https://blog.dansec.red/vendors/rockstar-games/Recent content in Rockstar Games on DanSec DailyHugoen-gbSat, 18 Apr 2026 00:00:00 +0000https://blog.dansec.red/posts/2026-04-18-cybersecurity-news/Sat, 18 Apr 2026 00:00:00 +0000https://blog.dansec.red/posts/2026-04-18-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li>Grinex, a Kyrgyzstan-based cryptocurrency exchange, suspended operations following a $13.7 million hack, which it attributes to Western intelligence agencies.</li> <li>A recent hack targeted Rockstar Games, attributed to the ShinyHunters group.</li> <li>A new incident involving the DraftKings breach: Kamerin Stokes was sentenced to prison for selling stolen credentials related to the attack, continuing his activities even after pleading guilty.</li> </ul> <h2 id="newly-discovered-vulnerabilities">Newly Discovered Vulnerabilities</h2> <ul> <li>CVE-2024-3721: Threat actors are actively exploiting this vulnerability in TBK DVRs and end-of-life TP-Link Wi-Fi routers to deploy Mirai variant ‘Nexcorium’ for DDoS botnets.</li> <li>Three zero-day vulnerabilities in Microsoft Defender are being actively exploited to gain elevated privileges on compromised systems. Two of these vulnerabilities remain unpatched.</li> <li>Apache ActiveMQ: A high-severity remote code execution vulnerability (CVE-2026-34197) is being actively exploited in the wild. The flaw, present for 13 years, was patched earlier this month.</li> <li>ShowDoc: A vulnerability in this platform is being exploited in the wild.</li> <li>Google Chrome: A security flaw in Chrome was reportedly awarded a $90,000 bug bounty.</li> </ul> <h2 id="notable-threat-actor-activity">Notable Threat Actor Activity</h2> <ul> <li>The Payouts King ransomware group is using QEMU virtual machines as reverse SSH backdoors to bypass endpoint security and maintain persistence.</li> <li>Tycoon phishing group has shifted to device code phishing, leveraging legitimate new-device login flows to bypass two-factor authentication.</li> <li>North Korean IT worker scheme: Two facilitators, Kejia Wang and Zhenxing Wang, were jailed in the US for helping North Korean workers obtain employment at over 100 US companies using stolen identities.</li> <li>ZionSiphon malware is targeting industrial control systems in Israeli water treatment and desalination plants.</li> <li>Underground cybercrime guides are circulating, teaching threat actors how to vet and select stolen credit card shops based on data quality, reputation, and survivability.</li> <li>ShinyHunters group involved in the Rockstar Games breach.</li> </ul> <h2 id="trends-tools-or-tactics-of-interest">Trends, Tools, or Tactics of Interest</h2> <ul> <li>Fake data breach alerts are being used as phishing lures to trick recipients into divulging sensitive information.</li> <li>Old vulnerabilities are being increasingly targeted and amplified by AI-driven attack techniques.</li> <li>Classic Nigerian advance-fee scams remain prevalent, with new twists keeping them effective.</li> <li>Identity Management Day highlights the growing importance of identity management at the edge as a core component of digital trust.</li> <li>CoChat launched an AI collaboration platform designed to combat “shadow AI” by improving visibility and governance over enterprise AI use.</li> <li>Google blocked or removed 8.3 billion policy-violating ads in 2025 and announced new Play policy updates focused on privacy and fraud prevention.</li> <li>Microsoft reported that some Windows domain controllers are entering reboot loops after the April 2026 security updates.</li> </ul> <h2 id="regulatory-or-policy-developments-affecting-the-security-industry">Regulatory or Policy Developments Affecting the Security Industry</h2> <ul> <li>NIST has reduced its enrichment of CVE data, impacting vulnerability management efforts; industry and ad-hoc coalitions are forming to address the gap.</li> <li>The US Coast Guard released new cybersecurity rules under the Maritime Transportation Security Act (MTSA), requiring OT security plans, third-party audits, and hybrid OT-security roles.</li> <li>The US House blocked an extension of Section 702, a surveillance program used by the FBI for warrantless searches.</li> <li>The White House is engaging with AI labs, including Anthropic, to discuss the security of advanced AI technologies.</li> <li>The Satellite Cybersecurity Act and increased EPA cybersecurity budget to $19 million were noted as recent legislative developments.</li> <li>Lawmakers in the US held closed-door discussions about the risks and rapid advancement of AI technologies.</li> </ul>https://blog.dansec.red/posts/2026-04-14-cybersecurity-news/Tue, 14 Apr 2026 00:00:00 +0000https://blog.dansec.red/posts/2026-04-14-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li>Basic-Fit, a major European gym chain, disclosed a data breach affecting one million customers, with hackers accessing personal information.</li> <li>Booking.com confirmed unauthorized access to its systems, exposing sensitive reservation and user data and prompting a forced reset of reservation PINs.</li> <li>Rockstar Games suffered a data breach involving analytics data, attributed to the ShinyHunters extortion gang, following a security incident at analytics provider Anodot.</li> <li>CPUID, developer of CPU-Z and HWMonitor, was compromised, leading to the distribution of trojanized installers (STX RAT) via modified download links.</li> <li>OpenAI rotated macOS code-signing certificates following a supply chain attack involving a malicious Axios package executed in a GitHub Actions workflow; the incident is linked to North Korea.</li> <li>The Los Angeles Police Department reported a data breach, as highlighted in Check Point’s latest threat intelligence bulletin.</li> </ul> <h2 id="newly-discovered-vulnerabilities">Newly Discovered Vulnerabilities</h2> <ul> <li>Adobe released an emergency fix for a zero-day vulnerability (CVE-2026-34621) in Acrobat and Reader, which has been exploited in the wild since at least December 2025. The flaw allowed remote code execution via malicious PDF files.</li> <li>ShowDoc, a document management platform, is affected by a critical remote code execution vulnerability (CVE-2025-0520) that is actively exploited on unpatched servers.</li> <li>A critical vulnerability in the wolfSSL library allows attackers to bypass certificate verification by exploiting improper handling of the hash algorithm or size in ECDSA signature checks.</li> <li>CISA added six actively exploited vulnerabilities affecting Fortinet, Microsoft, and Adobe products to its Known Exploited Vulnerabilities (KEV) catalog, indicating ongoing exploitation.</li> </ul> <h2 id="notable-threat-actor-activity">Notable Threat Actor Activity</h2> <ul> <li>JanelaRAT, a financial malware derived from BX RAT, has been observed in an ongoing campaign targeting banks and financial institutions in Latin America, with over 14,700 attacks in Brazil in 2025. The latest variants show updates to infection chains and malware capabilities.</li> <li>North Korea-linked APT37 (ScarCruft) is conducting a multi-stage social engineering campaign via Facebook, delivering the RokRAT malware to targets.</li> <li>APT41, a Chinese state-backed group, is deploying a “zero-detection” backdoor to harvest cloud credentials from AWS, Google, Azure, and Alibaba environments, using typosquatting to obscure command-and-control communications.</li> <li>The W3LL phishing network, responsible for global phishing campaigns and $20 million in fraud attempts, was dismantled in a joint operation by the FBI and Indonesian police, resulting in the arrest of the alleged developer.</li> <li>A new commodity phishing kit, “Venom Stealer,” is enabling automation of ClickFix attacks, a social engineering technique used to bypass multi-factor authentication.</li> <li>A new infostealer dubbed “Storm” leverages server-side decryption to hijack browser sessions, enabling attackers to bypass passwords and multi-factor authentication protections.</li> <li>Fake Claude (Anthropic) websites are distributing PlugX RAT via DLL sideloading, using legitimate branding to lure victims and employing clean-up routines post-infection.</li> <li>Russian-speaking threat actors compromised CPUID’s download infrastructure to distribute the STX RAT.</li> <li>International law enforcement operations in the US, UK, and Canada targeted multimillion-dollar cryptocurrency theft schemes, identifying over $45 million in stolen assets and freezing $12 million.</li> </ul> <h2 id="trends-tools-or-tactics-of-interest">Trends, Tools, or Tactics of Interest</h2> <ul> <li>Anthropic’s Claude Mythos AI model was temporarily restricted after autonomously discovering and exploiting zero-day vulnerabilities across major operating systems and browsers, prompting warnings of a potential “AI vulnerability storm.”</li> <li>Attackers are increasingly scanning for webshells, including EncystPHP, with a focus on those lacking authentication or secured with default credentials.</li> <li>There is a trend toward server-side decryption in infostealer malware, as demonstrated by the “Storm” infostealer, which enables session hijacking and circumvents MFA.</li> <li>Social engineering via social media platforms (e.g., Facebook) continues to be leveraged by state actors for initial access and malware delivery.</li> <li>Gmail has introduced end-to-end encryption for enterprise users on Android and iOS, allowing secure message composition and reading on mobile devices.</li> </ul> <h2 id="regulatory-or-policy-developments-affecting-the-security-industry">Regulatory or Policy Developments Affecting the Security Industry</h2> <ul> <li>Operational Technology (OT) asset owners are being required by regulators to attest to their post-quantum cryptographic readiness, despite lacking adequate tooling to provide genuine security assurances.</li> <li>Civil society organizations have issued warnings to Meta regarding potential risks associated with facial recognition features in smart glasses, citing privacy and safety concerns for vulnerable populations.</li> </ul>