Next.js on DanSec Daily

Cybersecurity Brief – 2026-09-23

Wed, 23 Sep 2026 00:00:00 +0000

Major Incidents or Breaches

The ShinyHunters cyber extortion group claims to have breached the US Federal Bureau of Investigation, stealing data on current and former employees and job applicants. The group states it exploited a zero-day vulnerability in Oracle PeopleSoft to access internal services and exfiltrate sensitive data. ShinyHunters is demanding the FBI retract a report describing its tactics and threatens to leak the stolen information if demands are not met ^[10]^[24]^[50]^[52].
Threat actors stole 170 private repositories from cybersecurity firm CrowdSec by leveraging an OAuth token obtained through the TanStack npm supply chain attack on a former employee’s computer ^[35].
Sweden’s data privacy regulator fined IT provider Miljödata $183,000 for insufficient security measures that led to a breach in August 2025, affecting 2.2 million individuals ^[22].

Newly Discovered Vulnerabilities

F5 disclosed and patched a critical zero-day vulnerability (CVE-2026-94127) in BIG-IP Access Policy Manager (APM) that allows unauthenticated attackers to execute remote code on affected systems. The flaw was actively exploited in attacks targeting OAuth servers ^[7]^[20]^[49].
Check Point released emergency fixes for a zero-day vulnerability (CVE-2026-93616) in its Security Management Server, which allowed attackers in targeted attacks to upload and execute arbitrary scripts ^[11]^[27]^[51].
Arista Networks patched a zero-day vulnerability in VeloCloud Orchestrator (VCO) On-Prem deployments, which was being actively exploited to allow remote attackers access to privileged internal functionality ^[17]^[48].
A new cPanel flaw in the CalDAV and CardDAV services enables any hosting account holder to execute code as root, granting full server control ^[3].
A critical vulnerability in Bifrost, an open-source AI gateway, allows unauthenticated attackers to execute arbitrary commands on the server without credentials ^[15].
A use-after-free vulnerability in the Linux kernel’s AF_UNIX socket subsystem enables container escape and host root access. An exploit has been released and the flaw remains unpatched in Ubuntu ^[6].
WordPress patched a critical flaw in its core software that allowed unauthenticated attackers to load arbitrary PHP files from outside theme folders, potentially leading to remote code execution on some servers ^[12].
Next.js disclosed a critical ImageResponse vulnerability that can lead to server code execution via crafted SVG input ^[9].
Adobe released patches for nine critical vulnerabilities in Connect and AEM Forms that could be exploited for arbitrary code execution and privilege escalation ^[43].
Google Chrome 154 patched 108 vulnerabilities, including several rated critical for memory safety and memory corruption ^[45].

Notable Threat Actor Activity

A Chinese state-linked threat actor (UTA0565) exploited a zero-day exploit chain in Google Chrome and Microsoft Windows via fake websites to deploy CLEANGULP malware, targeting victims with advanced techniques ^[8].
Chinese-speaking threat actors have been exploiting vulnerabilities in Zyxel GS1900 Smart Managed Switches and WordPress to steal sensitive government data from nearly 1,000 devices and over 18,500 records ^[23].
The EvilTokens phishing-as-a-service platform, which compromised more than 12,000 Microsoft accounts at over 10,000 organizations using AI-driven attack chains, was disrupted in a coordinated takedown by Microsoft, which seized 50 websites and disabled over 150 domains ^[14]^[28]^[33]^[44].
A malicious npm package (“tw-pkgprobe-7731”) posed as a Twilio bug-bounty probe to target developers, enabling credential exfiltration ^[13].
A new Windows malware, ClosedQuorum, uses multiple AI models (Google Gemini, DeepSeek, Qwen, Mistral) to autonomously determine post-compromise actions ^[25].
The Ryuk ransomware group member was sentenced to 24 months in prison for attacks on US companies ^[19].
Threat actors exploited a stolen OAuth token from a former employee to access CrowdSec’s private GitHub repositories ^[35].

Trends, Tools, or Tactics of Interest

An AI-assisted phishing campaign sent over one million personalized emails attempting payment diversion scams, demonstrating the growing use of AI in large-scale phishing operations ^[1].
AI is increasingly being leveraged in both attack (e.g., phishing, malware decision-making) and defense (e.g., autonomous security agents), with new tools emerging to benchmark and control AI agent performance ^[4]^[5]^[25]^[36]^[44]^[47].
Attackers with privileged access can register rogue external MFA providers to steal user passwords during legitimate login attempts ^[21].
More than 80,000 AI relay servers are being used to mask Chinese access to frontier AI models in the US, likely to facilitate model cloning ^[31].
A proof-of-concept zero-day tool, BigDiskBuster, was released that can block Microsoft Defender updates by filling available disk space ^[16].
The Cybersecurity and Infrastructure Security Agency (CISA) published guidance on deception techniques to help organizations set traps for cybercriminals ^[34].
Shadow IT remains a challenge, with tools like Wazuh recommended to improve visibility of unmanaged endpoints and unauthorized assets ^[26].
Honeywell research indicates that while 88% of OT security leaders consider their programs mature, only 21% have a complete OT asset inventory, and full autonomy in OT security remains rare ^[42].

Regulatory or Policy Developments Affecting the Security Industry

Sweden’s IMY imposed a significant fine on Miljödata for inadequate data protection, reinforcing regulatory expectations for IT service providers handling large volumes of personal data ^[22].

Sources

ShinyHunters Claims FBI Breach, Says It Stole Data on Agents and Job Applicants - thehackernews.com
ShinyHunters claims FBI hack, data theft in PeopleSoft zero-day breach - bleepingcomputer.com
ShinyHunters Claims FBI Hack, Demands Retraction of Threat Report - securityweek.com
ShinyHunters claims FBI breach was revenge for “false” report - malwarebytes.com
Shai-Hulud Attack Nips Cyber-Firm CrowdSec's GitHub Data - darkreading.com
Sweden fines Miljödata $183,000 over breach affecting 2.2 million - bleepingcomputer.com
F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers - thehackernews.com
F5 patches BIG-IP APM zero-day flaw exploited in RCE attacks - bleepingcomputer.com
Critical F5 BIG-IP Vulnerability Exploited as Zero-Day - securityweek.com
Check Point Warns of Management Server Zero-Day Exploited in Targeted Attacks - thehackernews.com
Check Point warns of Management Server zero-day exploited in attacks - bleepingcomputer.com
Check Point Patches Exploited Management Server Zero-Day - securityweek.com
Arista patches actively exploited VeloCloud Orchestrator zero-day - bleepingcomputer.com
Arista Urges Immediate Patching of Exploited VCO Zero-Day - securityweek.com
New cPanel Flaw Lets a Hosting Account Run Code as Root, Take Full Server Control - thehackernews.com
Critical Bifrost AI Gateway Flaw Lets Attackers Run Commands Without Credentials - thehackernews.com
Exploit Released for Unpatched Ubuntu Linux Flaw Enabling Host-Root Container Escape - thehackernews.com
WordPress Issues Patch for Critical Flaw That Can Enable Code Execution on Some Servers - thehackernews.com
Critical Next.js ImageResponse Flaw Can Lead to Server Code Execution via Crafted SVG Input - thehackernews.com
Adobe Patches Critical Flaws in Connect, AEM Forms - securityweek.com
Chrome 154 Patches 108 Vulnerabilities - securityweek.com
Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware - thehackernews.com
Chinese hackers exploit WordPress, Zyxel flaws to steal govt data - bleepingcomputer.com
Microsoft Takes Down EvilTokens Device-Code Phishing Service Tied to 12,000 Inbox Compromises - thehackernews.com
EvilTokens PhaaS disrupted after compromising 12,000 Microsoft accounts - bleepingcomputer.com
Microsoft Disrupts EvilTokens Device Code Phishing Service - darkreading.com
AI-Powered Phishing Platform EvilTokens Disrupted by Microsoft - securityweek.com
Malicious npm Package Poses as Twilio Bug-Bounty Probe, Can Exfiltrate Credentials - thehackernews.com
New ClosedQuorum Windows malware uses AI for attack decisions - bleepingcomputer.com
Ryuk ransomware member sentenced to 24 months in prison - bleepingcomputer.com
AI-Assisted Phishing Campaign Sent Over A Million Personalized Emails - blog.knowbe4.com
545 Hackers Tested It First. Now XRanges for AI Scores Your Security Agent - thehackernews.com
Anthropic and OpenAI Models Still Attempt Restricted Actions in Safety Tests - thehackernews.com
Amid Ongoing Rogue Incidents, Debate Over AI Safety Gets Real - darkreading.com
Outerlimit Raises $16 Million to Stop Rogue AI Agents From Causing Harm - securityweek.com
Rogue external MFA providers can steal passwords during logins - bleepingcomputer.com
Relays Are Masking Chinese Access to Frontier AI Models in the US - darkreading.com
Researcher Drops BigDiskBuster Zero-Day PoC That Blocks Microsoft Defender Updates - thehackernews.com
Deception by Design: CISA's Guide to Tricking Cybercriminals - darkreading.com
Reducing shadow IT visibility gaps with Wazuh - bleepingcomputer.com
Honeywell: OT Security Teams Embrace AI, but Autonomy Still Rare - securityweek.com

Cybersecurity Brief – 2026-04-07

Tue, 07 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

Wynn Resorts disclosed that 21,000 employees were affected by the ShinyHunters hack. The company reportedly paid a ransom to prevent data leakage.
Drift Protocol attributed its recent $280M cryptocurrency theft to a six-month, in-person operation where attackers established an operational presence inside the organisation.
Axios, a popular NPM package, was compromised in a supply chain attack involving sophisticated social engineering targeting maintainers. North Korean threat actors are linked to this and similar campaigns against Node.js maintainers.
Guardarian users were targeted via 36 malicious NPM packages impersonating Strapi plugins, enabling shell execution, container escape, and credential harvesting.
The European Commission experienced a significant cyber incident, as noted in Check Point’s threat intelligence report.

Newly Discovered Vulnerabilities

Flowise AI Agent Builder is under active exploitation for a CVSS 10.0 remote code execution vulnerability. Over 12,000 instances are exposed.
Fortinet issued an emergency patch for a zero-day authentication bypass flaw (CVE-2026-35616) in FortiClient EMS, which allows unauthenticated remote code execution. CISA has mandated federal agencies patch this vulnerability.
A new GPUBreach attack technique enables privilege escalation and system takeover through Rowhammer-induced bit-flips on GPU GDDR6 memory.
Exploit code for an unpatched Windows privilege escalation zero-day (“BlueHammer”) was leaked, allowing local attackers to gain SYSTEM or administrator privileges.
Automated credential harvesting campaigns are exploiting the React2Shell flaw in vulnerable Next.js applications.
Google DeepMind researchers identified “AI Agent Traps,” a vulnerability that allows attackers to manipulate and exploit AI agents via malicious web content.

Notable Threat Actor Activity

China-linked Storm-1175 has been observed exploiting zero-day and n-day vulnerabilities to rapidly deploy Medusa ransomware in high-velocity attacks.
Qilin and Warlock ransomware groups are using the bring-your-own-vulnerable-driver (BYOVD) tactic to disable over 300 endpoint detection and response (EDR) tools during ransomware deployment.
An Iran-linked threat actor is conducting password-spraying attacks against over 300 Israeli and UAE Microsoft 365 organisations.
DPRK-linked actors are using GitHub as command-and-control infrastructure in multi-stage attacks targeting South Korean entities.
North Korean threat actors are targeting Node.js maintainers with social engineering as part of supply chain attacks.
A threat cluster tracked as UAT-10608 is automating credential harvesting by exploiting web-exposed Next.js applications.

Trends, Tools, or Tactics of Interest

There is increased use of AI-assisted tools by threat actors in supply chain attacks, as seen in the PRT-scan campaign targeting GitHub misconfigurations.
Social engineering targeting open-source maintainers is becoming industrialised, with attackers leveraging complex, scalable tactics.
The BYOVD technique remains prevalent among ransomware operators for bypassing security controls.
Open redirects continue to be widely abused in phishing campaigns.
Infostealers are harvesting credentials and session cookies at scale, outpacing traditional breach monitoring capabilities.
Developer workstations are being increasingly targeted as entry points for credential theft and lateral movement.
Shadow AI use in healthcare persists, with medical professionals adopting unsanctioned AI tools.

Regulatory or Policy Developments Affecting the Security Industry

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch the actively exploited Fortinet EMS vulnerability by Friday.
The OWASP GenAI Security Project has updated its risk matrix, now recognising 21 generative AI risks and recommending tailored security approaches for GenAI and agentic AI systems.
German authorities have formally identified two Russian nationals as the leaders of the GandCrab and REvil ransomware operations between 2019 and 2021.
Microsoft has deprecated and removed the Support and Recovery Assistant (SaRA) tool from all supported Windows versions as of March 10.

Cybersecurity Brief – 2026-04-06

Mon, 06 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

Drift disclosed that the $285 million theft on April 1, 2026, resulted from a six-month social engineering campaign attributed to North Korean (DPRK) threat actors, involving targeted infiltration and operational planning.
Multiple Syrian government accounts were hijacked in March, exposing significant deficiencies in the state’s cybersecurity posture and basic operational security.

Newly Discovered Vulnerabilities

Fortinet released an emergency patch for a new critical vulnerability (CVE-2026-35616) in FortiClient Enterprise Management Server (EMS), which is being actively exploited in the wild.
Attackers are exploiting the React2Shell vulnerability (CVE-2025-55182) in vulnerable Next.js applications as part of a widespread, automated credential theft campaign.

Notable Threat Actor Activity

Germany’s Federal Criminal Police Office (BKA) identified and unmasked the main actors behind the REvil (Sodinokibi) ransomware group, including the individual known as “UNKN,” linked to both REvil and GandCrab ransomware operations. The primary suspect is named as Daniil Maksimov, a 31-year-old Russian national.
North Korean (DPRK) threat actors were responsible for the $285 million Drift hack, using prolonged and sophisticated social engineering tactics.

Trends, Tools, or Tactics of Interest

Phishing scams have shifted tactics by incorporating QR codes into fake “Notice of Default” traffic violation text messages, directing recipients to phishing sites to harvest payment and personal information.
The automated exploitation of React2Shell in Next.js applications highlights an ongoing trend towards large-scale, automated credential theft campaigns targeting web application vulnerabilities.

Regulatory or Policy Developments Affecting the Security Industry

No significant regulatory or policy developments were reported in the provided headlines.

Cybersecurity Brief – 2026-04-03

Fri, 03 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

European Commission Cloud Hack: CERT-EU confirmed a breach attributed to the TeamPCP threat group, exposing data from at least 30 EU entities.
Drift Protocol Exploit: North Korean threat actors seized Security Council administrative powers in the Drift Protocol, resulting in a loss of at least $280 million in a coordinated attack.
Stryker Cyberattack: Stryker Corporation experienced a data-wiping attack, claimed by an Iranian-linked group. The company reports full operational recovery after three weeks.
Hasbro Breach: Hasbro disclosed “unauthorized access” to its systems, leading to business continuity activation and some systems being taken offline.
Nacogdoches Memorial Hospital Data Breach: A breach affecting 250,000 individuals occurred in January 2026, involving theft of personal and health information.
WhatsApp Spyware Incident: WhatsApp alerted approximately 200 users after a fake iOS app infected devices with spyware, with an Italian firm reportedly facing action.
Mercor Supply Chain Attack: AI recruiting firm Mercor is investigating a supply chain attack via LiteLLM, with Lapsus$ claiming theft of 4TB of data.
Claude Code Leak Abuse: Following the Claude Code source code leak, threat actors used fake GitHub repositories to distribute Vidar infostealer malware.
Adversaries Exploiting Vacant Homes: Threat actors are using vacant homes as mail drop addresses to intercept mail and facilitate fraud.

Newly Discovered Vulnerabilities

Cisco IMC and SSM Flaws: Cisco patched critical vulnerabilities in the Integrated Management Controller (IMC) and SSM, including an authentication bypass (CVSS 9.8) that allowed unauthenticated remote admin access.
Progress ShareFile Pre-Auth RCE Chain: Two vulnerabilities in Progress ShareFile can be chained for unauthenticated file exfiltration and remote code execution.
F5 BIG-IP APM RCE Exposure: Over 14,000 F5 BIG-IP APM instances remain exposed to a critical RCE vulnerability, with active exploitation ongoing.
Claude Code Critical Vulnerability: A critical vulnerability was identified in Claude Code days after its source code leak.
Apple DarkSword Exploit Kit: Apple expanded patches for vulnerabilities exploited by the DarkSword kit to iOS and iPadOS 18.7.7.
Vite (CVE-2025-30208) Exploitation: Active attempts to exploit the Vite frontend tooling vulnerability have been observed.
Next.js (CVE-2025-55182) Exploitation: Threat actors exploited the React2Shell vulnerability to breach 766 Next.js hosts, stealing credentials, SSH keys, and AWS secrets.

Notable Threat Actor Activity

TeamPCP: Attributed to the European Commission cloud breach affecting multiple EU entities.
North Korean Actors: Responsible for the $280 million theft from Drift Protocol via Security Council power compromise.
Lapsus$: Claimed responsibility for the Mercor LiteLLM supply chain attack.
Iranian-linked Group: Claimed the data-wiping attack on Stryker Corporation.
REF1695: Financially motivated group leveraging fake installers to distribute RATs and crypto miners since November 2023.
Vidar Infostealer Campaign: Threat actors are leveraging the Claude Code leak to distribute infostealer malware via GitHub.
Casbaneiro Banking Trojan: Ongoing campaigns targeting Latin American financial institutions, using advanced evasion and replication techniques.

Trends, Tools, or Tactics of Interest

Residential Proxy Evasion: 78% of 4 billion sessions using residential proxies successfully evaded IP reputation checks, complicating detection of malicious traffic.
Hybrid Cybercrime via Postal Fraud: Use of vacant homes as drop addresses is enabling hybrid cybercrime through mail interception.
CloudTrail Evasion Techniques: Noted as an emerging tactic for threat actors to avoid detection in cloud environments.
Mining Operations Using ISO Lures: Ongoing campaigns use ISO file lures to deliver RATs and cryptocurrency miners.
CrystalX RAT: Newly observed sophisticated RAT capable of spying, stealing data, and altering device configurations.
AI in Security Operations: CISOs and industry leaders at RSAC 2026 and in interviews report increased adoption and planned expansion of AI-driven security tools, with debates over automation versus human oversight.
Pre-Auth Exploitation Chains: Multiple vulnerabilities are being chained pre-authentication for remote code execution and data exfiltration.
Supply Chain Attacks via Open Source: The State of Trusted Open Source report and recent incidents highlight risks in open source software supply chains.

Regulatory or Policy Developments

WhatsApp/Italian Regulatory Action: Italian authorities are reportedly taking action following the spyware incident involving a fake WhatsApp iOS app.
Cybersecurity M&A Activity: 38 significant cybersecurity mergers and acquisitions were announced in March 2026, involving major firms such as Airbus, Cellebrite, Databricks, Quantum eMotion, Rapid7, and OpenAI.
Malwarebytes VPN Audit: Malwarebytes completed a third-party audit of its VPN infrastructure, with results published for transparency.

Cybersecurity Brief – 2026-02-27

Fri, 27 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

ManoMano, a major European DIY retail chain, has suffered a data breach impacting 38 million customers. The breach was caused by the compromise of a third-party service provider.
French football club Olympique de Marseille confirmed an attempted cyberattack following a data leak, with a threat actor claiming responsibility for breaching the club’s systems.
Conduent, a US-based business process services company, has revised the impact of its third-party breach to 25 million affected Americans.
A new malicious NuGet package, “StripeApi,” was discovered impersonating a legitimate Stripe library to steal API tokens, targeting the financial sector.
Google API keys previously considered harmless can now be abused to access private Gemini AI data if exposed in client-side code.
Anthropic patched vulnerabilities in its Claude AI code interpreter that could have allowed silent compromise of developer devices through malicious configuration files.

Newly Discovered Vulnerabilities

Trend Micro patched two critical remote code execution vulnerabilities in Apex One endpoint security products for Windows, and addressed a total of eight critical and high-severity issues across Windows and macOS versions.
A critical vulnerability in Juniper Networks’ PTX Series routers running Junos OS Evolved allows unauthenticated remote code execution with root privileges, enabling full router takeover.
Cisco disclosed and patched a maximum-severity zero-day vulnerability (CVE-2026-20127) in its SD-WAN software, which had been exploited for three years by a sophisticated threat actor, allowing authentication bypass and administrative access.
Zyxel patched a critical remote code execution vulnerability in the UPnP function affecting multiple device models.
Four vulnerabilities were disclosed in Gardyn smart garden products, allowing remote hacking; CISA has issued an advisory on these flaws.

Notable Threat Actor Activity

Google’s Threat Intelligence Group reported that nation-state actors are using Gemini and other AI tools to enhance phishing, malware development, and social engineering campaigns.
A previously undocumented threat cluster, UAT-10027, has been targeting US education and healthcare sectors since December 2025, deploying the Dohdoor backdoor.
The Aeternum C2 botnet loader was revealed to use encrypted command storage on the Polygon blockchain, making its command-and-control infrastructure highly resistant to takedown.
Microsoft observed a coordinated campaign targeting developers via malicious Next.js repositories purporting to be legitimate, delivering in-memory malware and establishing persistence.
Fake Zoom and Google Meet scams are distributing the legitimate Teramind monitoring tool as malware by exploiting trusted branding.
CISA released an updated analysis of the RESURGE malware, highlighting continued stealthy and active operations.
The US Treasury sanctioned Russian exploit broker Operation Zero, which acquired eight zero-day exploits from a US defense contractor.

Trends, Tools, or Tactics of Interest

Ransomware payment rates have dropped to a record low of 28% despite an increase in the number of attacks, indicating a shift in victim response and negotiation strategies.
Threat actors are increasingly leveraging AI-based tools, such as Gemini and Claude, to automate and refine attack techniques.
Blockchain technology is being adopted for resilient command-and-control infrastructure, as demonstrated by the Aeternum C2 botnet.
There is a rise in attacks targeting developers, including via malicious open-source packages and fake technical assessment repositories.
Open source project IronCurtain has been released, aiming to constrain and secure AI assistant agents to prevent unintended actions.

Regulatory or Policy Developments Affecting the Security Industry

Apple iPhone and iPad devices have been cleared for handling classified information by NATO, having been added to the NATO Information Assurance Product Catalogue (NIAPC).
The US government has imposed sanctions on Russian exploit broker Operation Zero for trafficking zero-day exploits.
A lawsuit (Marquis v. SonicWall) is raising questions about liability in third-party breaches, with a FinTech company holding a firewall provider responsible for breach damages.
New York Attorney General filed a lawsuit against Valve Corporation, alleging illegal gambling promotion through game loot boxes targeting minors.
Industry experts are recommending immediate preparation for post-quantum cryptography (PQC) to counter future risks of encrypted data theft and decryption.

Cybersecurity Brief – 2026-02-26

Thu, 26 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Google, Mandiant, and partners disrupted a global espionage campaign by suspected China-nexus threat actor UNC2814, which breached at least 53 organizations across 42 countries, including telecom firms and government agencies. The campaign leveraged SaaS API calls to conceal malicious traffic.
UFP Technologies, a US-based medical device manufacturer, disclosed a cyberattack involving data theft and file-encrypting ransomware.
CarGurus suffered a data breach impacting over 12 million users, with hackers claiming theft of personally identifiable information and internal corporate data.
Wynn Resorts confirmed a data breach in which the ShinyHunters group exfiltrated employee data.
Marquis Software Solutions filed a lawsuit against SonicWall, alleging gross negligence and misrepresentation after a backup breach led to a ransomware attack.

Newly Discovered Vulnerabilities

Cisco disclosed CVE-2026-20127, a critical authentication bypass vulnerability in Catalyst SD-WAN Controller and Manager, actively exploited in the wild since 2023. The flaw allows remote attackers to gain administrative access.
Anthropic’s Claude Code AI-powered coding assistant was found to have multiple vulnerabilities (including CVE-2025-59536 and CVE-2026-21852) enabling remote code execution and API key exfiltration via project files.
Four malicious NuGet packages targeting ASP.NET developers were discovered, designed to steal sensitive data through supply chain compromise.
Zyxel released patches for a critical remote code execution vulnerability affecting over a dozen router models, which could allow unauthenticated attackers to execute commands remotely.
SolarWinds patched four critical vulnerabilities in its Serv-U product; exploitation would require administrative privileges.

Notable Threat Actor Activity

Scattered LAPSUS$ Hunters (SLH) cybercrime group was observed offering $500–$1,000 per call to recruit women for IT help desk vishing attacks, focusing on social engineering.
North Korean threat actors were linked to a campaign using malicious Next.js repositories and fake job interviews to backdoor developers’ devices and establish persistent access.
A former L3Harris (US defense contractor) employee was sentenced to over seven years in prison for selling eight zero-day exploits to a Russian broker. The US Treasury also sanctioned the Russian broker involved in purchasing stolen exploits.
RAMP ransomware forum was seized, causing disruption and fragmentation within the ransomware ecosystem.
Chinese police were implicated in using ChatGPT for politically motivated influence operations targeting foreign officials.

Trends, Tools, or Tactics of Interest

Google’s latest GTIG AI Threat Tracker report highlights increasing adversarial use of AI, including distillation, experimentation, and integration of AI for malicious purposes.
Attackers are increasingly using telephone-oriented attack delivery (TOAD) emails, which contain only a phone number as payload, to bypass email security gateways.
The OpenClaw supply chain threat has generated significant discussion on dark web and Telegram channels, though current telemetry suggests more hype than widespread exploitation.
The PCI Security Standards Council reported that threats to payment systems are accelerating, requiring faster adaptation by the industry.
IBM X-Force reported that 56% of tracked vulnerabilities in 2025 required no authentication for exploitation, raising concerns about the weaponisation of agentic AI and the impact of stolen credentials.
A “Richter Scale” model has been introduced to rate the severity and effects of cybersecurity incidents in operational technology (OT) environments.
Drug cartels, such as Mexico’s CJNG, are adopting AI, drones, and social media for criminal operations.
Manual processes for sensitive data transfers remain prevalent in national security organizations, increasing risk exposure.

Regulatory or Policy Developments Affecting the Security Industry

CISA issued an emergency directive requiring immediate action to secure Cisco SD-WAN systems affected by CVE-2026-20127.
Reddit was fined nearly $20 million by the UK data privacy watchdog for failures related to the protection of children’s personal information.

Cybersecurity Brief – 2026-01-06

Tue, 06 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Brightspeed, a major US broadband provider, is investigating claims of a security breach and data theft made by the Crimson Collective extortion gang. The group alleges theft of personal information of over 1 million customers.
Sedgwick confirmed a cyberattack on a file transfer system at its government subsidiary, affecting agencies it serves.
Ledger notified customers of a data breach at third-party payment processor Global-e, resulting in exposure of personal data.
Multiple corporate data theft incidents have been linked to threat actor Zestix, who breached ShareFile, Nextcloud, and OwnCloud instances and is offering stolen data from dozens of companies.
Artisans’ Bank and VeraBank, two US banks, disclosed security incidents.
NordVPN denied breach claims, stating that attackers only accessed dummy data from a third-party automated testing platform.
No evidence of cyberattack was found in the communications failure that grounded flights in Greece.

Newly Discovered Vulnerabilities

n8n, an open-source workflow automation platform, disclosed a critical vulnerability (CVSS 9.9) allowing authenticated users to execute arbitrary system commands.
The “@adonisjs/bodyparser” npm package is affected by a critical vulnerability (CVSS 9.2) enabling arbitrary file writes on servers.
A critical ‘MongoBleed’ vulnerability in MongoDB allows unauthenticated attackers to extract passwords and tokens via a memory leak. The flaw is under active attack.
VSCode IDE forks, including Cursor, Windsurf, Google Antigravity, and Trae, expose users to attacks via non-existent “recommended extensions” that can be abused for malicious purposes.
Risks associated with newer IP-based KVM devices have been highlighted, as out-of-band access could introduce security concerns.
WhatsApp metadata leak through device fingerprinting was reported, with Meta rolling out fixes.

Notable Threat Actor Activity

Russia-aligned group UAC-0184 targeted Ukrainian military and government entities by delivering malicious ZIP archives via the Viber messaging platform.
The Kimwolf Android botnet has infected over 2 million devices, leveraging exposed ADB interfaces and residential proxy networks for DDoS attacks, app installs, and proxy bandwidth resale.
Zestix is offering for sale corporate data stolen from cloud file-sharing platforms.
The Crimson Collective extortion gang claimed responsibility for the Brightspeed breach.
US cyber professionals pleaded guilty to working as affiliates of the ALPHV/BlackCat ransomware group.
The RondoDox botnet has expanded operations by exploiting React2Shell vulnerabilities, targeting Next.js servers for cryptomining and botnet payload delivery.
New VVS Stealer malware, written in Python, is targeting Discord accounts to harvest credentials and tokens.

Trends, Tools, or Tactics of Interest

The ClickFix social engineering campaign is targeting the European hospitality sector, using fake Windows Blue Screen of Death (BSOD) screens to trick users into executing malware.
Threat actors are increasingly abusing cloud file-sharing platforms for corporate data theft.
The Kimwolf botnet demonstrates the growing use of residential proxy networks for botnet expansion and monetization.
AI-powered IDEs recommending non-existent extensions present a new supply chain risk vector.
Agentic AI adoption is raising identity management challenges, with AI agents acting as a new class of identity that CISOs must manage.
CISA’s Known Exploited Vulnerabilities (KEV) catalog expanded by 20% in 2025, now including 1,484 entries, with 24 new vulnerabilities known to be exploited by ransomware groups.
Automated License Plate Reader (ALPR) surveillance is discussed as a privacy and security concern.
Ineffectiveness of AI guardrails was highlighted following an incident involving Grok generating inappropriate content.

Regulatory or Policy Developments Affecting the Security Industry

The early release of Ilya Lichtenstein, convicted for the Bitfinex cryptocurrency exchange hack, under the US First Step Act, was reported.

Cybersecurity Brief – 2026-01-03

Sat, 03 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Covenant Health confirmed a data breach impacting nearly 478,000 individuals, with attribution to the Qilin ransomware group. Data was stolen from systems in May 2025.
Ongoing cryptocurrency thefts have been traced to the 2022 LastPass breach, with attackers draining wallets years after the theft of encrypted vaults.
Trust Wallet reported that approximately $8.5 million was stolen from over 2,500 crypto wallets, likely linked to the “Shai-Hulud” NPM supply chain attack in November, described as an industry-wide compromise.

Newly Discovered Vulnerabilities

Over 10,000 Fortinet firewalls remain exposed to a five-year-old two-factor authentication (2FA) bypass vulnerability that is actively being exploited.
The Kimwolf botnet is exploiting an undisclosed vulnerability that has been under attack for several months, with Internet-wide security advisories issued.
The RondoDox botnet is exploiting the React2Shell vulnerability to compromise vulnerable Next.js servers, with a campaign noted in December.
Thousands of requests have targeted a dozen vulnerabilities in Adobe ColdFusion servers in a coordinated campaign observed by GreyNoise during the Christmas 2025 holiday.

Notable Threat Actor Activity

Transparent Tribe has launched a new wave of remote access trojan (RAT) attacks targeting Indian government, academic, and strategic entities.
The Qilin ransomware group was responsible for the data theft from Covenant Health.
Two US cybersecurity professionals pleaded guilty to acting as affiliates of the BlackCat/Alphv ransomware group, participating in ransomware attacks.
Cybercriminals are abusing Google Cloud Application Integration to send multi-stage phishing emails that impersonate legitimate Google-generated messages.

Trends, Tools, or Tactics of Interest

AI-driven threats are predicted to rise, with a growing shift in the industry focus from prevention to resilience and an emphasis on advanced security measures.
Attack Surface Management (ASM) tools are generating large volumes of asset inventory data and alerts, raising concerns about actionable ROI.
AI technologies made scams more convincing throughout 2025, with rapid advancements leading to systems that can evade meaningful human oversight.
Protest surveillance tactics are shifting from cooperation to antagonism and political marketing, affecting privacy and civil liberties.

Regulatory or Policy Developments Affecting the Security Industry

CTOs and industry experts are prioritising the formal governance of AI and quantum technologies, as well as enhancements in supply chain and managed cloud provider (MCP) security, for 2026.

Cybersecurity Brief – 2026-01-01

Thu, 01 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Trust Wallet Chrome Extension Hack: Trust Wallet disclosed that a supply chain attack involving the Shai-Hulud worm in November 2025 compromised its Chrome extension, resulting in the theft of $8.5 million from 2,520 wallets. The attacker exploited exposed developer GitHub secrets to publish a backdoored browser extension.
Unleash Protocol Hack: The decentralized intellectual property platform Unleash Protocol suffered a loss of approximately $3.9 million in cryptocurrency after an unauthorized contract upgrade enabled asset withdrawals, attributed to a multisig hijack.
European Space Agency Breach: The European Space Agency confirmed that external science servers were compromised and that a hacker is offering to sell stolen data. An investigation is ongoing.
DarkSpectre Browser Extension Campaigns: The threat actor behind previous ShadyPanda and GhostPoster campaigns has been attributed to a third campaign, DarkSpectre, impacting 2.2 million users. In total, the campaigns have affected 8.8 million users worldwide.
Ivanti EPMM Attacks: April/May zero-day exploitations of Ivanti’s mobile device management platform resulted in the compromise of thousands of organisations by a Chinese APT.

Newly Discovered Vulnerabilities

IBM API Connect: IBM disclosed a critical authentication bypass vulnerability (CVE-2025-13915, CVSS 9.8) in API Connect that could allow remote attackers to access applications. Customers have been urged to patch immediately.
React2Shell Flaw in Next.js: The RondoDox botnet is actively exploiting the critical React2Shell vulnerability (CVE-2025-55182) to breach Next.js servers, deploying malware and cryptominers.

Notable Threat Actor Activity

North Korean Fraudulent Job Applicants: Amazon reported blocking more than 1,800 suspected North Korean job applicants since April 2024, indicating ongoing attempts by North Korean actors to infiltrate Western technology companies.
Shai-Hulud Worm Activity: Researchers have identified a new, modified strain of the Shai-Hulud worm on the npm registry, showing continued evolution and testing of payloads following the Trust Wallet supply chain attack.
RondoDox Botnet: Actively exploiting the React2Shell vulnerability to compromise Next.js servers.

Trends, Tools, or Tactics of Interest

Supply Chain Attacks on Browser Extensions: The Shai-Hulud campaign demonstrates continued targeting of browser extension supply chains, leveraging compromised developer credentials to distribute malicious updates.
Malicious Browser Extensions: Large-scale campaigns such as DarkSpectre, ShadyPanda, and GhostPoster highlight the persistent threat from malicious browser extensions, impacting millions of users globally.
Cryptocurrency Platform Targeting: Both Trust Wallet and Unleash Protocol incidents reflect ongoing targeting of cryptocurrency platforms through supply chain and contract manipulation attacks.
IoT and Cloud Reliance: Reports discuss the risks associated with IoT device dependence on cloud services, with outages causing widespread disruption to connected devices.
AI and Identity Security: Industry predictions for 2026 note increased adoption of agentic AI, expansion of identity governance and administration (IGA) in the mid-market, SOC-identity team collaboration, and identity platform consolidation. Growing skepticism about AI’s ROI and economic sustainability is also noted.

Regulatory or Policy Developments

Disney COPPA Settlement: Disney agreed to pay a $10 million civil penalty to settle claims of violating the Children’s Online Privacy Protection Act (COPPA) by mislabeling videos and allowing targeted advertising data collection on YouTube.
Age Verification Laws: Enforcement of age checks in 2025 led to widespread internet access issues, with some websites blocking entire countries and users increasingly turning to VPNs to bypass restrictions.
Device Bans at Public Events: The NYC mayoral inauguration explicitly banned Flipper Zero and Raspberry Pi devices, reflecting growing concerns about the use of hacking tools at high-profile events.

Cybersecurity Brief – 2025-12-06

Sat, 06 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

Barts Health NHS Trust disclosed a data breach after Clop ransomware actors exploited a zero-day vulnerability in Oracle E-Business Suite, resulting in the theft of database files.
American pharmaceutical company Inotiv reported a ransomware attack in August 2025 that led to the theft of personal information affecting thousands of individuals.
An AI image generator startup exposed a database containing over 1 million images and videos, including nude and “nudified” photos of real people, due to misconfigured internet access.
A human rights lawyer in Pakistan was targeted by Intellexa’s Predator spyware via a malicious WhatsApp link, marking the first known civil society targeting in the region.
Cloudflare experienced a major outage, causing widespread 500 Internal Server Errors, attributed to emergency mitigations for the React2Shell vulnerability.

Newly Discovered Vulnerabilities

React2Shell (CVE-2025-55182): A maximum-severity remote code execution vulnerability in React and Next.js was disclosed. The flaw is under active exploitation, particularly by China-linked threat actors, and has prompted emergency patching efforts including by Cloudflare.
Apache Tika (CVE-2025-66516): A critical XML external entity (XXE) injection vulnerability, rated CVSS 10.0, was disclosed in Apache Tika, requiring urgent patching.
Perplexity’s Comet Browser: A new agentic browser attack was disclosed, allowing a crafted email to trigger deletion of a user’s entire Google Drive contents via a zero-click exploit.
Akamai HTTP Smuggling: Akamai patched a vulnerability allowing HTTP smuggling attacks.

Notable Threat Actor Activity

Multiple China-nexus threat groups began exploiting the React2Shell vulnerability within hours of its public disclosure, targeting React and Next.js applications.
State-sponsored actors from the People’s Republic of China (PRC), including the group Warp Panda, have been observed deploying the BRICKSTORM, Junction, and GuestConduit malware families for long-term persistence in US systems.
Clop ransomware group exploited an Oracle E-Business Suite zero-day in the Barts Health NHS breach.
Intellexa, operators of Predator spyware, continue to leverage newly acquired zero-day exploits and alternative vectors such as ad-based delivery to bypass security controls and target individuals.

Trends, Tools, or Tactics of Interest

Malicious AI Tools: Researchers at Palo Alto Networks’ Unit 42 identified WormGPT 4 and KawaiiGPT, malicious AI tools enabling threat actors to automate the creation of phishing lures and ransomware code.
DDoS Attacks: The Aisuru botnet launched a record-breaking distributed denial-of-service (DDoS) attack, peaking at 29 Tbps and 14.1 billion packets per second, recently mitigated by Cloudflare.
Virtual Kidnapping Scams: The FBI warned of criminals using altered social media images as fake “proof of life” in virtual kidnapping ransom scams.
Attack Surface Management: Emphasis on continuous, automated attack surface visibility as cloud assets and exposures change rapidly.
Detection Tools: Burp Suite has added automated scanning capabilities for React2Shell vulnerabilities in Next.js applications.
Predator Spyware: Leaked Intellexa documents show ongoing use of high-priced zero-day exploits to maintain Predator spyware effectiveness.

Regulatory or Policy Developments

The European Commission fined X (formerly Twitter) €120 million ($140 million) for violating transparency obligations under the Digital Services Act (DSA), specifically related to deceptive blue checkmarks.
India has rolled back its proposed mandate requiring citizens to install a government cybersecurity app, following surveillance and privacy concerns.

Cybersecurity Brief – 2025-12-05

Fri, 05 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

Inotiv, a US-based company, disclosed a ransomware attack resulting in the theft of names, addresses, Social Security numbers, and financial and medical information of 9,542 individuals.
Freedom Mobile reported a data breach involving the compromise of customer personal information through its account management platform.
Marquis suffered a data breach impacting over 780,000 people, with compromised data including names, addresses, Social Security numbers, and card numbers.

Newly Discovered Vulnerabilities

A critical command injection vulnerability in Array Networks AG Series secure access gateways (ArrayOS AG VPN devices) has been actively exploited since August 2025. Threat actors are deploying webshells and creating rogue users.
A maximum-severity vulnerability, CVE-2025-55182 (“React2Shell”), exists in React Server Components’ ‘Flight’ protocol, enabling remote code execution without authentication in React and Next.js applications. AWS and other sources confirm active exploitation attempts, including by China-linked threat groups. Only instances using a newer feature are affected.
Google released a Chrome update addressing 13 security issues, including a high-severity vulnerability in Digital Credentials.

Notable Threat Actor Activity

Chinese state-sponsored actors are actively exploiting the React2Shell vulnerability and targeting VMware vSphere servers with BrickStorm malware, as warned by CISA, NSA, and international partners. The BrickStorm malware is being used to backdoor VMware servers in government and technology sectors.
The Predator spyware, developed by Intellexa, is leveraging a new zero-click infection vector (“Aladdin”) that compromises targets via malicious advertisements without user interaction.
The financially motivated group GoldFactory is distributing modified banking apps in Southeast Asia (Indonesia, Thailand, Vietnam), resulting in over 11,000 mobile infections.
The Silver Fox threat actor is conducting a false flag campaign in China, distributing ValleyRAT malware via fake Microsoft Teams installers and search engine optimization (SEO) poisoning.
Russian state-sponsored hackers targeted Reporters Without Borders (RSF) using phishing emails to deliver malware.
China-based SMS phishing groups have shifted tactics to promote scams involving loyalty points, taxes, and fake retailers during the holiday season.
A student was found selling access to compromised government and university websites to Chinese threat actors for low prices.

Trends, Tools, or Tactics of Interest

Sophisticated fraud attacks are increasing, driven by the accessibility of AI tools and fraud-as-a-service platforms, making advanced techniques available to unskilled attackers.
Multi-stage phishing campaigns targeting Microsoft 365 credentials have been observed since November 2025, employing advanced evasion techniques.
AutoIT3 compiled scripts are being used to deliver shellcode payloads in Windows environments.
There is a marked increase in AI-powered attacks, evolving injection techniques, and the use of automation in both offensive and defensive cyber operations.
Cloudflare reported blocking 416 billion AI bot requests since July 1, indicating a surge in automated scraping and reconnaissance activity.
SMS phishing campaigns are adapting to current events and seasonal trends, with new lures targeting points, taxes, and fake retailers.

Regulatory or Policy Developments Affecting the Security Industry

The UK National Cyber Security Centre (NCSC) announced the testing of a “Proactive Notifications” service to alert UK organizations about vulnerabilities in exposed devices.
CISA, NSA, and allied cyber agencies published security guidance for the integration of AI in operational technology (OT) environments, outlining principles for secure AI deployment in critical infrastructure.
India’s Ministry of Communications rescinded an order that would have required smartphone manufacturers to preinstall a government cybersecurity app (“Sanchar Saathi”) and prevent users from disabling it.
Canadian police are trialing facial recognition body cameras, raising potential privacy and accuracy concerns.
The US Inspector General’s report on the “Signalgate” incident recommended a single procedural change to improve the handling of classified material.
ServiceNow acquired Veza, a provider of non-human identity (NHI) access control, to enhance its governance and AI Control Tower offerings.