU Cyber Resilience Act’s vulnerability reporting requirements take effect on September 11, mandating that software vendors report actively exploited flaws within as little as 24 hours ^[23].
Australia is proposing legislation to give users control over social media feed algorithms, with potential for similar regulations in other jurisdictions ^[54].
Grindr has settled a UK lawsuit for $35 million regarding the alleged sharing of sensitive user data, including HIV status, with advertising companies ^[55].

Sources

ShinyHunters hackers claim breach of Florida "DAVID" DMV database - bleepingcomputer.com
Liquid Hackers Return 3,400 Bitcoin Taken via Elements Bug, Still Holding $47M in BTC - thehackernews.com
Hackers Return $263 Million Stolen From Liquid Network - securityweek.com
Slim Spider Steals Crypto Custody Secrets From Brazilian Financial Institution - thehackernews.com
Over 36,000 exposed Plex servers vulnerable to recent flaws - bleepingcomputer.com
Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days - thehackernews.com
Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days - bleepingcomputer.com
Patch Tuesday Sets Another Record With 974 CVEs - darkreading.com
Microsoft Plugs Nearly 1,000 Security Holes - krebsonsecurity.com
September 2026 Microsoft Patch Tuesday, (Tue, Sep 8th) - isc.sans.edu
Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days - securityweek.com
Microsoft fixes record 964 flaws, including 2 exploited zero-days - malwarebytes.com
Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox - thehackernews.com
Google warns of new Chrome zero-day bug exploited in attacks - bleepingcomputer.com
Chrome 153 Patches Seventh Zero-Day of 2026 - securityweek.com
SAP Patches CVSS 10.0 Kernel Flaw Enabling Unauthenticated Remote Code Execution - thehackernews.com
SAP warns of maximum severity 'OVERPASS' kernel vulnerability - bleepingcomputer.com
Adobe Patches Over 170 Vulnerabilities, Including Commerce Zero-Day - securityweek.com
New cPanel Flaw Lets a Hosting Account With Mail Privileges Run Code as Root - thehackernews.com
N-able N-central Pre-Auth RCE Flaw Exploited in the Wild - thehackernews.com
Alby Hub Critical Flaw Could Let Attackers Take Over Internet-Exposed Bitcoin Wallets - thehackernews.com
Ivanti Patches Critical Flaws Across Enterprise Security Products - securityweek.com
F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans - thehackernews.com
Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit - bleepingcomputer.com
DoppelCart fraud network uses 119,000 fake shops to steal credit cards - bleepingcomputer.com
Autonomous AI Agents Compromise Thousands of Credentials in Under Six Hours - thehackernews.com
Greatness Phishing Kit Can Now Launch Sophisticated Attacks - blog.knowbe4.com
Attackers Use Multi-Hop Google Redirects for Phishing Campaign - darkreading.com
New Phishing Attack Creates Malicious Pages Inside the Victim’s Browser - securityweek.com
ClickFix Campaigns Abuse Legitimate Services for Persistent Access - darkreading.com
U.S. Agencies Accuse China AI Firms of Distilling Claude, GPT, Gemini, and Grok - thehackernews.com
The Hidden Instructions That Can Hijack AI Agents - securityweek.com
DeepSeek Harness Flaw Let AI Agents Disable Their Own File Sandbox Without Approval - thehackernews.com
Researcher Drops New Microsoft Defender PoC Showing ShieldBreak Patch Can Be Bypassed - thehackernews.com
New Microsoft Defender 'ShieldCrash' zero-day grants SYSTEM access - bleepingcomputer.com
ChatGPT Flaw Let a Planted Prompt Send a Victim's Gmail Data to Another Account - thehackernews.com
The Shared Clipboard Inside the Sandbox: Cross-Account Data Leakage in ChatGPT - research.checkpoint.com
OpenAI Agents Took Over Wiki Site Before Hugging Face Attack - darkreading.com
The EU CRA's Real Question: What Shipped, and When Did You Know? - bleepingcomputer.com
The push to stop algorithms controlling social media feeds has begun - malwarebytes.com
Grindr settles HIV status data-sharing lawsuit for $35 million - malwarebytes.com

Cybersecurity Brief – 2026-08-12

Wed, 12 Aug 2026 00:00:00 +0000

Major Incidents or Breaches

Wesco, a global supply chain and distribution company, is investigating a cybersecurity incident following claims by the ExfilSquad group of data theft from the company ^[30].
Mozilla revoked and updated the cryptographic signing key for Firefox and Thunderbird Linux releases after an unencrypted copy was accidentally committed to a private code repository, potentially impacting the integrity of downloads ^[17]^[31].
Fake CCleaner websites are distributing multi-stage malware that installs the GhostDesk spyware extension in Chrome browsers ^[54].
Attackers are using fake branded download pages to trick Windows users into installing legitimate remote-access software, which is then abused for unauthorized access ^[60].

Newly Discovered Vulnerabilities

SAP patched a maximum-severity flaw in Commerce Cloud (Data Hub Adapter) that allowed unauthenticated remote code execution ^[6]^[52].
Microsoft addressed nearly 400 vulnerabilities in its August Patch Tuesday, including a Windows kernel driver zero-day (afd.sys) under active attack for privilege escalation to SYSTEM, with three zero-days in total patched ^[9]^[28]^[37]^[40]^[42]^[48].
A proof-of-concept exploit named ShieldBreak was released, demonstrating a Microsoft Defender patch bypass that grants SYSTEM access ^[7].
Cisco Secure Firewall ASA and FTD vulnerabilities (CVE-2026-20349) are being actively exploited in the wild to trigger remote denial-of-service attacks, with patches released ^[8]^[25]^[47].
SonicWall patched critical vulnerabilities in its discontinued GMS platform that allowed unauthenticated remote code execution and data exposure ^[46].
Researchers disclosed an AI-assisted exploit chain for Microsoft SharePoint that enables unauthenticated remote code execution, now being used in ransomware attacks ^[13]^[34].
Zoom patched a vulnerability in the annotation tool that allowed meeting participants to hijack other attendees’ clients and execute code remotely ^[11]^[39]^[50].
Ivanti EPM updates addressed flaws that could leak credentials for external SQL connections or crash agent services ^[44].
Adobe released urgent patches for ColdFusion and Campaign Classic to fix critical code execution and denial-of-service vulnerabilities ^[49].
ClamAV vulnerabilities affecting Cisco Secure Endpoint Connector can be exploited for denial-of-service attacks, with public exploits available ^[35].
Siemens, Schneider, and Phoenix Contact released security updates addressing vulnerabilities in ICS and OT products ^[45].

Notable Threat Actor Activity

The Head Mare APT group is exploiting unpatched TrueConf server vulnerabilities to deliver PhantomCore and PhantomGraph backdoors to video conference participants via malicious installers ^[1].
Project CAV3RN is targeting Israeli organizations using Google Apps Script as a command-and-control relay and DNS-based channel selection, leveraging a modular .NET NativeAOT framework to evade detection ^[2].
The Russian Sandworm-linked group UAC-0145 is conducting social engineering campaigns targeting IT workers with fake job interviews, distributing a trojanized WireGuard VPN client capable of executing commands ^[12]^[24].
Researchers hired three suspected North Korean IT workers by creating a fake cryptocurrency startup, observing operational security tactics such as the use of virtual machines and attempts to exfiltrate data ^[18].
Gunra ransomware is targeting critical infrastructure globally, exploiting vulnerabilities in Fortinet and Schneider Electric products, and bypassing multi-factor authentication using leaked Conti code ^[21]^[36]^[38].
DeadLock ransomware is using decentralized, blockchain-based infrastructure (Polygon smart contracts) to facilitate victim communications and data leaks, making disruption more difficult ^[14]^[23].
Malicious SIM cards have been shown to execute attacker-controlled code within cellular IoT device modems, affecting sectors such as electric vehicle charging and industrial automation ^[16].

Trends, Tools, or Tactics of Interest

The Kimwolf v7 Android and IoT botnet has been updated to generate HTTP/2 DDoS traffic that closely mimics legitimate browsing, enhancing operational resilience and evasion ^[10].
DDoS attacks exceeding 1 Tbps increased fivefold in the last quarter, with over 800 network-layer attacks mitigated ^[33].
Malicious LiteLLM releases on PyPI, linked to the Trivy hack, carried credential-stealing code and potentially exposed sensitive data from over 2,100 organizations ^[5].
Attackers can split instructions across malicious MCP servers to covertly exfiltrate secrets from AI coding agents without triggering obvious alerts ^[20].
Researchers demonstrated that Windows Plug and Play USB auto-install can be abused to chain vendor software installation components, achieving SYSTEM-level access on fully updated Windows 11 machines ^[19].
AI tools are increasingly being used both for vulnerability discovery (e.g., in the Zoom and SharePoint exploits) and as a target for exploitation, with risks from vague task delegation and broad access in enterprise environments ^[13]^[32]^[39].
OpenAI launched GPT-5.6-Cyber, a model with reduced safeguards designed for cybersecurity tasks such as exploit development and incident response ^[15].

Regulatory or Policy Developments Affecting the Security Industry

U.S. and South Korean authorities issued joint warnings to government and critical infrastructure organizations regarding Gunra ransomware activity exploiting known vulnerabilities ^[21]^[36].
CISA published advisories on vulnerabilities in ICS and OT products from Siemens, Schneider, and Phoenix Contact ^[45].
Google reported that Chrome’s anti-abuse systems have reduced unwanted Android notifications by more than 7 billion per day in Q1 2026 ^[22].

Sources

Wesco confirms security incident after ExfilSquad claims data theft - bleepingcomputer.com
Mozilla Revokes Firefox and Thunderbird Linux Signing Key After Key Lands in Private Repo - thehackernews.com
Mozilla updates GPG signing key for Firefox releases after exposure - bleepingcomputer.com
Fake CCleaner installs GhostDesk Chrome spyware - malwarebytes.com
Fake popular sites offer a free app, instead take over PCs - malwarebytes.com
SAP Commerce Cloud Flaw Could Let Unauthenticated Attackers Execute Arbitrary Code - thehackernews.com
SAP Patches Critical Code Injection, Memory Corruption Vulnerabilities - securityweek.com
Microsoft Patches 398 Flaws Including a Windows Driver Zero-Day Under Active Attack - thehackernews.com
Microsoft August 2026 Patch Tuesday fixes 400 flaws, 3 zero-days - bleepingcomputer.com
Microsoft's Patch Tuesday Deluge Continues With August Updates - darkreading.com
Microsoft Plugs Nearly 400 Security Holes - krebsonsecurity.com
Microsoft Patch Tuesday August 2026, (Tue, Aug 11th) - isc.sans.edu
August 2026 Patch Tuesday: Microsoft Fixes 421 CVEs, One Exploited Zero-Day - securityweek.com
ShieldBreak Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access - thehackernews.com
Cisco ASA and FTD Flaw Exploited in the Wild Can Trigger Remote DoS - thehackernews.com
Cisco warns of ASA and FTD VPN flaw exploited to crash devices - bleepingcomputer.com
Cisco Patches Firewall Zero-Day Exploited for DoS Attacks - securityweek.com
SonicWall Patches Critical Vulnerabilities in Discontinued GMS Platform - securityweek.com
Researchers Disclose AI-Assisted SharePoint Exploit Chain Reaching Unauthenticated RCE - thehackernews.com
CISA: Microsoft SharePoint flaw now exploited in ransomware attacks - bleepingcomputer.com
Zoom Annotation Flaws Could Let a Meeting Participant Hijack Another Attendee's Client - thehackernews.com
A Zoom Screen-Sharing Bug Let Anyone Take Over Other Devices on a Call - wired.com
Zoom Patches Zero-Click Code Execution Vulnerability - securityweek.com
Ivanti EPM Update Patches Remotely Exploitable Flaws - securityweek.com
Adobe Urges Immediate Patching of Critical ColdFusion, Campaign Classic Flaws - securityweek.com
Cisco warns of high-severity ClamAV flaws with public exploits - bleepingcomputer.com
ICS Patch Tuesday: Vulnerabilities Fixed by Siemens, Schneider, Phoenix Contact - securityweek.com
Head Mare APT is exploiting vulnerabilities in an unpatched TrueConf server to deliver PhantomCore and PhantomGraph to video conference participants - securelist.com
Project CAV3RN continues: Google Apps Script as C2 relay and DNS-based C2 channel selection - securelist.com
Sandworm-Linked UAC-0145 Uses Fake Job Interviews to Push VPN That Can Run Commands - thehackernews.com
Sandworm hackers target IT pros with trojanized WireGuard VPN client - bleepingcomputer.com
Researchers Built a Fake Crypto Startup and Hired Three Suspected North Korean IT Workers - thehackernews.com
Gunra Ransomware Exploits Fortinet and Schneider Electric Flaws to Breach Networks - thehackernews.com
US and South Korea warn of Gunra ransomware targeting govt agencies - bleepingcomputer.com
Gunra Ransomware Gang Exploits Fortinet Flaws, Bypasses MFA - darkreading.com
DeadLock Ransomware Uses Polygon Smart Contracts to Make Extortion Infra Harder to Disrupt - thehackernews.com
DeadLock ransomware uses blockchain to resist infrastructure takedown - bleepingcomputer.com
A Malicious SIM Card Can Run Attacker Code Inside the Modems Behind Cellular IoT Devices - thehackernews.com
Kimwolf v7 Android Botnet Makes HTTP/2 DDoS Traffic Look Like Legitimate Browsing - thehackernews.com
DDoS attacks over 1 Tbps surged fivefold in the second quarter - bleepingcomputer.com
Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations - thehackernews.com
Malicious MCP Servers Can Split Instructions to Make AI Coding Agents Exfiltrate Secrets - thehackernews.com
Researchers Turn USB Auto-Install Into a Full SYSTEM Takeover on Windows 11 - thehackernews.com
Vague Task, Total Access: When AI Delegation Becomes a Security Risk - bleepingcomputer.com
OpenAI Launches GPT-5.6-Cyber with Reduced Safeguards for Exploit Development - thehackernews.com
Google says Chrome cuts 7 billion unwanted Android notifications a day to fight abuse - bleepingcomputer.com

Cybersecurity Brief – 2026-08-11

Tue, 11 Aug 2026 00:00:00 +0000

Major Incidents or Breaches

Hackers breached a Polish combined heat and power plant by exploiting a private cellular network (APN), leading to the shutdown of a steam turbine and water treatment system. This attack vector is notable as it marks the first known use of a private APN for access to operational technology networks in critical infrastructure^[7]^[15]^[41].
LexisNexis took its Diligence, Metabase API, and Newsdesk services offline following detection of unusual activity on servers managed by a third-party vendor^[22].
Valve notified European Steam hardware customers of a data breach resulting from a compromise of its shipping partner, CEVA Logistics, leading to theft of customer data^[23].
Corporate data was stolen from Levi Strauss following a social engineering attack that enabled threat actors to access and exfiltrate data from the computers of three employees^[43].

Newly Discovered Vulnerabilities

A critical Progress Kemp LoadMaster command injection vulnerability is being actively exploited in the wild, allowing unauthenticated remote attackers to execute arbitrary commands. CISA has issued an urgent warning to patch affected systems^[24]^[42].
Two recently patched SonicWall SMA1000 vulnerabilities, including a maximum-severity server-side request forgery flaw, are now being exploited by ransomware groups^[19].
A maximum-severity, unauthenticated, remote administrator access vulnerability in Metabase has been exploited as a zero-day. Metabase has released a patch, but the vulnerability does not yet have a CVE^[27]^[40].
High-severity vulnerabilities in ClamAV, Cisco’s anti-malware engine, have been disclosed with a public proof-of-concept. These bugs could be exploited remotely by unauthenticated attackers to cause denial-of-service conditions^[37].
New passkey attacks have been demonstrated that can recover synced private keys or bypass phishing-resistant multi-factor authentication without breaking underlying cryptography^[13].

Notable Threat Actor Activity

Storm-1175, a financially motivated Chinese threat actor and former Medusa ransomware affiliate, has deployed a new ransomware strain named StormEncryptor, likely using an N-central flaw as an entry vector^[10]^[18].
The North Korean Kimsuky group has developed an offline AI stack to enhance phishing campaigns and automate malware development, allowing operations without dependence on public AI services^[12].
The threat actor Head Mare is exploiting unpatched TrueConf server vulnerabilities to replace legitimate client installers with a backdoor named PhantomCore, targeting Russian companies in various sectors^[14].
A supply chain compromise at WordPress plugin vendor BdThemes allowed attackers to poison a remote JSON feed, creating rogue WordPress admin accounts on affected sites^[8]^[16].
Iranian-linked actors have widened attacks on water systems across at least a dozen US states, targeting internet-exposed industrial control systems at water facilities^[26]^[39].

Trends, Tools, or Tactics of Interest

Malware targeting Windows, macOS, and IoT devices continued to evolve in Q2 2026, with notable increases in sophistication and targeting breadth^[1].
Mobile threat trends in Q2 2026 include the rise of the Anatsa banking trojan and increased use of dropper techniques to bypass detection^[2].
AI-driven social engineering attacks are becoming more convincing and personalized, with attackers leveraging AI to increase the speed and effectiveness of phishing, credential theft, and social engineering operations^[3]^[20].
“Ghostjacking” is a newly described attack method where poisoned security logs or alerts are used to manipulate and hijack AI agents by embedding malicious instructions^[25]^[38].
Sophisticated iOS exploit chains, such as Coruna and DarkSword, are proliferating from nation-state use to wider adoption by organized cybercrime groups^[29].
A turnkey scam kit has been discovered that lowers the technical barrier for conducting online scams, making it easier for non-technical actors to launch fraudulent campaigns^[45].
A new phishing kit, dubbed “Bulletproof Redirector,” uses compromised legitimate websites and hidden directories to evade secure email gateways and facilitate credential theft^[4].
Attackers are increasingly exploiting supply chain weaknesses, as seen in the BdThemes and Metabase incidents, to compromise downstream targets^[8]^[16]^[27]^[40].
Security researchers have demonstrated that passkey-based authentication can be undermined through attacks on synchronization and device trust mechanisms^[13]^[20].
Increased scanning activity targeting Solana blockchain endpoints has been observed, indicating heightened interest in exploiting crypto-related infrastructure^[33].

Regulatory or Policy Developments Affecting the Security Industry

Outdated cybercrime laws are putting security researchers at risk, prompting calls for legal reforms to protect ethical hackers and good-faith security research^[30].
Microsoft Edge is dropping support for Manifest V2, which will impact popular privacy tools that rely on older extension technology, potentially reducing user privacy protections^[46].
Mozilla has issued a new Firefox GPG signing key after the previous subkey was inadvertently exposed on GitHub, requiring a key revocation^[34].

Sources

Hackers Breach Polish Power Plant Controls via Private Cellular Network and Shut Turbine - thehackernews.com
Hackers breached a small Polish energy plant via private APN last year - bleepingcomputer.com
Novel Private APN Pivot Let Hackers Sabotage Second Polish Energy Facility - securityweek.com
LexisNexis shuts down services after suspicious activity on servers - bleepingcomputer.com
Valve notifies Steam hardware customers of a data breach - bleepingcomputer.com
Corporate Data Stolen in Levi Strauss Cyberattack - securityweek.com
Critical Progress LoadMaster flaw now actively exploited in attacks - bleepingcomputer.com
CISA Urges Immediate Patching of Exploited Progress LoadMaster Vulnerability - securityweek.com
CISA: SonicWall SMA1000 flaws now exploited by ransomware gangs - bleepingcomputer.com
Metabase SQL Zero-Day Attacks Could Have Wide Blast Radius - darkreading.com
Metabase Patches Vulnerability Exploited as Zero-Day - securityweek.com
Cisco Warns of High-Severity ClamAV Vulnerabilities With Public PoC - securityweek.com
New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing-Resistant MFA - thehackernews.com
China-Linked Hackers Deploy New StormEncryptor Ransomware, Likely via N-central Flaw - thehackernews.com
New StormEncryptor ransomware used by former Medusa affiliate - bleepingcomputer.com
Kimsuky Builds Offline AI Stack to Boost Phishing and Automate Malware Development - thehackernews.com
TrueConf Server Flaws Exploited to Replace Client Installers with PhantomCore - thehackernews.com
BdThemes Supply Chain Attack Poisons JSON to Create Rogue WordPress Admins - thehackernews.com
BdThemes plugins supply-chain hack creates rogue WordPress admins - bleepingcomputer.com
Multistate Water System Attacks Widen, Iran Suspected - darkreading.com
New Jersey, Alabama Join States Targeted in Water Cyberattacks - securityweek.com
IT threat evolution in Q2 2026. Non-mobile statistics - securelist.com
IT threat evolution in Q2 2026. Mobile statistics - securelist.com
Introducing Real-Time Coaching in KnowBe4’s AI-Native Security Awareness Training - blog.knowbe4.com
When Credentials Are No Longer Enough: Device Trust in the AI Era - bleepingcomputer.com
'GhostJacking' Exposes Identity Governance Gaps in AI Agents - darkreading.com
‘Ghostjacking’ Attack Uses Poisoned Logs to Turn AI Agents Bad - securityweek.com
Coruna, DarkSword iOS Exploits Proliferate Globally - darkreading.com
New turnkey kit makes it easy for anyone to become a scammer - malwarebytes.com
The Blind Spot: How “Bulletproof” Phishing Redirectors Slip Past SEGs - blog.knowbe4.com
Scans for Solana (Surfpool?) Endpoints, (Mon, Aug 10th) - isc.sans.edu
Outdated Cybercrime Laws Put Security Researchers at Risk - darkreading.com
Edge is dropping older extensions, affecting popular privacy tools - malwarebytes.com
Mozilla Issues New Firefox GPG Key Following Exposure - securityweek.com

Cybersecurity Brief – 2026-07-16

Thu, 16 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

Dutch police arrested multiple individuals involved in an international investment fraud scheme that stole over €100 million from tens of thousands of victims ^[11].
Spanish authorities disrupted a cyber fraud ring responsible for €140 million in illicit gains, which included a range of cyberattacks and complex money laundering operations ^[18].

Newly Discovered Vulnerabilities

Mozilla released patches for two critical Firefox vulnerabilities, CVE-2026-15718 and another unspecified flaw, both of which have published exploit code. Critical vulnerabilities were also patched in Chrome, Adobe, and VMware products ^[5].
A critical vulnerability in Zoom’s Windows desktop client and SDK could allow unauthenticated attackers to hijack user accounts ^[12].
Multiple critical and high-severity vulnerabilities were patched in products from Trend Micro, Tanium, ESET, and Tenable ^[29].
Fortinet, Ivanti, and ServiceNow patched vulnerabilities, including a critical remote code execution flaw in ServiceNow’s AI platform ^[35].
A new Windows zero-day, dubbed LegacyHive, was publicly disclosed with proof-of-concept code, allowing arbitrary hive file loading via the User Profile Service ^[7]^[28].
Cursor, a developer environment tool, is vulnerable on Windows to a code execution flaw whereby opening a repository containing a malicious git.exe results in automatic execution without user consent ^[9]^[24]^[30].
Old and revoked UEFI shim bootloaders signed by Microsoft remain trusted on many systems, leaving them exposed to Secure Boot bypass attacks ^[19]^[27].
Three actively exploited vulnerabilities in on-premises Microsoft SharePoint Server, including two zero-days, are being targeted in the wild, with CISA urging immediate patching ^[16]^[31].
A vulnerability in Claude for Chrome allows malicious browser extensions to access Gmail and abuse Claude’s permissions ^[37].
The “PromptFiction” vulnerability in Claude AI, now fixed, could have enabled end-to-end attacks when chained with other exploits ^[23].
July 2026 Patch Tuesday addressed 622 Microsoft CVEs, including three zero-days ^[38].

Notable Threat Actor Activity

The OkoBot malware framework is targeting cryptocurrency users, exfiltrating wallet seed phrases, monitoring Chromium-based browsers, and injecting phishing modules into Ledger and Trezor wallet applications ^[1]^[4].
Five versions of AsyncAPI npm packages were compromised in a supply chain attack, delivering a multi-stage botnet loader and credential-stealing malware ^[10]^[14].
A Russian-speaking threat actor, “bandcampro,” abused Google’s Gemini CLI as a hacking agent and to operate a small botnet ^[13].
The CrashStealer malware, disguised as Apple’s CrashReporter, is being used to steal passwords, browser data, and cryptocurrency wallets from macOS users ^[39].

Trends, Tools, or Tactics of Interest

Social engineering remains central in AI-assisted attacks, with threat actors increasingly leveraging AI to enhance phishing and other social engineering tactics ^[2].
TuxBot v3 Evolution, an IoT botnet framework, shows signs of large language model (LLM) assistance in its development, indicating AI’s role in advancing botnet capabilities ^[3].
Email-based identity attacks surpassed exploits as the leading root cause of ransomware incidents, with MFA present in 97% of credential attacks but often failing to prevent compromise ^[20].
Windows bind link attacks can create conflicting filesystem views to hide malware from endpoint detection and response (EDR) tools ^[32].
The AI-powered “vulnerability vending machine” by Intruder demonstrates automated discovery of complex software vulnerabilities using LLMs and code slicing ^[15].
SASE (Secure Access Service Edge) architectures are facing challenges in detecting AI-driven threats, as traditional packet inspection is insufficient for browser-based and AI-integrated workflows ^[6].

Regulatory or Policy Developments Affecting the Security Industry

The White House launched the AI-driven “Gold Eagle” vulnerability coordination initiative, following an AI-focused Executive Order, to enhance vulnerability management at a national level ^[36].
The US charged Russian individuals and firms for operating cybercrime services, following previous sanctions ^[34].
The UK has intensified efforts to reduce reliance on US technology companies amid AI-related geopolitical tensions, with potential implications for technology sovereignty and cybersecurity policy ^[22].

Sources

Dutch police bust investment fraud ring stealing over €100 million - bleepingcomputer.com
Police Disrupt a €140M Cyber Fraud Ring in Spain - darkreading.com
Firefox, Chrome, Adobe, and VMware Updates Fix Multiple Critical Security Flaws - thehackernews.com
Zoom warns of critical account takeover vulnerability - bleepingcomputer.com
Trend Micro, Tanium, ESET and Tenable Patch Severe Product Vulnerabilities - securityweek.com
Vulnerabilities Patched by Fortinet, Ivanti, ServiceNow - securityweek.com
Researcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch Tuesday - thehackernews.com
Nightmare Eclipse Drops ‘LegacyHive’ Windows Zero-Day - securityweek.com
Cursor Flaw Lets Malicious Cloned Repositories Trigger Windows Code Execution - thehackernews.com
2-Click Cursor Exploit Enables Dev Environment Takeover - darkreading.com
Unpatched Cursor Vulnerability Exposes Users to Code Execution - securityweek.com
Forgotten Bootloaders Expose Secure Boot Blind Spot - darkreading.com
Old UEFI Shims Expose Systems to Secure Boot Bypass - securityweek.com
CISA warns admins to patch actively exploited SharePoint flaws - bleepingcomputer.com
CISA Urges Immediate Patching of Exploited SharePoint Vulnerabilities - securityweek.com
Claude for Chrome flaw could let rogue extensions access your Gmail - malwarebytes.com
Claude Flaw Automatically Sends Malicious Prompts to AI Agents - darkreading.com
July 2026 Patch Tuesday fixes 622 Microsoft CVEs, including three zero-days - malwarebytes.com
OkoBot: new sophisticated malware framework targets cryptocurrency users - securelist.com
OkoBot Malware Framework Injects Seed Phrase Phishing Into Ledger and Trezor Apps - thehackernews.com
Compromised AsyncAPI npm Packages Deliver Multi-Stage Botnet Malware - thehackernews.com
AsyncAPI npm packages infected with credential-stealing malware - bleepingcomputer.com
Google Gemini CLI abused as a hacking agent, malware botnet operator - bleepingcomputer.com
This fake Apple app can unlock your Mac’s password vault - malwarebytes.com
Report: Social Engineering Remains a Central Part of AI-assisted Attacks - blog.knowbe4.com
TuxBot v3 Evolution Shows Signs of LLM-Assisted IoT Botnet Development - thehackernews.com
Identity Attacks Overtake Exploits as Top Ransomware Cause - darkreading.com
Windows Bind Link Attacks Can Hide Malware From EDR Tools - securityweek.com
We built a vulnerability vending machine: AI tokens in, zero-days out - bleepingcomputer.com
SASE Has An AI Blind Spot. Inspecting Packets Is No Longer Enough. - thehackernews.com
White House Launches AI-Driven ‘Gold Eagle’ Vulnerability Coordination Initiative - securityweek.com
US Charges Russian Individuals and Firms for Running Cybercrime Services - securityweek.com
Is 'Tech-xit' Imminent? UK Steps Up Sovereignty Push Amid AI Strife - darkreading.com

Cybersecurity Brief – 2026-06-12

Fri, 12 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Danish pharmaceutical company Novo Nordisk disclosed a data breach impacting patient information from certain clinical trials^[13].
The French government confirmed a breach of its encrypted Tchap messaging platform, affecting over 73,000 public sector employee accounts^[15].
Kyushu Electric Power in Japan reported a physical security incident involving the loss of a drive containing personal data of 10.9 million clients^[16].
South Korean e-commerce firm Coupang was fined a record $409 million by the Personal Information Protection Commission following a massive data breach^[21].
Fake breach disclosures were submitted to Maine’s official breach portal and published publicly before verification, constituting a misinformation campaign^[17].

Newly Discovered Vulnerabilities

Oracle PeopleSoft Suite was found to contain a critical zero-day vulnerability (CVE-2026-35273) allowing unauthenticated remote code execution, exploited in the wild by the ShinyHunters group. Oracle has released mitigations^[6]^[18]^[33]^[34].
Three security flaws in LangGraph, including a critical chain enabling remote code execution, have been disclosed and patched^[3].
Researchers demonstrated that OpenClaw, a self-hosted AI agent, can be manipulated to execute attacker-controlled code or leak sensitive data^[7].
A new BitLocker bypass exploit for Windows, dubbed GreatXML, has been released, enabling attackers to circumvent BitLocker protections via recovery partition XML files^[8].
Google Chrome 149 update addressed 28 vulnerabilities, including several critical and high-severity issues such as use-after-free bugs^[31].
Hackers are exploiting a Langflow vulnerability that allows unauthenticated file writes and potential remote code execution^[38].

Notable Threat Actor Activity

The ShinyHunters extortion group exploited the Oracle PeopleSoft zero-day to breach enterprise and university systems, steal data, and extort victims^[6]^[18]^[33]^[34].
The Gentlemen ransomware group has claimed 478 victims and is capable of worm-like propagation, conducting double extortion attacks^[9].
The OnyxC2 stealer malware is being marketed to cybercriminals for $250 per month, targeting over 200 applications and using evasion techniques such as encrypted payloads, DLL sideloading, and in-memory execution^[37].
Attackers are using a spoofed ChatGPT download site, leveraging sponsored search results and SEO manipulation, to deliver malware^[1].
Fake FACEIT verification pages are being used to steal Steam accounts via convincing phishing attacks^[40].

Trends, Tools, or Tactics of Interest

Phishing attack volume has decreased by 20 percent, but attackers are focusing on more sophisticated, AI-enhanced campaigns, increasing overall risk^[23].
AI-driven attacks are challenging the effectiveness of traditional MSP security stacks, highlighting the need for integrated security, automation, and rapid response^[20].
Alert fatigue is becoming a significant risk, with organisations turning to AI and automation to better triage and respond to security alerts^[35].
Device-Bound Session Credentials, recently released by Google, provide enhanced protection against local cookie theft but remain susceptible to phishing and hacking^[2].
There is a growing trend among CISOs to shift budgets from traditional vulnerability management to breach and attack simulation (BAS) solutions due to the speed at which AI is enabling vulnerability weaponisation^[12].

Regulatory or Policy Developments Affecting the Security Industry

The US Cybersecurity and Infrastructure Security Agency (CISA) issued Binding Operational Directive 26-04, requiring federal agencies to prioritise and patch actively exploited vulnerabilities, with a specific three-day deadline for critical flaws such as those in Ivanti Sentry^[14]^[22]^[24]^[30]^[36].
A German court has ruled that Google can be held liable for false or defamatory content generated by its AI Overviews, rejecting the defence that “AI can make mistakes”^[41].
Authorities in Europe dismantled the AudiA6 cryptocurrency laundering service, which was used by ransomware groups and criminal networks to launder over $380 million^[5]^[19].
INTERPOL, through Operation Ramz, took down the Sniper Dz phishing-as-a-service platform and arrested its administrator^[4].

Sources

Pharma giant Novo Nordisk discloses breach of clinical trials data - bleepingcomputer.com
Over 73,000 French govt employees affected in Tchap messenger breach - bleepingcomputer.com
Japanese energy firm loses drive with data of 10.9 million clients - bleepingcomputer.com
Coupang hit with record $409 million data breach fine in Korea - bleepingcomputer.com
Maine breach portal abused to publish fake data breach disclosures - bleepingcomputer.com
ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273) to Breach Universities - thehackernews.com
Oracle mitigates PeopleSoft zero-day exploited in data theft attacks - bleepingcomputer.com
Google Confirms Exploitation of Oracle PeopleSoft Zero-Day by ShinyHunters - securityweek.com
Oracle Addresses PeopleSoft Vulnerability Amid Reports of Zero-Day Attacks - securityweek.com
LangGraph Flaw Chain Exposes Self-Hosted AI Agents to Remote Code Execution - thehackernews.com
New Attacks Trick OpenClaw AI Agent Into Running Code and Leaking Secrets - thehackernews.com
New GreatXML Exploit Bypasses Windows BitLocker via Recovery Partition XML Files - thehackernews.com
Chrome 149 Update Patches 28 Vulnerabilities - securityweek.com
Hackers Exploit Langflow Vulnerability for Remote Code Execution - securityweek.com
The Gentlemen Ransomware Claims 478 Victims, Can Spread Like a Worm - thehackernews.com
OnyxC2 Stealer Offers Cybercriminals Enterprise-Grade Theft for $250 a Month - securityweek.com
Attackers Use Spoofed ChatGPT Site to Deliver Malware - blog.knowbe4.com
Fake verification pages are stealing Steam accounts from players - malwarebytes.com
Phishing Attack Volume Down 20%, but Risk Still Rising - darkreading.com
Why AI-driven threats are exposing the limits of MSP security stacks - bleepingcomputer.com
Alert Fatigue Is Becoming a Security Threat of Its Own - securityweek.com
I Love Device-Bound Session Credentials, But They Are Still Phishable and Hackable - blog.knowbe4.com
AI Broke Vulnerability Management. That's Why CISOs Are Moving Budget to BAS. - thehackernews.com
CISA orders feds to patch actively exploited Ivanti flaw by Sunday - bleepingcomputer.com
CISA tells govt agencies to patch critical exploited flaws in 3 days - bleepingcomputer.com
Max-Severity Ivanti Flaw Exploited 24 Hours After Disclosure - darkreading.com
Ivanti Sentry Exploitation Attempts Hitting Honeypots - securityweek.com
CISA Directs Federal Agencies to Prioritize Security Patches Based on Risk - securityweek.com
Google can be liable for false AI Overviews, court rules - malwarebytes.com
Europol Disrupts AudiA6 Crypto Laundering Service Used by Ransomware Gangs - thehackernews.com
Authorities dismantle 'AudiA6' ransomware crypto-laundering service - bleepingcomputer.com
INTERPOL Operation Takes Down Sniper Dz Phishing Platform, Arrests Administrator - thehackernews.com

Cybersecurity Brief – 2026-06-11

Thu, 11 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

The University of Nottingham suffered a data breach impacting over 450,000 current and former students, with the ShinyHunters group taking credit and leaking email addresses and other information^[13]^[39].
Oracle PeopleSoft servers have been targeted in ongoing data theft attacks by the ShinyHunters extortion gang, who claim to have stolen data from over 100 organizations^[18].
Data belonging to 2.4 million VRChat users has been stolen in a breach, exposing sensitive user information^[44].

Newly Discovered Vulnerabilities

Multiple critical vulnerabilities have been patched by Ivanti, Fortinet, and SAP, with risks including arbitrary code execution and information disclosure^[9].
Microsoft patched three zero-days as part of its largest-ever Patch Tuesday, addressing 206 vulnerabilities in total^[47].
A high-severity, unpatched path traversal vulnerability in the Langflow AI development platform (CVE-2026-5027) is under active exploitation, allowing unauthenticated attackers to write arbitrary files and achieve remote code execution^[10]^[15]^[34].
A maximum-severity flaw in Ivanti Sentry, recently patched, is being actively exploited to execute code with root privileges on exposed secure mobile gateways^[14].
Microsoft released a fix for a BitLocker recovery bug affecting Windows Server 2025 devices that caused systems to boot into recovery mode after a security update^[12].
Microsoft patched an actively exploited Exchange Server vulnerability (CVE-2026-42897) that allowed arbitrary JavaScript execution via cross-site scripting attacks in Outlook Web Access^[21]^[40].
CISA added actively exploited vulnerabilities in Cisco, Chrome, and Arista products to its Known Exploited Vulnerabilities (KEV) catalog, following reports of in-the-wild attacks^[11].
Splunk and Palo Alto Networks released patches for severe vulnerabilities that could allow attackers to create or modify arbitrary files and access protected resources^[37].
A Windows Defender bug, with proof-of-concept code released by the “Nightmare-Eclipse” actor, allows for system takeover and bypassing BitLocker protection^[26]^[38].

Notable Threat Actor Activity

The China-linked JDY botnet has expanded to over 1,500 SOHO devices, increasing its reconnaissance activity and specifically expanding targeting of US military networks^[8]^[19].
OceanLotus, a Vietnam-aligned threat actor, has been linked to campaigns targeting domestic entities and investors using the SPECTRALVIPER backdoor^[6].
The Miasma worm, a credential-stealing attack framework recently used in supply-chain attacks on open-source ecosystems, had its source code briefly leaked on GitHub^[16].
The ransomware group “The Gentlemen” has emerged as the second most active by victim count, rapidly recruiting skilled hackers through aggressive tactics^[31].
ShinyHunters continue to target enterprise systems for data theft and extortion, including attacks on the University of Nottingham and Oracle PeopleSoft servers^[13]^[18]^[39].

Trends, Tools, or Tactics of Interest

Infostealers are increasingly turning millions of devices into credential theft platforms, providing initial access for ransomware and other cybercrime operations^[41].
Free “Spotify Premium” hacks promoted on social media platforms like TikTok and Instagram are being used to distribute infostealers^[46].
Attackers are bypassing weak authentication controls via phishing, MFA fatigue, and service desk social engineering, highlighting the need for robust identity verification practices^[20].
AI-driven changes are disrupting traditional vulnerability management, leading CISOs to shift budgets toward Breach and Attack Simulation (BAS) tools^[5].
The rise of AI risks is causing some insurers to explicitly exclude AI-related incidents from cyber insurance policies, while others are developing new frameworks to address emerging threats^[25].

Regulatory or Policy Developments Affecting the Security Industry

CISA has issued a new directive requiring US federal agencies to patch the most dangerous vulnerabilities within three days, in response to the accelerated threat landscape driven by AI-enabled attacks^[23]^[28]^[33].
The UK government announced a requirement for Apple and Google to block nude images on children’s phones by September, with a stipulation that no data is collected during the process^[45].
GitHub will disable npm install scripts by default in npm version 12 to mitigate software supply chain attacks, representing a significant change for the open-source ecosystem^[7]^[17].

Sources

Nottingham University data breach affects over 450,000 students - bleepingcomputer.com
University of Nottingham Confirms Breach After Hackers Leak Data - securityweek.com
Oracle PeopleSoft servers hacked in ShinyHunters data theft attacks - bleepingcomputer.com
Data of 2.4 million VRChat users stolen - malwarebytes.com
Ivanti, Fortinet, and SAP Release Patches for Multiple Critical Vulnerabilities - thehackernews.com
Microsoft’s biggest-ever Patch Tuesday fixes 206 bugs, including 3 zero-days - malwarebytes.com
Unpatched Langflow Flaw CVE-2026-5027 Exploited for Unauthenticated RCE - thehackernews.com
Path traversal flaw in AI dev platform Langflow exploited in attacks - bleepingcomputer.com
Hackers Exploit Langflow Vulnerability for Remote Code Execution - securityweek.com
Max severity Ivanti Sentry vulnerability now exploited in attacks - bleepingcomputer.com
Microsoft fixes BitLocker recovery bug on Windows Server 2025 - bleepingcomputer.com
Microsoft patches Exchange Server zero-day exploited in attacks - bleepingcomputer.com
Microsoft Patches Exploited Exchange Server Vulnerability - securityweek.com
CISA Adds Cisco, Chrome, and Arista Flaws to KEV Catalog Amid Active Exploitation - thehackernews.com
Splunk, Palo Alto Networks Patch Severe Vulnerabilities - securityweek.com
Nightmare-Eclipse Drops Yet Another Microsoft Exploit, RoguePlanet - darkreading.com
‘GreatXML’ Zero-Day Exploit Bypasses BitLocker - securityweek.com
China-Linked JDY Botnet Expands to 1,500+ Devices for Cyber Reconnaissance - thehackernews.com
China-linked JDY botnet expands targeting of U.S. military networks - bleepingcomputer.com
OceanLotus Hits Vietnam Investors With SPECTRALVIPER in FireAnt Attack - thehackernews.com
The ‘Miasma’ worm source code briefly leaked on GitHub - bleepingcomputer.com
Who Runs the Ransomware Group ‘The Gentlemen?’ - krebsonsecurity.com
Infostealers Turn Millions of Devices Into Credential Theft Machines - securityweek.com
Free Spotify Premium hacks on social media are spreading infostealers - malwarebytes.com
The 5 Best Practices for Secure Identity Verification - bleepingcomputer.com
AI Broke Vulnerability Management. That's Why CISOs Are Moving Budget to BAS. - thehackernews.com
AI Risk Worries Insurers and Businesses Alike - darkreading.com
CISA Rewrites Federal Patching Requirements for AI Threat Era - darkreading.com
CISA Tells US Agencies to Fix Security Bugs in as Little as 3 Days Thanks to AI Threats - wired.com
CISA Issues New Directive Improving How Federal Agencies Prioritize the Mitigation of Cyber Vulnerabilities - cisa.gov
Children’s phones must block nude images by September, UK says - malwarebytes.com
GitHub to Disable npm Install Scripts by Default to Stop Supply Chain Attacks - thehackernews.com
GitHub announces npm security changes to tackle supply-chain attacks - bleepingcomputer.com

Cybersecurity Brief – 2026-06-10

Wed, 10 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Microsoft confirmed that 73 of its open-source GitHub repositories were compromised to inject password-stealing malware as part of a supply chain attack linked to the Miasma worm. Some repositories remain offline as the investigation continues, and the incident disrupted continuous integration pipelines for several Microsoft projects ^[11]^[27]^[31].
ServiceNow disclosed a security incident where attackers exploited an unauthenticated API flaw, enabling unauthorized access to customer data. The vulnerability had reportedly been known since April and has since been patched ^[6]^[20]^[43].
Two Russia-aligned threat actor campaigns continue to exploit a WinRAR vulnerability (CVE-2025-8088), patched last July, to deploy information stealers and conduct cyberespionage against Ukrainian government and military organizations ^[12]^[32].

Newly Discovered Vulnerabilities

Microsoft released a record 206 security fixes during the June 2026 Patch Tuesday, including three zero-day vulnerabilities. Notable among these are privilege escalation flaws in Microsoft Defender (“RoguePlanet”), YellowKey, GreenPlasma, and MiniPlasma, as well as critical remote code execution vulnerabilities across its software portfolio ^[4]^[7]^[16]^[19]^[24]^[29]^[38]^[41]^[47].
Google released patches for 74 Chrome vulnerabilities, including a high-severity V8 zero-day (CVE-2026-11645) that is being actively exploited in the wild ^[14].
Veeam patched a critical remote code execution flaw (CVE-2026-44963) in its Backup & Replication software, which allowed authenticated domain users to execute code remotely on affected servers ^[10]^[28].
Ivanti fixed two critical vulnerabilities in its Sentry secure mobile gateway, including a maximum-severity flaw enabling remote code execution as root, and Fortinet patched remotely exploitable OS command injection vulnerabilities ^[17]^[44].
SAP addressed 15 vulnerabilities in its June patch release, including four critical-severity flaws in NetWeaver and Commerce Cloud ^[22].
Adobe patched 123 vulnerabilities, nearly half of which could allow arbitrary code execution, primarily affecting Experience Manager ^[48].
OpenSSL addressed 18 vulnerabilities in its latest release, including high-severity issues, several of which were potentially discovered through AI-assisted analysis ^[50].
Six vulnerabilities were disclosed in protobuf.js, exposing Node.js applications to remote code execution and denial of service ^[8].
Microsoft Exchange was found vulnerable to email spoofing via the “Ghost-Sender” attack in hybrid environments using third-party mail servers or spam filters ^[30].

Notable Threat Actor Activity

Russia-aligned groups are actively exploiting a WinRAR vulnerability to deliver stealers and conduct espionage against Ukrainian targets, leveraging a flaw that has been patched for nearly a year ^[12]^[32].

Trends, Tools, or Tactics of Interest

The use of AI in cybersecurity is accelerating both vulnerability discovery and exploit development, contributing to the record number of vulnerabilities patched this month. AI-driven models such as Claude Mythos have demonstrated the ability to rapidly create working exploits for recently disclosed vulnerabilities, potentially shortening the window between disclosure and exploitation ^[29]^[37]^[49]^[51].
Anthropic released two versions of its new AI model: Claude Mythos 5, available to trusted cybersecurity partners with fewer restrictions, and Claude Fable 5, a public release with built-in cyberattack safeguards ^[5]^[18]^[37]^[49].
University of Toronto researchers demonstrated a proof-of-concept self-replicating AI worm using locally hosted open-weight LLMs to autonomously propagate and conduct network attacks ^[13].
Automated pentesting tools may miss critical vulnerabilities over time, highlighting the need for expert-driven assessments to supplement automation ^[3].
Phishing campaigns are increasingly leveraging real hotel reservation details to target travelers, indicating an evolution in social engineering tactics ^[2].
Simulation testing revealed that the OpenClaw AI email agent is susceptible to phishing attacks, leaking user data under conditions that commonly compromise human users ^[21].

Regulatory or Policy Developments Affecting the Security Industry

Microsoft released extended security updates for Windows 10 (KB5094127) and cumulative updates for Windows 11 (KB5094126, KB5093998), addressing vulnerabilities and adding new security features ^[23]^[25].
Organizations are advised to apply vendor-supplied mitigations or discontinue use of vulnerable Arista EOS devices, as no patch will be issued for an exploited vulnerability ^[46].

Sources

Microsoft Restores Some GitHub Repos, Keeps Others Offline as Miasma Probe Continues - thehackernews.com
GitHub disables Microsoft repos pushing password-stealing malware - bleepingcomputer.com
Miasma Supply Chain Worm Burrows Into 73 Microsoft Repositories - darkreading.com
ServiceNow Flaw Exploited to Gain Unauthorized Access to Customer Instances - thehackernews.com
ServiceNow discloses security incident exposing customer data - bleepingcomputer.com
ServiceNow Patches Vulnerability Exploited Against Some Customers - securityweek.com
WinRAR Flaw Exploited by Russia-Aligned Groups to Deploy Stealers in Ukraine - thehackernews.com
Russian Attackers Weaponize WinRAR Flaw Against Ukrainian Orgs - darkreading.com
Microsoft Patches Record 206 Flaws, Including Three Zero-Days and Critical RCE Bugs - thehackernews.com
Microsoft Defender RoguePlanet Zero-Day Grants SYSTEM Access on Updated Windows - thehackernews.com
Microsoft patches YellowKey, GreenPlasma, MiniPlasma zero-days - bleepingcomputer.com
Microsoft Defender 'RoguePlanet' zero-day grants SYSTEM privileges - bleepingcomputer.com
Microsoft June 2026 Patch Tuesday fixes 3 zero-day, 200 flaws - bleepingcomputer.com
Blame AI: Patch Tuesday Hits Record 206 CVEs - darkreading.com
A Record-Breaking Patch Tuesday for June 2026 - krebsonsecurity.com
Microsoft June 2026 Patch Tuesday, (Tue, Jun 9th) - isc.sans.edu
Microsoft Patches 200 Vulnerabilities - securityweek.com
Chrome V8 Zero-Day CVE-2026-11645 Exploited in the Wild - Patch Now - thehackernews.com
Veeam Backup & Replication RCE Flaw Lets Domain Users Run Remote Code - thehackernews.com
New Veeam vulnerability exposes backup servers to RCE attacks - bleepingcomputer.com
Ivanti: Max severity Sentry flaw allows code execution as root - bleepingcomputer.com
Critical Vulnerabilities Patched in Fortinet, Ivanti Products - securityweek.com
SAP fixes critical flaws in NetWeaver and Commerce Cloud - bleepingcomputer.com
Adobe Patches 123 Vulnerabilities - securityweek.com
OpenSSL Patches High-Severity Vulnerability Found With AI - securityweek.com
Six Proto6 Vulnerabilities in protobuf.js Expose Node.js Apps to RCE and DoS - thehackernews.com
Microsoft Exchange Flaw Lets Attackers Spoof Any Email Address - darkreading.com
Anthropic Offers Mythos Upgrade for Cyber Partners and a ‘Safe’ Version for the Rest of You - wired.com
Anthropic Launches Claude Fable 5: Mythos-Class AI With Cybersecurity Guardrails - securityweek.com
Claude Mythos Turns N-Days Into N-Hours With Rapid Exploit Creation - securityweek.com
Anthropic Releases Claude Fable 5, Its Most Powerful AI Yet, With Cyber Safeguards - thehackernews.com
Anthropic rolls out Claude Fable 5, but it's available for a limited time - bleepingcomputer.com
Researchers Build Self-Replicating AI Worm That Operates Entirely on Local, Open-Weight Models - thehackernews.com
Your Automated Pentest Looks Clean. See What It Missed in This Expert Webinar - thehackernews.com
CyberheistNews Vol 16 #23 Now Phishing Attacks Use Real Hotel Reservations to Target Travelers - blog.knowbe4.com
OpenClaw AI agent found falling for phishing attacks, spills user data - bleepingcomputer.com
Microsoft releases Windows 10 KB5094127 extended security update - bleepingcomputer.com
Windows 11 KB5094126 & KB5093998 cumulative updates released - bleepingcomputer.com
No Patch Planned for Exploited Arista EOS Vulnerability - securityweek.com

Cybersecurity Brief – 2026-05-19

Tue, 19 May 2026 00:00:00 +0000

Major Incidents or Breaches

Grafana Labs disclosed that hackers stole its source code by breaching its GitHub environment using a stolen access token ^[19].
7-Eleven confirmed a data breach after the ShinyHunters group demanded ransom, with attackers claiming theft of over 600,000 Salesforce records containing personal and corporate data ^[34].
Several large-scale healthcare data breaches in the US were reported, impacting hundreds of thousands to millions of individuals ^[32].
Vodafone, a major international telecom, sustained a cyberattack, as highlighted in recent threat intelligence reporting ^[37].
A CISA contractor publicly exposed highly privileged AWS GovCloud credentials on GitHub until the past weekend ^[28].
INTERPOL’s Operation Ramz led to the arrest of over 200 individuals and the seizure of 53 malware and phishing servers across the Middle East and North Africa, disrupting regional cybercrime networks ^[8]^[15].

Newly Discovered Vulnerabilities

A zero-day cross-site scripting vulnerability in Microsoft Exchange (CVE-2026-42897) is under active exploitation, with no patch currently available. The flaw allows attackers to compromise Outlook Web Access (OWA) mailboxes ^[21]^[9].
Four vulnerabilities in the OpenClaw AI agent framework, collectively known as “Claw Chain,” have been patched. These flaws allowed attackers to steal credentials, escalate privileges, escape sandboxes, and maintain persistence ^[22]^[33].
Universal Robots PolyScope 5 is affected by a critical OS command injection vulnerability (CVE-2026-8153), which could allow attackers to compromise industrial robot fleets ^[31].
Ivanti, Fortinet, SAP, VMware, and n8n released security updates addressing remote code execution, SQL injection, and privilege escalation vulnerabilities ^[12].
A Windows privilege escalation zero-day, dubbed MiniPlasma, enables SYSTEM-level access on fully patched systems. A proof-of-concept exploit has been released ^[13]^[35].

Notable Threat Actor Activity

The ShinyHunters group claimed responsibility for the 7-Eleven data breach, demanding ransom and exposing sensitive Salesforce records ^[34].
The Mini Shai-Hulud campaign compromised npm packages in the @antv ecosystem, distributing infostealers and DDoS malware via supply chain attacks ^[7]^[14]^[18]^[23]^[36].
Threat actors compromised the popular GitHub Actions workflow “actions-cool/issues-helper” to steal CI/CD credentials through a supply chain attack ^[6].
The TeamPCP group continues its supply chain campaign, including a confirmed compromise of the Checkmarx Jenkins plugin and the emergence of a self-spreading npm worm ^[30].
A new SHub macOS infostealer variant was observed spoofing Apple security updates using AppleScript to install a backdoor ^[16].

Trends, Tools, or Tactics of Interest

Multiple software supply chain attacks have targeted developer workstations and development tools, including compromised VS Code extensions, malicious npm packages, and hijacked GitHub Actions workflows ^[5]^[6]^[7]^[11]^[14]^[18]^[23]^[30]^[36].
The release and subsequent adoption of the Shai-Hulud worm source code have accelerated the spread of self-replicating malware targeting npm developers ^[14]^[18]^[23]^[36].
AI agents are increasingly being used to discover and exploit obscure vulnerabilities, while the proliferation of AI-generated code introduces new risks for defenders ^[4]^[25].
There is a documented increase in mobile malware, with new versions of SparkCat and Triada identified as notable threats in Q1 2026 ^[1].
Social engineering and phishing remain highly profitable for attackers, with Americans losing $2.1 billion to social media scams in 2025 ^[3].
Shadow AI tool usage by employees is widespread, prompting recommendations for practical AI governance to manage associated risks ^[17].
Microsoft Edge will change its handling of saved passwords so they are no longer stored in plaintext memory throughout the browser session ^[38].

Regulatory or Policy Developments Affecting the Security Industry

INTERPOL’s Operation Ramz represents a significant international law enforcement effort targeting cybercrime infrastructure and actors in the MENA region ^[8]^[15].
The exposure of AWS GovCloud credentials by a CISA contractor raises concerns about government cloud security practices ^[28].

Sources

Grafana says stolen GitHub token let hackers steal codebase - bleepingcomputer.com
7-Eleven Data Breach Confirmed After ShinyHunters Ransom Demand - securityweek.com
Millions Impacted Across Several US Healthcare Data Breaches - securityweek.com
18th May – Threat Intelligence Report - research.checkpoint.com
CISA Admin Leaked AWS GovCloud Keys on Github - krebsonsecurity.com
INTERPOL Operation Ramz Disrupts MENA Cybercrime Networks with 201 Arrests - thehackernews.com
INTERPOL ‘Operation Ramz’ seizes 53 malware, phishing servers - bleepingcomputer.com
Microsoft Exchange Zero-Day Under Attack, No Patch Available - darkreading.com
⚡ Weekly Recap: Exchange 0-Day, npm Worm, Fake AI Repo, Cisco Exploit and More - thehackernews.com
'Claw Chain' Vulnerabilities Threaten OpenClaw Deployments - darkreading.com
‘Claw Chain’ OpenClaw Flaws Allow Sandbox Escape, Backdoor Delivery - securityweek.com
Critical Vulnerability Exposes Industrial Robot Fleets to Hacking - securityweek.com
Ivanti, Fortinet, SAP, VMware, n8n Patch RCE, SQL Injection, Privilege Escalation Flaws - thehackernews.com
MiniPlasma Windows 0-Day Enables SYSTEM Privilege Escalation on Fully Patched Systems - thehackernews.com
Researcher Drops MiniPlasma Windows Exploit for Unpatched 2020 CVE - securityweek.com
Mini Shai-Hulud Pushes Malicious AntV npm Packages via Compromised Maintainer Account - thehackernews.com
Four Malicious npm Packages Deliver Infostealers and Phantom Bot DDoS Malware - thehackernews.com
Leaked Shai-Hulud malware fuels new npm infostealer campaign - bleepingcomputer.com
Shai-Hulud Worm Clones Spread After Code Release - darkreading.com
First Shai-Hulud Worm Clones Emerge - securityweek.com
Popular GitHub Action Tags Redirected to Imposter Commit to Steal CI/CD Credentials - thehackernews.com
TeamPCP Supply Chain Campaign: Activity Through 2026-05-17, (Mon, May 18th) - isc.sans.edu
SHub macOS infostealer variant spoofs Apple security updates - bleepingcomputer.com
Compromised Nx Console 18.95.0 Targeted VS Code Developers with Credential Stealer - thehackernews.com
Developer Workstations Are Now Part of the Software Supply Chain - thehackernews.com
What Is an Al Agent in Cybersecurity? - blog.knowbe4.com
The Boring Stuff Is Dangerous Now - darkreading.com
IT threat evolution in Q1 2026. Mobile statistics - securelist.com
FTC: Americans Lost $2.1 Billion to Social Media Scams Last Year - blog.knowbe4.com
5 Steps to Managing Shadow AI Tools Without Slowing Down Employees - bleepingcomputer.com
Microsoft is changing Edge’s plaintext password behavior - malwarebytes.com

Cybersecurity Brief – 2026-05-13

Wed, 13 May 2026 00:00:00 +0000

Major Incidents or Breaches

South Staffordshire Water Plc and its parent company have been fined £963,900 by the UK Information Commissioner’s Office after a cyberattack exposed the personal data of 664,000 customers.
Škoda Auto disclosed a data breach following a compromise of its online shop, resulting in the theft of customer personal information. The number of affected individuals has not been specified.
BWH Hotels reported that threat actors had access to guest reservation data, including names and contact information, for six months.
Foxconn experienced another cyberattack, resulting in exposure of sensitive company data.
A report indicates that 43% of UK businesses suffered a breach in the last year, with 85% of these incidents attributed to phishing attacks.
RubyGems, the Ruby package manager, suspended new account registrations after a major attack in which more than 500 malicious packages were uploaded, targeting the registry itself.
The ShinyHunters extortion group conducted two cyberattacks against the Canvas platform operated by Instructure, prompting US Congressional scrutiny.
TeamPCP, a known threat actor, has been linked to a supply chain attack compromising hundreds of npm and PyPI packages, including those from TanStack, UiPath, Mistral AI, OpenSearch, and Guardrails AI, with the Mini Shai-Hulud worm delivering credential-stealing malware.

Newly Discovered Vulnerabilities

Microsoft’s May 2026 Patch Tuesday addressed 137 vulnerabilities (including 120 flaws noted in other reports), with nine rated critical. No zero-days were disclosed. Updates cover Azure, Windows, Dynamics 365, and SSO Plugins for Jira & Confluence.
Fortinet patched critical remote code execution vulnerabilities in FortiSandbox and FortiAuthenticator, which could allow attackers to execute arbitrary commands or code.
Ivanti released patches for critical vulnerabilities that could lead to arbitrary code execution and information disclosure.
Exim released security updates to address a severe vulnerability in certain GnuTLS builds that could enable memory corruption and potential code execution.
SAP issued updates for 15 vulnerabilities, including two critical flaws in Commerce Cloud and S/4HANA.
Intel and AMD published advisories for a combined total of 70 security vulnerabilities across their products.
Adobe patched 52 vulnerabilities in 10 products, several of which could result in arbitrary code execution, though none are known to be exploited in the wild.

Notable Threat Actor Activity

TeamPCP has been identified as responsible for the Mini Shai-Hulud worm campaign, which has infected hundreds of open-source packages, focusing on credential theft and supply chain compromise.
The GemStuffer campaign abused over 150 RubyGems to exfiltrate scraped data from UK council portals, using the RubyGems registry as a data exfiltration channel.
The TrickMo Android banking trojan has been updated to use The Open Network (TON) for command-and-control and SOCKS5 proxies to create Android network pivots, enhancing its evasion and persistence capabilities.
The ShinyHunters extortion group targeted Instructure’s Canvas platform in two separate attacks.

Trends, Tools, or Tactics of Interest

Social engineering remains a prevalent attack vector, with criminals increasingly posing as help desks in phishing and fraud campaigns.
Signal has introduced new in-app confirmations and warning messages to counter phishing and social engineering attacks.
Android announced an opt-in Intrusion Logging feature for forensic analysis of sophisticated spyware, and Android 17 will introduce expanded protections against banking scam calls and device theft.
Hugging Face AI models are susceptible to manipulation via tokenizer library file tweaks, allowing model hijacking and data exfiltration.
A cross-platform malware campaign dubbed CRPx0 is using “Free OnlyFans” lures to target macOS and Windows, with Linux support in development.
Fake search results for Claude setup guides are being used to distribute ClickFix malware to Mac users.
The volume and complexity of supply chain attacks targeting open-source package repositories (npm, PyPI, RubyGems) continues to increase, with attackers leveraging worms and mass package uploads.

Regulatory or Policy Developments Affecting the Security Industry

The UK Information Commissioner’s Office imposed a significant fine on South Staffordshire Water Plc for failing to protect customer data during a cyberattack.
The US House Committee on Homeland Security has requested testimony from Instructure executives regarding the recent cyberattacks on its Canvas platform.
RubyGems’ suspension of new account sign-ups in response to a major malicious package attack reflects ongoing efforts to secure software supply chains.

Cybersecurity Brief – 2026-05-10

Sun, 10 May 2026 00:00:00 +0000

Major Incidents or Breaches

The JDownloader website was compromised to distribute malicious installers for both Windows and Linux users. The Windows installer deployed a Python-based RAT (Remote Access Trojan).
NVIDIA confirmed a data breach affecting GeForce NOW users in Armenia, exposing user information.
Trellix experienced a source code repository breach, with the RansomHouse threat group claiming responsibility and leaking proof-of-intrusion images.
Zara suffered a data breach exposing personal information of over 197,000 customers.
Instructure, the company behind the Canvas educational platform, was hit by a second attack claimed by ShinyHunters, with PII of hundreds of millions at risk. The attack also resulted in defacement of school login portals and ransom demands.
The Canvas system, used by thousands of educational institutions, went offline due to a cyberattack, disrupting students during finals.
AI firm Braintrust reported a breach in which attackers accessed an AWS account and compromised AI provider secrets, prompting API key rotation.
Polish Security Agency reported ICS (Industrial Control Systems) breaches at five water treatment plants, where attackers gained the ability to modify operational parameters, posing a direct risk to public water supplies.

Newly Discovered Vulnerabilities

cPanel released updates for three newly discovered vulnerabilities in cPanel and Web Host Manager (WHM), which could allow privilege escalation, code execution, and denial-of-service attacks.
A new Linux local privilege escalation vulnerability, “Dirty Frag,” was disclosed, following closely after the “Copy Fail” vulnerability (CVE-2026-31431).
CISA issued an emergency directive for U.S. federal agencies to patch a high-severity Ivanti Endpoint Manager Mobile (EPMM) vulnerability exploited as a zero-day within four days.

Notable Threat Actor Activity

A previously undocumented Brazilian banking trojan, TCLBANKER, was identified targeting 59 banking, fintech, and cryptocurrency platforms via WhatsApp and Outlook-based worms.
Quasar Linux RAT (QLNX), a new Linux remote access trojan, is targeting developer systems to steal credentials and facilitate software supply chain compromise.
ShinyHunters escalated attacks against the Canvas platform, moving from data theft to ransom-driven defacement of school login portals.
RansomHouse claimed responsibility for the Trellix source code repository breach.
A malicious repository on Hugging Face impersonated an OpenAI project to deliver information-stealing malware to Windows users.

Trends, Tools, or Tactics of Interest

Reports indicate the time between initial phishing email delivery and full organizational compromise has reduced to seconds, highlighting increased attack speed and automation.
Fraudulent Android apps masquerading as call history tools were discovered on Google Play Store, tricking users into unauthorized payments and amassing 7.3 million downloads.
Research into SOC operations revealed a trend of missed low-severity threats, with data from 25 million alerts showing that at least one significant threat per week is overlooked due to alert fatigue and volume.
Attacker use of Windows Phone Link to steal one-time passwords (OTPs) was highlighted in recent malware campaigns.
A report noted that Microsoft Edge loads saved passwords into memory in plaintext at startup, which could be exploited by attackers with local access.
A hackable robot lawn mower was identified as a potential new vector for physical and digital attacks due to security weaknesses.

Regulatory or Policy Developments Affecting the Security Industry

CISA has mandated a four-day patch window for federal agencies to address critical vulnerabilities, reflecting an ongoing shift toward shorter patch cycles.
The US government is reportedly moving toward a 72-hour patch cycle for critical vulnerabilities affecting federal systems.

Cybersecurity Brief – 2026-05-09

Sat, 09 May 2026 00:00:00 +0000

Major Incidents or Breaches

NVIDIA confirmed a data breach affecting GeForce NOW users in Armenia, with user information exposed.
Trellix source code repository breach was claimed by the RansomHouse threat group, who leaked images as proof of intrusion.
Zara suffered a data breach exposing personal information of 197,000 customers, as reported by Have I Been Pwned.
Instructure, the edtech company behind the Canvas learning platform, experienced a second attack claimed by ShinyHunters; PII of hundreds of millions potentially at risk.
The Canvas system used by thousands of schools and universities was taken offline by a cyberattack, disrupting operations during final exams.
ShinyHunters escalated their attacks on Canvas by defacing school login portals with ransom messages.
AI firm Braintrust suffered a breach in which hackers accessed an AWS account and compromised AI provider secrets, prompting API key rotation.
The Polish Security Agency reported ICS breaches at five water treatment plants, where attackers gained the ability to modify operational parameters, posing a direct risk to public water supply.

Newly Discovered Vulnerabilities

cPanel released patches for three vulnerabilities in cPanel and Web Host Manager (WHM) that could allow privilege escalation, code execution, and denial-of-service.
A new local privilege escalation (LPE) vulnerability in the Linux kernel, dubbed “Dirty Frag,” was disclosed, following the recent “Copy Fail” (CVE-2026-31431) vulnerability.
Quasar Linux RAT (QLNX), a previously undocumented Linux remote access trojan, was identified targeting developer systems, enabling credential theft and post-compromise activity.
Microsoft Edge was found to load saved passwords into system memory in plaintext on startup, making them susceptible to theft if the device is already compromised; Microsoft states this is “by design.”
Ivanti Endpoint Manager Mobile (EPMM) was subject to a high-severity zero-day vulnerability exploited in the wild, prompting urgent patching directives.

Notable Threat Actor Activity

RansomHouse claimed responsibility for the Trellix source code breach and published proof of access.
ShinyHunters continued their campaign against Instructure/Canvas, including login portal defacement and ransom demands.
TCLBANKER, a newly identified Brazilian banking trojan, was observed targeting 59 banking, fintech, and cryptocurrency platforms via WhatsApp and Outlook-based worms.
Fraudulent Android apps on Google Play, purporting to provide call history access, were discovered stealing user payments after 7.3 million downloads.
Malware leveraging Windows Phone Link to steal one-time passwords (OTPs) was reported in active use.
PamDOORa, a new Linux backdoor, was identified in the wild.
A train hacker was arrested in connection with cyberattacks on critical infrastructure.

Trends, Tools, or Tactics of Interest

The time between phishing email delivery and full organizational compromise has reportedly shrunk to seconds, highlighting increasing attack speed.
Analysis of 25 million SOC alerts revealed that low-severity threats are frequently missed, with at least one missed threat per week in large enterprises.
Overwhelmed SOC teams are unable to keep pace with attacker speed; AI is being promoted as a tool to accelerate alert triage and investigation.
Cybersecurity is increasingly intersecting with geopolitical and cognitive warfare, particularly noted in the African context.
Attackers are increasingly targeting software supply chains by compromising developer credentials and systems.
Attackers are exploiting social engineering and fraudulent apps at scale via official app stores.

Regulatory or Policy Developments Affecting the Security Industry

CISA mandated U.S. federal agencies to patch the Ivanti EPMM zero-day vulnerability within four days.
The US government is targeting 72-hour patch cycles for critical vulnerabilities.
A new frontrunner for the CISA Director position was reported.

Cybersecurity Brief – 2026-05-08

Fri, 08 May 2026 00:00:00 +0000

Major Incidents or Breaches

The ShinyHunters extortion group breached Instructure’s Canvas platform, exploiting a new vulnerability to deface login portals across hundreds of colleges and universities, disrupting classes and coursework nationwide. The campaign involved mass ransomware extortion and data theft.
RansomHouse ransomware group claimed responsibility for a breach of cybersecurity vendor Trellix, publishing screenshots of access to internal services.
Daemon Tools confirmed a supply chain attack affecting its distribution infrastructure; the vendor reports the attack has been contained, compromised files removed, and installation packages validated.
A massive AI investment scam operation was uncovered, spanning 15,500 domains and using the Keitaro ad-tracking platform for targeted victim exposure.
Thousands of web applications built using AI-driven platforms were found to be leaking sensitive corporate and personal data due to misconfiguration and insecure defaults.

Newly Discovered Vulnerabilities

CVE-2025-68670: A pre-authentication remote code execution (RCE) vulnerability was discovered in the xrdp server component, affecting Kaspersky USB Redirector. The issue has been patched.
Dirty Frag: A new, unpatched local privilege escalation (LPE) vulnerability in the Linux kernel allows attackers to gain root access on all major Linux distributions. It is a successor to the recently disclosed Copy Fail vulnerability.
CVE-2026-6973: Ivanti Endpoint Manager Mobile (EPMM) is affected by a high-severity RCE vulnerability, which has been exploited in limited zero-day attacks. Ivanti has released a patch.
PAN-OS Firewall Zero-Day: Palo Alto Networks disclosed that a critical RCE vulnerability in PAN-OS firewalls has been exploited in the wild since at least April 9, 2026. The campaign exhibits hallmarks of Chinese state-sponsored activity.
Vulnerabilities in Claude AI and associated tools (Claude Chrome extension, Claude Code, Cursor CLI, Gemini CLI, CoPilot CLI) allow code execution and OAuth token theft via malicious repositories or hijacking, due to lax permissions and insufficient warning dialogs.
Chrome 148 was released, addressing 127 security vulnerabilities, including critical-severity integer overflow and use-after-free bugs.

Notable Threat Actor Activity

PCPJack: A new credential-stealing malware framework, PCPJack, is actively targeting exposed cloud infrastructure. It spreads worm-like by exploiting five CVEs, steals credentials, and removes competing TeamPCP malware from infected environments. PCPJack uses parquet files for stealthy, pre-validated target discovery.
ShinyHunters: Conducted a mass extortion and ransomware campaign against the Canvas education platform, impacting thousands of educational institutions.
TCLBanker: A new banking trojan is self-spreading via WhatsApp and Outlook, targeting 59 banking, fintech, and cryptocurrency platforms. Initial infection is delivered through a trojanized MSI installer.
Ongoing campaigns using ClickFix social engineering are distributing Vidar Stealer malware, as warned by the Australian Cyber Security Center.
Fake Claude AI website is distributing a new Windows backdoor, “Beagle,” through malicious downloads.

Trends, Tools, or Tactics of Interest

Credential theft and session hijacking remain prevalent, with attackers using phishing, malicious packages (e.g., PyPI packages delivering ZiChatBot), and browser-based techniques to bypass traditional security controls.
APT groups are increasingly leveraging C2 frameworks for attacks, as detailed in a Q1 2026 vulnerabilities and exploits report.
Attackers are exploiting browser activity (copy/paste, AI prompts) to bypass data loss prevention (DLP) controls, highlighting gaps in current endpoint protection strategies.
AI-integrated attacks are becoming more sophisticated, targeting both vision-language models and SaaS platforms, though some recent attempts failed to breach OT/ICS environments.
Cloud infrastructure is a primary target for worm-like malware and credential stealers, with new frameworks focusing on lateral movement and removal of competing threats.
There is a continued trend of attackers abusing software supply chains and public repositories (e.g., PyPI) to distribute malware.

Regulatory or Policy Developments Affecting the Security Industry

A UK report on the Online Safety Act indicates some progress in online age checks, but highlights ongoing issues with workarounds, persistent harm, and unresolved privacy concerns.

Cybersecurity Brief – 2026-04-16

Thu, 16 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

Ukrainian government and healthcare organisations have been targeted in a data-theft malware campaign attributed to threat actor UAC-0247. The campaign utilised a new malware family, ‘AgingFly’, which steals authentication data from Chromium-based browsers and WhatsApp messenger.
Over 30 WordPress plugins within the EssentialPlugin package have been compromised, allowing unauthorized access and malware deployment on thousands of websites.
Digitally signed adware tools have been abused to deploy payloads with SYSTEM privileges, disabling antivirus protections on thousands of endpoints, including those in education, utilities, government, and healthcare sectors.
A coordinated campaign involving 100 malicious Chrome extensions has been identified, stealing user data and establishing backdoors via shared command and control infrastructure.
Sweden publicly attributed last year’s cyberattack on its energy infrastructure, specifically a heating plant, to a pro-Russian group.

Newly Discovered Vulnerabilities

A critical authentication bypass vulnerability in nginx-ui (CVE-2026-33032) is being actively exploited in the wild, enabling attackers to fully compromise Nginx servers, including restarting, creating, modifying, and deleting configuration files.
April Patch Tuesday updates addressed numerous critical vulnerabilities across Microsoft, Adobe, SAP, and Fortinet products. Notably, Microsoft patched a SharePoint zero-day and a Windows Task Host privilege escalation vulnerability, both of which have been actively exploited.
Two vulnerabilities in Ivanti Neurons for ITSM were patched, addressing risks of persistent access after account disablement and exposure of session information.
Microsoft and Salesforce patched prompt injection vulnerabilities in their AI agents (Copilot and Agentforce), which could have allowed attackers to leak sensitive data.
Researchers highlighted a ‘by design’ flaw in Anthropic’s Model Context Protocol (MCP), enabling unsanitized command execution and potential full system compromise in AI supply chains.

Notable Threat Actor Activity

UAC-0247 has been identified as responsible for recent attacks on Ukrainian clinics and government entities, deploying the ‘AgingFly’ malware for credential theft.
Pro-Russian threat actors were named by Swedish authorities as responsible for a cyberattack targeting critical energy infrastructure in Sweden.
Threat actors have weaponised n8n, an AI workflow automation platform, since October 2025 to conduct phishing campaigns and deliver malware via abused webhooks.
Mirax RAT, offered as malware-as-a-service primarily to Russian-speaking affiliates, is targeting Android users in Europe, converting devices into proxy nodes.
A Windows infostealer is being distributed through fake Proton VPN sites, malicious gaming mods, and GitHub/YouTube links, aiming to hijack accounts and drain cryptocurrency wallets.

Trends, Tools, or Tactics of Interest

Abuse of legitimate automation and workflow platforms (e.g., n8n) and signed software to bypass security controls and deliver malware is increasing.
Attackers are exploiting prompt injection vulnerabilities in AI-powered tools to exfiltrate sensitive data, highlighting the growing risks in AI agent ecosystems.
The emergence of malware campaigns using browser extensions and phishing emails (such as fake YouTube copyright notices) to compromise accounts and steal credentials.
AI-driven clickbait campaigns (e.g., Pushpaganda) are turning browser notifications into persistent scam delivery channels.
Long-running ransomware campaigns are targeting small businesses and homes, particularly in Turkey, often remaining undetected due to under-reporting.
Industrial automation systems continue to face a diverse range of infection vectors and malware types, with region- and industry-specific targeting noted in recent threat landscape reports.

Regulatory or Policy Developments Affecting the Security Industry

The US Congress is considering reauthorisation of a foreign surveillance program, with ongoing debate over privacy protections.
Regulatory complexity and differences in Asia’s digital supply chain are increasing security challenges, particularly with the integration of AI technologies.
An audit found that major technology companies, including Google, Meta, and Microsoft, often fail to comply with California privacy law opt-out requests for online tracking.

Cybersecurity Brief – 2026-04-09

Thu, 09 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

Bitcoin Depot Hack
- Bitcoin Depot, a major Bitcoin ATM operator, reported a breach in which attackers stole approximately $3.665 million from its crypto wallets. Attackers gained access to credentials and transferred over 50 bitcoins out of company wallets.
Massachusetts Hospital Cyberattack
- Signature Healthcare in Massachusetts experienced a cyberattack that forced ambulance diversions, cancellation of some services, and disruption of pharmacy operations.
Zendesk Ticket Theft by UNC6783
- Threat actor UNC6783 compromised business process outsourcing (BPO) providers to steal corporate Zendesk support tickets from high-value companies across multiple sectors.
Magento E-commerce Card Skimming Campaign
- Nearly 100 online stores running the Magento platform were impacted by a campaign embedding credit card-stealing code within a pixel-sized SVG image.
TeamPCP Supply Chain Attack Update
- TeamPCP supply chain campaign update reveals Cisco source code was stolen via a breach linked to the Trivy security scanner. Google GTIG tracks the group as UNC6780.

Cybersecurity Brief – 2026-04-04

Sat, 04 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

Solana-based decentralized exchange Drift confirmed a security incident on 1 April 2026, resulting in a loss of approximately $285 million. The attack, attributed to North Korean threat actors, exploited durable nonces and social engineering to compromise an admin key and drain five vaults.
Hims & Hers Health disclosed a data breach involving the theft of support tickets from a third-party customer service platform (Zendesk).
The German political party Die Linke suffered an IT systems outage and data theft, with the Qilin ransomware group claiming responsibility and threatening to leak sensitive data.
Meta paused work with data vendor Mercor after a data breach potentially exposed sensitive AI industry secrets, affecting major AI labs.
T-Mobile clarified that a recent insider-driven cybersecurity incident had a limited impact.
European Commission cloud infrastructure was breached as part of the ongoing TeamPCP supply chain campaign, with over 1,000 SaaS environments reportedly affected. Sportradar was also named among impacted organizations.
Sensitive Customs and Border Protection (CBP) facility codes leaked via publicly accessible online flashcards.
Axios npm package was compromised in a supply chain attack following a targeted social engineering campaign by North Korean threat actors (UNC1069).
ChatGPT experienced a data leak, and a water facility was hit by ransomware, according to SecurityWeek’s round-up.

Newly Discovered Vulnerabilities

Critical vulnerabilities in Citrix ShareFile could be chained to bypass authentication and achieve unauthenticated remote code execution (RCE) via arbitrary file uploads.
A zero-day vulnerability in the TrueConf video conferencing platform was exploited by a Chinese threat actor for reconnaissance, privilege escalation, and payload execution in attacks on Asian government entities.
Microsoft detailed the use of cookie-controlled PHP web shells on Linux servers, enabling persistent remote code execution via cron jobs.
A new variant of the SparkCat malware was found in iOS and Android apps on official app stores, stealing images of crypto wallet recovery phrases.
React2Shell vulnerability was exploited in a large-scale credential harvesting campaign, compromising over 750 systems.
Apple released an iOS 18 patch for the DarkSword mobile OS-cracking tool, extending protection to devices unable to upgrade to iOS 26.
Symantec vulnerability and anti-ClickFix mechanisms for macOS were also noted in recent security news.

Notable Threat Actor Activity

North Korean threat actors (UNC1069) conducted a targeted social engineering campaign against the Axios npm maintainer, resulting in a supply chain compromise.
North Korean actors were attributed to the $285 million Drift DEX heist, leveraging nonce-based transactions and admin key compromise.
China-linked TA416 resumed targeting European government and diplomatic organizations since mid-2025, using PlugX malware and OAuth-based phishing.
Chinese threat actors exploited a TrueConf zero-day in attacks against Asian governments.
TeamPCP’s supply chain campaign continues to expand, with additional attribution disputes involving ShinyHunters and Lapsus$.
Criminal threat actors increased phishing attacks by 130% by exploiting the conflict in Iran, according to Bitdefender.
Job scam campaigns impersonating Coca-Cola and Ferrari were discovered, targeting user credentials for Google and Facebook accounts.
Qilin ransomware group was responsible for the Die Linke breach and extortion.

Trends, Tools, or Tactics of Interest

Multi-extortion ransomware attacks are increasingly leveraging stolen data for public leaks, intensifying pressure on victims.
Third-party and supply chain risks remain a significant security gap, as highlighted by recent breaches and campaigns.
Mobile attack surfaces are expanding due to shadow AI in apps, outdated devices, and zero-click exploits.
Threat actors are using HTTP cookies as control channels for PHP web shells on Linux, with persistence achieved via cron jobs.
Automated credential harvesting campaigns are utilizing frameworks like Nexus Listener and large-scale scanning.
Unmanaged Windows 11 24H2 devices are being force-upgraded by Microsoft to 25H2.
LinkedIn was reported to be secretly scanning for over 6,000 Chrome extensions and collecting device data via hidden JavaScript.
Emerging research suggests “skull vibration harmonics” could be used for authentication in XR headsets.
Chainguard released Factory 2.0, a platform to automate and harden the software supply chain.
CrowdStrike’s next-gen SIEM now ingests Microsoft Defender telemetry, reflecting increased integration between major security vendors.
Outbound email security and the need for IT staff security awareness training were emphasized in recent industry commentary.
Inconsistent privacy labels for mobile apps were highlighted as inadequate for informing users of data practices.

Regulatory or Policy Developments Affecting the Security Industry

Governments are implementing varied age-based bans on social media access for children, though execution and effectiveness remain debated.
The FBI classified a recent hack as a “major incident,” indicating increased regulatory scrutiny on federal cybersecurity events.

Cybersecurity Brief – 2026-03-14

Sat, 14 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

Starbucks disclosed a data breach affecting hundreds of employees after threat actors gained access to Starbucks Partner Central accounts via phishing attacks targeting the employee portal.
Poland’s National Centre for Nuclear Research (NCBJ) reported an attempted cyberattack targeting its IT infrastructure; the attack was detected and blocked with no reported impact.
The FBI is investigating eight malicious games uploaded to the Steam platform, which were used to spread malware. The agency is seeking information from affected users.
An Iran-linked hacker group attacked Stryker, disrupting manufacturing and shipping operations. The attackers used legitimate endpoint management software to wipe devices rather than deploying malware.

Newly Discovered Vulnerabilities

Google released security updates for Chrome to address two high-severity zero-day vulnerabilities (CVE-2026-1234 and CVE-2026-2345) affecting Skia and V8 components, both exploited in the wild to potentially allow code execution and security bypass.
Nine vulnerabilities (“CrackArmor” flaws) were disclosed in the Linux kernel’s AppArmor module. These flaws can be exploited by unprivileged users to escalate privileges to root and bypass container isolation.
A flaw in the n8n automation platform was reported as being actively exploited.
Issues have been reported with some Samsung laptops running Windows 11 after the February 2026 security update, resulting in users losing access to the C:\ drive.

Notable Threat Actor Activity

Storm-2561, a tracked threat actor, is distributing trojanized VPN clients masquerading as legitimate enterprise VPN software (Ivanti, Cisco, Fortinet) via SEO poisoning. These fake downloads are used to steal company VPN credentials.
A suspected China-based cyber espionage group has been targeting Southeast Asian military organizations since at least 2020, deploying custom malware families “AppleChris” and “MemFun.”
Pro-Iranian hackers have increased cyber operations against sites in the Middle East and are expanding attacks to US targets, including defense contractors and critical infrastructure. Recent activity includes the Stryker attack and threats to power and water facilities.
Authorities in the US and Europe disrupted the SocksEscort proxy service, powered by the AVrecon botnet, which had impacted approximately 360,000 devices since 2020.
INTERPOL, as part of Operation Synergia III, sinkholed 45,000 malicious IP addresses and seized servers linked to phishing, malware, and ransomware campaigns. The operation resulted in 94 arrests globally.

Trends, Tools, or Tactics of Interest

Threat actors are increasingly leveraging SEO poisoning to distribute malware, as seen in the Storm-2561 campaign targeting VPN users.
Use of fake enterprise software download sites is on the rise for credential theft.
ClickFix variants are being used in scams, such as a fake $TEMU crypto airdrop, to trick victims into executing malware that installs remote-access backdoors.
Scammers are sending fake calendar renewal notices impersonating Malwarebytes to lure victims into calling fraudulent billing numbers.
Real-time banking trojans in Brazil are combining malware with human operators to target Pix users at opportune moments.
Nonprofit organizations remain attractive targets due to security gaps, with underreporting of incidents making risk assessment difficult.
AI is being increasingly leveraged for both cyber defense and attack, with new startups focusing on autonomous agent oversight and real-time device protection.
Research demonstrates that widely-used facial recognition systems can be bypassed using smart glasses, deepfakes, and face swaps.
Most attacks on Google Cloud begin with exploitation of vulnerabilities rather than credential theft or misconfiguration.

Regulatory or Policy Developments Affecting the Security Industry

Meta announced it will discontinue support for end-to-end encrypted (E2EE) chats on Instagram as of May 8, 2026.
Google reported paying out $17 million in bug bounty rewards in 2025, including $3.7 million for Chrome vulnerabilities and $3.5 million for cloud security issues, reflecting ongoing industry investment in vulnerability discovery and disclosure.

Cybersecurity Brief – 2026-03-12

Thu, 12 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

Stryker, a global medical technology company, was impacted by a wiper malware attack attributed to the Iran-linked Handala hacktivist group. The attackers claim to have wiped more than 200,000 devices, severely disrupting operations.
Michelin confirmed a data breach linked to an Oracle EBS attack, with cybercriminals leaking over 300GB of allegedly stolen files.
Bell Ambulance reported a data breach affecting 238,000 individuals, with stolen personal information including names, Social Security numbers, and driver’s license numbers.
Meta disabled over 150,000 accounts associated with scam centers in Southeast Asia as part of a coordinated global crackdown, and reported the removal of 10.9 million Facebook and Instagram accounts linked to criminal scam centers in the past year.

Newly Discovered Vulnerabilities

Two critical remote code execution (RCE) vulnerabilities in the n8n workflow automation platform were disclosed and patched. The flaws allow arbitrary command execution and exposure of stored credentials. CISA has added the RCE bug to its Known Exploited Vulnerabilities (KEV) catalog and ordered US federal agencies to patch affected systems, with over 24,700 instances still exposed.
An SQL injection vulnerability was identified in the Elementor Ally WordPress plugin, impacting over 250,000 sites and enabling potential theft of sensitive data.
CVE-2026-0866 (“Zombie Zip”) was published, affecting ZIP file processing.
Microsoft’s March Patch Tuesday addressed 84 vulnerabilities, including two publicly known zero-days and eight critical-rated issues. Vulnerabilities could allow privilege escalation and cause service crashes.
SAP released updates for two critical vulnerabilities enabling arbitrary code execution.
Fortinet, Ivanti, and Intel issued patches for high-severity vulnerabilities that could result in arbitrary code execution, privilege escalation, or authentication rate-limit bypass.

Notable Threat Actor Activity

The Iran-linked Handala group claimed responsibility for the wiper attack on Stryker, targeting over 200,000 devices.
The PhantomRaven supply-chain campaign launched a new wave of attacks on the npm registry, using 88 malicious packages to exfiltrate sensitive developer data.
Attackers compromised the xygeni/xygeni-action GitHub Action via tag poisoning, maintaining an active command-and-control implant for up to a week.
Chinese state-linked actors shifted focus to Qatari entities in response to Iranian conflict, conducting at least two targeted attacks.

Trends, Tools, or Tactics of Interest

Ransomware attacks surged by 50% in 2025, but the proportion of victims paying ransoms reached an all-time low.
Agentic web browsers, such as Perplexity’s Comet AI Browser, were demonstrated to be susceptible to phishing attacks in under four minutes, highlighting risks with AI-driven autonomous browsing.
Phishing campaigns are leveraging IPv6 tricks to obscure malicious links in emails, as seen in recent “free toothbrush” scams impersonating United Healthcare.
Sextortion emails are incorporating real passwords harvested from disposable inboxes to increase credibility.
Robocall scams are targeting individuals during tax season with fake relief program offers.
Meta introduced new anti-scam protections across WhatsApp, Facebook, and Messenger, including user-facing warnings and enhanced detection systems.
WhatsApp launched parent-managed accounts for pre-teens, providing parents with control over contacts and group participation.
Vulnerability management is evolving towards continuous telemetry, contextual prioritization, and agentic remediation in response to the increasing use of AI and autonomous agents in exploitation.

Regulatory or Policy Developments Affecting the Security Industry

The US Senate confirmed Joshua Rudd as head of both the NSA and US Cyber Command under the “dual-hat” leadership structure.
CISA mandated federal agencies to patch the actively exploited n8n RCE vulnerability.
Google completed its acquisition of cloud security firm Wiz, which will retain its brand under Google Cloud.

Cybersecurity Brief – 2026-03-11

Wed, 11 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

Ericsson disclosed a data breach impacting thousands, attributed to a third-party vendor.
A suspected breach of the FBI’s wiretap network is under investigation, with concerns about possible nation-state involvement via supply chain compromise.
Salesforce confirmed that hundreds of customers have been targeted in a data theft campaign exploiting misconfigured instances.
Signal and WhatsApp accounts have been targeted in a phishing campaign, with attackers tricking users into sharing verification codes or linking malicious devices.

Newly Discovered Vulnerabilities

Microsoft released security updates for Windows 10 and 11, addressing 79–93 vulnerabilities (depending on reporting), including two publicly disclosed zero-days. No active exploitation reported for these flaws.
Adobe patched 80 vulnerabilities across eight products, including Acrobat Reader, Illustrator, Commerce, and Premiere Pro.
SAP issued patches for critical vulnerabilities in FS-QUO (code injection) and NetWeaver (insecure deserialization), both allowing potential arbitrary code execution.
Hewlett Packard Enterprise (HPE) patched multiple vulnerabilities in Aruba Networking AOS-CX, including critical flaws that allowed admin password resets and code execution.
Google Looker Studio was found to contain nine cross-tenant vulnerabilities (“LeakyLooker”) enabling arbitrary SQL queries and potential data exfiltration.
A high-severity Ivanti Endpoint Manager (EPM) vulnerability is now under active exploitation, as flagged by CISA, with U.S. federal agencies ordered to patch within three weeks.

Notable Threat Actor Activity

Russian state-sponsored APT28 (Sednit) has resurfaced with new sophisticated malware, including BEARDSHELL and a customised variant of the open-source Covenant framework, used for long-term espionage against Ukrainian military targets.
Russian-speaking threat actors have been targeting HR departments with a new EDR killer malware dubbed “BlackSanta” for over a year, bypassing security controls to facilitate data theft.
Iranian MOIS-linked actors are increasingly engaging in cybercrime, leveraging criminal tools and operational models to support state objectives.

Trends, Tools, or Tactics of Interest

BeatBanker, a newly identified Android Trojan, is targeting Brazilian users by impersonating government and Google Play Store apps. It combines banking credential theft with cryptocurrency mining capabilities and has also been observed posing as a Starlink app.
KadNap malware is infecting over 14,000 edge devices, primarily Asus routers, to create a stealth proxy botnet for malicious traffic.
Five malicious Rust crates were discovered on crates.io, masquerading as time-related utilities but designed to exfiltrate developer secrets from .env files, including via CI/CD pipeline compromise.
A new “Zombie ZIP” technique enables malware to evade detection by hiding payloads in specially crafted compressed files, bypassing antivirus and EDR solutions.
Attackers are increasingly using geometry-based techniques to mimic human interaction and evade sandbox detection, with 80% of top attacker techniques now focused on evasion and persistence.
Credential stuffing attacks, fuelled by combolists and infostealer malware, accounted for 22% of breaches in 2025, driving large-scale enterprise account takeover.
Overly permissive Salesforce cloud configurations are being actively targeted, exposing client data through misconfigured guest user access.
FortiGate Next-Generation Firewall appliances are being abused as entry points in campaigns aimed at stealing service account credentials.
AI-powered security tools are gaining traction, with new platforms launched for DLP (Jazz), IT/OT security (Kai), and red teaming (Armadin). OpenAI introduced Codex Security, an AI-based vulnerability scanner that has already identified hundreds of critical issues.

Regulatory or Policy Developments

CISA mandated that U.S. federal agencies patch the actively exploited Ivanti EPM vulnerability within three weeks.
Microsoft announced that hotpatch security updates will be enabled by default for eligible Windows devices managed via Intune and Microsoft Graph API starting May 2026.
Microsoft is rolling out phishing-resistant Windows sign-ins using Entra passkeys and Windows Hello.
The U.S. Department of Homeland Security removed privacy officers who objected to the mislabelling of government records, raising concerns over transparency and privacy compliance.

Cybersecurity Brief – 2026-03-10

Tue, 10 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

Ericsson US Data Breach: Ericsson Inc. disclosed a data breach following a service provider hack, resulting in the theft of employee and customer data. The number of affected individuals has not been specified.
UNC4899 Crypto Firm Compromise: The North Korean threat actor UNC4899 breached a cryptocurrency organization in 2025, leveraging an AirDropped, trojanized file to a developer’s work device, resulting in the theft of millions of dollars.
Salesforce Experience Cloud Data Exposure: Salesforce warned customers of attacks exploiting misconfigured Experience Cloud platforms, allowing guest users to access sensitive data. The ShinyHunters group claims ongoing data theft attacks against Salesforce Aura.
AkzoNobel Compromise: AkzoNobel, a Netherlands-based paint manufacturer, was listed among top attacks and breaches in Check Point’s latest threat intelligence report.

Cybersecurity Brief – 2026-02-28

Sat, 28 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Over 900 Sangoma FreePBX instances remain compromised with web shells following exploitation of a command injection vulnerability in the endpoint manager’s interface, ongoing since December 2025.
ManoMano, an online marketplace, suffered a data breach allegedly impacting 38 million individuals, with stolen data including names, email addresses, phone numbers, and other personal information.
The U.S. Department of Justice seized $61 million in Tether cryptocurrency linked to “pig butchering” crypto scams.
Data broker breaches have contributed to nearly $21 billion in identity-theft losses, according to a new report.
A Ukrainian national pleaded guilty to operating OnlyFake, an AI-powered fake ID website that generated and sold over 10,000 fraudulent identification documents globally.

Newly Discovered Vulnerabilities

Juniper Networks PTX routers are affected by a critical remote code execution vulnerability (CVE-2026-21902) in Junos OS Evolved, addressed via an out-of-band security update.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) released details on the RESURGE malware, which can remain dormant on Ivanti Connect Secure devices after exploitation of CVE-2025-0282.
Researchers discovered that public Google API keys, previously considered non-sensitive, can be used to access Gemini AI data, exposing potentially sensitive information.

Notable Threat Actor Activity

The North Korean APT group ScarCruft (APT37) has been observed using new malware to breach air-gapped networks, leveraging Zoho WorkDrive for command-and-control and spreading via USB drives.
A malicious Go module has been identified stealing passwords, establishing SSH persistence, and deploying the Rekoobe Linux backdoor.
Threat actors are distributing trojanized gaming utilities via browsers and chat platforms to install Java-based remote access trojans (RATs).
Aeternum botnet loader is using Polygon blockchain-based smart contracts for resilient command-and-control infrastructure.
ShinyHunters has claimed responsibility for the Odido breach, as reported in industry news roundups.

Trends, Tools, or Tactics of Interest

The Kratos Phishing-as-a-Service (PhaaS) kit is industrializing credential compromise attacks, with projections that over 90% of such attacks will use modular PhaaS by 2026.
Fake Google security checks are being used as lures to trick users into granting browser permissions, enabling threat actors to harvest contacts, location data, and other sensitive information.
Malicious actors continue to exploit social engineering on Facebook, using compromised accounts to propagate scams.
Third-party software, including PDF readers and email clients, remains a significant attack surface due to inconsistent patching and update practices.
Cities hosting major events are being advised to enhance defenses against wireless and drone-based threats, beyond traditional cyber and physical security measures.
Microsoft is testing security improvements for batch file and CMD script execution in Windows 11 Insider Preview builds.
Meta has filed lawsuits against advertisers in Brazil, China, and Vietnam for running celebrity-bait scams on its platforms.

Regulatory or Policy Developments

The Pentagon has designated Anthropic as a supply chain risk, amid a dispute over the use of its AI technologies for military applications. Anthropic is resisting Pentagon demands for broader AI safeguards, seeking assurances against use for mass surveillance or autonomous weapons.
U.S. President Trump has ordered all federal agencies to phase out the use of Anthropic technology.
Europol-led “Project Compass” resulted in 30 arrests and 179 suspects being linked to “The Com,” a cybercrime group targeting children and teenagers.
Congressional scrutiny is increasing on data brokers following revelations about identity theft losses tied to industry breaches.

Cybersecurity Brief – 2026-02-20

Fri, 20 Feb 2026 00:00:00 +0000

Major Incidents and Breaches

The French Ministry of Economy reported unauthorized access to the national bank account registry (FICOBA), exposing 1.2 million bank accounts.
Blockchain-based lender Figure confirmed a data breach after threat actor ShinyHunters leaked over 2GB of data, compromising nearly 1 million user records.
German rail operator Deutsche Bahn experienced a large-scale DDoS attack that disrupted information and booking systems for several hours.
Abu Dhabi Finance Week inadvertently exposed VIP passport details due to unprotected cloud storage.
Intimate products company Tenga suffered a phishing attack, potentially exposing US customer data.
A Nigerian national was sentenced to eight years in prison for hacking tax preparation firms in Massachusetts and filing fraudulent tax returns worth over $8.1 million.

Newly Discovered Vulnerabilities

Microsoft patched CVE-2026-26119, a privilege escalation vulnerability in Windows Admin Center.
A critical vulnerability in Grandstream GXP1600 series VoIP phones allows unauthenticated remote attackers to gain root privileges and eavesdrop on communications.
The US Cybersecurity and Infrastructure Security Agency (CISA) ordered federal agencies to patch a maximum-severity, actively exploited Dell vulnerability within three days.
OpenClaw, following a supply chain attack via a malicious npm package (Cline v2.3.0), continues to face security and misconfiguration issues despite recent patches.
Ivanti zero-day vulnerabilities have seen a surge in exploitation, with attacks traced back to July 2025, including shell access, reconnaissance, and malware delivery.
Foxit PDF software and OpenSSL both reported new remote code execution vulnerabilities, with active exploitation noted in the wild.

Notable Threat Actor Activity

The CRESCENTHARVEST campaign is targeting supporters of Iran’s protests with remote access trojan (RAT) malware for information theft and espionage.
ShinyHunters leaked user data stolen from Figure, a blockchain lender.
A supply chain attack injected the OpenClaw backdoor into Cline npm package, downloaded over 4,000 times.
Threat actors are targeting Microsoft Entra accounts in technology, manufacturing, and financial sectors using combined device code phishing and vishing to abuse OAuth 2.0 Device Authorization Grant.
INTERPOL’s Operation Red Card 2.0 resulted in 651 arrests and the recovery of $4.3 million, targeting online scams, investment fraud, mobile money scams, and fake loan applications across 16 African countries.

Trends, Tools, and Tactics of Interest

AI-assisted social engineering attacks remain the top initial access vector, with reports of a 1200% surge in AI-driven fraud during December 2025. Threat actors are leveraging AI for bot deployment, phishing, and identity fraud.
The PromptSpy Android malware is the first known mobile malware to leverage generative AI (Google Gemini) at runtime for persistence and adaptation across devices.
The Massiv Android banking trojan, disguised as IPTV apps, is actively targeting users in southern Europe with device takeover and financial theft capabilities.
The Arkanix Stealer, written in C++ and Python, has been distributed as malware-as-a-service (MaaS) with a referral program, targeting a wide range of user data.
Infostealer dumps are increasingly linking stolen credentials to real-world identities, correlating usernames, cookies, and behavioural data across personal and enterprise accounts.
The Starkiller phishing kit, available as phishing-as-a-service (PhaaS), bypasses multi-factor authentication (MFA) by live-proxying legitimate login sites.
AI-generated passwords have been found to be highly predictable and less secure compared to traditional random password generation methods.
IoT security risks continue due to reused passwords, lack of network segmentation, and poor sanitisation processes, increasing the attack surface.
Google blocked over 1.75 million Play Store app submissions in 2025 and prevented more than 255,000 apps from obtaining excessive access to sensitive user data.

Regulatory or Policy Developments

Texas filed a lawsuit against TP-Link, alleging deceptive marketing of its routers as secure while allowing exploitation of firmware vulnerabilities by Chinese state-backed hackers.
CISA issued an emergency directive for federal agencies to patch an actively exploited Dell vulnerability within three days.
Three former Google engineers were indicted in the US for allegedly stealing trade secrets and transferring them to Iran.

Cybersecurity Brief – 2026-02-15

Sun, 15 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Over 300 malicious Chrome extensions, with a combined total of more than 37 million downloads, have been identified leaking or stealing user data, exposing users to tracking and personal information theft.
Threat actors are conducting physical mail-based attacks targeting users of Trezor and Ledger cryptocurrency hardware wallets. The letters impersonate the companies and attempt to trick recipients into disclosing their wallet recovery phrases, enabling cryptocurrency theft.

Newly Discovered Vulnerabilities

Two critical vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM) are being actively exploited. A single threat actor is responsible for 83% of recent remote code execution (RCE) attacks targeting these vulnerabilities.

Notable Threat Actor Activity

A single threat actor is attributed to the majority of recent exploitation activity against Ivanti EPMM, leveraging critical RCE vulnerabilities for likely malicious purposes.

Trends, Tools, or Tactics of Interest

Threat actors are using unconventional attack vectors, such as physical mail, to target cryptocurrency users, indicating a diversification of social engineering tactics beyond digital communication channels.
The deployment of over 300 malicious Chrome extensions demonstrates continued abuse of browser extension ecosystems for large-scale data exfiltration and user tracking.

Cybersecurity Brief – 2026-02-13

Fri, 13 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Dutch telecommunications provider Odido suffered a cyberattack resulting in exposure of personal data belonging to 6.2 million customers.
Romania’s national oil pipeline operator Conpet S.A. confirmed data theft by the Qilin ransomware gang.
ApolloMD disclosed a data breach impacting 626,000 individuals, with patient information from affiliated physicians and practices stolen.
Hackers breached Senegal’s national biometric database, compromising personal and biometric data of nearly 20 million residents.
The Outlook add-in AgreeTo, after being abandoned by its developer, was repurposed into a phishing kit that stole 4,000 credentials and payment data.

Newly Discovered Vulnerabilities

Apple patched a zero-day vulnerability (CVE-2026-20700) in the ‘dyld’ component, which allowed arbitrary code execution and was exploited in the wild.
A critical pre-authentication remote code execution vulnerability in BeyondTrust Remote Support and Privileged Remote Access appliances is being actively exploited following the public release of a proof-of-concept.
The WPvivid Backup & Migration plugin for WordPress (900,000+ installs) is vulnerable to a critical RCE flaw allowing attackers to upload arbitrary files.
Multiple vulnerabilities in Windows LNK shortcut files were disclosed, enabling attackers to deploy malicious payloads, though Microsoft does not classify them as vulnerabilities.
Ivanti EPMM zero-day bugs continue to be exploited in active attacks.

Notable Threat Actor Activity

Google reported North Korea-linked UNC2970 using the Gemini AI model for reconnaissance and attack support.
The Lazarus Group launched a campaign targeting npm and PyPI repositories with malicious packages under the guise of fake recruitment, aiming to compromise developers.
Google observed state-backed actors from Russia, China, North Korea, and Iran, as well as cybercriminals and hacktivists, targeting the global defense sector.
The Qilin ransomware gang was identified as responsible for the Conpet S.A. breach.
30 malicious Chrome extensions, posing as AI tools and installed by over 300,000 users, were used to steal credentials, emails, and browsing data.
The AMOS infostealer is targeting macOS users via popular AI apps and extension marketplaces to harvest credentials.
AI website builders are being leveraged by criminals to clone and impersonate major brands for phishing and fraud campaigns.

Trends, Tools, or Tactics of Interest

Voice phishing (vishing) kits with real-time control capabilities have emerged, enabling threat actors to bypass multifactor authentication.
Sophisticated phishing campaigns are bypassing Microsoft 365 MFA, targeting North American organizations.
Ransomware groups are increasingly using “naming and shaming” tactics, exposing corporate data on leak sites to pressure victims.
Attackers are increasingly abusing trusted tools and established methods, rather than relying on novel exploits.
AI prompt-based RCE and “Claude 0-click” vulnerabilities are being discussed in the context of new attack vectors.
AI recommendation poisoning was uncovered in 31 companies across 14 industries, facilitated by turnkey tools.
Criminals are using AI-assisted website builders to rapidly clone legitimate brand websites for phishing.
Abandoned software projects, such as the AgreeTo Outlook add-in, are being hijacked and weaponised for credential theft.
Booz Allen released Vellox Reverser, an AI-powered tool for automated malware analysis and reverse engineering.
SpecterOps launched BloodHound Scentry, a platform for identity attack path management and analysis.

Regulatory or Policy Developments Affecting the Security Industry

Russia is attempting to block WhatsApp and Telegram as part of a broader crackdown on non-government-controlled communication platforms.
Microsoft announced forthcoming “Windows Baseline Security” measures, enabling runtime integrity safeguards by default to ensure only properly signed software runs.
China has revived the Tianfu Cup hacking contest with increased secrecy and reduced rewards.
Meta is facing landmark trials alleging failure to protect children from sexual exploitation, grooming, and addiction-related harms on its platforms.

Cybersecurity Brief – 2026-02-12

Thu, 12 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

The Conduent data breach has impacted at least 25 million individuals, including nearly 17,000 Volvo Group employees whose data was exposed.
The AgreeTo Outlook add-in was hijacked and used as a phishing kit, resulting in the theft of over 4,000 Microsoft account credentials.
A surge in LummaStealer infections has been reported, linked to campaigns using the CastleLoader malware and the ClickFix social engineering technique.

Newly Discovered Vulnerabilities

Apple released updates for all platforms (iOS, iPadOS, macOS, tvOS, watchOS, visionOS), addressing 71 vulnerabilities, including a zero-day exploited in sophisticated attacks against targeted individuals.
Microsoft issued security updates for 59 vulnerabilities, including six zero-days that are actively exploited. Notable fixes include a remote code execution flaw in Windows 11 Notepad and vulnerabilities affecting Windows Secure Boot and other core components.
Intel and AMD collectively addressed over 80 vulnerabilities across their chipsets in recent advisories.
Ivanti patched vulnerabilities in Endpoint Manager, including a high-severity authentication bypass that could be exploited remotely without authentication.

Notable Threat Actor Activity

APT36 and SideCopy have launched campaigns targeting Indian defense and government-aligned organizations, deploying cross-platform remote access trojans (RATs) affecting both Windows and Linux environments.
North Korea’s UNC1069 is increasingly targeting Web3 and cryptocurrency firms, employing large language models (LLMs), deepfakes, legitimate platforms, and ClickFix techniques.
The SSHStalker botnet is leveraging IRC-based command-and-control channels and legacy Linux kernel exploits to control compromised systems.
The Crazy ransomware gang is abusing legitimate employee monitoring tools and the SimpleHelp remote support tool to maintain persistence, evade detection, and facilitate ransomware deployment in corporate environments.

Trends, Tools, or Tactics of Interest

Campaigns involving RenEngine and HijackLoader have distributed LummaStealer via complex infection chains since March 2025.
There is increased abuse of AI models, with Google reporting that attackers are using Gemini AI for all stages of cyberattacks. Model extraction and distillation attacks are being observed using legitimate API access.
Spam and phishing trends for 2025 include increased use of scam QR codes, ClickFix attacks, and lures involving ChatGPT subscriptions.
Intentionally vulnerable training applications (e.g., OWASP Juice Shop, DVWA, Hackazon, bWAPP) are being targeted in cloud environments, exposing organizations to crypto-mining attacks.
The first known malicious Microsoft Outlook add-in supply chain attack has been observed in the wild.
WSL (Windows Subsystem for Linux) continues to be exploited within the malware ecosystem to facilitate cross-platform attacks.
Arrests have been made in the Netherlands related to the sale of JokerOTP, a phishing automation tool capable of intercepting multi-factor authentication (MFA) one-time passcodes.

Regulatory or Policy Developments Affecting the Security Industry

Nevada has introduced a new statewide data classification policy, categorizing data as “public,” “sensitive,” “confidential,” or “restricted,” following a recent cyberattack.
Microsoft announced plans to refresh Windows Secure Boot certificates in June 2026, replacing certificates that have been in use for over 15 years.

Cybersecurity Brief – 2026-02-11

Wed, 11 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Warlock (Storm-2603) ransomware gang breached SmarterTools by exploiting an unpatched SmarterMail server on 29 January 2026.
Volvo Group North America reported a customer data exposure due to a breach at Conduent, an IT services provider.
Dutch Data Protection Authority and the Council for the Judiciary in the Netherlands confirmed cyberattacks exploiting Ivanti zero-day vulnerabilities, leading to exposure of employee contact data.

Newly Discovered Vulnerabilities

Microsoft’s February 2026 Patch Tuesday addressed 58–60 vulnerabilities, including six zero-days (three actively exploited security feature bypass flaws) and three publicly disclosed vulnerabilities. Updates apply to Windows, Microsoft Edge, and other Microsoft products.
Fortinet released patches for a critical SQL injection vulnerability in FortiClientEMS (CVE identifier not specified) that allows unauthenticated remote code execution.
Adobe fixed 44 vulnerabilities in its Creative Cloud applications, several of which are critical and could allow arbitrary code execution.
SAP patched 26 new and one updated vulnerability in CRM, S/4HANA, and NetWeaver products, including critical issues.
Siemens, Schneider, Aveva, and Phoenix Contact issued patches for vulnerabilities in their industrial control systems as part of ICS Patch Tuesday.
Microsoft began rolling out new Secure Boot certificates in Windows updates to replace expiring 2011 certificates, ahead of their June 2026 expiration.

Notable Threat Actor Activity

North Korea-linked UNC1069 targeted cryptocurrency organizations using AI-generated lures and new malware for Windows and macOS, including the ClickFix technique and tailored AI-generated video content.
DPRK (North Korean) IT operatives are impersonating professionals on LinkedIn, applying for remote jobs using hijacked LinkedIn accounts to infiltrate organizations.
Transparent Tribe (APT36), a Pakistan-linked group, is conducting a three-pronged cyber espionage campaign against Indian defense and government sectors, deploying GETA, ARES, and Desk RAT malware.
A newly documented Linux botnet, SSHStalker, is leveraging IRC for command-and-control communications.
A malicious 7-Zip website is distributing a trojanized installer that converts infected devices into residential proxy nodes.

Trends, Tools, or Tactics of Interest

Reynolds ransomware incorporates a bring-your-own-vulnerable-driver (BYOVD) technique to disable EDR (Endpoint Detection and Response) security tools during attacks.
Ransomware actors are shifting from simple encryption to maintaining persistent, “resident” access within victim environments.
ZeroDayRAT, a commercial spyware kit marketed on Telegram, enables full compromise of Android and iOS devices, granting access to SIM, location data, SMS, and facilitating MFA bypass and account takeover.
Surge in AI-enabled social engineering: AI-generated romance scams and “pig butchering” investment frauds are increasingly difficult to detect, as highlighted by recent law enforcement action against a $73M scheme.
Phishing attacks are increasingly leveraging trusted platforms, with LinkedIn direct messages being used to target executives.
Tax-related phishing and scams are prevalent during the tax season, with attackers impersonating IRS communications.
Operational Technology (OT) attacks are employing “living-off-the-plant” techniques, using native tools and protocols to evade detection.
Cloud incident response is being streamlined through automation and AI-driven tools, such as Tines, to reduce mean time to resolution (MTTR).

Regulatory or Policy Developments Affecting the Security Industry

The European Commission unconditionally approved Google’s $32B acquisition of Wiz, a major cloud security provider.
Discord will restrict user profiles to teen-appropriate mode by default unless age is verified, to enhance child safety on the platform.
Microsoft announced plans to introduce mobile-style app permission prompts in Windows 11, requiring explicit user consent before apps can access sensitive resources such as files, cameras, and microphones.

Cybersecurity Brief – 2026-01-31

Sat, 31 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

CERT Polska reported coordinated cyber attacks on over 30 wind and solar farms, as well as a private manufacturing company, in Poland. Related reporting attributes a Russia-linked threat actor (Sandworm/Electrum) as responsible for these intrusions, which resulted in bricked ICS devices at 30 sites affecting communication and control systems in the Polish power grid.
ShinyHunters ransomware group claimed breaches of Match Group dating platforms (Match, Hinge, OkCupid) and Panera Bread, allegedly stealing millions of user records.
Illegal cryptocurrency flows reached $158 billion in 2025, marking a record high after several years of decline.
Researchers identified malicious Google Chrome extensions capable of hijacking affiliate links, stealing data, and collecting OpenAI ChatGPT authentication tokens.
Android users were targeted with a remote access trojan (RAT) delivered via malicious applications hosted on Hugging Face repositories.
Over 175,000 exposed Ollama AI model hosts were identified, with 23,000 persistently active, posing risks of LLM abuse.

Newly Discovered Vulnerabilities

Ivanti released patches for critical-severity, actively exploited zero-day vulnerabilities in its Endpoint Manager Mobile (EPMM) product, which allowed unauthenticated remote code execution.
Microsoft fixed a bug in Microsoft 365 Outlook that prevented users from accessing encrypted emails in classic Outlook.
The Windows 11 KB5074105 update addressed multiple issues, including boot, sign-in, and activation failures.

Notable Threat Actor Activity

China-linked threat actor UAT-8099 was observed targeting IIS servers in Asia with the BadIIS SEO malware campaign between late 2025 and early 2026. The campaign focused on search engine manipulation through server compromise.
Sandworm/Electrum, a Russia-linked group, was attributed to the bricking of ICS devices during coordinated attacks on Polish energy infrastructure.

Trends, Tools, or Tactics of Interest

Agentic AI and autonomous AI assistants such as OpenClaw (ClawdBot, MoltBot) are increasingly present in business environments, raising concerns about privileged, autonomous control and the expanding attack surface.
Security researchers noted increased abuse of Google Presentations for phishing campaigns targeting webmail users.
The Tenable One AI Exposure add-on was introduced to discover unsanctioned AI use within organizations and enforce compliance with approved AI tools.
Aisy launched an AI-assisted vulnerability management platform after emerging from stealth with $2.3 million in seed funding.

Regulatory or Policy Developments

Microsoft announced plans to disable the legacy NTLM authentication protocol by default in future Windows releases, citing security vulnerabilities.
The White House revoked two Biden-era memorandums related to software security rules, although some associated resources remain available for government use.
TikTok updated its privacy policy to explicitly reference immigration status in user data, drawing public attention and scrutiny.

Cybersecurity Brief – 2026-01-30

Fri, 30 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Match Group, the parent company of Tinder, OkCupid, Hinge, and Match.com, confirmed a cybersecurity incident resulting in the compromise of user data across multiple platforms.
Marquis Software Solutions reported that a ransomware attack in August 2025 affecting dozens of U.S. banks and credit unions was due to a breach of SonicWall cloud backups.
An AI chat toy company, Bondu, exposed over 50,000 logs of conversations between children and its AI-enabled toys due to an unsecured web console.
The French national unemployment agency was fined €5 million for a breach that resulted in the theft of job seekers’ personal information.
eScan antivirus suffered a supply chain attack, with malicious updates detected and distributed through its update mechanism.
Google, in collaboration with industry partners, disrupted the IPIDEA residential proxy network, which had been leveraged by threat actors via malware-infected devices.

Newly Discovered Vulnerabilities

Ivanti released security updates for two zero-day remote code execution (RCE) vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM), CVE-2026-1281 and CVE-2026-1340, both of which have been actively exploited.
SolarWinds patched four critical vulnerabilities in its Web Help Desk product, including unauthenticated RCE and authentication bypass flaws.
Multiple critical vulnerabilities were identified in the n8n automation platform, allowing unauthenticated remote code execution and server hijacking via sandbox and AST sanitization flaws.
Microsoft issued an emergency patch for a Microsoft Office zero-day that allowed malicious documents to bypass security checks.
Researchers found 175,000 publicly exposed Ollama AI servers across 130 countries, creating a significant attack surface for exploitation.
Android theft protection features were updated by Google to strengthen device authentication and recovery.

Notable Threat Actor Activity

A new Android malware campaign abused the Hugging Face platform to distribute thousands of APK payload variants targeting financial and payment credentials.
Chinese APT groups deployed advanced malware against organisations in Asia, indicating ongoing high-end cyber-espionage operations.
The Aisuru (Kimwolf) botnet executed a record-setting DDoS attack in December 2025, peaking at 31.4 Tbps and 200 million requests per second.
Flare researchers highlighted how infostealer malware is being distributed via malicious Roblox game mods, enabling lateral movement from home PCs to corporate environments.
An operation dubbed “Bizarre Bazaar” targeted exposed large language models (LLMs) and managed control panels (MCPs) for commercial monetization.
The Clawdbot malware rebranded as Moltbot, sparking impersonation and supply chain risk campaigns.

Trends, Tools, or Tactics of Interest

SentinelOne and Censys reported a widespread issue of unmanaged, publicly accessible AI deployments, specifically Ollama servers, posing risks to data privacy and security.
The use of “semantic chaining” in prompt engineering was shown to bypass content controls in LLMs such as Gemini Nano Banana and Grok 4 by splitting malicious prompts into discrete segments.
The IPIDEA proxy network relied on SDKs embedded in mobile and desktop applications to enroll compromised devices into its proxy service.
The Global Cybersecurity Outlook 2026 and industry commentary emphasize the need for improved vulnerability management, preparation for quantum threats, and responsible AI deployment.
A survey of over 100 energy sector OT systems revealed pervasive cybersecurity gaps in substations, power plants, and control centers.
Microsoft Teams will introduce a feature to report suspicious calls as potential scams or phishing attempts by mid-March 2026.

Regulatory or Policy Developments

The Trump administration rescinded Biden-era guidance requiring U.S. federal agencies to solicit software bills of materials (SBOMs) and compliance attestations with NIST’s Secure Software Development Framework (SSDF) from vendors.
The French data protection authority imposed a €5 million fine on the national unemployment agency for inadequate security measures leading to a data breach.

Cybersecurity Brief – 2026-01-01

Thu, 01 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Trust Wallet Chrome Extension Hack: Trust Wallet disclosed that a supply chain attack involving the Shai-Hulud worm in November 2025 compromised its Chrome extension, resulting in the theft of $8.5 million from 2,520 wallets. The attacker exploited exposed developer GitHub secrets to publish a backdoored browser extension.
Unleash Protocol Hack: The decentralized intellectual property platform Unleash Protocol suffered a loss of approximately $3.9 million in cryptocurrency after an unauthorized contract upgrade enabled asset withdrawals, attributed to a multisig hijack.
European Space Agency Breach: The European Space Agency confirmed that external science servers were compromised and that a hacker is offering to sell stolen data. An investigation is ongoing.
DarkSpectre Browser Extension Campaigns: The threat actor behind previous ShadyPanda and GhostPoster campaigns has been attributed to a third campaign, DarkSpectre, impacting 2.2 million users. In total, the campaigns have affected 8.8 million users worldwide.
Ivanti EPMM Attacks: April/May zero-day exploitations of Ivanti’s mobile device management platform resulted in the compromise of thousands of organisations by a Chinese APT.

Newly Discovered Vulnerabilities

IBM API Connect: IBM disclosed a critical authentication bypass vulnerability (CVE-2025-13915, CVSS 9.8) in API Connect that could allow remote attackers to access applications. Customers have been urged to patch immediately.
React2Shell Flaw in Next.js: The RondoDox botnet is actively exploiting the critical React2Shell vulnerability (CVE-2025-55182) to breach Next.js servers, deploying malware and cryptominers.

Notable Threat Actor Activity

North Korean Fraudulent Job Applicants: Amazon reported blocking more than 1,800 suspected North Korean job applicants since April 2024, indicating ongoing attempts by North Korean actors to infiltrate Western technology companies.
Shai-Hulud Worm Activity: Researchers have identified a new, modified strain of the Shai-Hulud worm on the npm registry, showing continued evolution and testing of payloads following the Trust Wallet supply chain attack.
RondoDox Botnet: Actively exploiting the React2Shell vulnerability to compromise Next.js servers.

Trends, Tools, or Tactics of Interest

Supply Chain Attacks on Browser Extensions: The Shai-Hulud campaign demonstrates continued targeting of browser extension supply chains, leveraging compromised developer credentials to distribute malicious updates.
Malicious Browser Extensions: Large-scale campaigns such as DarkSpectre, ShadyPanda, and GhostPoster highlight the persistent threat from malicious browser extensions, impacting millions of users globally.
Cryptocurrency Platform Targeting: Both Trust Wallet and Unleash Protocol incidents reflect ongoing targeting of cryptocurrency platforms through supply chain and contract manipulation attacks.
IoT and Cloud Reliance: Reports discuss the risks associated with IoT device dependence on cloud services, with outages causing widespread disruption to connected devices.
AI and Identity Security: Industry predictions for 2026 note increased adoption of agentic AI, expansion of identity governance and administration (IGA) in the mid-market, SOC-identity team collaboration, and identity platform consolidation. Growing skepticism about AI’s ROI and economic sustainability is also noted.

Regulatory or Policy Developments

Disney COPPA Settlement: Disney agreed to pay a $10 million civil penalty to settle claims of violating the Children’s Online Privacy Protection Act (COPPA) by mislabeling videos and allowing targeted advertising data collection on YouTube.
Age Verification Laws: Enforcement of age checks in 2025 led to widespread internet access issues, with some websites blocking entire countries and users increasingly turning to VPNs to bypass restrictions.
Device Bans at Public Events: The NYC mayoral inauguration explicitly banned Flipper Zero and Raspberry Pi devices, reflecting growing concerns about the use of hacking tools at high-profile events.

Cybersecurity Brief – 2025-12-11

Thu, 11 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

Threat actors are actively exploiting CVE-2025-55182, with observed attacks targeting honeypots and deploying malware.
Multiple threat groups are exploiting WinRAR vulnerability CVE-2025-6218, which has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog.
Gladinet’s CentreStack and Triofox products are under active attack due to hard-coded cryptographic keys, resulting in unauthorized access and code execution in at least nine organizations.
React2Shell vulnerability in React Server Components is being heavily exploited to deliver cryptocurrency miners and other malware across multiple sectors.
Over 10,000 Docker Hub container images have been found leaking sensitive credentials, including production system access, CI/CD database keys, and LLM model keys.
A new AMOS infostealer malware campaign is using Google search ads to lure users into fake ChatGPT and Grok guides, resulting in macOS infections.
A new Android malware, DroidLock, is locking devices for ransom, erasing data, and accessing sensitive information such as messages, contacts, and audio data.
The GhostFrame phishing kit is enabling widespread phishing attacks using dynamic subdomains and hidden iframes to evade detection.
A Ukrainian national has been charged and extradited to the US for assisting Russian hacktivist groups in attacks on critical infrastructure, including water, election, and nuclear systems.
Pro-Russian hacktivists are targeting US critical infrastructure, primarily by compromising VNC connections in operational technology (OT) systems, with potential for increased destructiveness.

Newly Discovered Vulnerabilities

PCIe 5.0+ systems are affected by three vulnerabilities in the Integrity and Data Encryption (IDE) protocol, exposing Intel and AMD processors to information disclosure, privilege escalation, and DoS via local attacks.
The .NET “SOAPwn” flaw allows remote code execution and arbitrary file writes via rogue WSDL files in enterprise applications.
Google patched a Gemini Enterprise zero-click vulnerability (“GeminiJack”) that could have exposed corporate data via crafted emails, calendar invites, or documents.
Fortinet released patches for two critical authentication bypass vulnerabilities impacting FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager with FortiCloud SSO enabled.
Ivanti Endpoint Manager (EPM) update addresses a critical XSS vulnerability enabling remote code execution with admin privileges.
SAP’s December 2025 updates fix critical vulnerabilities in Solution Manager, Commerce Cloud, and jConnect SDK, which could lead to code injection and remote code execution.
Siemens, Rockwell, and Schneider have issued patches for multiple vulnerabilities across their industrial control system (ICS) products.
Microsoft issued fixes for 56 vulnerabilities, including three zero-days, one of which is under active exploitation, and introduced a PowerShell warning for unsafe code execution.
A possible new exploit variant for Kubernetes OS command injection vulnerability CVE-2024-9042 has been identified.

Notable Threat Actor Activity

Storm-0249, an initial access broker, is abusing endpoint detection and response (EDR) platforms and Windows utilities in stealthy attacks.
The Silver Fox APT, associated with ValleyRAT malware, continues to evolve, utilizing kernel rootkits and advanced builder techniques.
The Spiderman phishing kit is targeting customers of dozens of European banks and cryptocurrency holders with highly convincing cloned sites.
The AMOS infostealer campaign leverages SEO poisoning and legitimate AI domains for malware delivery to macOS systems.
US authorities indicted Victoria Dubranova for supporting Russia-backed CARR and NoName hacktivist groups in attacks on critical infrastructure.
Two individuals linked to China’s Salt Typhoon hacker group reportedly received training via a Cisco Academy prior to targeting Cisco devices in espionage campaigns.

Trends, Tools, or Tactics of Interest

Phishing attacks have surged 400% year-over-year, with a focus on corporate accounts.
Social engineering campaigns are exploiting Microsoft Teams’ “Chat with Anyone” feature to conduct phishing attacks via external DMs.
Attackers are increasingly exploiting cloud misconfigurations across AWS, AI models, and Kubernetes, bypassing standard security tools.
Supply-chain attacks in manufacturing environments are leveraging compromised credentials, malicious NPM packages, and development tool exploits.
Microsoft Teams is developing a feature to warn IT administrators about suspicious traffic with external domains.
The GhostFrame phishing kit is enabling large-scale, evasive phishing campaigns using dynamic infrastructure.
The Spiderman phishing kit demonstrates sophistication in targeting European financial institutions with pixel-perfect phishing sites.

Regulatory or Policy Developments Affecting the Security Industry

Israeli cybersecurity sector investment reached a record $4.4 billion, reflecting over 500% growth in the past decade.
CISA added the WinRAR CVE-2025-6218 vulnerability to its KEV catalog, mandating remediation for US federal agencies.

Cybersecurity Brief – 2025-12-10

Wed, 10 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

Spanish authorities arrested a 19-year-old in Barcelona for allegedly stealing and attempting to sell 64 million personal data records obtained from breaches at nine companies.
Canadian organizations have been the primary target in a campaign by threat cluster STAC6565, with almost 40 incidents investigated. The Gold Blade group has been observed deploying QWCrypt ransomware in these attacks.
Japanese manufacturers, retailers, and government entities continue to experience prolonged recovery periods following ransomware attacks, highlighting the long-term operational impact of such incidents.
Microsoft Copilot experienced an outage affecting users in Europe, with investigation and mitigation ongoing.

Newly Discovered Vulnerabilities

Microsoft’s December 2025 Patch Tuesday addressed 57 vulnerabilities, including three zero-days (one actively exploited, two publicly disclosed) affecting Windows and supported software.
Adobe released patches for nearly 140 vulnerabilities, including 117 in Experience Manager (116 XSS bugs).
SAP issued patches for 14 vulnerabilities across multiple products, including three critical-severity flaws.
Fortinet released updates for two critical authentication bypass vulnerabilities affecting FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager, and warned of critical SSO login flaws in FortiCloud that could allow authentication bypass.
Ivanti disclosed and patched a critical remote code execution vulnerability in Endpoint Manager.
Google patched a critical “no-click” vulnerability in Gemini Enterprise that allowed attackers to exfiltrate sensitive data via malicious document instructions.
Microsoft added PowerShell warnings for scripts using Invoke-WebRequest to help prevent risky code execution.
Google introduced new layered defenses in Chrome to block indirect prompt injection threats following the addition of agentic AI capabilities.
Researchers identified malicious extensions in Microsoft Visual Studio Code Marketplace and malicious packages in Go, npm, and Rust ecosystems, designed to steal developer data.

Notable Threat Actor Activity

North Korea-linked actors exploited the React2Shell (CVE-2025-55182) vulnerability in React Server Components to deploy new EtherRAT malware, which implements multiple Linux persistence mechanisms and uses Ethereum smart contracts for command and control.
Four distinct threat clusters are leveraging the CastleLoader malware loader, indicating it is being offered as a service for broader cybercriminal use.
Storm-0249, previously known as an initial access broker, has escalated to direct ransomware operations using advanced techniques such as domain spoofing, DLL side-loading, fileless PowerShell, and abusing endpoint detection and response (EDR) solutions for stealthy malware execution.
A phishing campaign leveraging the Evilginx open-source phishing framework is targeting at least 18 U.S. universities, aiming to bypass MFA and steal credentials.
Multi-stage phishing attacks have been observed evading Microsoft 365 security controls.
Kaspersky researchers report that Telegram’s crackdown on illicit channels is pushing cybercriminal activity to other platforms.
Shanya, a “packer-as-a-service,” is being used to obfuscate ransomware payloads and disable EDR, supporting ransomware operators in evading detection.

Trends, Tools, or Tactics of Interest

Increased abuse of EDR and trusted Windows utilities by threat actors for stealthy malware deployment and persistence.
Growing adoption of malware loaders and packer-as-a-service offerings (e.g., CastleLoader, Shanya) to facilitate ransomware and malware campaigns.
Surge in malicious packages and extensions targeting developer environments (VS Code, Go, npm, Rust) to steal sensitive data and credentials.
Attackers are leveraging deepfakes, AI-generated resumes, and social engineering to impersonate job applicants and infiltrate organizations.
Prompt injection vulnerabilities in AI-powered tools remain a persistent and difficult-to-mitigate risk, as highlighted by the UK’s NCSC.
Zero Trust adoption is hindered by lack of interoperability among security tools, with 88% of organizations experiencing challenges in sharing security signals.
Ongoing migration of cybercriminal communities away from Telegram due to increased enforcement and platform blocks.

Regulatory or Policy Developments Affecting the Security Industry

The UK government imposed sanctions on Russian and Chinese firms suspected of conducting malign information warfare and hybrid threats targeting critical infrastructure and democratic processes.
The EU fined X (formerly Twitter) $140 million for verification rules that facilitate impostor scams by allowing anyone to purchase a verified checkmark.
CISA, FBI, and international partners issued a joint advisory urging immediate action to defend critical infrastructure from pro-Russia hacktivist threats.
The US announced a $10 million bounty for information on Iranian hackers associated with Emennet Pasargad.
Microsoft announced new operating CISOs as part of a strategic shift toward AI-driven cyber defense and enhanced operational oversight.

Cybersecurity Brief – 2025-11-13

Thu, 13 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

Synnovis, a UK pathology services provider, has notified healthcare providers of a data breach resulting from a ransomware attack in June 2024, which led to the theft of patient data.
Over 67,000 fake npm packages have been published in a large-scale, worm-like spam attack, likely financially motivated, flooding the npm registry since early 2024.
DanaBot malware has resumed activity, infecting Windows systems after a six-month hiatus following law enforcement disruption in May 2024.
A campaign targeting Microsoft 365 users is leveraging Quantum Route Redirection to bypass email security and steal credentials, impacting victims in over 90 countries.
Phishing emails disguised as spam filter alerts are being used to steal user credentials.

Newly Discovered Vulnerabilities

Amazon’s threat intelligence team disclosed that an advanced threat actor exploited two zero-day vulnerabilities: “Citrix Bleed 2” (CVE-2025-5777) in Citrix NetScaler ADC/Gateway and CVE-2025-20337 in Cisco Identity Service Engine (ISE).
Microsoft released fixes for 63 security vulnerabilities, including a Windows kernel zero-day flaw currently under active exploitation.
Google Chrome (version 142) and Mozilla Firefox (version 145) have patched multiple high-severity vulnerabilities in their latest releases.
Ivanti and Zoom have patched high-severity vulnerabilities that could enable arbitrary file writes, privilege escalation, code execution, and information disclosure.
Intel, AMD, and Nvidia have published advisories addressing over 60 vulnerabilities in their products as part of their regular security updates.
Siemens, Rockwell, Aveva, and Schneider Electric have addressed vulnerabilities affecting industrial control systems.

Notable Threat Actor Activity

Google has filed a lawsuit in the US District Court against China-based threat actors operating the “Lighthouse” Phishing-as-a-Service (PhaaS) platform, attributed to the group “Smishing Triad.” The platform facilitated large-scale SMS phishing campaigns, including US toll scam texts, using over 194,000 malicious domains.
Advanced persistent threat actors exploited Citrix NetScaler and Cisco ISE zero-day vulnerabilities in coordinated attacks, demonstrating increased targeting of identity and access management systems.
The SmartApeSG campaign is using ClickFix social engineering techniques, including fake Cloudflare verification pages, to push NetSupport RAT malware.
Ongoing cyber threats have been identified against Cisco ASA and Firepower devices, as reported by CISA.

Trends, Tools, or Tactics of Interest

ClickFix attacks are becoming more sophisticated, with recent campaigns mimicking Cloudflare verification checks to trick users into executing malicious commands.
The Quantum Route Redirection technique in phishing campaigns simplifies attack steps and is being used to bypass traditional email security controls.
There is increased adversary interest in targeting identity and access management infrastructure, as evidenced by recent zero-day exploitation of Citrix and Cisco products.
Passkey management on Windows 11 now supports third-party applications, with 1Password and Bitwarden as initial partners, improving passwordless authentication options.
The return of DanaBot and the scale of npm spam attacks highlight persistent threats to software supply chains and end-user systems.
Google introduced “Private AI Compute,” a privacy-enhancing technology for secure AI processing in the cloud.
Token Security outlined methods to extend Zero Trust principles to autonomous AI agents, emphasizing scoped access and continuous verification.
Behavioral (TTP-based) detection is being promoted as more effective than traditional IoC-based hunting for identifying privilege escalation, credential theft, and lateral movement.

Regulatory or Policy Developments Affecting the Security Industry

The UK government has introduced new legislation to strengthen cybersecurity requirements for critical infrastructure, including hospitals, energy, water, and transport sectors.
Kenya has launched the “Code Nation” initiative to train one million workers in technology skills, with a focus on cybersecurity, software engineering, and data science.

Cybersecurity Brief – 2025-10-16

Thu, 16 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

F5 disclosed a significant breach attributed to nation-state actors, resulting in the theft of BIG-IP source code, undisclosed security vulnerabilities, and some customer information. The attack profile suggests Chinese involvement. Patches for stolen vulnerabilities have been released, and CISA has issued an emergency directive regarding F5 devices.
Capita has been fined £14 million by the UK Information Commissioner’s Office for a 2023 data breach that exposed personal data of 6.6 million people.
Harvard University suffered a breach via an Oracle zero-day exploit, with the Clop ransomware group claiming responsibility as part of a broader campaign targeting Oracle customers.
Spanish retailer MANGO disclosed a data breach affecting customer information, resulting from a compromise at a marketing vendor.
A 19-year-old individual was sentenced to four years in prison for orchestrating a major cyberattack on PowerSchool in December 2024.
Over 100 Visual Studio Code (VS Code) extensions were found to have leaked access tokens, creating supply chain risks by allowing attackers to update extensions maliciously.
Discord named customer service firm 5CA as the third-party responsible for a data breach; 5CA denies involvement.
Scientists reported ongoing leakage of unencrypted voice calls and text messages from geostationary satellites, exposing sensitive personal and business data.

Newly Discovered Vulnerabilities

Microsoft released fixes for 183 security flaws, including two new zero-days actively exploited in the wild-one affecting every version of Windows ever shipped.
A critical vulnerability in Adobe Experience Manager, rated CVSS 10.0, is under active attack and has been added to CISA’s Known Exploited Vulnerabilities catalog.
F5 released security updates for BIG-IP vulnerabilities compromised during the recent breach.
High-severity vulnerabilities have been patched by Fortinet and Ivanti in their October 2025 Patch Tuesday updates.
Siemens, Schneider, Rockwell, ABB, and Phoenix Contact published over 20 advisories addressing vulnerabilities in their industrial control systems (ICS).
Microsoft confirmed that September 2025 Windows Server updates are causing Active Directory issues on Windows Server 2025 systems.

Notable Threat Actor Activity

The Mysterious Elephant APT group has intensified operations, targeting government and diplomatic entities in South Asia with custom tools such as BabShell and MemLoader HidenDesk, and exfiltrating WhatsApp-related data.
Chinese threat group ‘Jewelbug’ conducted a five-month-long intrusion into a Russian IT service provider, indicating geographic expansion beyond Southeast Asia.
Clop ransomware group claimed responsibility for the Harvard University breach as part of a campaign exploiting Oracle zero-day vulnerabilities.
A new banking trojan, Maverick, was distributed at scale in Brazil via malicious LNK files sent over WhatsApp. The malware shares code with Coyote.
Ongoing phishing campaigns are targeting LastPass and Bitwarden users with fake breach alerts, leading to PC compromise through malicious downloads. Similar phishing tactics are being used against Robinhood users.

Trends, Tools, or Tactics of Interest

Attackers are actively bypassing synced passkeys, highlighting inherent risks in cloud-based passkey deployments.
There is an increase in supply chain risks due to compromised VS Code extensions, with over 100 leaking tokens that could allow malicious updates.
Satellite communications remain insecure, with continued leakage of unencrypted sensitive data.
Dark web threats are increasingly hiding within normal network traffic, with network detection and response (NDR) platforms being promoted as effective countermeasures.
TikTok is being used as a platform for crypto-related scams, luring victims with fraudulent paywall schemes.

Regulatory or Policy Developments Affecting the Security Industry

The UK ICO imposed a £14 million fine on Capita for failing to protect personal data in a 2023 breach.
CISA issued an emergency directive mandating urgent remediation of critical vulnerabilities in F5 devices.
LevelBlue announced plans to acquire Cybereason, expanding its extended detection and response (XDR) and managed detection and response (MDR) portfolio.

Cybersecurity Brief – 2025-10-12

Sun, 12 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

SonicWall SSL VPN devices: Huntress reported a widespread compromise of SonicWall SSL VPN devices, with threat actors authenticating into over 100 customer environments to access internal systems.
Gladinet CentreStack and TrioFox: Active exploitation of a zero-day vulnerability (CVE-2025-11371) in Gladinet CentreStack and TrioFox products has been observed, allowing unauthenticated local file access and potential escalation to remote code execution. The flaw remains unpatched.
BreachForums Takedown: The FBI seized all domains of the BreachForums hacking forum operated by the ShinyHunters group, which was used for leaking data from ransomware and extortion attacks, including recent Salesforce-related incidents.
AI Companion Apps Data Leak: Two AI “girlfriend” apps exposed millions of private chat logs belonging to over 400,000 users.
Oracle EBS Zero-Day Attacks: Sophisticated malware was deployed in attacks exploiting a zero-day in Oracle E-Business Suite (EBS), affecting dozens of organizations since at least 10 July.
Discord Age-Verification Data Exposure: A hack exposed sensitive age-verification data of Discord users.
Manufacturing Sector Ransomware: Reports highlight continued ransomware attacks targeting the manufacturing industry, with attackers exploiting unpatched vulnerabilities.
US Universities Payroll Attacks: US universities were targeted by attackers hijacking HR SaaS accounts to divert payroll payments, attributed to the Storm-2657 threat actor.

Newly Discovered Vulnerabilities

Juniper Networks Junos Space: More than 200 vulnerabilities, including nine critical-severity flaws, were patched in Junos Space and Junos Space Security Director.
Ivanti Endpoint Manager: The Zero Day Initiative (ZDI) disclosed 13 unpatched vulnerabilities in Ivanti Endpoint Manager, enabling remote code execution and privilege escalation.
GoAnywhere MFT (CVE-2025-10035): Fortra detailed active exploitation of this critical flaw in GoAnywhere Managed File Transfer, which has since been patched.
Node.js SEA Feature Abuse: The Stealit malware campaign uses Node.js’ Single Executable Application feature to distribute payloads via trojanized game and VPN installers.
Malicious npm Packages: 175 malicious npm packages with over 26,000 downloads were found harvesting credentials as part of a phishing campaign.

Notable Threat Actor Activity

North Korean IT Worker Schemes: North Korean threat actors have expanded fraudulent remote employment operations to target a broad range of industries, including architectural design, using fake identities and documentation.
LockBit/Storm-2603: The LockBit ransomware group (Storm-2603) has been observed abusing the Velociraptor DFIR tool to maintain persistence and facilitate attacks.
Storm-2657: This actor is actively hijacking HR SaaS accounts to redirect payroll payments, targeting a variety of organizations, including universities.
Coordinated Attacks on Network Devices: Infrastructure linked to coordinated attacks is being used to exploit vulnerabilities in Cisco, Fortinet, and Palo Alto Networks devices.
RondoDox Botnet: The RondoDox botnet employs over 50 exploits in a “shotgun” approach to compromise routers, DVRs, NVRs, CCTV systems, and other edge devices globally.
Aisuru DDoS Botnet: The Aisuru botnet is responsible for record-setting DDoS attacks against US ISPs, leveraging large numbers of compromised IoT devices.

Trends, Tools, or Tactics of Interest

Abuse of Legitimate Tools: Increased weaponization of legitimate digital forensics and incident response tools (e.g., Velociraptor) by ransomware groups for persistence and post-exploitation.
AI and Deepfake Threats: OpenAI’s new video and audio generation system raises concerns about the proliferation of deepfakes. Organizations report high awareness but insufficient investment in deepfake detection capabilities.
AI in Security Operations: Advancements in AI-powered Security Operations Center (SOC) platforms, with Microsoft introducing agentic AI capabilities in Sentinel, and the emergence of AI browser agents presenting new authentication challenges.
Supply Chain Risks: Discovery of malicious packages in npm and abuse of Node.js SEA highlight ongoing supply chain threats to software development environments.
Password Guidance: NIST updates suggest a shift away from overly complex password requirements, focusing on usability and security balance.

Regulatory or Policy Developments Affecting the Security Industry

Apple Bug Bounty Expansion: Apple has doubled its maximum bug bounty payout to $2 million for zero-click RCE vulnerabilities, introduced new research categories, and increased transparency in its rewards structure. Total payouts have reached $35 million, with bonuses for iPhone exploits potentially raising rewards to $5 million.
Windows 11 23H2 End of Support: Microsoft reminded users that Home and Pro editions of Windows 11 23H2 will stop receiving security updates next month.
Chrome Notification Permissions: Google Chrome will automatically revoke notification permissions for inactive websites to reduce notification spam.
Age-Verification Law Privacy Concerns: Apple raised privacy concerns regarding proposed age-verification laws, citing risks associated with increased sensitive data collection.

Cybersecurity Brief – 2025-10-11

Sat, 11 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

The FBI has seized all domains associated with BreachForums, operated by the ShinyHunters group, which was used as a portal for leaking corporate data obtained through ransomware and extortion attacks, including recent Salesforce-related incidents. Despite the takedown, ShinyHunters continues to issue extortion threats against Salesforce victims.
Two AI companion applications exposed millions of private chat records from over 400,000 users due to inadequate security controls.
A critical zero-day vulnerability (CVE-2025-11371) in Gladinet CentreStack and TrioFox file sharing products is being actively exploited in the wild, allowing unauthenticated local attackers to access system files.
Sophisticated malware has been deployed in Oracle E-Business Suite (EBS) zero-day attacks, with exploitation believed to have started as early as July 10 and affecting dozens of organizations.
A large-scale DDoS attack was launched by the Aisuru botnet, leveraging compromised IoT devices hosted on major US ISPs.
Microsoft has observed a threat actor, Storm-2657, hijacking HR SaaS accounts to divert employee salary payments to attacker-controlled accounts; US universities have been specifically targeted in these payroll diversion attacks.

Newly Discovered Vulnerabilities

Fortra disclosed details of active exploitation of CVE-2025-10035, a critical vulnerability in GoAnywhere Managed File Transfer (MFT).
13 unpatched vulnerabilities in Ivanti Endpoint Manager have been publicly released by the Zero Day Initiative (ZDI), permitting remote code execution and privilege escalation.
Juniper Networks released patches for over 200 vulnerabilities in Junos Space and Junos Space Security Director, including nine critical-severity flaws.
175 malicious npm packages, collectively downloaded over 26,000 times, have been used in a credential phishing campaign.
Security researchers have detailed an active Stealit malware campaign abusing the Node.js Single Executable Application (SEA) feature, distributed via game and VPN installers.

Notable Threat Actor Activity

North Korean threat actors have expanded their fraudulent remote employment schemes to target nearly every industry hiring remote workers, including architectural design roles, using fake identities and documentation.
Chinese APT group Storm-2603 is abusing the Velociraptor digital forensics and incident response (DFIR) tool to gain persistent access to victim networks and facilitate ransomware deployment.
A coordinated campaign has been identified targeting Cisco, Fortinet, and Palo Alto Networks devices, with attacks originating from shared infrastructure.
The RondoDox botnet employs a “shotgun” approach, using more than 50 exploits against unpatched routers, DVRs, NVRs, CCTV systems, servers, and other network devices globally.

Trends, Tools, or Tactics of Interest

AI-generated deepfakes are proliferating, with OpenAI releasing an updated AI video and audio generation system, raising concerns about the acceleration and accessibility of deepfake creation.
The security industry is experiencing inadequate investment in deepfake detection, despite high organizational awareness and frequent encounters with AI-augmented threats.
Security Operations Centres (SOCs) are increasingly integrating AI-powered agents, with projections indicating significant transformation in SOC workflows by 2026.
Microsoft has added agentic AI capabilities to its Sentinel platform, previewing new security graph and MCP server features.
Attackers are leveraging malicious npm packages and abusing legitimate software features (e.g., Node.js SEA) to distribute malware and harvest credentials.
1Password addressed a critical security gap in its AI browser agent, which posed risks of credential leakage.
Timely patch management is highlighted as a key defense against escalating ransomware attacks on manufacturing and industrial control system (ICS) environments.

Regulatory or Policy Developments Affecting the Security Industry

Apple has expanded its bug bounty program, doubling the maximum payout to $2 million for zero-click remote code execution vulnerabilities, with potential bonuses raising the maximum to $5 million. The program now includes new research categories and a more transparent reward structure.
Microsoft reminded users that Windows 11 23H2 Home and Pro editions will reach end of support in 30 days, after which security updates will cease.
Google Chrome will automatically revoke notification permissions for inactive websites to reduce user alert fatigue.
Apple voiced concerns over proposed age-verification laws, warning that increased data collection for compliance could heighten user privacy risks.
NIST is revising password guidance, indicating that excessively complex password requirements may no longer be necessary.

Cybersecurity Brief – 2025-09-21

Sun, 21 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

UNC1549, an Iran-nexus cyber espionage group, compromised 34 devices across 11 European telecommunications firms using LinkedIn job lures and the MINIBIKE malware.
Over 600,000 individuals were impacted by healthcare data breaches in the past day, with additional major intrusions attributed to the ShinyHunters group.
The Royal Canadian Mounted Police dismantled the TradeOgre cryptocurrency exchange, seizing over $40 million linked to criminal activity.
FBI issued an alert regarding cybercriminals impersonating the FBI’s Internet Crime Complaint Center (IC3) via fake reporting portals for malicious purposes.

Newly Discovered Vulnerabilities

Fortra released a critical patch for a command injection vulnerability (CVE-2025-10035, CVSS 10.0) in GoAnywhere Managed File Transfer (MFT) software, specifically in its License Servlet. Exploitation enables arbitrary command execution.
OpenAI’s ChatGPT Deep Research agent was found vulnerable to a zero-click flaw, allowing attackers to exfiltrate Gmail inbox data via a single crafted email. The vulnerability has since been patched.
Novakon HMIs were reported to have unpatched remote code execution and information exposure vulnerabilities, exposing industrial control systems to remote attacks.
A critical vulnerability was disclosed and fixed in Microsoft Azure Entra ID that could have enabled catastrophic identity and access management attacks if exploited.

Notable Threat Actor Activity

Russian APT groups Turla and Gamaredon, both linked to the FSB, were observed collaborating to compromise high-profile Ukrainian targets. Turla deployed malware on systems previously accessed by Gamaredon, including the Kazuar backdoor.
The Iranian APT group, including a Charming Kitten subgroup, conducted sophisticated cyberattacks targeting telecommunications and satellite companies, using bespoke targeting techniques.
The Scattered Spider group had two suspected members arrested in the UK, with one charged in the US for hacking critical infrastructure.
SystemBC malware is powering the REM Proxy botnet, leveraging approximately 1,500 daily VPS victims and 80 C2 servers to provide proxy services to threat actors.

Trends, Tools, or Tactics of Interest

A phishing-as-a-service (PhaaS) surge was observed, with Lighthouse and Lucid platforms linked to over 17,500 phishing domains targeting 316 brands across 74 countries.
Atomic Infostealer is being distributed to macOS users via fake GitHub repositories, with campaigns targeting LastPass users.
Researchers identified the earliest known malware, codenamed MalTerminal, embedding GPT-4 LLM capabilities for automated ransomware creation and reverse shell generation.
CISA published an analysis of malware kits deployed in attacks exploiting Ivanti Endpoint Manager Mobile (EPMM) vulnerabilities, detailing tactics such as system information collection, credential dumping, and arbitrary code execution.
Ransomware attacks continue to evade defenses, with prevention rates dropping to 62% and data exfiltration prevention at only 3%, per the Picus Blue Report 2025.
Synthetic identity fraud is resurging in the finance and lending sector, with estimated damages reaching $3.3 billion from new accounts.
ChatGPT was demonstrated to be capable of solving CAPTCHAs and mimicking human cursor behaviour, highlighting risks in automated abuse of AI agents.

Regulatory or Policy Developments Affecting the Security Industry

Netskope completed a successful IPO, raising over $908 million and reaching a valuation of $8.6 billion.
Valve announced Steam will end support for 32-bit Windows in January 2026, affecting software compatibility and potentially security posture for legacy systems.

Cybersecurity Brief – 2025-09-20

Sat, 20 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

UNC1549, an Iran-linked cyber espionage group, successfully infiltrated 34 devices across 11 European telecommunications organisations using LinkedIn job lures and the MINIBIKE malware.
Russian threat groups Gamaredon and Turla collaborated in a campaign targeting Ukrainian entities, with Turla malware deployed on systems previously compromised by Gamaredon.
Over 600,000 individuals were impacted by recent healthcare sector breaches; ShinyHunters was identified as responsible for major attacks.
The FBI issued a warning about cybercriminals creating fake FBI Internet Crime Complaint Center (IC3) portals for malicious activity.
The REM Proxy botnet, powered by SystemBC malware, currently controls approximately 1,500 VPS victims daily via 80 C2 servers.
A surge in phishing-as-a-service (PhaaS) operations, notably Lighthouse and Lucid, has resulted in over 17,500 phishing domains targeting 316 brands in 74 countries.

Newly Discovered Vulnerabilities

Fortra disclosed and patched a critical vulnerability (CVE-2025-10035, CVSS 10.0) in GoAnywhere Managed File Transfer (MFT), allowing remote command injection via the License Servlet.
A zero-click vulnerability in OpenAI ChatGPT’s Deep Research agent enabled attackers to exfiltrate Gmail inbox data through a crafted email. OpenAI has since patched the issue.
Novakon Human-Machine Interfaces (HMIs) were found to have unpatched remote code execution and information exposure vulnerabilities.
A critical flaw in Microsoft Azure Entra ID was disclosed and fixed; it could have enabled catastrophic identity and access management attacks.
CISA released an analysis of malware kits used in attacks exploiting Ivanti Endpoint Manager Mobile (EPMM) vulnerabilities, where attackers chained two flaws to collect system information, dump credentials, and execute malware.

Notable Threat Actor Activity

Iranian APT group UNC1549 targeted European telecom and satellite companies with highly bespoke attacks, leveraging LinkedIn lures and custom malware.
Russian APTs Gamaredon and Turla collaborated to compromise Ukrainian organisations, with evidence of sequential deployment of their respective malware.
Scattered Spider group members were arrested in the UK and charged in the US for attacks on critical infrastructure organisations.

Trends, Tools, or Tactics of Interest

Researchers identified the earliest known malware (MalTerminal) embedding GPT-4-powered LLM capabilities, enabling autonomous creation of ransomware and reverse shells.
ChatGPT was demonstrated as capable of solving CAPTCHAs and mimicking human cursor movement, highlighting ongoing risks of AI-driven automation in bypassing security controls.
Ransomware continues to evade defences, with latest data showing only 62% prevention rates and data exfiltration prevention dropping to 3%.
Synthetic identity fraud in the finance and lending sector is rising post-pandemic, with estimated damages reaching $3.3 billion from new accounts.
The Tines platform released over 1,000 pre-built AI-driven security automation workflows, facilitating automated alert triage and response using AI agents and Confluence SOPs.
Industrial automation systems remain a high-value target, with Kaspersky reporting a broad range of malicious objects detected on ICS computers in Q2 2025.

Regulatory or Policy Developments Affecting the Security Industry

Netskope completed a successful IPO, raising over $908 million and achieving a valuation of $8.6 billion.
Valve announced that Steam will end support for 32-bit Windows systems in January 2026, impacting legacy software environments.

Cybersecurity Brief – 2025-09-19

Fri, 19 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

SonicWall suffered a breach of its MySonicWall cloud backup service, exposing firewall configuration backup files for fewer than 5% of customers. Impacted customers have been instructed to reset their passwords and import new configuration files.
Tiffany & Co. disclosed a data breach affecting thousands of customers in the US and Canada, with attackers accessing information related to gift cards.
Medical Associates of Brevard reported a data breach impacting nearly 250,000 individuals, attributed to the BianLian ransomware group.
ChatGPT was targeted in a server-side data theft attack using a zero-click method called ShadowLeak, which has since been fixed by OpenAI.
The Python Package Index (PyPI) invalidated all tokens stolen in the GhostAction supply chain attack and confirmed that threat actors did not use the stolen tokens to publish malicious packages.

Newly Discovered Vulnerabilities

WatchGuard released security updates for a critical remote code execution vulnerability in Firebox firewalls.
Google issued a Chrome 140 update patching four vulnerabilities, including a zero-day (CVE-2025-10585) in the V8 JavaScript engine, which was actively exploited.
Microsoft addressed a pair of vulnerabilities in Entra ID (formerly Azure AD) that could have allowed attackers to access virtually all Azure customer accounts.
CISA published details of two malware strains exploiting Ivanti EPMM vulnerabilities (CVE-2025-4427 and CVE-2025-4428) in a recent incident.

Notable Threat Actor Activity

Two UK teenagers linked to the Scattered Spider group were arrested in connection with the August 2024 cyberattack on Transport for London.
North Korean threat actors behind the “Contagious Interview” campaign are using a ClickFix social engineering technique to target job seekers with fraudulent employment offers.
Russian ransomware gangs are deploying a new multi-version malware loader, CountLoader, to deliver post-exploitation tools such as Cobalt Strike and Adaptee.
RevengeHotels has been targeting hotels in Brazil and Spanish-speaking regions with VenomRAT implants.
The SystemBC proxy botnet is actively compromising commercial VPS systems, maintaining around 1,500 bots daily to facilitate malicious traffic.
Two malicious PyPI packages were discovered delivering the SilentSync remote access trojan (RAT) to Windows systems.
Microsoft and Cloudflare disrupted RaccoonO365, a major Phishing-as-a-Service operation targeting Microsoft 365 credentials.
SMS blaster tools are being used to send large volumes of scam texts by impersonating cell towers, bypassing carrier-level protections.

Trends, Tools, or Tactics of Interest

AI-assisted phishing attacks are increasing in volume and sophistication, posing a growing threat to organizations.
Small businesses continue to be disproportionately targeted by ransomware attacks compared to large enterprises.
Microsoft 365’s widespread adoption and integration are expanding its attack surface, making it a prime target for cybercriminals.
HTTP request smuggling remains a practical attack vector, with pentesters continuing to find exploitable desynchronization vulnerabilities in web applications.
The use of Phishing-as-a-Service platforms is accelerating, with recent disruptions highlighting their prevalence and focus on Microsoft 365 accounts.
Age verification and enhanced parental controls are being introduced to ChatGPT to address concerns about AI-related harms to minors.

Regulatory or Policy Developments Affecting the Security Industry

UK law enforcement made arrests in connection with the Scattered Spider group’s attack on Transport for London, reflecting ongoing efforts to disrupt cybercriminal groups.
OpenAI is implementing age verification and parental controls for ChatGPT in response to increasing scrutiny over AI safety for minors.

Cybersecurity Brief – 2025-09-11

Thu, 11 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Jaguar Land Rover (JLR) confirmed a data breach following a recent cyberattack that forced system shutdowns and operational disruptions. Some company data was stolen in the incident.
The New York Blood Center began notifying affected individuals about a data breach resulting from a ransomware attack, confirming user data was stolen.
Plex, a media streaming platform, reported a data breach and advised users to reset their passwords.
The largest known supply-chain attack in the NPM ecosystem impacted approximately 10% of all cloud environments. Despite the scale, attackers reportedly gained little financial benefit.
An open-source developer known as “qix” disclosed a compromise of their GitHub account after being socially engineered to surrender access credentials.
A DDoS mitigation service provider in Europe was targeted by a distributed denial-of-service attack peaking at 1.5 billion packets per second.

Newly Discovered Vulnerabilities

Microsoft released patches for 80 vulnerabilities, including a publicly disclosed flaw, an SMB privilege escalation vulnerability, and Azure bugs rated CVSS 10.0.
Fortinet, Ivanti, and Nvidia issued security updates addressing high-severity vulnerabilities that could allow remote code execution, privilege escalation, information disclosure, and configuration tampering.
Rockwell Automation published eight security advisories as part of ICS Patch Tuesday, with additional advisories from Siemens, Schneider Electric, Phoenix Contact, and CISA.
A weakness in the Cursor AI code editor was identified, allowing repositories to automatically execute malicious code on a developer’s device when opened.

Notable Threat Actor Activity

Chinese APT groups have been linked to multiple high-profile incidents:
- A Chinese APT deployed the previously undocumented EggStreme fileless malware framework to compromise a Philippines-based military company.
- APT41, a China-linked group, is conducting ongoing cyber espionage campaigns targeting U.S. trade officials amid 2025 negotiations, as formally warned by the U.S. House Select Committee on China.
- Chinese state-backed actors have been observed posing as a U.S. congressman in spear-phishing attacks.
AsyncRAT is being distributed via compromised ConnectWise ScreenConnect installations to steal credentials and cryptocurrency.
Hacktivist and APT groups targeting Russian organizations have been analyzed and classified into three clusters based on their tactics, techniques, and procedures (TTPs).
The U.S. announced a $10 million reward for information leading to the arrest of Volodymyr Tymoshchuk, accused of deploying LockerGoga, MegaCortex, and Nefilim ransomware against hundreds of organizations.

Trends, Tools, or Tactics of Interest

The use of “shadow AI”-unauthorized or unmanaged AI tools by employees-is highlighted as an increasing security risk for organizations.
A new Phishing-as-a-Service kit, Salty2FA, has emerged, targeting U.S. and EU enterprises and focusing on bypassing two-factor authentication.
Two new malware families were identified:
- CHILLYHELL, a modular macOS backdoor with multiple persistence mechanisms, password brute-forcing, payload dropping, and multi-protocol communication.
- ZynorRAT, a Go-based remote access trojan capable of targeting macOS, Windows, and Linux systems.
BASE64 encoding over DNS is being used as a data exfiltration technique by certain backdoors.
Google is implementing C2PA Content Credentials in the Pixel 10 camera and Google Photos to verify image authenticity and counter AI-generated fakes.
Students are increasingly posing insider threats within the education sector, often unintentionally but at a scale challenging for security teams.
Social engineering remains a significant vector, as demonstrated by the Scattered Spider group breaching Clorox through phone-based help desk manipulation, leading to $380 million in damages.

Regulatory or Policy Developments Affecting the Security Industry

CISA presented its vision for the Common Vulnerabilities and Exposures (CVE) program, indicating ongoing evolution in vulnerability management and disclosure processes.
Apple introduced Memory Integrity Enforcement (MIE) in new iPhone models, providing always-on memory safety protections for the kernel and over 70 userland processes.
The U.S. is increasing scrutiny and financial incentives related to ransomware operators, exemplified by the $10 million reward targeting a Ukrainian ransomware actor.
The number of U.S. investors in commercial spyware companies increased sharply in 2024, with new countries identified as linked to the proliferation of such tools.

Cybersecurity Brief – 2025-08-29

Fri, 29 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

TransUnion suffered a data breach impacting over 4.4 million individuals in the US, exposing personal information but not credit reports or core credit data.
MathWorks (MATLAB developer) disclosed a ransomware attack that resulted in the theft of data belonging to over 10,000 individuals.
Google confirmed that the Salesloft breach is larger than previously reported, with attackers using stolen OAuth tokens to access both Google Workspace email accounts and Salesforce data.
The maintainers of the Nx build system reported a supply chain attack involving malicious npm packages and plugins, resulting in the leakage of over 2,300 GitHub, cloud, and AI credentials. This incident marks the first known use of AI-powered stealers in a supply chain attack.
Law enforcement agencies (FBI and Dutch Police) seized servers and domains associated with the VerifTools fake ID marketplace.
TransUnion and MathWorks incidents highlight continued targeting of large data repositories by threat actors, with significant personal data exposure.

Newly Discovered Vulnerabilities

A high-severity authentication bypass vulnerability was disclosed in Passwordstate, an enterprise password manager. Customers have been urged to patch immediately.
A flaw in the Visual Studio Code Marketplace allows attackers to republish previously deleted extensions under the same names, posing a risk to the software supply chain.
Researchers highlighted hidden vulnerabilities in popular project management tools (e.g., Trello, Asana), with risks including data exposure and insufficient backup protections.

Notable Threat Actor Activity

The China-linked APT group Salt Typhoon has exploited vulnerabilities in Cisco, Ivanti, and Palo Alto devices to breach over 600 organizations globally, including critical infrastructure in telecom, government, and military sectors. The group maintains persistent access for espionage purposes.
Cybercriminals are actively recruiting social engineering talent with fluent English skills, according to a new report on the cybercriminal recruitment ecosystem.
A new phishing-as-a-service (PhaaS) platform named “Salty 2FA” is being used to bypass MFA and steal Microsoft 365 credentials, targeting organizations across North America and Europe.
The TamperedChef malware campaign uses malvertising and fake PDF editor sites to deliver an information stealer that exfiltrates credentials and cookies.
North Korean IT worker schemes were targeted by new US Treasury sanctions, exposing $600K in crypto transfers and over $1M in profits for DPRK-linked threat actors.
Threat actors have abused Anthropic’s Claude AI to develop ransomware and automate data extortion campaigns.
Akira and Cl0p remain among the most active ransomware-as-a-service groups, with reports noting increased use of AI by both established and emerging gangs.

Trends, Tools, or Tactics of Interest

First documented AI-weaponized supply chain attack occurred via the Nx build system, where AI-powered stealers were used to rapidly exfiltrate developer secrets.
There is a notable rise in requests for ZIP files in web honeypot logs, indicating a possible trend in attackers seeking to exploit ZIP-based delivery or exfiltration methods.
Shadow IT continues to expand organizational attack surfaces, with researchers finding widespread exposed backups, open Git repositories, and accessible admin panels containing sensitive data.
RedExt, a browser extension-based C2 framework, has been released for red team operations, enabling data collection and command-and-control via Chromium-based browsers.
Meta reported shutting down millions of WhatsApp accounts linked to scam centers, reflecting ongoing large-scale anti-fraud operations.
Increasing use of malvertising and fake software download sites to deliver malware, as seen in the TamperedChef campaign.
Affiliates are flocking to scam gambling sites that lure victims with free credits and steal cryptocurrency deposits.
Microsoft Word for Windows will soon autosave and default to cloud storage for new documents.
CISA, FBI, and NSA issued a global advisory on the widespread espionage activities of Chinese nation-state actors targeting network devices.

Regulatory or Policy Developments

The US Treasury’s Office of Foreign Assets Control (OFAC) imposed new sanctions on individuals and entities associated with North Korean IT worker schemes.
The FCC disconnected over a thousand voice operators from the public telephone network for failing to combat robocalling.
CISA released updated Software Bill of Materials (SBOM) guidelines, receiving mixed industry reviews regarding their effectiveness and practical utility.

Cybersecurity Brief – 2025-07-24

Thu, 24 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

The US National Nuclear Security Administration was breached via exploitation of a Microsoft SharePoint zero-day vulnerability chain. At least three Chinese nation-state cyber-espionage groups are implicated in targeting older, on-premises SharePoint instances after a flawed patch attempt.
Clorox has filed a $380M lawsuit against Cognizant, alleging gross negligence after hackers successfully impersonated an employee and convinced the help desk to reset credentials, enabling a major August 2023 cyberattack.
Ongoing phishing campaigns are mimicking the US Department of Education’s G5 grant portal, exploiting recent layoffs and political turmoil to target users.
The npm package ‘is’, with 2.8 million weekly downloads, was compromised in a supply chain attack, injecting backdoor malware that gave attackers full device access.
npm accidentally removed the Stylus package, breaking builds and pipelines globally that depend on the library.
Ukraine arrested the suspected administrator of the Russian-language cybercrime forum XSS.is at the request of French authorities.

Newly Discovered Vulnerabilities

Sophos patched five critical vulnerabilities in Sophos Firewall that allowed for remote code execution by unauthenticated attackers.
CISA issued an alert regarding active exploitation of two vulnerabilities in SysAid ITSM software, which attackers are using to hijack administrator accounts.
Cisco reported active exploitation attempts of critical Cisco Identity Services Engine (ISE) vulnerabilities, which could lead to unauthenticated remote code execution.
Multiple high-severity memory safety vulnerabilities were patched in both Chrome and Firefox browsers.
Persistent exploitation of known Ivanti remote code execution vulnerabilities continues, particularly affecting Japanese organizations due to patching complications.

Notable Threat Actor Activity

Threat actor “Mimo” has shifted tactics to target Magento CMS and misconfigured Docker instances for crypto mining and proxyware deployment, expanding from previous campaigns against Craft CMS.
Chinese threat actors continue to exploit Ivanti RCE vulnerabilities in targeted attacks.
The Lumma Stealer malware re-emerged and resumed activity after a prior law enforcement takedown.
The Interlock ransomware group is actively targeting organizations through drive-by download attacks, prompting a government alert.
Hackers are using stolen credit cards and loyalty points to book travel for clients, with risks extending to remote workers, SMBs, and travel brands.

Trends, Tools, or Tactics of Interest

Researchers identified a new stealthy WordPress backdoor hidden in the “mu-plugins” directory, enabling persistent administrative access and evading standard detection.
The Coyote banking trojan is the first known malware to abuse the Windows UI Automation (UIA) accessibility framework to steal banking credentials, with attacks observed against banks and crypto exchanges in Brazil.
Kerberoasting attacks remain effective due to weaknesses in current detection methods; new approaches to detection and Active Directory hardening are being discussed.
Increased exploitation of SharePoint vulnerabilities is observed, with multiple exploit attempts and scanning activity detected shortly after public disclosure.
File integrity monitoring receives renewed focus with the release of the ficheck.py tool for forensic analysis.
Google launched the OSS Rebuild initiative to enhance security in open-source package ecosystems and address software supply chain attack risks.
Brave browser implemented a feature to block Windows Recall from capturing screenshots of browser activity by default.
Proton launched “Lumo,” a privacy-focused encrypted AI assistant that does not log user conversations or use prompts for training.
OpenAI is rolling out new ChatGPT features, including “personality” toggles and a “Study together” mode for exam preparation.
AI bot traffic is increasingly impacting website performance, with new mitigation strategies under discussion.
OpenAI CEO Sam Altman warned of the rising threat of AI voice fraud in banking, stating that voice clones are becoming indistinguishable from real voices and require new verification methods.

Regulatory or Policy Developments

The UK is considering a ban on ransomware payments, with debate over potential unintended consequences such as victims hiding incidents or attackers shifting tactics.
ISO 42001, a new international standard for AI governance, is being highlighted as a framework for responsible AI development and deployment.

Cybersecurity Brief – 2025-07-10

Thu, 10 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Qantas confirmed a data breach affecting 5.7 million customers, with threat actors exfiltrating customer data.
Bitcoin Depot reported a data breach impacting nearly 27,000 cryptocurrency users, exposing sensitive customer information.
Ingram Micro is restoring operations after a ransomware attack by the SafePay group, which disrupted systems and business services.
McDonald’s AI hiring platform, operated by Paradox.ai, exposed the personal information of tens of millions of job applicants due to basic security flaws, including the use of the password ‘123456’.
Nippon Steel Solutions disclosed a data breach following exploitation of a zero-day vulnerability in network equipment.
Nova Scotia Power, a Canadian electric utility, reported disruption of power meters and a data breach affecting individuals in both Canada and the United States.
Researchers identified millions of users being spied on via malicious browser extensions available in the Chrome and Edge web stores.

Newly Discovered Vulnerabilities

Microsoft released patches for 130 vulnerabilities, including critical flaws in SPNEGO and SQL Server. One of the patched vulnerabilities was publicly known prior to remediation.
A new vulnerability in ServiceNow, dubbed “Count(er) Strike,” allows low-privileged users to enumerate and extract restricted data from tables they should not access.
Multiple severe vulnerabilities remain unpatched in Ruckus Wireless management products, allowing attackers to fully compromise managed network environments.
A container escape vulnerability in the NVIDIA Container Toolkit could allow attackers to access AI datasets across Kubernetes tenants.
Ivanti, Fortinet, and Splunk released security updates addressing critical and high-severity vulnerabilities in their respective products.
Siemens, Schneider Electric, and Phoenix Contact issued July 2025 ICS Patch Tuesday advisories, addressing vulnerabilities in industrial control systems.

Notable Threat Actor Activity

The Initial Access Broker (IAB) Gold Melody has been linked to campaigns exploiting leaked ASP.NET machine keys to gain unauthorized access to organizations and sell that access.
APT group DoNot, with suspected ties to India, expanded operations targeting European foreign ministries using the LoptikMod malware for data harvesting.
The U.S. Department of the Treasury sanctioned a North Korean hacker affiliated with the Andariel group for involvement in remote IT worker schemes and malware campaigns.
Xu Zewei, a Chinese national, was arrested in Milan for alleged involvement with the Silk Typhoon state-sponsored group and cyberattacks against U.S. organizations.
Researchers reported a North American APT exploiting a Microsoft Exchange zero-day to target a Chinese entity.
The SatanLock ransomware group has shut down its operations but plans to leak additional files stolen from victims.

Trends, Tools, or Tactics of Interest

Attackers are bypassing legacy MFA solutions using real-time phishing and fake websites, highlighting the limitations of traditional authenticator apps.
A proof-of-concept AI malware using reinforcement learning was demonstrated to reliably evade Microsoft Defender.
Deepfake technology was used to impersonate a government official, successfully deceiving diplomats and politicians, exemplifying the growing national security threat from AI-generated impersonations.
Malicious browser extensions continue to be distributed via official Chrome and Edge stores, enabling large-scale user surveillance.
The open-source bot blocker “Anubis” was introduced to prevent AI scrapers from accessing website content using a proof-of-work firewall.
SSH tunneling and direct-tcp requests were highlighted as active techniques for covert network access.
Security automation platforms like Tines are offering extensive libraries of pre-built workflows for ticketing, device identification, and threat triage.

Regulatory or Policy Developments Affecting the Security Industry

The U.S. Department of the Treasury’s OFAC imposed sanctions on a North Korean cyber actor for their role in IT worker schemes supporting the Andariel group.
Microsoft confirmed a widespread issue with Windows Server Update Services (WSUS) preventing synchronization and deployment of Windows updates.
Microsoft announced that Windows 10 Extended Security Updates (ESU) will be available for consumers and businesses post-October 2025, with varying pricing models.
Microsoft Authenticator on iOS will transition backups to iCloud, removing the requirement for a Microsoft personal account.
Google disclosed further details on Android’s Advanced Protection for Chrome, emphasizing enhanced security measures.
Samsung announced new security features for Galaxy smartphones, including on-device AI protections, cross-device threat detection, and quantum-resistant encryption for network security.

Cybersecurity Brief – 2025-07-04

Fri, 04 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Spanish police dismantled an investment fraud ring responsible for over €10 million in losses, targeting victims through fraudulent investment schemes.
IdeaLab confirmed data was stolen during a ransomware attack in October 2024, with notifications being sent to affected individuals.
Microsoft is investigating ongoing intermittent access issues affecting SharePoint Online users.
Over 40 malicious Firefox browser extensions targeting cryptocurrency wallets have been discovered, designed to steal wallet secrets and user assets.

Newly Discovered Vulnerabilities

Grafana Labs released critical security updates for the Image Renderer plugin and Synthetic Monitoring Agent, addressing four Chromium vulnerabilities.
Brother printers have a critical security flaw related to default admin credentials; users are advised to change default passwords immediately.

Notable Threat Actor Activity

A major Android ad fraud operation, IconAds, involving 352 malicious apps, was disrupted. The apps loaded out-of-context ads and performed fraud at scale.
Chinese threat actors exploited Ivanti Connect Secure Appliance (CSA) zero-days in attacks against French government, telecommunications, media, finance, and transport sectors.
Hunters International Ransomware-as-a-Service operation has shut down and released free decryptors for its victims.
Dark web vendors are increasingly shifting to selling access to third-party and software supply chain services, with more data on critical infrastructure being advertised.
Attackers are using QR codes in phishing and malware campaigns, as observed by the Anti-Phishing Working Group.
Callback phishing campaigns are impersonating brands such as Microsoft, PayPal, and DocuSign, luring victims to call attacker-controlled numbers.

Trends, Tools, or Tactics of Interest

Malicious IDE extensions can bypass verification checks in popular integrated development environments, posing a hidden risk to the software supply chain.
There is a notable increase in attacks targeting software supply chains and third-party providers, as evidenced by trends on the dark web.
Weaknesses in AI-powered SOC tools have been highlighted, with concerns around reliance on limited training data and insufficient transparency in automated decision-making.
Southeast Asia remains a hotspot for cybercrime, with organizations in the region experiencing some of the highest cybersecurity risks globally, particularly from phishing.
Criminals are increasingly using QR codes as a vector for phishing and malware distribution.
Leaks suggest OpenAI is developing an Operator-like tool for ChatGPT ahead of the GPT-5 launch, potentially impacting conversational AI security.
xAI is preparing to launch Grok 4, a new state-of-the-art AI model intended to compete with Claude and Gemini.

Regulatory or Policy Developments

Microsoft announced the general availability of Exchange Server Subscription Edition (SE) for enterprise customers.
Deloitte released a new cyber blueprint aimed at guiding organizations on AI adoption and preparedness.
The U.S. Treasury’s sanctions against a Chinese national operating a cloud provider linked to virtual currency scams have seen mixed compliance from major technology firms.

Cybersecurity Brief – 2025-07-03

Thu, 03 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Qantas Airlines suffered a data breach impacting 6 million customers. Personal information was accessed via a third-party call center platform; passport and credit card data were not included.
Spanish authorities arrested two individuals in Las Palmas for cybercriminal activity, including data theft from government entities, politicians, and journalists.

Newly Discovered Vulnerabilities

Cisco disclosed and patched a critical vulnerability in Unified Communications Manager (Unified CM) and Session Management Edition, involving hardcoded root SSH credentials that allowed remote root access. The backdoor account has now been removed.
The Forminator WordPress plugin is vulnerable to an unauthenticated arbitrary file deletion flaw, enabling potential full site takeover attacks.
Google Chrome was updated to address a serious security flaw that has been exploited in the wild.
Citrix issued a warning that patching recent authentication bypass vulnerabilities in NetScaler ADC and Gateway may cause login page failures.
Multiple fake cryptocurrency wallet extensions were discovered in the Firefox add-ons store, designed to steal wallet credentials and sensitive data.

Notable Threat Actor Activity

The Russian APT group Gamaredon continues aggressive spearphishing campaigns targeting Ukrainian government entities in 2024, utilizing an evolved cyberespionage toolset and new stealth-focused techniques, including weaponization of network drives.
North Korean state-backed actors are targeting Web3 and cryptocurrency organizations with new malware written in Nim, including a macOS variant named NimDoor, which can revive itself if terminated. They are also leveraging the ClickFix technique in the BabyShark campaign to bypass browser safeguards.
A China-nexus initial access broker has been observed exploiting unpatched Ivanti vulnerabilities for initial access, then self-patching the vulnerabilities to block other threat actors.
Scattered Spider, a group of young cybercriminals, is identified as a significant and imminent threat, having targeted retailers, insurers, and airlines with a flexible and difficult-to-defend structure.
Threat actors are increasingly using callback phishing campaigns, impersonating brands such as Microsoft and DocuSign via PDFs to trick users into calling attacker-controlled phone numbers.
Attackers are using AI to rapidly generate convincing phishing sites impersonating Okta and Microsoft 365 login pages.
Attack chains such as ClickFix and FileFix exploit browser and user behavior to bypass security controls and enable malicious script execution.

Trends, Tools, or Tactics of Interest

Nearly 80% of cyber threats now mimic legitimate user behavior, complicating network threat detection.
Modern phishing campaigns are leveraging AI and social engineering to increase the speed and realism of attacks.
Social engineering tactics are being used in attack chains to manipulate victims into saving and renaming files that execute malicious scripts.
Fake browser extensions and add-ons targeting cryptocurrency wallets are proliferating in official app stores.
New malware written in the Nim programming language is being used in targeted attacks, reflecting an ongoing trend of threat actors adopting less common languages to evade detection.

Regulatory or Policy Developments Affecting the Security Industry

The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) sanctioned Russia-based bulletproof hosting provider Aeza Group for supporting ransomware and malware operations, including affiliations with BianLian and Lumma Stealer.
The U.S. Department of Justice is investigating a former ransomware negotiator for alleged criminal collaboration with ransomware gangs to profit from extortion payment deals.
A U.S. judge approved the sale of 23andMe’s DNA data to TTAM Research Institute, prompting privacy concerns and increased user requests for data deletion.

Cybersecurity Brief – 2025-06-11

Wed, 11 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

The Texas Department of Transportation (TxDOT) suffered a data breach in which a threat actor downloaded 300,000 crash records from its database.
United Natural Foods, Inc. (UNFI) experienced a cybersecurity incident, leading to proactive system shutdowns and operational disruption. The exact attack vector remains unknown.
A widespread outage impacted Heroku, preventing developers from accessing the platform and disrupting web services for over six hours.
OpenAI’s ChatGPT experienced a global outage, affecting user access across web, mobile, and desktop platforms.

Newly Discovered Vulnerabilities

Adobe released security patches addressing 254 vulnerabilities, primarily affecting Experience Manager (AEM).
Microsoft’s June 2025 Patch Tuesday addressed 66-67 vulnerabilities, including one actively exploited zero-day and another publicly disclosed flaw. Notably, a Microsoft Outlook update will expand the list of blocked risky attachments.
A new Secure Boot bypass vulnerability (CVE-2025-3052) was disclosed, allowing attackers to disable security controls and install bootkit malware.
Ivanti patched three high-severity hardcoded key vulnerabilities in Workspace Control, which exposed SQL credentials.
Researchers identified over 20 configuration-related risks, including five CVEs, in Salesforce Industry Cloud, potentially exposing sensitive data.
A researcher discovered a flaw in Google’s account recovery process that allowed brute-forcing of linked phone numbers, which has since been addressed.
Proof-of-concept code was released for a Roundcube webmail vulnerability, enabling authenticated attackers to fully compromise servers.

Notable Threat Actor Activity

FIN6 has been observed impersonating job seekers and using AWS-hosted fake resumes on LinkedIn to deliver the More_eggs malware, targeting recruiters with malicious payloads.
The Rare Werewolf (formerly Rare Wolf) APT group has conducted attacks against Russian and CIS enterprises, leveraging legitimate software in their operations.
Stealth Falcon APT exploited a Microsoft remote code execution zero-day in the Middle East, which was patched in the latest Patch Tuesday.
DanaBot malware operators were exposed and dismantled due to a command-and-control server bug introduced in 2022.
Quasar RAT is being distributed through malicious BAT files in ongoing campaigns.
Poisoned npm packages disguised as utilities were found containing backdoors with file-deletion commands, posing a threat to software supply chains.
A new Rust-based information stealer, Myth Stealer, is being distributed via fraudulent gaming websites, targeting Chrome and Firefox users.

Trends, Tools, or Tactics of Interest

Increased targeting of educational institutions, with reports highlighting worsening cybersecurity in schools.
AI-related data exposure risks are rising; a report found that 99% of organizations analyzed had sensitive data accessible to AI systems.
Non-human identity management is emerging as a critical security challenge due to the proliferation of automated services and applications.
SSH key mismanagement continues to be a significant risk, with untracked and unrotated credentials creating vulnerabilities.
Cisco announced new tools to monitor and control AI agent behavior within enterprise networks amid concerns about rogue AI activity.
GitHub is promoting artifact attestation and the SLSA framework to prevent software supply chain attacks.
Microsoft Outlook will block additional risky attachment types to mitigate malware delivery.
Android devices are receiving new enterprise-scale security protections.
Red Canary is expanding AI-driven solutions to reduce alert fatigue in security operations centers.

Regulatory or Policy Developments Affecting the Security Industry

ConnectWise is rotating code signing certificates for ScreenConnect, Automate, and RMM products due to security concerns.
India’s security leaders are grappling with new digital privacy regulations and AI governance, amid a shortage of cybersecurity talent.
Apple is emphasizing on-device processing for its new AI features, positioning privacy as a key differentiator.

Cybersecurity Brief – 2025-05-23

Fri, 23 May 2025 00:00:00 +0000

Major Incidents or Breaches

Chinese Threat Actor Activity:
- Chinese-speaking group UAT-6382 exploited a now-patched remote code execution vulnerability in Trimble Cityworks to breach multiple US local government networks, deploying Cobalt Strike and VShell.
- Chinese nexus actors exploited recently patched Ivanti Endpoint Manager Mobile (EPMM) vulnerabilities to target government agencies and enterprises across Europe, North America, and Asia.
Phishing Campaign Targeting International Students:
- The FBI reported an ongoing phishing campaign specifically targeting Middle Eastern students studying in the US, aiming to steal personal and financial information.
Database Exposure:
- A database containing 184 million login credentials, including those for Apple, Google, Meta, and various government services, was discovered and subsequently taken offline.
Cryptocurrency Theft via Fake Apps:
- Cybercriminals are distributing fake Ledger apps targeting macOS users to steal cryptocurrency seed phrases and digital assets.

Cybersecurity Brief – 2025-05-15

Thu, 15 May 2025 00:00:00 +0000

Major Incidents or Breaches

Coinbase Data Breach and Extortion Attempt
- Coinbase disclosed a data breach affecting approximately 1% of its users after cybercriminals bribed customer support agents. Attackers accessed sensitive customer information, including government IDs, and attempted to extort $20 million. The extortion attempt failed, but the incident highlights ongoing risks to cryptocurrency platforms from both insider and external threats.
Nova Scotia Power Data Breach
- Nova Scotia Power confirmed a cyberattack resulting in the theft of sensitive customer data. The breach was discovered last month and underscores the persistent targeting of critical infrastructure and utility providers.

Newly Discovered Vulnerabilities

SAP NetWeaver (CVE-2025-31324)
- A critical vulnerability in SAP NetWeaver is being actively exploited by multiple threat actors, including ransomware groups BianLian and RansomExx. The flaw allows remote code execution and has led to a surge in attacks against unpatched systems. Immediate patching is strongly advised.
Samsung MagicINFO 9 Server (CVE-2025-4632)
- Samsung patched a critical vulnerability (CVSS 9.8) in MagicINFO 9 Server that was actively exploited to deploy Mirai botnet variants. Organizations using this software should update immediately.
Google Chrome High-Severity Flaw
- Google released emergency updates addressing a high-severity Chrome vulnerability that has a public exploit and is being used in the wild for cross-origin data leaks via the Loader Referrer Policy. All users are advised to update promptly.
Ivanti Endpoint Manager Mobile (EPMM) Zero-Day Flaws
- Ivanti confirmed exploitation in the wild of zero-day vulnerabilities in EPMM, affecting a limited number of customers. The flaws stem from open source library issues and are being used in chained attacks.

Cybersecurity Brief – 2025-05-14

Wed, 14 May 2025 00:00:00 +0000

Major Incidents and Breaches

Marks & Spencer confirmed customer data was stolen in a recent cyberattack. While no account passwords were compromised, customers are being required to reset passwords as a precaution.
Dior disclosed a cybersecurity incident resulting in the exposure of customer information.
Nucor Corporation, a major steel producer, experienced network disruptions due to a cyberattack, forcing parts of its systems offline for containment.
The Australian Human Rights Commission suffered a data breach in which private documents were leaked online and indexed by search engines.
Xinbi Guarantee, a Chinese-language Telegram marketplace, has been linked to $8.4 billion in illicit transactions, including crypto crime, romance scams, and North Korean money laundering.
North Korean IT worker scams are being exposed at scale, with researchers publishing 1,000 email addresses and photos linked to infiltration of Western companies.
Kosovo extradited the admin of BlackDB, an online cybercrime marketplace, to the US to face charges.

Newly Discovered Vulnerabilities and Exploits

Microsoft Patch Tuesday (May 2025): Microsoft released fixes for 78 vulnerabilities, including five zero-days under active exploitation. Notably, a CVSS 10 vulnerability impacts Azure DevOps Server.
Samsung patched CVE-2025-4632 in MagicINFO 9 Server, a critical flaw (CVSS 9.8) exploited to deploy Mirai botnet malware.
Fortinet addressed CVE-2025-32756, a zero-day RCE flaw in FortiVoice enterprise phone systems, confirmed as exploited in the wild.
Ivanti released updates for two vulnerabilities in Endpoint Manager Mobile (EPMM) that have been chained for remote code execution in limited attacks.
SAP NetWeaver vulnerability is being actively exploited by multiple ransomware groups, including BianLian and RansomExx, to deploy malware such as PipeMagic Trojan.
Google Chrome is rolling out a security change to prevent browser launches with admin privileges on Windows, reducing attack surface.
Open redirect vulnerabilities in trusted domains (e.g., google.com) continue to be abused in phishing campaigns.
Focused phishing attacks are leveraging trusted domains, real CAPTCHAs, and server-side validation for more targeted credential theft.

Notable Threat Actor Activity

Earth Ammit, a cyber espionage group, was linked to supply chain breaches in the drone sector via ERP systems in the VENOM and TIDRONE campaigns targeting Taiwan and South Korea.
Scattered Spider (aka UNC3944) tactics, previously used against UK retail chains, are now being deployed against US retailers.
Ransomware gangs are increasingly exploiting SAP NetWeaver vulnerabilities for initial access and malware deployment.
Meta Mirage, a global phishing campaign, is targeting Meta Business Suite users to hijack high-value business accounts.
Horabot malware is being distributed through invoice-themed phishing emails, targeting Windows users across six Latin American countries.

Trends, Tools, and Tactics of Interest

Phishing campaigns are becoming more sophisticated, with increased use of trusted domains, CAPTCHAs, and real-time validation to evade detection and improve targeting.
Telegram-based black markets remain a significant vector for cybercrime, with recent enforcement actions leading to shutdowns and exposure of major illicit marketplaces.
Shadow SaaS and AI usage is an emerging risk, with new tools (e.g., LastPass SaaS monitoring) being developed to detect unauthorised employee use of unsanctioned cloud and AI services.
Supply chain attacks via ERP systems and targeting of high-value sectors (e.g., drones, retail) remain prevalent.
AI agent security: Research indicates that AI agents can be manipulated by implanting fake “memories,” raising concerns about the integrity of autonomous systems.
Device hygiene: Daily phone reboots are recommended as a practical defense against persistent zero-click mobile exploits.

Regulatory and Policy Developments

Consumer Financial Protection Bureau (CFPB) in the US has canceled plans for tighter regulation of data brokers, potentially impacting privacy and data protection standards.
Telegram enforcement: Following media inquiries, Telegram banned thousands of accounts tied to crypto scam money laundering, disrupting several major illicit marketplaces.

Cybersecurity Brief – 2025-04-26

Sat, 26 Apr 2025 00:00:00 +0000

Major Incidents and Breaches

Marks & Spencer Cyberattack
- Marks & Spencer, a major UK retailer, has suspended online orders following a cyberattack. Recovery efforts are ongoing, with continued disruption to online shopping services.
MTN Group Data Breach
- African telecom giant MTN disclosed a cybersecurity incident resulting in unauthorised access to personal information of subscribers in certain countries. The breach is attributed to an unknown third party.
Baltimore City Public Schools Data Breach
- Over 31,000 individuals have been notified of a data breach after attackers compromised the network in February, exposing employee and student information.
Craft CMS Zero-Day Exploitation
- Ongoing zero-day attacks are targeting Craft CMS servers via a chained remote code execution exploit, resulting in data theft. CERT Orange Cyberdefense reports active exploitation.
Physical Cryptocurrency Theft
- A recent case highlights the physical risks associated with cryptocurrency, involving a $250 million theft that escalated to kidnapping.