Cybersecurity Brief – 2026-05-06

Wed, 06 May 2026 00:00:00 +0000

Major Incidents or Breaches

DAEMON Tools supply chain attack: Installers downloaded from the official DAEMON Tools website since 8 April were trojanised, delivering a sophisticated backdoor to thousands of systems globally. Government and scientific entities were among those targeted, though the backdoor was selectively deployed on a limited number of systems.
Vimeo data breach: The ShinyHunters extortion group accessed and exfiltrated personal information of over 119,000 users following a breach of the Vimeo platform in April.
Instructure breach: A hacker claims to have stolen 280 million data records from 8,809 educational institutions by breaching Instructure, exposing student and staff data.
Trellix source code breach: Attackers accessed source code for Trellix security products, potentially exposing detection mechanisms and product controls.
Taiwan high-speed rail hack: A university student was arrested for exploiting the TETRA communication system to trigger emergency brakes on Taiwan’s high-speed railway.
CloudZ RAT exploitation via Windows Phone Link: Researchers disclosed an incident involving the CloudZ remote access tool, leveraging a previously undocumented plugin (“Pheno”) to steal credentials and OTPs.
Government targeting by UAT-8302: China-linked APT group UAT-8302 was attributed to ongoing attacks against government entities in South America and South Asia, using malware shared across regions.

Newly Discovered Vulnerabilities

Palo Alto Networks PAN-OS (CVE-2026-0300): A critical buffer overflow vulnerability in PAN-OS User-ID Authentication Portal is under active exploitation, enabling remote code execution on PA and VM series firewalls.
Apache HTTP/2 (CVE-2026-23918): A severe vulnerability in Apache HTTP Server’s HTTP/2 implementation could allow denial-of-service and potential remote code execution. Security updates have been released.
MetInfo CMS (CVE-2026-29014): A critical flaw in the open-source MetInfo CMS is being actively exploited for remote code execution attacks.
Android System (CVE-2026-0073): A critical remote code execution vulnerability was patched in Android’s System component, exploitable without user interaction.
Ollama “Bleeding Llama”: A critical heap out-of-bounds read issue in Ollama LLM deployments could be exploited remotely and without authentication, potentially affecting up to 300,000 deployments.
WhatsApp: Two newly patched vulnerabilities could have allowed attackers to send malicious files to users, potentially leading to malware infection.
Microsoft Edge: Proof-of-concept exploits show that passwords are stored in process memory and can be extracted by users with admin privileges, posing an enterprise risk.

Notable Threat Actor Activity

ShinyHunters: Responsible for the Vimeo data breach, exfiltrating user personal information.
UAT-8302 (China-linked APT): Conducting cross-regional campaigns targeting government agencies using shared APT malware.
Karakurt ransomware group: A Latvian national, Deniss Zolotarjovs, was sentenced in the US for his role as a negotiator in extortion operations.
Quasar Linux (QLNX) malware: A new, previously undocumented Linux implant is targeting software developers with rootkit, backdoor, and credential-stealing features.

Trends, Tools, or Tactics of Interest

Supply chain attacks: DAEMON Tools and Trellix incidents highlight the ongoing risk of supply chain compromise, with attackers leveraging trusted software distribution channels.
OAuth token persistence: Many AI tools and productivity apps connected to Google or Microsoft environments leave persistent OAuth tokens without expiration or automated revocation, increasing lateral movement and persistence risks.
AI service exposure: Scans of one million exposed AI services reveal significant security gaps as businesses rapidly adopt AI technologies, with insecure deployments and insufficient access controls.
Social engineering and AI: Evolution in phishing and social engineering tactics, now leveraging AI to create more convincing lures and automate attacks, as noted in new KnowBe4 SAT platform updates and recent phishing campaigns.
Binary Transparency for Android: Google has expanded public verification of Android app binaries to prevent supply chain attacks.
Microsoft phishing campaign: Ongoing sophisticated phishing attacks against US organisations, using adversary-in-the-middle (AitM) techniques to harvest credentials.
Jailbreaking and data poisoning AI models: Security researchers are actively probing AI guardrails for weaknesses, using jailbreaking and data poisoning to demonstrate attack vectors.

Regulatory or Policy Developments

FTC action against Kochava: The US Federal Trade Commission will ban data broker Kochava and its subsidiary from selling Americans’ location data without explicit consent, as part of a legal settlement.
Oracle patch cadence: Oracle will now release monthly critical security patch updates, aiming to address high-priority vulnerabilities more rapidly.
SSL.com root certificate rotation: SSL.com rotated its root certificate as part of standard lifecycle management.
CISA critical infrastructure initiative: The US Cybersecurity and Infrastructure Security Agency (CISA) announced a new initiative to strengthen the security of critical infrastructure.

Cybersecurity Brief – 2025-09-27

Sat, 27 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Volvo and two other international vehicle manufacturers suffered supply chain cyberattacks in the past month, resulting in the theft of Volvo employee Social Security Numbers in a ransomware attack.
Hackers stole data on 8,000 nursery children and contacted their parents directly, demanding ransom payments under threat of leaking the children’s information.
A South Korean credit card company was hacked, and the Maryland Transit Administration experienced a ransomware attack. The UK’s Co-op lost £206 million due to a cyberattack.
Flo Health and Google agreed to pay $56 million to settle lawsuits over the period-tracking app Flo sharing sensitive users’ health data for advertising purposes.
Neon Mobile, a popular US app, pays users to record their phone calls and then sells this data for AI training.

Newly Discovered Vulnerabilities

A critical vulnerability (CVE-2025-10035, CVSS 10) in Fortra’s GoAnywhere Managed File Transfer (MFT) software was exploited as a zero-day at least eight days prior to public disclosure, allowing unauthenticated remote command injection and the creation of backdoor admin accounts.
Multiple vulnerabilities in Cognex industrial cameras allow for remote hacking; no patches are available, and customers are advised to migrate to newer models.
Google Project Zero highlighted the risk of pointer leaks through pointer-keyed data structures, which can undermine ASLR protections and facilitate remote exploitation.

Notable Threat Actor Activity

The Russian APT group COLDRIVER launched a new campaign using ClickFix-style attacks to deliver two new lightweight malware families.
Iranian APTs, including the Charming Kitten offshoot Subtle Snail, have been observed signing malware with valid code-signing certificates issued by SSL.com.
North Korean threat actors are posing as recruiters to steal developers’ identities and provide these to fraudulent IT workers.
A phishing campaign impersonating Ukrainian government agencies is distributing CountLoader, which subsequently deploys Amatera Stealer and PureMiner malware. PureRAT phishing threats are also targeting Vietnam.
LockBit 5.0 ransomware activity continues to be reported.

Trends, Tools, or Tactics of Interest

The XCSSET macOS malware has a new variant with a four-stage infection chain, an additional persistence mechanism, and new targeting of Firefox browser data, including cryptocurrency transaction hijacking.
Microsoft Edge will introduce a feature to block malicious sideloaded browser extensions.
Generative AI deployments are increasingly recognised as introducing new cyber risks, including phishing, fraud, and model manipulation.
North Korean threat actors are leveraging social engineering by masquerading as recruiters to facilitate identity theft for use by IT worker proxies.
Interpol arrested 260 suspects in Africa involved in online romance scams that used relationship-building to extort or blackmail victims.
A new tool, convert-ts-bash-history.py, has been released to facilitate quick timeline analysis from bash histories.
Breach and Attack Simulation (BAS) is highlighted as an effective method for validating security controls beyond theoretical design.
The Neon Mobile app’s business model of incentivising users to record and sell their phone call data for AI training is drawing privacy concerns.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft has restricted access to cloud and AI products for a unit within the Israeli military, following an internal review linking these services to mass surveillance activities in Gaza.
U.S. President Donald Trump signed an executive order approving the restructuring of TikTok’s U.S. operations to address national security concerns, transferring control to U.S. investors.
Google and Flo Health face regulatory enforcement, agreeing to a $56 million settlement over improper sharing of sensitive health data.
Cognex is recommending customers transition to newer products due to unpatched vulnerabilities in its industrial cameras.

SSL.com on DanSec Daily

Cybersecurity Brief – 2026-05-06

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments

Cybersecurity Brief – 2025-09-27

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry