https://blog.dansec.red/vendors/target/Recent content in Target on DanSec DailyHugoen-gbWed, 14 Jan 2026 00:00:00 +0000https://blog.dansec.red/posts/2026-01-14-cybersecurity-news/Wed, 14 Jan 2026 00:00:00 +0000https://blog.dansec.red/posts/2026-01-14-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li>Central Maine Healthcare experienced a data breach affecting over 145,000 individuals, exposing sensitive personal information.</li> <li>Belgian hospital AZ Monica was forced to shut down all servers, cancel procedures, and transfer critical patients due to a cyberattack.</li> <li>Betterment, a US digital investment advisor, confirmed a breach resulting in fake crypto-related emails being sent to customers.</li> <li>Target source code samples were leaked and confirmed as authentic by employees, prompting an accelerated lockdown of internal systems.</li> <li>JPMorgan disclosed that the law firm Fried Frank suffered a data security incident impacting high-profile clients.</li> <li>Spanish energy company Endesa was hacked, resulting in the theft of customer data, including contact, payment, and national identity information.</li> </ul> <h2 id="newly-discovered-vulnerabilities">Newly Discovered Vulnerabilities</h2> <ul> <li>Microsoft’s January 2026 Patch Tuesday addressed 114 vulnerabilities, including three zero-days (one actively exploited, two publicly disclosed). Updates also replaced expiring Secure Boot certificates and fixed vulnerabilities in Windows 10 and 11.</li> <li>ServiceNow patched a critical AI platform vulnerability that allowed unauthenticated user impersonation, exposing customer data and systems.</li> <li>Adobe released patches for 25 vulnerabilities, including a critical Apache Tika flaw in ColdFusion.</li> <li>SAP’s January 2026 updates addressed 17 vulnerabilities, with four rated critical (including SQL injection, remote code execution, and code injection).</li> <li>Broadcom Wi-Fi chipset vulnerability was disclosed, allowing attackers to disrupt networks on affected devices, including Asus routers.</li> <li>Apple confirmed active exploitation of a vulnerability, with full protections available only for iPhones running iOS 26+.</li> </ul> <h2 id="notable-threat-actor-activity">Notable Threat Actor Activity</h2> <ul> <li>Ukrainian Defense Forces were targeted with PLUGGYAPE malware via Signal and WhatsApp in a charity-themed campaign between October and December 2025.</li> <li>A long-running web skimming campaign, active since January 2022, has targeted major payment networks by stealing credit card data from online checkout pages.</li> <li>A new malicious Chrome extension was discovered stealing MEXC cryptocurrency exchange API keys by posing as a trading tool.</li> <li>The SHADOW#REACTOR campaign used multi-stage Windows attack chains and text-only files to deliver Remcos RAT, employing techniques to bypass detection and leverage native utilities.</li> <li>Attackers are abusing Python and Cloudflare services to deliver AsyncRAT, leveraging legitimate cloud infrastructure and open source tools.</li> <li>GoBruteforcer botnet is targeting crypto and blockchain projects, exploiting AI-generated server deployments with weak credentials and legacy web stacks.</li> <li>Dutch port hacker sentenced to prison for planting remote access malware on a logistics firm&rsquo;s systems, with insider assistance.</li> </ul> <h2 id="trends-tools-or-tactics-of-interest">Trends, Tools, or Tactics of Interest</h2> <ul> <li>AI-powered deepfakes are being used to impersonate religious figures and solicit fraudulent donations from congregations.</li> <li>Attackers are increasingly using agentic AI to automate and scale traditional attack techniques, optimising established playbooks rather than relying solely on novel exploits.</li> <li>Phishing campaigns are leveraging LinkedIn comment-reply tactics, posting convincing fake replies to lure users into clicking malicious links.</li> <li>AI agents such as Copilot, Claude Code, and Codex are now capable of building, testing, and deploying software autonomously, raising concerns about shadow API key sprawl and tool misuse.</li> <li>Web skimming and supply chain attacks remain persistent threats, with campaigns demonstrating long-term stealth and adaptability.</li> <li>CISO turnover is highlighted as a compounding risk factor for organisational security posture.</li> <li>Data brokers are being scrutinised for selling sensitive health and personal profiles, as evidenced by regulatory fines.</li> </ul> <h2 id="regulatory-or-policy-developments">Regulatory or Policy Developments</h2> <ul> <li>A data broker was fined by California regulators for selling sensitive information on Alzheimer’s patients and millions of other individuals.</li> <li>Microsoft’s security updates and certificate rollouts have implications for compliance and device security baselines.</li> <li>CrowdStrike announced the acquisition of browser security firm Seraphic for $420 million, following its agreement to acquire identity security startup SGNL for $740 million.</li> </ul>https://blog.dansec.red/posts/2026-01-13-cybersecurity-news/Tue, 13 Jan 2026 00:00:00 +0000https://blog.dansec.red/posts/2026-01-13-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li>Target Corporation: Hackers claim to have stolen and are selling internal source code from Target, with samples published online. Target’s development server has been taken offline.</li> <li>University of Hawaii Cancer Center: Ransomware attack in August 2025 resulted in theft of participant data, including documents with Social Security numbers dating back to the 1990s.</li> <li>Endesa (Spanish Energy Provider): Data breach disclosed, with hackers accessing customer contract-related information, including personal details.</li> <li>BreachForums: The notorious cybercriminal forum was breached, exposing data on 324,000 administrators and members.</li> <li>Manage My Health (New Zealand): Identified as a top breach in recent threat intelligence reporting, affecting patient portals and healthcare data.</li> <li>Instagram: Data leak incident where user data appeared on the dark web, coinciding with a password reset vulnerability (see below).</li> <li>Apex Legends: Live matches disrupted as threat actors hijacked player characters, disconnected users, and changed nicknames.</li> </ul> <h2 id="newly-discovered-vulnerabilities">Newly Discovered Vulnerabilities</h2> <ul> <li>n8n Workflow Automation Platform: <ul> <li>“Ni8mare” vulnerability impacts nearly 60,000 online instances; maximum-severity flaw remains largely unpatched.</li> <li>Supply chain attack observed, with malicious npm packages masquerading as integrations to steal OAuth credentials from developers.</li> </ul> </li> <li>Gogs (Git Service): High-severity remote code execution (RCE) flaw exploited in zero-day attacks. CISA has ordered US federal agencies to patch.</li> <li>Instagram: Password reset vulnerability allowed third parties to send reset emails to users, contributing to a recent data leak.</li> <li>Telegram: Hidden proxy links can expose user IP addresses with a single click due to how proxy links are handled. Telegram has announced plans for a fix.</li> </ul> <h2 id="notable-threat-actor-activity">Notable Threat Actor Activity</h2> <ul> <li>GoBruteforcer Botnet: New campaigns target over 50,000 Linux servers, especially those supporting cryptocurrency and blockchain projects, exploiting weak credentials and AI-generated configurations.</li> <li>APT28 (Russia): Targeting energy research and defense collaboration entities by impersonating webmail and VPN portals (Microsoft OWA, Google, Sophos VPN).</li> <li>Kimsuky (North Korea): FBI flagged QR-code phishing (“quishing”) campaigns targeting US and foreign government agencies, NGOs, and academia.</li> <li>LLM/AI Service Exploitation: Multiple campaigns targeting exposed large language model (LLM) endpoints and misconfigured proxy servers to access sensitive APIs and data.</li> <li>VoidLink Malware: Discovery of a stealthy, cloud-native Linux malware framework, attributed to a Chinese threat cluster, designed for persistence and evasion in cloud environments.</li> <li>Facebook Credential Theft: Increased use of “browser-in-the-browser” (BitB) phishing techniques to steal Facebook login credentials over the past six months.</li> </ul> <h2 id="trends-tools-or-tactics-of-interest">Trends, Tools, or Tactics of Interest</h2> <ul> <li>Supply Chain Attacks: Growing use of malicious npm packages for credential theft, specifically targeting workflow automation platforms.</li> <li>Botnet Evolution: GoBruteforcer botnet demonstrates ongoing adaptation, now preying on servers with weak or AI-generated credentials.</li> <li>AI and LLM Security: Surge in attacks against exposed LLM endpoints and APIs, highlighting expanding attack surfaces in organizations’ AI deployments.</li> <li>Phishing Techniques: Rise in “quishing” (QR-code phishing) and “browser-in-the-browser” attacks, increasing the sophistication of credential theft campaigns.</li> <li>Healthcare AI Adoption: Anthropic launched Claude AI for healthcare, introducing HIPAA-ready tools for providers and payers, reflecting broader AI integration in sensitive sectors.</li> <li>Endpoint Security Expansion: Hexnode announced entry into endpoint security with its new XDR (Extended Detection and Response) platform.</li> </ul> <h2 id="regulatory-or-policy-developments-affecting-the-security-industry">Regulatory or Policy Developments Affecting the Security Industry</h2> <ul> <li>CISA Directive: US federal agencies ordered to patch Gogs RCE vulnerability exploited in active attacks.</li> <li>EU Regulatory Review: The European Union set a February deadline for its verdict on Google’s $32B acquisition of Wiz, following US approval.</li> <li>Deepfake Regulation: Global regulators are scrutinizing Grok, an AI tool, over its role in generating illegal sexual deepfake content, including child sexual abuse material.</li> <li>Privacy and Cybersecurity Law Complexity: Ongoing analysis indicates compliance challenges will persist into 2026, with limited progress on comprehensive federal cybersecurity legislation.</li> </ul>