Origin Energy on DanSec Daily

Cybersecurity Brief – 2026-07-28

Tue, 28 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

The Coca-Cola Company confirmed data theft from its Fairlife dairy subsidiary following a ransomware attack earlier this month. The Anubis cybercrime group has claimed responsibility and is threatening to leak the stolen data ^[18]^[40].
Ernst & Young suffered a data breach attributed to the ShinyHunters extortion gang, who claim to have obtained credentials for some of the firm’s systems via a supply-chain attack ^[19].
Origin Energy reported a data breach affecting approximately 900,000 customers, with attackers claiming to have stolen data for up to 2 million customers ^[34].
Private conversations with Claude AI chatbots were indexed and exposed in Google and Bing search results due to misconfigured web crawler controls ^[27].

Newly Discovered Vulnerabilities

A maximum-severity command injection vulnerability (CVE-2026-16812) in on-premises Arista VeloCloud Orchestrator is under active exploitation. Arista has released patches for affected systems ^[4]^[14]^[33].
A critical remote code execution zero-day in the FastJson Java library is being actively exploited in the wild, allowing attackers to execute code without authentication or elevated privileges ^[13]^[32].
A public exploit has been released for a patched pre-authentication code execution vulnerability in vBulletin, enabling attackers to execute code via unauthenticated requests to PHP’s eval() function on unpatched forums ^[7].
n8n automation platform patched a high-severity sandbox escape bug allowing authenticated workflow editors to execute OS commands as the n8n process ^[9].
A proof-of-concept exploit for the “Certighost” Windows Active Directory Certificate Services vulnerability has been published, allowing authenticated attackers to potentially hijack Windows domains ^[16].
A critical unsafe deserialization flaw in PTC Windchill is being exploited in ransomware campaigns, enabling unauthenticated remote code execution ^[37].
Persistent “confused deputy” vulnerabilities remain in Google Cloud and Microsoft Azure, allowing attackers to gain administrative permissions and bypass cloud access controls ^[22].

Notable Threat Actor Activity

Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore) has deployed new malware, including NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools, targeting the Middle East and Africa ^[1].
The Dysphoria IoT botnet has compromised around 200,000 devices globally, adopting blockchain-based C2 and infected-device relays after law enforcement disruption of JackSkid. The botnet is being used for DDoS attacks and traffic relay operations ^[6]^[15].
TELESHIM, an East Asia-linked threat actor, is abusing Telegram for command and control in attacks on Middle Eastern government entities, resulting in data exfiltration ^[12].
The ShinyHunters gang is not only conducting extortion but their leaked data is being leveraged in sextortion scams, with scammers posing as ShinyHunters to make their emails more credible ^[19]^[44].
An espionage attack on Thailand’s Ministry of Finance used Hermes, an autonomous open source AI agent, operating in “YOLO mode” to conduct its campaign ^[21].

Trends, Tools, or Tactics of Interest

Attackers are actively exploiting legitimate remote monitoring and management (RMM) tools such as Level RMM and ScreenConnect via phishing lures themed as Microsoft Teams updates in “Operation BlueDash” ^[10].
AI agents are proliferating in enterprise environments, often without security oversight, posing new governance and risk challenges ^[20].
The Cruciferra crypter, used by a China-linked group targeting Indian tax professionals, employs bring-your-own-vulnerable-driver (BYOVD) and process ghosting techniques to evade detection on Windows systems ^[11].
MedusaHVNC, a malware-as-a-service operation, uses hidden Windows desktops to launch legitimate browsers for persistent, covert remote access ^[38].
AutoIT remains a common tool for malware payload injection due to its ease of use and powerful capabilities ^[28].
There is a decline in confidence in autonomous security tools, as adversaries increasingly leverage defenders’ own rulebooks instead of relying on zero-day exploits ^[24].
Java Spring Boot heapdump endpoints are being scanned, as exposed endpoints can leak sensitive memory data ^[30].
Aftercall ad fraud campaigns are spreading Android apps that display full-screen ads after phone calls, impacting user experience ^[43].

Regulatory or Policy Developments Affecting the Security Industry

NVIDIA and 36 other organizations have formed the Open Secure AI Alliance to develop and share open technologies, techniques, and tools for securing software and AI agents ^[5]^[39].
GitHub and PyPI announced new supply chain security policies: Dependabot will now have a three-day cooldown before opening pull requests, and PyPI will reject file uploads to releases older than 14 days ^[36].

Sources

Coca-Cola confirms data theft in Fairlife ransomware attack - bleepingcomputer.com
Coca-Cola Confirms Data Breach After Fairlife Ransomware Attack - securityweek.com
Ernst & Young data breach claimed by ShinyHunters extortion gang - bleepingcomputer.com
Origin Energy Data Breach Affects 900,000 Australians - securityweek.com
Private Claude Chats Exposed in Google and Bing Search Results - wired.com
Attackers Exploit Arista VeloCloud Orchestrator Command Injection Flaw - thehackernews.com
Arista patches VeloCloud Orchestrator zero-day exploited in attacks - bleepingcomputer.com
Critical Arista VeloCloud Orchestrator Vulnerability Exploited as Zero-Day - securityweek.com
Hackers target US firms in FastJson RCE zero-day attacks - bleepingcomputer.com
Unpatched Fastjson Vulnerability Exploited in Attacks - securityweek.com
Public Exploit Released for Patched vBulletin Pre-Auth Code Execution Flaw - thehackernews.com
n8n Sandbox Escape Lets Workflow Editors Run OS Commands as the n8n Process - thehackernews.com
New Certighost PoC exploit lets attackers hijack Windows domains - bleepingcomputer.com
PTC Windchill Vulnerability Exploited in Ransomware Campaign - securityweek.com
'Confused Deputy' Flaws Persist in Google Cloud, Microsoft Azure - darkreading.com
Mirage Kitten targets Middle East and Africa region with new malware - securelist.com
Dysphoria IoT Botnet Adds Blockchain C2 and Victim Relays After JackSkid Disruption - thehackernews.com
New Dysphoria DDoS botnet spreads to 200k devices worldwide - bleepingcomputer.com
TELESHIM Abuses Telegram for C2 in Attacks Against Middle East Governments - thehackernews.com
Sextortion scammers are exploiting ShinyHunters data leaks - malwarebytes.com
AI Agent Drives Espionage Attack on Thai Ministry of Finance - darkreading.com
Operation BlueDash Deploys Level RMM and ScreenConnect via Fake Teams Update - thehackernews.com
Shadow AI agents are multiplying. Here's how to find and secure them. - bleepingcomputer.com
Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware - thehackernews.com
MedusaHVNC Malware Uses Hidden Windows Desktops to Evade Detection - securityweek.com
AutoIT Payload Injector , (Tue, Jul 28th) - isc.sans.edu
Adversaries Don't Need a Zero-Day — They Read Your Rulebook - darkreading.com
Java Spring Boot "heapdump" scans, (Mon, Jul 27th) - isc.sans.edu
Aftercall ads are driving Android users crazy - malwarebytes.com
NVIDIA Forms 37-Member Open Secure AI Alliance and Open-Sources NOOA Framework - thehackernews.com
Nvidia and Tech Giants Launch AI Security Alliance - securityweek.com
New GitHub, PyPI Policies Boost Supply Chain Security - securityweek.com

Cybersecurity Brief – 2026-07-24

Fri, 24 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

Origin Energy, an Australian energy provider, confirmed a data breach in which an unauthorized party accessed and leaked customer data online, exposing sensitive personally identifiable information^[15]^[31].
Upbound Group disclosed a data breach resulting in the theft of non-sensitive customer information and documents, leading to $13 million in fraudulent contract losses^[37].
Chick-fil-A experienced a credential stuffing attack in which threat actors used credentials obtained from other companies to compromise Chick-fil-A One accounts^[34].

Newly Discovered Vulnerabilities

A nine-year-old race condition vulnerability in the Linux kernel’s XFS filesystem, tracked as CVE-2026-64600, allows local attackers to overwrite protected files and gain root privileges^[22].
A zero-day vulnerability in Check Point products, tracked as CVE-2026-16232, has been exploited in the wild against customers with specific configurations^[39].
A sandbox escape vulnerability was identified in Anthropic’s Claude Cowork, allowing AI agents to break out of a Linux virtual machine and access Mac files^[7].
HermeticReader, a now-patched flaw in Adobe’s Acrobat Chrome extension, could have allowed attackers to spy on WhatsApp Web chats^[41].
A hidden flaw in a dealer-installed car alarm system was discovered, potentially allowing attackers to unlock vehicles and track their locations without owners’ knowledge^[40].

Notable Threat Actor Activity

A Russian state-supported espionage group, known as Laundry Bear or Void Blizzard, exploited a zero-day flaw in Zimbra’s webmail client to steal email and two-factor authentication codes from Western organizations. The group used “half-click” phishing emails requiring only message preview to compromise targets^[5]^[17]^[26].
CERT-UA reported a campaign by threat actors distributing a fake Notepad++ plugin containing malware (MATCHBOIL.V2) to compromise Windows systems. The malware was delivered via an archive with the legitimate Notepad++ application and a malicious utility named LunchPoke^[4]^[18].
The Clop ransomware gang is targeting Internet-exposed PTC Windchill and FlexPLM instances in a new data theft extortion campaign^[13].
The Chaos ransomware group is deploying a Rust-based implant called msaRAT, which routes command-and-control traffic through the victim’s own Chrome or Edge browsers^[8]^[23].
A China-nexus threat cluster tracked as JadeProx is using a new TriBack loader in attacks targeting government, healthcare, and education organizations across Asia and Latin America^[9].
Attackers are weaponizing GitHub Actions runners by turning compromised repositories into distributed attack infrastructure to target cPanel and WebHost Manager (WHM) servers^[11].
A malvertising campaign is promoting a fake Claude desktop app via Bing ads, delivering SectopRAT malware through a legitimate Claude.ai domain^[16].

Trends, Tools, or Tactics of Interest

Two new phishing toolkits, including “Jalisco,” are being tracked for their capability to bypass multifactor authentication (MFA) via device code phishing^[2].
Ransomware delivery tactics continue to evolve, with phishing emails now often serving as initial access vectors rather than direct payload delivery, enabling stealthier and more targeted attacks^[3].
The new Dolphin X remote access trojan uses an AI-powered profiling feature to score and rank infected users, enabling cybercriminals to prioritize high-value targets^[14].
Synthetic identity fraud is increasingly being used to target machine identities, making detection more challenging compared to traditional identity theft^[10].
AI security guardrails and protections are inconsistent across different languages, exposing gaps in multilingual environments, particularly in the EU^[25].
Nuclear-sabotage malware benchmarks show that most frontier AI models struggle to sustain a malware investigation^[36].
New developments in security operations center (SOC) automation, threat intelligence enrichment, and AI-native investigation are being highlighted as means to address sophisticated email threats and improve administrative workflows^[1].
The adoption of agentic AI presents new challenges for confidential computing, even as technical barriers to secure data vaults are being addressed^[27].

Regulatory or Policy Developments Affecting the Security Industry

The European Commission fined Google €890 million ($1 billion) for violating the Digital Markets Act (DMA) concerning search and app store antitrust violations^[21].
The FedRAMP 20X transition replaces point-in-time assessments with continuous, machine-readable evidence to demonstrate that security controls are operational, impacting compliance requirements for cloud service providers^[20].

Sources

Australian energy provider Origin says data breach exposes client data - bleepingcomputer.com
Data Breach Confirmed After Australian Energy Giant Origin Is Hacked - securityweek.com
Upbound Group Says Data Breach Led to $13 Million in Fraudulent Contract Losses - securityweek.com
Chick-fil-A Accounts Get Fried in Credential Stuffing Attack - securityweek.com
New RefluXFS Linux flaw lets attackers gain root privileges - bleepingcomputer.com
New Check Point Zero-Day Vulnerability Exploited in the Wild - securityweek.com
Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files - thehackernews.com
WhatsApp Web chats exposed by Adobe’s Acrobat extension flaw - malwarebytes.com
Millions of cars could be tracked and unlocked by a hidden security flaw - malwarebytes.com
Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes - thehackernews.com
Russian hackers exploit Zimbra zero-click flaw for email theft - bleepingcomputer.com
Russian Hackers Exploit Zimbra Zero-Day Against US, Ukraine Targets - darkreading.com
Fake Notepad++ Plugin Delivers MATCHBOIL.V2 in UAC-0099 Attacks - thehackernews.com
Hackers abuse Notepad++ plugins to stealthily install malware - bleepingcomputer.com
Clop ransomware targets Windchill, FlexPLM in data theft attacks - bleepingcomputer.com
Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge - thehackernews.com
New msaRAT malware uses Chrome, Edge browsers to route C2 traffic - bleepingcomputer.com
China-Nexus JadeProx Uses New TriBack Loader in Government and Healthcare Attacks - thehackernews.com
Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers - thehackernews.com
Fake Claude app promoted by Bing ads pushes SectopRAT malware - bleepingcomputer.com
New Phishing Tools Enable Attackers to Easily Bypass Multifactor Authentication - blog.knowbe4.com
From Inbox to Encryption: How Ransomware Delivery Has Evolved - blog.knowbe4.com
New Dolphin X malware uses AI to rank high-value targets - bleepingcomputer.com
How Synthetic Identity Fraud is Coming for Machine Identities - thehackernews.com
Europe's Multilingual Reality Exposes AI Security Gaps - darkreading.com
Nuclear-Sabotage Malware Benchmark Trips Up Most Frontier AI Models - securityweek.com
Elevating the SOC Experience: Smarter Automation, Richer Threat Intelligence, and AI-Native Investigation - blog.knowbe4.com
Agentic AI Challenges Progress in Confidential Computing - darkreading.com
EU fines Google $1 billion for search, app store antitrust violations - bleepingcomputer.com
FedRAMP Rev5 Is Ending: What the 20x Transition Really Requires - bleepingcomputer.com