Medtronic on DanSec Daily

Cybersecurity Brief – 2026-07-04

Sat, 04 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

Medtronic experienced a data breach in April, with threat actor ShinyHunters accessing corporate IT systems and stealing personal and medical information of 3.8 million individuals ^[15].
A joint operation, including Google, disrupted the NetNut residential proxy network, severing access to 2 million compromised Android devices, smart TVs, and streaming boxes ^[10].
Former Member of the European Parliament Stelios Kouloglou was repeatedly targeted with Pegasus spyware during his tenure investigating spyware abuses ^[9].

Newly Discovered Vulnerabilities

Seven unpatched vulnerabilities were disclosed in the FatFs filesystem library, which is embedded in millions of devices using FAT and exFAT formats for USB and SD card access ^[4].
A Linux kernel flaw, CVE-2026-46242 (“Bad Epoll”), allows unprivileged users to escalate privileges to root on Linux desktops, servers, and Android devices ^[5].

Notable Threat Actor Activity

The Armored Likho APT group has been linked to spear-phishing campaigns using AI-generated loaders and the new BusySnake Stealer, targeting government agencies and the electric power sector in Russia, Brazil, and Kazakhstan ^[1]^[8].
North Korea-linked actors have distributed malicious npm packages masquerading as Rollup polyfills to steal developer secrets and enable remote access ^[7].
The INC ransomware-as-a-service operation has targeted the legal sector, with hundreds of claimed victims in 2026 ^[2].
Researchers identified a new modular malware framework called Avalon, distributed via a multi-stage phishing chain and capable of deploying CrownX ransomware ^[6].
ARToken, a new phishing-as-a-service platform affiliated with EvilTokens, has exposed a sophisticated toolkit aimed at compromising Microsoft 365 accounts ^[11].
A Canadian hacker associated with Anonymous was jailed, while other cases included open source zero-day disclosures and sentencing for ATM jackpotting ^[13].
A 19-year-old alleged member of Scattered Spider, linked to over 100 network intrusions and $100 million in ransom payments, was extradited to the US ^[16].
Two new campaigns were observed: a verified X (Twitter) ad distributing Mac malware, and the ConsentFix campaign stealing Microsoft accounts, both relying on social engineering tactics ^[17].

Trends, Tools, or Tactics of Interest

Attackers are increasingly leveraging AI, including agentic LLMs, to automate complex, multi-stage intrusions such as ransomware attacks, as demonstrated via Langflow ^[14].
Chinese-developed large language models (LLMs) are advancing rapidly, broadening the capability gap between attackers and defenders ^[12].
AI-generated loaders and modular, multi-stage phishing chains are being used to bypass traditional security controls ^[1]^[6].
Social engineering is increasingly favoured over software exploits for compromising devices and accounts ^[17].
The security of open source software is under renewed scrutiny following the public release of zero-day vulnerabilities ^[13].

Regulatory or Policy Developments Affecting the Security Industry

The targeting of a European Parliament member with Pegasus spyware occurred while the individual was investigating spyware abuses, highlighting ongoing policy and oversight challenges related to commercial spyware use in Europe ^[9].

Sources

Medtronic Data Breach Impacts 3.8 Million People - securityweek.com
NetNut proxy network disrupted, 2 million infected devices cut off - bleepingcomputer.com
European Parliament Member Investigating Spyware Was Hacked With Pegasus - thehackernews.com
Unpatched Flaws Disclosed in Filesystem Bundled Into Millions of Embedded Devices - thehackernews.com
New "Bad Epoll" Linux Kernel Flaw Lets Unprivileged Users Gain Root, Hits Android - thehackernews.com
Armored Likho digging a snake pit: inside the covert BusySnake Stealer campaign - securelist.com
Armored Likho Targets Government Agencies, Power Sector with BusySnake Stealer - thehackernews.com
North Korea-Linked npm Packages Mimic Rollup Polyfills to Steal Developer Secrets - thehackernews.com
INC Ransomware Gang Targets the Legal Sector - blog.knowbe4.com
New Avalon Malware Framework Packs CrownX Ransomware Capabilities - thehackernews.com
ARToken PhaaS exposes EvilTokens' Microsoft 365 phishing toolkit - bleepingcomputer.com
In Other News: Canadian Hacker Jailed, Open Source Zero-Days, Two Sentenced for ATM Jackpotting - securityweek.com
Alleged Scattered Spider Hacker Extradited to US - securityweek.com
Verified X ad spreads Mac malware, while ConsentFix steals Microsoft accounts - malwarebytes.com
Agentic AI Used to Conduct Ransomware Attack via Langflow - securityweek.com
Chinese LLMs Broaden the Gap Between Attackers & Defenders - darkreading.com

Cybersecurity Brief – 2026-07-02

Thu, 02 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

Medtronic has notified customers of a data breach resulting from unauthorized access to personal data, attributed to the ShinyHunters threat actor group ^[19].
Kubota North America Corporation disclosed that hackers had access to parts of its network systems for over a month earlier this year ^[21].
The US Department of Homeland Security confirmed a breach of the Homeland Security Information Network (HSIN), a sensitive information-sharing platform used by government agencies ^[23].
Over 900 Oracle E-Business Suite instances have been found exposed online and are subject to ongoing attacks exploiting a critical security flaw ^[27].

Newly Discovered Vulnerabilities

Adobe released patches for multiple critical vulnerabilities in ColdFusion and Campaign Classic, including seven flaws rated CVSS 10.0 that could lead to arbitrary code execution ^[13]^[37].
Citrix issued patches for NetScaler appliances, addressing six vulnerabilities including a new HTTP/2 Bomb attack and a high-severity CitrixBleed-style information disclosure bug ^[38].
Apple released security updates for iOS, macOS, and Safari, addressing dozens of vulnerabilities affecting WebKit, the kernel, WebRTC, and other components ^[40].
Google released a Chrome update fixing 382 security bugs, with 15 rated as critical ^[46].
Argo CD has an unpatched vulnerability in its repo-server component that allows unauthenticated attackers to execute code if they can access the component ^[8].
Microsoft SharePoint Server vulnerability CVE-2026-45659 has been added to the CISA Known Exploited Vulnerabilities catalog following reports of active exploitation ^[7].
Progress Kemp LoadMaster is affected by a critical pre-authentication remote code execution flaw that is currently seeing active exploitation attempts ^[15].

Notable Threat Actor Activity

Kaspersky researchers identified a large-scale campaign using compromised ScreenConnect software, distributed via SEO-poisoned sites, to deliver AsyncRAT malware ^[1]^[10].
The FortiBleed credential theft campaign has been linked to the INC and Lynx ransomware groups, indicating that stolen Fortinet credentials are intended to facilitate future network intrusions and ransomware attacks ^[20].
A 19-year-old suspected member of the Scattered Spider hacking group has been extradited from Finland to the US to face hacking and fraud charges ^[9].
The Ousaban banking trojan is targeting users in Spain and Portugal with phishing PDF lures to infect Windows systems ^[12].
A new campaign is delivering the PureLogs information stealer through a multi-stage malware chain leveraging Blogger pages and social engineering ^[11].
Multiple weaponized proof-of-concept (PoC) exploits on GitHub are distributing the ChocoPoC remote access trojan, targeting vulnerability researchers ^[6]^[22].

Trends, Tools, or Tactics of Interest

Attackers are using fingerprinting via user-agent data to adapt phishing payloads to the victim’s device and operating system, increasing compromise rates ^[30].
ClickFix, a social engineering technique, is reported as a dominant method for malware delivery ^[31].
AI-generated browser ransomware has been observed abusing the Chromium API across Windows, Linux, macOS, and Android, combining novel attack paths with real browser capabilities ^[16]^[43].
A fake Perplexity Chrome extension, “Search for perplexity ai,” was found to be spying on user searches and requires manual removal ^[44].
Large language models (LLMs) are being exploited for “phantom squatting,” where hallucinated domains for legitimate brands are registered by attackers for supply chain attacks ^[32].
Two vulnerabilities in the AI code editor Cursor could allow prompt injection to escape the sandbox and execute arbitrary commands on a developer’s machine ^[14].
Phishing attacks have exposed employee data at 86 percent of Fortune 100 companies in the past year, with technology, airline, and automotive sectors most affected ^[4].
Hackers conducted over 81 million password-spraying login attempts against Microsoft 365 accounts in a two-week period ^[25].

Regulatory or Policy Developments Affecting the Security Industry

Microsoft announced it is accelerating its post-quantum cryptography roadmap, targeting a transition by 2029 due to advances in quantum computing ^[18].
The US Federal Trade Commission fined Amazon $2.25 million for withholding transaction records from identity theft victims, impacting fraud investigations ^[29].
Microsoft introduced new Teams admin policies requiring organizer approval for external AI bots in meetings, enhancing control over automated participants ^[36].

Sources

Medtronic notifies customers impacted by ShinyHunters data breach - bleepingcomputer.com
Kubota says hackers had month-long access to network systems - bleepingcomputer.com
DHS confirms hackers breached HSIN info-sharing platform - bleepingcomputer.com
Over 900 Oracle E-Business instances exposed to ongoing attacks - bleepingcomputer.com
Adobe Patches 7 CVSS 10.0 Flaws in ColdFusion and Campaign Classic - thehackernews.com
Adobe Patches Critical ColdFusion, Campaign Classic Vulnerabilities - securityweek.com
Citrix Patches NetScaler Vulnerabilities, Including New ‘HTTP/2 Bomb’ Attack - securityweek.com
Apple Patches Dozens of Vulnerabilities Across iOS, macOS, and Safari - securityweek.com
Chrome needs another whopper update to fix 382 security bugs - malwarebytes.com
Unpatched Argo CD Repo-Server Flaw Could Let Attackers Take Over Kubernetes Clusters - thehackernews.com
SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation - thehackernews.com
Progress Kemp LoadMaster Pre-Auth RCE Flaw Faces Active Exploitation Attempts - thehackernews.com
The SOC Files: ScreenConnect masked as freeware. An inside look at a large-scale campaign - securelist.com
SEO-Poisoned Software Sites Abuse ScreenConnect to Deploy AsyncRAT - thehackernews.com
FortiBleed credential-theft campaign linked to Lynx ransomware - bleepingcomputer.com
19-Year-Old Scattered Spider Suspect Extradited to Face U.S. Hacking Charges - thehackernews.com
Ousaban Banking Trojan Targets Iberian Bank Users with Fake PDF Lures - thehackernews.com
VEIL#DROP Malware Chain Uses Blogger Platform to Deliver PureLogs Stealer - thehackernews.com
New ChocoPoC RAT Targets Vulnerability Researchers via Fake PoC Exploit Repos - thehackernews.com
New ChocoPoC malware targets researchers via trojanized PoC exploits - bleepingcomputer.com
Crafty Phishing Campaigns Auto-Adapt to Victim's Device, OS - darkreading.com
And the Winner in Dominant Malware Delivery? ClickFix - darkreading.com
AI-Generated Browser Ransomware Abuses Chromium API on Windows, Linux, macOS, Android - thehackernews.com
Browser-Only Ransomware: From LLM Hallucinations to a Practical Attack Technique - research.checkpoint.com
Fake Perplexity Chrome extension spies on your searches - malwarebytes.com
'Phantom Squatting': An Emerging AI-Driven Supply Chain Threat - darkreading.com
Critical Cursor Flaws Could Let Prompt Injection Escape Sandbox and Run Commands - thehackernews.com
Phishing Exposes Employee Data at 86% of Fortune 100 Companies - blog.knowbe4.com
Hackers target Microsoft 365 accounts with 81 million login attempts - bleepingcomputer.com
Microsoft Accelerates Post-Quantum Cryptography Shift to 2029 - thehackernews.com
Amazon fined $2.25M for withholding evidence from fraud victims - bleepingcomputer.com
Microsoft Adds New Teams Controls to Block Unauthorized AI Bots From Meetings - securityweek.com

Cybersecurity Brief – 2026-05-05

Tue, 05 May 2026 00:00:00 +0000

Major Incidents or Breaches

Trellix disclosed a data breach following unauthorised access to a portion of its source code repository. The investigation found no impact on source code release or distribution processes.
DigiCert revoked certificates after hackers exploited a customer chat channel to deliver malware, infect an analyst’s system, and access the internal support portal.
Over 40,000 servers have been compromised in ongoing exploitation of a critical cPanel vulnerability (CVE-2026-41940), with attacks targeting government, military, managed service providers (MSPs), and hosting providers in Southeast Asia.
Medtronic, a global medical device manufacturer, disclosed a security incident, as referenced in Check Point’s latest threat intelligence bulletin.

Newly Discovered Vulnerabilities

A critical remote code execution vulnerability (CVE-2026-22679) in Weaver (Fanwei) E-cology office automation software has been under active exploitation since March 2026.
Progress Software patched two security flaws in MOVEit Automation, including a critical authentication bypass vulnerability. Customers have been urged to apply updates immediately.
The “Copy Fail” Linux vulnerability is now being actively exploited in the wild. CISA has added it to its Known Exploited Vulnerabilities (KEV) list, and Microsoft has observed limited exploitation linked to proof-of-concept testing.

Notable Threat Actor Activity

The China-based group Silver Fox has been linked to a campaign targeting organisations in India and Russia using tax-themed phishing emails to deliver the new ABCDoor malware, as well as ValleyRAT and Sainbox malware.
A previously unknown threat actor has been exploiting the cPanel authentication-bypass vulnerability to target government, military, MSP, and hosting provider networks, with evidence of zero-day activity prior to public disclosure.

Trends, Tools, or Tactics of Interest

Attackers are increasingly abusing Amazon Simple Email Service (SES) and Google AppSheet to send phishing emails that bypass standard security filters, making detection more challenging.
Multiple large-scale phishing campaigns are leveraging legitimate remote monitoring and management (RMM) tools such as SimpleHelp and ScreenConnect to establish persistent remote access, impacting over 80 organisations since April 2025.
Microsoft detailed a phishing campaign targeting 35,000 users across 26 countries using code of conduct-themed lures and legitimate email services for credential theft.
A malicious version of the PyTorch Lightning package was published on PyPI, delivering a credential-stealing payload targeting browsers, environment files, and cloud services.
Deepfake-driven fraud has resulted in $2.19 billion in global losses, with the majority attributed to investment scams.
Fraudsters are exploiting legitimate business processes at credit unions using structured loan fraud and stolen identities, rather than direct hacking.
The 2026 World Cup is being leveraged in a multi-faceted scam economy involving fake visas, fraudulent tokens, and other schemes.
AI-assisted attacks are on the rise, with increased use of artificial intelligence to enhance phishing and other malicious activities.
Thousands of Facebook accounts have been compromised through phishing emails sent via Google services, evading standard email security controls.

Regulatory or Policy Developments Affecting the Security Industry

CISA added the “Copy Fail” Linux vulnerability to its Known Exploited Vulnerabilities (KEV) list, mandating federal agencies to mitigate the issue.
OpenAI introduced Advanced Account Security for ChatGPT accounts, including stronger login methods, improved account recovery, and training data exclusion.
Cisco announced the acquisition of Astrix Security to strengthen its capabilities around non-human identity risks, particularly for AI and machine access.

Cybersecurity Brief – 2026-04-28

Tue, 28 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

Checkmarx has confirmed that data from its GitHub repositories was leaked on the dark web following a supply chain attack on March 23. The TeamPCP supply chain campaign has been linked to this and other concurrent compromises, including Bitwarden CLI and xinference PyPI.
Home security provider ADT suffered a breach affecting 5.5 million individuals, with the ShinyHunters extortion group claiming responsibility for stealing personal information.
Medtronic, a major medical device manufacturer, confirmed a breach after hackers claimed to have accessed up to 9 million records. The ShinyHunters group is also linked to this incident.
Itron, an energy and water management firm, reported unauthorized access to its systems detected on April 13.
Vercel disclosed a security incident, as noted in Checkpoint’s latest threat intelligence bulletin.
The elementary-data package on PyPI (with 1.1 million monthly downloads) was compromised to distribute information-stealing malware targeting developer data and cryptocurrency wallets.

Newly Discovered Vulnerabilities

Microsoft patched a privilege escalation flaw in Entra ID’s AI agent administrative role, which could enable service principal takeover.
Microsoft confirmed active exploitation of Windows Shell vulnerability CVE-2026-32202, which has been patched.
An unpatched Windows ‘PhantomRPC’ flaw was disclosed, with five exploit paths allowing privilege escalation via RPC architectural weaknesses.
An incomplete Windows patch left systems vulnerable to zero-click attacks, previously exploited by Russia-linked APT28 against Ukraine and EU targets.
A 15-year-old OpenSSH flaw was disclosed, allowing full root shell access due to certificate principal parsing issues.
A race condition vulnerability in Linux PackageKit, dubbed ‘Pack2TheRoot’, enables unprivileged users to escalate privileges during package installation.
Firefox vulnerability CVE-2026-6770, now patched in Firefox 150 and Tor 15.0.10, allowed fingerprinting of Tor users.

Notable Threat Actor Activity

PhantomCore, a pro-Ukrainian hacktivist group, has been actively targeting Russian TrueConf video conferencing servers since September 2025.
UNC6692, a newly identified threat actor, is conducting campaigns using Microsoft Teams, AWS S3 buckets, and custom “Snow” malware variants (Snowbelt, Snowglaze, Snowbasin). Their tactics include social engineering, email bombing, and cloud resource abuse.
ShinyHunters has claimed responsibility for the recent breaches of ADT and Medtronic, threatening to leak stolen data.
Silk Typhoon: A Chinese national alleged to be part of this group was extradited to the US for cyberespionage activities targeting US interests.

Trends, Tools, or Tactics of Interest

Researchers discovered 73 malicious Visual Studio Code extensions on the Open VSX repository delivering GlassWorm v2 malware, with the campaign leveraging “sleeper” extensions that activate malicious payloads post-update.
Malicious prompt injection attacks against AI systems are increasing, though most remain low in sophistication according to Google.
Deepfake voice attacks are becoming more prevalent, with reports showing that as little as three seconds of audio can enable successful cloning for fraud schemes.
The “fast16” malware framework, dating back 20 years and predating Stuxnet, has been uncovered and is believed to have been used in early cyber sabotage operations.
The Robinhood account creation process was exploited to send phishing messages via legitimate notification emails.
Supply chain attacks remain a key threat, with concurrent compromises (Checkmarx, Bitwarden CLI, xinference PyPI, npm worm “CanisterSprawl”) reported as part of ongoing campaigns.
Americans lost over $2.1 billion to social media scams in 2025, according to the FTC.
Canadian authorities arrested three individuals in Toronto for operating an “SMS blaster” device to send mass phishing texts.

Regulatory or Policy Developments

The US government has launched a sweeping crackdown on Southeast Asian cyberscam operations and imposed sanctions on a Cambodian senator for involvement.