Cybersecurity Brief – 2026-05-26

Tue, 26 May 2026 00:00:00 +0000

Major Incidents or Breaches

7-Eleven suffered a data breach in April resulting in the compromise of personal information belonging to over 183,000 individuals. The ShinyHunters extortion group was responsible for the attack, which targeted the systems of the convenience store chain^[7]^[25].
The Oncology Institute disclosed a data breach caused by a third-party vendor, with the specific vendor not named^[20].
Radiology Associates of Richmond experienced a data breach affecting 266,000 individuals, with threat actors stealing files containing names and protected health information^[21].
DocketWise reported a data breach impacting 143,000 people, involving the compromise of names, addresses, Social Security numbers, financial information, and medical data from third-party partner repositories^[24].

Newly Discovered Vulnerabilities

A now-patched high-severity flaw in the Digital Knowledge KnowledgeDeliver LMS was exploited as a zero-day, enabling attackers to deploy Godzilla web shells and Cobalt Strike beacons^[1].
A critical vulnerability in Ghost CMS, tracked as CVE-2026-26980, is being actively exploited to inject malicious JavaScript code for ClickFix attacks. Over 700 websites, including those of major universities and DuckDuckGo, have been compromised^[3]^[19].
Microsoft confirmed a known issue with Windows Server 2016 after the KB5087537 May 2026 security update, causing domain controller lookups to fail^[6].

Notable Threat Actor Activity

The North Korea-linked Lazarus Group has deployed the RemotePE cross-platform memory-only remote access trojan (RAT) in attacks targeting financial and cryptocurrency organisations^[5].
The ShinyHunters extortion gang was identified as the actor behind the 7-Eleven breach^[7]^[25].
TeamPCP continues its supply chain campaign, operating across three package ecosystems, trojanising an officially Microsoft-published Python SDK, and reaching GitHub’s internal codebase^[17]^[18].
The FBI issued a warning regarding the Kali365 phishing-as-a-service platform, which targets Microsoft 365 accounts by abusing OAuth device code authentication to steal session tokens and bypass multifactor authentication^[9].

Trends, Tools, or Tactics of Interest

Attackers are increasingly exploiting supply chain weaknesses, as demonstrated by the TeamPCP campaign and the poisoning of Laravel-Lang packages to deliver malware and exfiltrate CI secrets^[17]^[18]^[23].
The AI-driven bug hunting arms race is intensifying, with attackers leveraging AI for exploit development and defenders using AI models such as Anthropic’s Mythos, which detected 23,000 potential vulnerabilities across 1,000 open-source projects, many of which are critical or high severity^[12]^[22].
There is a rise in phishing-as-a-service platforms, with Kali365 providing tools to bypass multifactor authentication protections on Microsoft 365 accounts^[9].
Recent incidents highlight the use of memory-only malware and advanced remote access trojans, as seen in Lazarus Group’s deployment of RemotePE^[5].

Regulatory or Policy Developments Affecting the Security Industry

Dutch authorities seized 800 servers and arrested two individuals connected to hosting infrastructure used by Russian state actors for cyberattacks and influence operations^[13].

Sources

7-Eleven data breach exposes personal information of 185,000 people - bleepingcomputer.com
25th May – Threat Intelligence Report - research.checkpoint.com
Oncology Institute Discloses Data Breach - securityweek.com
266,000 Affected by Data Breach at Radiology Associates of Richmond - securityweek.com
DocketWise Data Breach Impacts 143,000 - securityweek.com
KnowledgeDeliver LMS Flaw Exploited to Deploy Godzilla and Cobalt Strike - thehackernews.com
Ghost CMS CVE-2026-26980 Exploited to Hijack 700+ Sites for ClickFix Attacks - thehackernews.com
Ghost CMS Vulnerability Exploited to Hack Over 700 Websites - securityweek.com
Microsoft: Domain Controller lookup may fail on Windows Server 2016 - bleepingcomputer.com
Lazarus Deploys RemotePE Memory-Only RAT Against Financial and Crypto Firms - thehackernews.com
TeamPCP Supply Chain Campaign: Activity Through 2026-05-24, (Mon, May 25th) - isc.sans.edu
TeamPCP Supply Chain Campaign: Activity Through 2026-05-24, (Mon, May 25th) - isc.sans.edu
FBI warns of Kali365 phishing service targeting Microsoft 365 accounts - bleepingcomputer.com
Laravel-Lang Packages Poisoned for Malware Delivery - securityweek.com
The AI Era Is Creating a Bug Hunting Arms Race - wired.com
Anthropic: Mythos Detected 23,000 Potential Vulnerabilities Across 1,000 OSS Projects - securityweek.com
Netherlands Seizes 800 Servers, Arrests 2 for Aiding Cyberattacks - krebsonsecurity.com

Cybersecurity Brief – 2025-07-19

Sat, 19 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

WineLab, the largest alcohol retailer in Russia, has closed stores following a ransomware attack that disrupted operations and customer purchases.
Radiology Associates of Richmond disclosed a data breach impacting 1.4 million individuals’ protected health and personal information.
Anne Arundel Dermatology reported a data breach affecting 1.9 million people, with hackers having access to systems for three months and potentially exfiltrating personal and health information.
Thousands of spoofed news sites (over 17,000) are being used to push investment fraud scams, per CTM360.
Arch Linux removed three malicious AUR packages that installed the CHAOS RAT on Linux devices.
A powerful US law firm was reportedly hacked by Chinese threat actors.
CitrixBleed 2 vulnerability in NetScaler has led to compromises at 100 organizations, with thousands of instances still vulnerable even after patching.
Veeam users have been targeted by a phishing campaign using voicemail-themed emails with malicious .wav file attachments.
Meta executives settled an $8 billion shareholder lawsuit over alleged disregard for privacy regulations.

Newly Discovered Vulnerabilities

A zero-day vulnerability (CVE-2025-54309) in CrushFTP is being actively exploited to hijack servers by gaining administrative access via the web interface.
A critical privilege escalation vulnerability in the NVIDIA Container Toolkit (NVIDIAScape) allows container escape and full host control, posing a risk to AI cloud services.
Fortinet FortiWeb is being exploited in the wild after a proof-of-concept for a recent critical vulnerability was published.
A vulnerability in the TeleMessage Signal clone app (CVE-2025-48927) is under active exploitation, allowing attackers to retrieve usernames, passwords, and sensitive data.
Symantec product flaw disclosed, though details are limited in the initial report.

Notable Threat Actor Activity

The UK National Cyber Security Centre (NCSC) formally attributed the ‘Authentic Antics’ credential-stealing malware targeting Microsoft 365 users to APT28 (Fancy Bear), linked to Russia’s GRU.
CERT-UA reported a phishing campaign delivering LAMEHUG malware, attributed to APT28, notable for using large language models (LLMs) to craft phishing content.
UNG0002 (Unknown Group 0002) conducted cyber espionage campaigns targeting multiple sectors in China, Hong Kong, and Pakistan, using LNK files and remote access trojans (RATs).
Google has filed suit against 25 Chinese entities for allegedly operating the BADBOX 2.0 botnet, which infected over 10 million Android devices and established a large-scale residential proxy network.
Hackers are actively scanning for and exploiting vulnerabilities in the TeleMessage SGNL app.
Chinese law enforcement is reportedly using the Massistant mobile forensics tool to extract SMS, GPS data, and images from confiscated phones.
Cryptocurrency thieves are reportedly bypassing FIDO keys in attacks.

Trends, Tools, or Tactics of Interest

Fraud-as-a-service operations are being accelerated by generative AI, enabling large-scale, more sophisticated fraud campaigns.
Investment scams are being distributed via large-scale spoofed news sites, indicating increased use of fake media infrastructure.
Phishing campaigns leveraging voicemail-themed emails and malicious attachments remain prevalent.
Ransomware attacks continue to disrupt business operations and public services, as seen in the WineLab and healthcare sector incidents.
IT leaders are shifting focus from traditional backup to broader cyber resilience strategies in response to escalating ransomware threats.
Free decryptors for Phobos and 8base ransomware have been released by Japanese police, enabling victims to recover files without paying ransoms.
AI-native email security solutions are emerging, with StrongestLayer launching from stealth with $5.2 million in seed funding.

Regulatory or Policy Developments Affecting the Security Industry

The US Federal Trade Commission (FTC) issued an advisory warning about job scams impersonating well-known companies.
Meta has agreed to pay $8 billion to settle a shareholder lawsuit over alleged privacy regulation violations.
Google’s legal action in New York federal court targets operators of the BADBOX 2.0 botnet, seeking to disrupt large-scale Android malware distribution.

Radiology Associates of Richmond on DanSec Daily

Cybersecurity Brief – 2026-05-26

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry

Sources

Cybersecurity Brief – 2025-07-19

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry