Lantronix on DanSec Daily

Cybersecurity Brief – 2026-06-26

Fri, 26 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Personal data belonging to politicians, military leaders, and executives was left publicly accessible due to a security misconfiguration at an elite networking organization, leading to a data breach affecting high-profile individuals ^[40].
Authorities in Poland arrested four members of a cybercrime group accused of breaching telecommunications partners and hijacking email accounts to conduct SIM-swapping attacks, resulting in millions in cryptocurrency theft ^[13].

Newly Discovered Vulnerabilities

A critical vulnerability (CVE-2026-12569) in PTC Windchill enabling remote code execution has been exploited in the wild and added to CISA’s Known Exploited Vulnerabilities catalog ^[28].
A server-side request forgery (SSRF) flaw in Cisco Unified Communications Manager (CUCM) and Unified CM SME, which can escalate privileges to root, was weaponized by attackers less than 24 hours after disclosure ^[21].
A vulnerability in Lantronix Serial-to-IP converters (CVE-2025-67038), disclosed in April, has been exploited following OT threat warnings ^[33].
Chrome patched 18 vulnerabilities, including four critical flaws, two of which are WebGL bugs that could allow sandbox escape ^[38].
GitLab CE/EE released updates addressing 13 vulnerabilities, including three rated high severity that could lead to code execution or information disclosure ^[34].
The open-source curl tool patched 18 vulnerabilities, including a 25-year-old flaw, though all were rated medium or low severity ^[35].
A popular Chrome ad blocker extension for YouTube, with over 10 million installs, was found to have dormant script injection capability that could allow arbitrary JavaScript execution ^[7].

Notable Threat Actor Activity

The Russian state-sponsored threat actor Turla has deployed a previously undocumented .NET backdoor named STOCKSTAY in espionage attacks targeting government and military organizations in Ukraine ^[6].
The Gamaredon APT group has upgraded its toolset, increasing its use of legitimate online services for command and control and data exfiltration, and is forming new alliances to enhance operational security ^[5]^[22].
A new backdoor named Mistic, linked to the KongTuke group, has been used in financially motivated attacks targeting sectors including insurance, education, IT, and professional services ^[11].
Iranian hacker group Handala claimed responsibility for a cyberattack on California Water Service, but investigation found no evidence of OT system compromise ^[32].

Trends, Tools, or Tactics of Interest

Sophisticated phishing kits are increasingly targeting device code authentication flows to breach accounts without requiring passwords ^[2].
The Bluekit phishing-as-a-service platform has adopted browser-in-the-middle techniques for login theft and expanded its infrastructure with nearly 70 new hostnames in the past week ^[18].
Threat actors are abusing the Shop order-tracking app by inserting fake purchase receipts into users’ histories to launch callback phishing attacks ^[14].
New macOS malware named Gaslight uses prompt injection payloads and embeds fake errors specifically designed to confuse AI-assisted malware analysis tools ^[10]^[16].
There is a rise in attacks against SMBs involving fake AI tools, phishing, and the sale of stolen data on the dark web ^[1].
Ransomware operators are increasingly targeting EU organizations and their suppliers, making Europe the primary region of interest after a global lull ^[25].
EdTech attackers are shifting focus from direct attacks on schools to targeting their software suppliers, increasing supply chain risk ^[23].
Parcel mule scams are spreading via fake job offers, tricking victims into handling stolen goods ^[37].
Fake domain renewal emails and websites are being used to deceive website owners into paying scammers ^[39].

Regulatory or Policy Developments Affecting the Security Industry

Microsoft has extended its free Windows 10 Extended Security Updates (ESU) program for consumers by one year, allowing continued receipt of security updates until October 2027 ^[15].
The new enterprise-ready Model Context Protocol (MCP) specification shifts security responsibilities from the protocol itself to developers and platform operators, introducing new security challenges ^[29].
A WIRED investigation highlighted reliability issues with a UK police predictive analytics system built as part of the adoption of AI in law enforcement ^[26].

Sources

Elite network says it was hacked after members’ personal data was left exposed - malwarebytes.com
Poland busts SIM-swapping gang tied to millions in crypto theft - bleepingcomputer.com
First-Ever Exploitation of PTC Windchill Vulnerability Discovered in the Wild - securityweek.com
In Less Than 24 Hours, Attackers Weaponize Cisco CUCM Flaw - darkreading.com
Lantronix Serial-to-IP Converter Flaw Exploited in Attacks After OT Threat Warning - securityweek.com
Update Chrome to patch critical browser security flaws - malwarebytes.com
GitLab Patches Code Execution, Information Disclosure Vulnerabilities - securityweek.com
25-Year-Old Vulnerability Patched in Curl - securityweek.com
Chrome Ad Blocker with 10M+ Installs Found with Dormant Script Injection Capability - thehackernews.com
Google Details Turla's New STOCKSTAY Backdoor Used in Ukraine Espionage Attacks - thehackernews.com
Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances - welivesecurity.com
Russian APT 'Gamaredon' Upgrades Its Arsenal, Requiring New Defenses - darkreading.com
New Mistic Backdoor Linked to KongTuke in ClickFix and ModeloRAT Campaigns - thehackernews.com
Cal Water Says No OT Systems Breached in Iranian Handala Cyberattack - securityweek.com
Report: Device Code Phishing is Surging - blog.knowbe4.com
Bluekit phishing kit adopts browser-in-the-middle for login theft - bleepingcomputer.com
Order-tracking app Shop abused to push callback phishing attacks - bleepingcomputer.com
New Gaslight macOS Malware Uses Prompt Injection to Disrupt AI-Assisted Analysis - thehackernews.com
New macOS malware embeds fake errors to confuse AI analysis tools - bleepingcomputer.com
Inside the 2026 SMB threat landscape: From phishing and scams to fake AI tools - securelist.com
Europe Evolves Into Ransomware's Favorite Region - darkreading.com
EdTech Attackers Shift From Schools to Their Software Suppliers - darkreading.com
Beware of “Parcel Expert” job offers: They’re parcel mule scams - malwarebytes.com
Fake domain renewal emails trick website owners into paying scammers - malwarebytes.com
Microsoft quietly extends free Windows 10 ESU support to October 2027 - bleepingcomputer.com
New Enterprise-Ready MCP Specification Brings New Security Challenges - securityweek.com
British Police Built a Sprawling Crime-Prediction Machine. Some Results Couldn’t Be Trusted - wired.com

Cybersecurity Brief – 2026-06-25

Thu, 25 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Law enforcement and private sector partners have disrupted the infrastructure of the Amadey botnet and Stealc infostealer operations, recovering 27 million stolen credentials and impacting hundreds of command-and-control servers in a coordinated global action known as Operation Endgame ^[5]^[8]^[17]^[30].
The US Department of Justice has seized a cloud computing account linked to subsidiaries of Cambodia-based HuiOne Group, which was allegedly used for cyber scam money laundering ^[11].
A 21-year-old hacker known as “Snoopy” has been sentenced to 18 months in prison for their involvement in the 2022 DraftKings cyberattack, with a requirement to pay approximately $1.8 million in forfeiture and restitution ^[13]^[33].

Newly Discovered Vulnerabilities

A critical zero-day vulnerability in Cisco Catalyst SD-WAN (CVE-2026-20245) was exploited for at least two months before public disclosure, allowing attackers to gain root access and create rogue accounts through rogue peering and exploitation of the device’s web-based management interface ^[6]^[14]^[20]^[28].
CISA has issued warnings about active exploitation of critical vulnerabilities in Lantronix EDS5000 Series devices and Ubiquiti UniFi OS products, enabling remote, unauthenticated attackers to make system changes, access underlying accounts, and inject commands ^[7]^[16]^[34].
Researchers have identified a critical FFmpeg flaw, dubbed PixelSmash, which allows attackers to compromise systems via malicious video files ^[36].
Chrome 149 update addresses 18 severe vulnerabilities, with more than half being use-after-free bugs that could lead to remote code execution ^[27].
A security gap in macOS allows users, including standard non-admin accounts, to disable security and integrated browser tools without requiring administrator privileges or kernel exploits by chaining legitimate OS behaviors ^[24]^[32].

Notable Threat Actor Activity

A new global campaign named StrikeShark is delivering Cobalt Strike Beacon through a custom loader called SharkLoader ^[1].
The Silent Ransom Group has targeted US law firms using a combination of voice phishing and in-person social engineering to exfiltrate sensitive data ^[3].
The Mistic backdoor has been linked to the ransomware access broker KongTuke, with attacks observed against organizations in insurance, education, IT, and professional services sectors ^[19].
Malicious Microsoft Edge extension “Edgecution” has been used in ransomware attacks to escape the browser sandbox and deploy a Python-based backdoor via abuse of Native Messaging ^[15].
Malicious packages on the OpenClaw (ClawHub) AI skills marketplace were found to bypass security checks and include infostealers and other threats, posing risks to the AI supply chain ^[23].

Trends, Tools, or Tactics of Interest

Attackers are increasingly exploiting weaknesses in CI/CD workflows, with researchers highlighting a new class of flaws (Cordyceps) that expose over 300 GitHub repositories to supply-chain attacks ^[9].
Threat actors are abusing a variety of collaboration channels beyond email, adapting to improved cloud email security and seeking new vectors for social engineering and phishing ^[4].
Service desks remain a favored target for social engineering attacks aimed at obtaining password resets, MFA changes, and unauthorized access to corporate accounts ^[18].
There is a noted rise in cyber threats targeting major events, with the 2026 FIFA World Cup facing persistent cybercrime, social engineering, and infrastructure attacks across host countries ^[21].
Attackers are leveraging information as an attack surface, using tactics such as hidden content injections and cognitive state poisoning to compromise AI and autonomous systems ^[29]^[35].

Regulatory or Policy Developments Affecting the Security Industry

NIST has opened updated IoT security guidance for public review, aiming to establish cybersecurity requirements for IoT devices used in federal agency networks ^[26].
Google is rolling out new privacy controls for Search services and Google Play, giving users more granular control over saved activity history and personalized recommendations ^[12].

Sources

ESET takes part in Operation Endgame to disrupt Amadey and Stealc - welivesecurity.com
Amadey and StealC Malware Network Disrupted, 27M Stolen Credentials Recovered - thehackernews.com
Amadey, StealC malware operations disrupted in Operation Endgame action - bleepingcomputer.com
Microsoft and Allies Smash Shared Infrastructure of Amadey and StealC Malware - securityweek.com
DoJ Seizes Huione Cloud Account Tied to Cyber Scam Money Laundering - thehackernews.com
DraftKings hacker 'Snoopy' sentenced to 18 months in prison - bleepingcomputer.com
Third DraftKings Hacker Sentenced to 18 Months in Prison - securityweek.com
Cisco Catalyst SD-WAN Zero-Day CVE-2026-20245 Exploited to Gain Root Access - thehackernews.com
Mandiant reveals how Cisco SD-WAN zero-day attacks gained root access - bleepingcomputer.com
Attackers Hit Cisco SD-WAN Flaw 2 Months Before Disclosure - darkreading.com
Cisco SD-WAN Zero-Day Exploited Months Before Patching - securityweek.com
CISA Warns Critical Lantronix EDS5000 Flaw Is Being Actively Exploited - thehackernews.com
CISA warns of max severity Ubiquiti flaws exploited in attacks - bleepingcomputer.com
Critical Ubiquiti Vulnerabilities in Attackers’ Crosshairs - securityweek.com
PixelSmash flaw turns video files into attack tools - malwarebytes.com
Chrome 149 Update Resolves 18 Severe Vulnerabilities - securityweek.com
Apple's MacOS Gap Lets Users Disable Security Tools - darkreading.com
macOS Weaknesses Chained to Silently Disable Endpoint Security Agents - securityweek.com
StrikeShark: investigating a new campaign delivering Cobalt Strike through SharkLoader - securelist.com
Extortion Gang Sends In-Person Attackers to Exfiltrate Data - blog.knowbe4.com
Stealthy Mistic backdoor linked to ransomware access broker KongTuke - bleepingcomputer.com
Malicious Edge extension abuses Native Messaging as bridge to malware - bleepingcomputer.com
More Malicious OpenClaw Skills Threaten AI Supply Chain - darkreading.com
Cordyceps CI/CD Flaws Expose 300+ GitHub Repositories to Supply-Chain Attacks - thehackernews.com
Attackers aren’t loyal to any collaboration channel - blog.knowbe4.com
Securing the service desk: Why social engineering attacks keep succeeding - bleepingcomputer.com
2026 FIFA World Cup Faces Surge in Cyber Threats - darkreading.com
When Information Becomes the Attack Surface – Understanding AI Agent Traps - securityweek.com
Agentic AI Security: Wrong Context, Wrong Decisions at Machine Speed - securityweek.com
NIST Opens Updated IoT Security Guidance to Public Review - securityweek.com
Google releases new privacy controls for activity history, personalization - bleepingcomputer.com

Cybersecurity Brief – 2026-04-22

Wed, 22 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

French Government Agency Data Breach: France Titres, responsible for issuing administrative documents, confirmed a breach after a hacker claimed to have stolen citizen data and offered it for sale.
Healthcare Data Breaches in the US: Data breaches were reported by Southern Illinois Dermatology, Saint Anthony Hospital, and North Texas Behavioral Health Authority, collectively affecting approximately 600,000 individuals.
Kelp DAO Crypto Heist: North Korean threat actors are attributed to a $290 million theft from Kelp DAO, exploiting LayerZero’s DVN by compromising RPC endpoints and using DDoS attacks to force failover to malicious infrastructure.
Perforce Server Exposures: Over 1,500 Perforce P4 version control servers were found to be unsecured, exposing sensitive data from major organizations.

Cybersecurity Brief – 2026-04-21

Tue, 21 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

KelpDAO suffered a $290 million cryptocurrency theft, attributed to North Korean state-sponsored Lazarus Group hackers. The attackers exploited the DeFi platform to drain assets.
Vercel, the creator of Next.js, confirmed a data breach after a threat actor claimed to have stolen data and offered it for sale for $2 million. The breach reportedly stemmed from compromised OAuth tokens used by an employee’s AI tool.
Seiko USA’s website was defaced, with attackers claiming theft of the Shopify customer database and threatening to leak the data unless a ransom is paid.
Bluesky social network experienced a 24-hour disruption due to a sophisticated DDoS attack, with a pro-Iran hacker group claiming responsibility.
Booking.com was reported as a recent victim of a cyberattack, with further details pending.
A British national, identified as a leader of the Scattered Spider cybercrime collective, pleaded guilty in the US to wire fraud and aggravated identity theft related to cryptocurrency theft.

Newly Discovered Vulnerabilities

Over twenty malicious apps impersonating popular crypto wallets (Metamask, Coinbase, Trust Wallet, OneKey, etc.) were discovered on the Apple App Store, primarily targeting users in China. These apps phished for recovery/seed phrases to steal cryptocurrency.
SGLang (CVE-2026-5760, CVSS 9.8): A critical vulnerability allows remote code execution via malicious GGUF model files.
Anthropic Model Context Protocol (MCP): A critical design weakness was disclosed, enabling remote code execution and posing a supply chain risk for AI deployments.
Serial-to-IP converters from Lantronix and Silex were found to contain 20 new vulnerabilities, exposing OT and healthcare systems to potential attacks.
CISA added eight new exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including three affecting Cisco devices.
WhatsApp was found to leak user metadata, allowing attackers to infer limited information about users without direct contact.
Half of the 6 million internet-facing FTP servers were found to lack encryption, exposing users and enterprises to various attacks.

Notable Threat Actor Activity

Lazarus Group (North Korea) linked to the $290 million KelpDAO crypto theft.
Scattered Spider leader pleaded guilty to multiple cybercrimes, including corporate intrusions and cryptocurrency theft.
Pro-Iran hacker group claimed responsibility for the DDoS attack on Bluesky.
The Gentlemen ransomware group was observed using the SystemBC proxy malware botnet (over 1,570 hosts) for bot-powered attacks, facilitating lateral movement and defense evasion.
Threat actors are abusing QEMU, a machine emulator, in campaigns to evade defenses and distribute ransomware and remote access tools.
Microsoft reported increased abuse of Microsoft Teams by threat actors for helpdesk impersonation and lateral movement using legitimate tools.
Reports indicate use of .wav files as a vector for malware delivery.

Trends, Tools, or Tactics of Interest

Third-party tools and compromised OAuth tokens are increasingly leveraged as initial access vectors in breaches, as seen in the Vercel incident.
There is a rise in threat actors exploiting trusted download paths and legitimate collaboration platforms (e.g., Microsoft Teams) for initial access and lateral movement.
The SystemBC proxy is being used by ransomware operators to automate attacks and maintain persistence within victim networks.
QEMU is being leveraged for defense evasion in recent ransomware and RAT campaigns.
Increase in phishing and malicious app distribution on official platforms, such as the Apple App Store, specifically targeting cryptocurrency assets.
Serial-to-IP converters in OT and healthcare environments remain a weak link due to numerous unpatched vulnerabilities.
AI supply chain risks are highlighted by critical vulnerabilities in AI model protocols and concerns about the misuse of powerful AI tools (e.g., Anthropic’s Mythos tool not publicly released over security fears).
Survey data from LevelBlue indicates ongoing concern among security leaders about the human element in cybersecurity, with workforce education seen as insufficient.

Regulatory or Policy Developments

The US Senate extended surveillance powers under a controversial program until 30 April 2026, following legislative delays.
CISA set federal deadlines in April–May 2026 for remediation of newly catalogued exploited vulnerabilities.