Nutex Health on DanSec Daily

Cybersecurity Brief – 2026-09-01

Tue, 01 Sep 2026 00:00:00 +0000

Major Incidents or Breaches

Berlin’s city administration confirmed data theft following a Rhysida ransomware attack, with cybercriminals attempting extortion after listing the city on a data leak site ^[18].
Hackers stole personal and health information affecting 9.5 million individuals from Aesto Health’s AWS infrastructure ^[33].
McKesson, a healthcare company, acknowledged a data breach after ShinyHunters claimed to have stolen hundreds of millions of records ^[42].
Nutex Health notified the SEC of a ransomware attack that compromised patient, employee, provider, business, and financial data ^[31].
Anthropic users were impacted by infostealer attacks, with session cookies stolen to gain access to Claude AI accounts and consume usage ^[19]^[41].
METR, an AI evaluation non-profit, suffered the theft of an API key, leading to the consumption of approximately $600,000 in AI credits ^[4].
Five Venezuelan nationals pleaded guilty in the US to ATM jackpotting attacks that involved attempting to physically install malware on ATMs to dispense cash ^[10]^[30].
The Cronos blockchain network was restarted after a price-manipulation exploit on the Tectonic lending platform enabled the theft of $74 million ^[12].

Newly Discovered Vulnerabilities

Nearly 22,000 Microsoft Exchange servers remain unpatched and exposed to a high-severity authentication bypass vulnerability, allowing attackers to hijack user mailboxes ^[9].
Two critical vulnerabilities in PaperCut NG and MF print management software (CVE-2026-82078 and CVE-2026-81578) are being actively exploited in data theft attacks; CISA has added these to its Known Exploited Vulnerabilities (KEV) catalog ^[11]^[35].
A critical authentication bypass vulnerability in JFrog Artifactory (CVE-2026-82329) is being exploited in the wild just days after disclosure ^[32].
WatchGuard patched three critical vulnerabilities in its Fireware OS iked process that could allow unauthenticated remote code execution ^[34].
ServiceNow patched three critical code injection vulnerabilities that could allow attackers to execute arbitrary code and access or tamper with data ^[37].
A critical flaw in Langflow (CVE-2026-0768) is under active exploitation, allowing unauthenticated remote execution of arbitrary Python code ^[6]^[29].
Kaspersky patched a vulnerability in its Endpoint Security product exploited by the Nightmare Eclipse group using the ‘HardBreacher’ technique ^[36].
Critical vulnerabilities in Ruby on Rails are being exploited for credential-probing and command and control activity ^[6].
JSCeal, a stealer targeting cryptocurrency applications, is delivered as compiled V8 bytecode and executed by a bundled Node.js runtime ^[38].

Notable Threat Actor Activity

Mirage Kitten, an Iran-linked threat actor, is targeting aviation and FinTech sectors across the Middle East and Africa with new malware families NodeRabbit (Node.js) and PollCat (JavaScript) ^[1].
The Russia-aligned UAC-0099 group is using a new technique, GuardBreaker, to plant nuclear weapon prompts in malware aimed at disrupting AI analysis in Ukraine ^[5].
North Korean threat actors are expanding job fraud operations beyond IT into healthcare and sales, seeking illicit employment in new sectors ^[7].
The Chinese Fire Ant group is using Cisco routers as spying platforms by establishing unauthorized GRE tunnel interfaces ^[16].
Rhysida ransomware is actively extorting the city of Berlin following a successful attack ^[18].
The Nightmare Eclipse group is exploiting a Kaspersky Endpoint Security vulnerability with a tool called ‘HardBreacher’ ^[36].

Trends, Tools, or Tactics of Interest

Abuse of enterprise collaboration tools by threat actors has increased fourfold in the past year as attackers use these platforms to evade detection ^[2].
The TerminalFix campaign, a variant of ClickFix, uses fake Cloudflare CAPTCHA prompts to trick users into executing malicious PowerShell commands, establishing reverse tunnels for deeper network access ^[13]^[20]^[40].
Infostealers are being used to hijack AI service accounts such as Anthropic’s Claude by stealing session cookies, enabling unauthorized access and usage ^[19]^[41].
Attackers are exploiting critical vulnerabilities in Langflow and Rails for credential harvesting and establishing command and control channels ^[6]^[29].
A router backdoor was observed where devices shipped with remote access enabled, allowing attackers to collect traffic and credentials and then erase logs ^[8].
Researchers demonstrated that AI models, such as Claude, can be used to port PLC exploits between device models quickly, reducing the barrier for industrial exploit development ^[28].
Job fraud tactics by North Korean actors are diversifying to include healthcare and sales roles ^[7].
JSCeal stealer is delivered in compiled V8 bytecode format and executed by a bundled Node.js runtime, targeting cryptocurrency users ^[38].

Regulatory or Policy Developments Affecting the Security Industry

CISA added the actively exploited PaperCut vulnerabilities (CVE-2026-82078 and CVE-2026-81578) to its Known Exploited Vulnerabilities catalog, signaling increased urgency for patching ^[35].
Nutex Health disclosed its ransomware breach to the SEC, reflecting regulatory requirements for timely breach notification ^[31].

Sources

Berlin confirms data theft after Rhysida ransomware attack claims - bleepingcomputer.com
9.5 Million Impacted by Aesto Health Data Breach - securityweek.com
McKesson confirms cyber incident after ShinyHunters claims patient-data theft - malwarebytes.com
Ransomware Gang Claims Nutex Health Data Breach - securityweek.com
Anthropic Users Hit by Infostealer Attacks, Session Thefts - darkreading.com
Infostealers are hijacking Claude accounts at users’ expense - malwarebytes.com
Attackers Steal METR API Key and Consume AI Credits Worth About $600,000 - thehackernews.com
Five Venezuelans plead guilty to ATM jackpotting attacks in US - bleepingcomputer.com
Five Venezuelans Plead Guilty in US Court to ATM Jackpotting - securityweek.com
Cronos blockchain restarts after $74 million Tectonic exploit - bleepingcomputer.com
Nearly 22,000 Microsoft Exchange servers vulnerable to hijack attacks - bleepingcomputer.com
Recently patched PaperCut zero-days used in data theft attacks - bleepingcomputer.com
PaperCut Exploitation Escalates to Active Intrusions - securityweek.com
Critical JFrog Artifactory Vulnerability Reportedly Exploited in the Wild - securityweek.com
WatchGuard Patches Critical Vulnerabilities - securityweek.com
ServiceNow Patches 3 Critical Code Injection Vulnerabilities - securityweek.com
Attackers Exploit Critical Langflow and Rails Flaws in Credential-Probing and C2 Activity - thehackernews.com
Hackers Start Exploiting Critical Langflow Vulnerability - securityweek.com
Nightmare Eclipse Drops ‘HardBreacher’ Kaspersky Product Exploit - securityweek.com
Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode - research.checkpoint.com
Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set - securelist.com
Russia-Aligned UAC-0099 Plants Nuclear Weapon Prompt in Malware to Disrupt AI Analysis - thehackernews.com
North Korean Job Fraud Expands Beyond IT Into Healthcare and Sales - thehackernews.com
Chinese Fire Ant hackers turn Cisco routers into spying platforms - bleepingcomputer.com
Attackers Abuse Enterprise Collaboration Tools to Avoid Detection - blog.knowbe4.com
Microsoft warns of TerminalFix attacks deploying reverse tunnels - bleepingcomputer.com
'TerminalFix' Campaign Weaponizes PowerShell for Enterprise Attacks - darkreading.com
TerminalFix looks like ClickFix, but delivers a very different payload - malwarebytes.com
⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off-Task, Router Backdoors and More - thehackernews.com
Experiment: Porting a PLC Exploit With AI Takes Hours and Hundreds of Dollars - securityweek.com

Cybersecurity Brief – 2026-08-26

Wed, 26 Aug 2026 00:00:00 +0000

Major Incidents or Breaches

Nutex Health, a healthcare and services provider, confirmed a data breach involving unauthorized access and data exfiltration from company servers, with sensitive information exposed^[18]^[31].
The Los Angeles County Museum of Art (LACMA) disclosed that a breach last year exposed customer and employee social security and medical data^[14].
Over 270 Zimbra Collaboration Suite servers have been compromised in ongoing attacks exploiting a high-severity remote code execution vulnerability^[22].
Norway’s shared government digital infrastructure suffered significant disruption due to a large-scale distributed denial-of-service (DDoS) attack, impacting public sector services^[17].

Newly Discovered Vulnerabilities

A critical remote code execution vulnerability in Gitea (CVE-2026-60004) is being actively exploited in the wild. The vulnerability was patched in Gitea version 1.27.1, but attackers are deploying miner-like payloads on unpatched instances^[3]^[32].
Two severe unauthenticated authentication bypass vulnerabilities (CVE-2026-61979 and CVE-2026-15981) in the Xecurify miniOrange SAML 2.0 Single Sign On plugin for WordPress are under active exploitation, allowing attackers to gain admin access^[13]^[35].
A high-severity flaw in Marimo notebook software was patched after it was found to allow attacker-supplied Model Context Protocol (MCP) command execution in specially crafted notebooks^[8].
Researchers disclosed a weakness in NVIDIA NemoClaw and its integration with the Ollama API that enables unauthenticated attackers to take control of local AI agent instances and plant persistent malicious instructions^[6]^[26].

Notable Threat Actor Activity

A commercial phishing-as-a-service toolkit, Mirage2FA, has targeted over 4,500 organisations in the US and EU since 2024, abusing Microsoft 365 login flows to bypass two-factor authentication^[9].
Threat actors are abusing npm and its mirrors to host clusters of malicious packages that redirect users to fake Cloudflare CAPTCHA phishing pages^[10]^[15].
A new campaign uses FTP banners as dead drop resolvers to deliver two novel remote access trojans (E4del and PINHOLE RAT), leveraging FTP banner text as a covert command and control channel^[11].
Iranian cyber actors have been sanctioned by the US government for their role in critical infrastructure breaches^[5].
A newly identified phishing-as-a-service platform, AnonyMousKIT, employs AI voice agents to call Apple device theft victims, attempting to phish for passcodes and two-factor authentication codes to bypass Apple’s Activation Lock^[4]^[16].

Trends, Tools, or Tactics of Interest

Phishing remains the leading initial access vector, responsible for more than half of observed cyberattacks in Q2 2026. Microsoft reported observing 7.6 billion phishing emails during this period^[1]^[2].
Attackers are increasingly targeting identity verification and account recovery processes, rather than just login credentials, to compromise accounts^[19].
Prompt injection attacks are being used to manipulate AI-powered email summarizers and assistants by embedding malicious or hidden instructions in otherwise benign-looking content, including encrypted text^[25]^[41].
AI model poisoning is an emerging concern, with vulnerabilities in local AI agent serving platforms allowing attackers to persistently corrupt models via malicious web content^[6]^[26].
WhatsApp has introduced support for multiple passkeys and stronger two-step verification to enhance account security across iOS and Android^[7]^[21]^[36].
Law enforcement agencies from 22 countries arrested 58 individuals and identified 263 suspects in a global crackdown on cybercrime networks coordinated by African crime groups^[23].

Regulatory or Policy Developments Affecting the Security Industry

The US Department of the Treasury announced new sanctions targeting Iranian cyber actors involved in attacks on critical infrastructure^[5].
Nigeria launched new financing, procurement, and infrastructure policies to support sovereign cloud initiatives aimed at strengthening national cybersecurity and technical capabilities^[24].
The Linux Foundation will govern TRACE, an open standard for AI runtime attestation, with contributions from AMD, Intel, Microsoft, OPAQUE, and TII^[33].
Taiwan charged nine individuals, including staff from Nvidia and Super Micro, for illegal exports of AI servers to China, highlighting ongoing regulatory scrutiny in the AI infrastructure supply chain^[40].

Sources

Hospital operator Nutex Health says data stolen in cyberattack - bleepingcomputer.com
Sensitive Information Exposed in Nutex Health Data Breach - securityweek.com
LACMA data breach last year exposed social security and medical data - bleepingcomputer.com
Hackers breached over 270 Zimbra servers in ongoing attacks - bleepingcomputer.com
Massive DDoS attack disrupts Norway’s government digital services - bleepingcomputer.com
Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner-Like Payload - thehackernews.com
CISA Warns of Exploited Gitea Vulnerability - securityweek.com
Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access - thehackernews.com
WordPress Websites Targeted via MiniOrange Plugin Vulnerabilities - securityweek.com
Marimo Notebook Flaw Could Run MCP Commands Before Cells Execute in Edit Mode - thehackernews.com
A Malicious Webpage Could Poison Your Local AI Model Behind NVIDIA NemoClaw - thehackernews.com
Finding Nemo(Claw): Networking Issue Allows for LLM Poisoning in OpenClaw - darkreading.com
Mirage2FA Surge Hits 4,500 US and EU Companies, Abusing Microsoft 365 Login Flows - thehackernews.com
24 npm Packages Abuse unpkg Mirrors to Host Fake Cloudflare CAPTCHA Pages - thehackernews.com
Hackers abuse npm mirrors to host phishing redirect pages - bleepingcomputer.com
E4del and PINHOLE RATs Turn FTP Banners Into Dead Drops for Malware Commands - thehackernews.com
U.S. Sanctions Iran-Linked Hackers Behind Critical Infrastructure Breaches - thehackernews.com
Fake Apple Support AI Calls Target Stolen-Device Owners for Passcodes and 2FA Codes - thehackernews.com
AnonyMousKIT PhaaS uses voice AI agents to phish iPhone passcodes - bleepingcomputer.com
Report: Phishing Remains the Primary Initial Access Vector - blog.knowbe4.com
CyberheistNews Vol 16 #34 Microsoft Observed 7.6 Billion Phishing Emails in Q2 2026 - blog.knowbe4.com
From Fake Workers to Account Recovery: The Growing Identity Verification Risk - bleepingcomputer.com
Hidden Prompts Trick AI Into False Email Summaries - darkreading.com
Grok fooled into stealing user chat, location data, and more - malwarebytes.com
WhatsApp Adds Multiple Passkeys for Phishing-Resistant Sign-Ins Across iOS and Android - thehackernews.com
WhatsApp adds stronger two-step verification, multiple passkeys - bleepingcomputer.com
WhatsApp Adds Multiple Passkeys and Stronger 2SV in Account Security Update - securityweek.com
Police arrests dozens of suspects in global cybercrime crackdown - bleepingcomputer.com
Nigeria Looks to Sovereign Cloud for Cyber, National Security - darkreading.com
Linux Foundation to Govern TRACE, an Open Standard for AI Runtime Attestation - securityweek.com
Taiwan Charges 9 Over Illegal AI Server Exports to China, Including Nvidia and Super Micro Staff - securityweek.com