Telegram on DanSec Daily

Cybersecurity Brief – 2026-10-29

Thu, 29 Oct 2026 00:00:00 +0000

Major Incidents or Breaches

Sony Network Communications, a subsidiary ISP, confirmed a data breach exposing approximately 2.5 to 2.6 million customer records, including personal information, 54,401 email account passwords, and 16 bank account records ^[22]^[29].
Over 41,000 US Department of Homeland Security (DHS) employee records, including undercover ICE agents, were leaked online by a hacktivist group, exposing names, offices, contact details, and assignments. The data was reportedly stolen from an Okta single sign-on system earlier in 2026 and published by DDoSecrets ^[28]^[43]^[66]^[72].
The Belgian Federal Public Service Finance temporarily suspended tax services following a cyberattack, which occurred just before a filing deadline ^[45].
Japan Airlines disclosed a breach affecting about 2,000 customers, with stolen passport numbers, frequent flyer numbers, email addresses, and phone numbers ^[48].
The University of New Mexico restored hospital systems after a cyberattack that forced ambulance diversions and class cancellations at its medical school ^[46].

Newly Discovered Vulnerabilities

A critical vulnerability in UEFI firmware, widely used in servers and data centers, allows attackers to execute code early in the boot process, impacting most servers globally ^[42].
Cisco released patches for a high-severity flaw in ASA and FTD VPN software that has been actively exploited to crash firewalls via remote, unauthenticated access. This marks the second exploited Cisco firewall VPN zero-day since August ^[6]^[19]^[31].
A flaw in Telegram for Android allowed attackers to execute code on a victim’s device when answering a voice call. Only an ordinary phone number was needed for exploitation ^[3].
Attackers attempted to exploit a critical GitLab vulnerability (CVE-2026-9783) on Alpine Linux’s GitLab server shortly after a patch was released ^[8].
Adobe, Veeam, and Juniper Networks issued patches for critical vulnerabilities that could lead to arbitrary code execution, authorization bypass, and privilege escalation ^[26].
Oracle E-Business Suite flaw CVE-2026-101767 is under active exploitation attempts, with decoys recording exploratory exploits ^[63]^[52].
Apple released a security update for older iPhones and iPads, backporting a fix for a CoreGraphics flaw reportedly exploited in targeted attacks ^[90].
Researchers demonstrated that logic bugs alone, without memory corruption, can be chained to escape the Microsoft Edge sandbox and execute code on Windows systems ^[14].
Researchers found vulnerabilities in the browsers built into several AI coding assistants (VS Code, Cursor, Copilot, Codex, Claude Desktop), allowing web pages to break out of the assistant’s browser sandbox ^[61].

Notable Threat Actor Activity

The China-linked APT group Volt Typhoon used a covert, ephemeral access network known as “Silent Train,” built from rapidly rotating chains of compromised devices, to conduct zero-day exploitation and strategic intrusions targeting hundreds of critical infrastructure networks ^[12]^[23]^[62]^[74]^[30].
Volt Typhoon also exploited a Cisco Catalyst SD-WAN flaw to deploy custom malware (KeyDrift) designed to steal encryption keys, with infrastructure overlapping the Silent Train network ^[9]^[30]^[87].
Chinese state-sponsored actors exploited a VMware ESX zero-day logging flaw (CVE-2026-41709) to reduce audit trail visibility, allowing operations by attackers with administrative privileges to go unlogged ^[10]^[33].
A suspected China-nexus threat actor leveraged PHP2Shell vulnerabilities to root 25 servers and breach a US government-affiliated network, including chaining with a high-severity Fragnesia Linux kernel privilege escalation bug ^[11]^[15]^[17].
The GOLD OGRE threat group used AI in the development, orchestration, and execution of Aur0ra ransomware operations ^[84].
A Ukrainian affiliate of Hive and Nefilim ransomware gangs was sentenced to 70 months in US prison for attacks targeting businesses and hospitals ^[34]^[53].
Attackers used fake ChatGPT and Claude projects to distribute Yoba malware, hiding malicious code behind signed binaries ^[60].
Malicious Firefox extensions impersonated popular crypto wallets to steal recovery phrases and private keys ^[89].
A threat actor impersonated AI bots from OpenAI, Anthropic, and Meta to scan for exposed credentials ^[39].
Attackers abused legitimate Mobile Device Management (MDM) platforms to deploy rogue remote management tools, turning device management into a pathway for remote access and persistence ^[93].
GitHub issues were weaponized in a supply chain attack campaign targeting 61 public repositories in less than an hour, exploiting vulnerable workflows ^[50].

Trends, Tools, or Tactics of Interest

AI is increasingly used both offensively and defensively in cybersecurity. Google introduced Gemini 4 Carbon, a frontier AI model outperforming predecessors in vulnerability discovery, exploitation, and patching ^[1]^[64].
Cisco open sourced Project Quarry, a rules language to detect AI agent attacks that emerge across sequences of benign actions ^[25].
Cisco Talos observed a new AI-enabled command-and-control framework in the wild, dubbed NIK C2 ^[86].
AI agents are now capable of controlling authenticated browsers, interacting with corporate applications, and accessing sensitive data while mimicking legitimate users ^[16].
The supply chain attack campaign “GhostAction” shifted toward targeting developer endpoints and cloud access, indicating evolving tactics among cybercrime groups ^[37].
Online scam volumes have doubled and now outpace phishing, with over six million scam detections in Q2 2026 ^[55].
Phishing remains the leading initial access technique, while ransomware and pre-ransomware cases have increased, with finance and public administration being the top-targeted industries ^[85].
Attackers are increasingly hiding malware behind signed binaries of AI tools to evade detection ^[60].
Credential exposure continues to be a significant risk, with 26,400 valid cloud and AI credentials found in public Gitee repositories ^[5].
Attackers are turning GitHub issues into attack vectors for supply chain campaigns, automating exploitation of vulnerable workflows ^[50].
The use of AI-enabled tools such as Gemini 4 Carbon and NIK C2, as well as AI-assisted attack orchestration by groups like GOLD OGRE, demonstrates the growing sophistication of threat actors ^[1]^[64]^[84]^[86].

Regulatory or Policy Developments Affecting the Security Industry

The UK released a shortlist of age verification methods for its upcoming under-16 social media ban, noting that some adults will also require verification ^[49].
The UK Information Commissioner’s Office (ICO) reprimanded Staffordshire Police following a serious breach of personal information related to domestic abuse cases ^[56].
CREST published a framework advocating a whole-ecosystem approach to strengthening cyber resilience across the financial services sector ^[54].
The US National Institute of Standards and Technology (NIST) published guidance for federal agencies on prioritizing post-quantum cryptography adoption to meet the 2031 transition deadline ^[57].
Microsoft again urged Entra ID administrators to migrate users to phishing-resistant authentication methods ahead of the planned retirement of SMS and voice authentication in February 2027 ^[24].
A federal appellate court ruled that West Virginia’s law barring disclosure of public officials’ personal data is unconstitutional ^[47].
US law enforcement seized the primary domain of Virtualine, a major bulletproof hosting provider used to facilitate cybercrime and ransomware operations ^[20]^[71].

Sources

Sony ISP subsidiary data breach exposes 2.5 million customer records - bleepingcomputer.com
Hackers Steal 2.6 Million Records From Sony’s Japanese ISP So-net - securityweek.com
Over 41,000 DHS Employee Records Leaked Online - securityweek.com
Massive Leak Exposes 41,000 Homeland Security Workers—Including Undercover ICE Agents - wired.com
Hacktivists leak 41,000 DHS staff records, revealing undercover ICE agents - helpnetsecurity.com
Leak site publishes data on more than 41,000 DHS employees obtained by hacktivists - cyberscoop.com
Cyberattack disrupts Belgian tax services before filing deadline - therecord.media
Japan Airlines warns of data breach as country grapples with multiple cyber incidents - therecord.media
University of New Mexico restores hospital systems, urges no contact with hackers - therecord.media
Most Servers on the Planet Are Vulnerable to This Firmware Code-Execution Flaw - wired.com
Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls - thehackernews.com
New Cisco firewall zero-day exploited to crash SSL VPN devices - bleepingcomputer.com
Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August - securityweek.com
Telegram Android Flaw Lets Attackers Run Code When Users Answer Voice Calls - thehackernews.com
Attacker Tried to Exploit Alpine Linux’s GitLab via CVSS 10.0 Flaw Its Ruby Left Open - thehackernews.com
Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities - securityweek.com
Exploitation attempts against recently patched Oracle EBS flaw have begun (CVE-2026-101767) - helpnetsecurity.com
Oracle celebrates end of Cybersecurity Awareness Month with quadruple trouble - theregister.com
Have an older iPhone or iPad? Apple has a security update for you - malwarebytes.com
Researcher Reveals How Logic Bugs Alone Cracked Microsoft Edge in $175,000 Pwn2Own Win - thehackernews.com
Researchers broke the browsers built into VS Code, Cursor, Copilot, Codex and Claude Desktop - helpnetsecurity.com
Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns - thehackernews.com
Volt Typhoon hides zero-day attacks using 'Silent Train' framework - bleepingcomputer.com
Volt Typhoon targeted enterprise control planes via ever-changing “Silent Train” relay network - helpnetsecurity.com
Researchers uncover Volt Typhoon’s covert, ephemeral network - cyberscoop.com
Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network - securityweek.com
Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys - thehackernews.com
Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN - blog.talosintelligence.com
China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility - thehackernews.com
Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day - securityweek.com
Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces - thehackernews.com
PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network - thehackernews.com
CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks - bleepingcomputer.com
AI used in Aur0ra ransomware testing and execution - sophos.com
Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison - securityweek.com
Serial ransomware crook gets 70 months behind bars for Nefilim, Hive roles - theregister.com
Attackers Hide Malware Behind Signed ChatGPT and Claude Binaries - infosecurity-magazine.com
Malicious Firefox extensions impersonate popular crypto wallets - malwarebytes.com
Attacker Relentlessly Scans for Credentials by Impersonating AI Bots - darkreading.com
Managed for Malice: How Attackers Turn MDM into Remote Access - huntress.com
Attackers turn GitHub issues into supply chain campaign against 61 public repos in less than an hour - theregister.com
Google's Gemini 4 Carbon Leads Benchmarks for Finding, Exploiting, and Patching Vulnerabilities - thehackernews.com
Google says Gemini 4 Carbon beats its predecessors at finding and fixing security flaws - helpnetsecurity.com
Cisco Open Sources Quarry to Catch AI Agent Attacks Hidden in Harmless Steps - securityweek.com
NIK C2: The new AI-enabled command-and-control framework - blog.talosintelligence.com
3 Ways AI Agents Already Operate in Your Browser - bleepingcomputer.com
GhostAction Hacking Wave Fizzles, But Attackers Lurk on in GitHub - darkreading.com
Online Scam Volumes Double to Overtake Phishing - infosecurity-magazine.com
IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases - blog.talosintelligence.com
26,400 Valid Cloud and AI Credentials Found Exposed in Public Gitee Repositories - thehackernews.com
Shortlist of age checks for the UK's under-16 social media ban is out, 'some' adults will need verifying - theregister.com
ICO Reprimands Staffordshire Police After Domestic Abuse Breach - infosecurity-magazine.com
CREST Urges Whole-Ecosystem Approach to Financial Cyber Resilience - infosecurity-magazine.com
NIST Publishes Guidance to Meet Federal Post-Quantum Deadlines - infosecurity-magazine.com
Microsoft urges Entra ID admins to migrate users to passkeys - bleepingcomputer.com
Court strikes down West Virginia law barring disclosure of public officials’ personal data - therecord.media
Police seize Virtualine bulletproof service tied to ransowmare, cybercrime - bleepingcomputer.com
Officials seize domain of top bulletproof hosting provider Virtualine - cyberscoop.com

Cybersecurity Brief – 2026-10-26

Mon, 26 Oct 2026 00:00:00 +0000

Major Incidents or Breaches

Genesys disclosed a security incident exposing customer data from internal systems. The Genesys Cloud, Genesys Engage, and Genesys Engage Cloud platforms were not affected ^[23].
Quest Diagnostics reported a breach impacting patient records and personal information ^[32].
953 online stores were found infected as part of a long-running malware campaign, where injected loader code served malicious payloads or remained dormant to avoid detection ^[26].
A Chinese national was extradited to the US for alleged involvement in a cryptocurrency investment scam that defrauded 174 victims of nearly $37 million ^[13].

Newly Discovered Vulnerabilities

Two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell, are being actively exploited in the wild. Industrial vendors including Siemens, Schneider Electric, and ABB confirmed some products are affected. Exploitation has shifted from probing to successful shell deployments against honeypots ^[15]^[22]^[25].
Two critical flaws were disclosed in Wasmtime, a WebAssembly runtime, allowing malicious modules to escape the intended sandbox ^[4].
An out-of-bounds write flaw in Google’s Brotli decoder affects Node.js, .NET, PowerShell, and Python packages, enabling code execution and prompting widespread patching efforts ^[28].
Unpatched vulnerabilities in Tailscale SSH allow a compromised device to gain root access on other reachable servers within the network ^[10].
The update process for the abandoned Popcorn Time streaming app was found to leave millions of devices exposed to remote hijacking ^[30].

Notable Threat Actor Activity

Ongoing exploitation attempts targeting the PHP2Shell vulnerabilities have been observed, with evidence of successful post-exploitation activity and suspected global scanning by North Korean actors ^[11]^[15]^[25].
An automated campaign, dubbed Gheist, is using stolen GitHub tokens to inject workflows that exfiltrate repository secrets via GitHub Actions logs ^[8].
A Microsoft 365 campaign has compromised 97 accounts across 79 organisations by leveraging adversary-in-the-middle relay attacks to capture and replay authentication tokens ^[7].
The uCreator Android spyware kit is being rented out to steal Telegram 2FA passwords and clone WeChat accounts by embedding itself in trojanised versions of the apps ^[6].
Dutch police arrested two individuals for conducting NFC relay attacks that drained over $400,000 from bank accounts, involving social engineering to trick victims into installing malicious apps and scanning credit cards ^[27].

Trends, Tools, or Tactics of Interest

Multiple headlines highlight the proliferation of RCE vulnerabilities, with attackers rapidly scanning for and exploiting new bugs such as PHP2Shell, Node2Shell, and others ^[3]^[28].
Attackers are leveraging malicious instruction files (e.g., AGENTS.md) placed in developer environments to hijack AI coding agents and install malicious npm packages ^[9]^[16].
New guidance from NIST, CISA, and NSA recommends treating incidents involving autonomous AI agents as standard security events, with a focus on tracking agent identity and authority ^[12].
Stolen reasoning traces from OpenAI models may facilitate the creation of cheaper rival AI systems, following a flaw in OpenAI’s compaction process ^[24].
Kali Linux 2026.3 was released, introducing six new security tools and desktop environment updates ^[14].
YARA-X 1.22.0 was released, delivering 11 improvements and 9 bugfixes ^[21].

Regulatory or Policy Developments

No significant regulatory or policy developments affecting the security industry were reported in the provided headlines.

Sources

Genesys Hack Exposes Customer Data From Internal Systems - securityweek.com
Patient records exposed in Quest breach: What you need to know - malwarebytes.com
953 Online Stores Infected in Long-Lasting Malware Campaign - securityweek.com
Chinese man extradited for role in $36 million cryptocurrency scam - bleepingcomputer.com
PHP2Shell security flaws now sucessfully exploited in the wild - bleepingcomputer.com
Industrial Vendors Check Products for PHP2Shell Vulnerabilities - securityweek.com
PHP2Shell Exploitation Moves From Probes to Working Shells - securityweek.com
Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes - thehackernews.com
Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages - securityweek.com
Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers - thehackernews.com
Popcorn Time’s forgotten updater left millions of devices exposed to hijacking - malwarebytes.com
PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity - thehackernews.com
Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs - thehackernews.com
Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations - thehackernews.com
uCreator Android Spyware Can Steal Telegram 2FA Passwords and Clone WeChat Accounts - thehackernews.com
Dutch Police Arrest Two Over NFC Relay Attacks That Drained $400,000+ From Bank Accounts - securityweek.com
⚡ Weekly Recap: This2Shell, That2Shell, Everything's an RCE? Rogue AI, Supply Chain Chaos and More - thehackernews.com
Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware - thehackernews.com
AI coding agents hijacked using AGENTS.md file in Downloads folder - bleepingcomputer.com
When an AI Agent Is the Incident, the Identity Record Is the Evidence - bleepingcomputer.com
Stolen AI Reasoning Could Help China Build Cheaper Rivals - securityweek.com
Kali Linux 2026.3 released with 6 new tools, desktop updates - bleepingcomputer.com
YARA-X 1.22.0 Release, (Sun, Oct 25th) - isc.sans.edu

Cybersecurity Brief – 2026-09-15

Tue, 15 Sep 2026 00:00:00 +0000

Major Incidents or Breaches

Hackers exploited a vulnerability in a VPN product used by Japan’s Digital Agency, resulting in a data breach that exposed the personal information of approximately 246,000 government employees ^[20]^[36].
Revolut unintentionally disclosed personal and financial information of users to a third party impersonating a government agency ^[43].
HBO Max’s official Reddit account was compromised and used to distribute malicious ads containing ClickFix attacks, leading to malware infections on Windows and macOS devices ^[23]^[39]^[45].

Newly Discovered Vulnerabilities

A critical vulnerability in LiteSpeed Web Server Enterprise allows a low-privilege website user to gain root access on a shared-hosting server, according to a cPanel advisory ^[6].
Cisco Secure Email Gateway is affected by a critical zero-day vulnerability (CVE-2026-76461) that enables unauthenticated attackers to execute arbitrary commands as root. This flaw is under active exploitation ^[7]^[18]^[40].
A new hardware attack named DDRop has been disclosed, which can bypass the memory protection of Intel TDX and AMD SEV-SNP confidential computing environments by silently dropping memory writes ^[9].
A maximum severity path traversal vulnerability (CVE-2026-85706) in GitLab Community Edition and Enterprise Edition puts software supply chains at risk ^[27].
A flaw in Telegram Desktop allowed hidden JavaScript to be embedded in messages, which could exfiltrate chat content when exported to HTML files ^[11].
Apple released a major update across all operating systems, patching over 200 vulnerabilities, including kernel flaws that could allow memory corruption, privilege escalation, system termination, and information leaks ^[33]^[37].

Notable Threat Actor Activity

A Chinese threat actor exploited a chain of recently patched Chrome and Windows zero-days to deliver the GRIMWEDGE JavaScript backdoor via spear-phishing ^[8].
The Red Heron group, suspected to be China-linked, rapidly exploited a recently disclosed Gitea RCE vulnerability to compromise 13 organizations across six countries ^[12].
Russian threat group Sandworm chained Cisco vulnerabilities to deploy an upgraded version of the Cyclops Blink botnet malware ^[26].
Ransomware gangs have begun exploiting a critical VMware vCenter RCE vulnerability, as warned by CISA ^[15].
Five alleged leaders of the Black Axe cybercrime syndicate, known for global cyber-enabled financial fraud, have been extradited to the United States to face charges ^[16].
An attacker gained and maintained root access inside the network of Thai broadband provider 3BB using the MeshCentral management tool and targeted subscriber credentials ^[10].

Trends, Tools, or Tactics of Interest

Social engineering campaigns are employing phony NDA documents to lure employees into moving conversations to WhatsApp and personal email, evading corporate security controls ^[1].
Threat actors are leveraging AI hallucinations to plant phishing links in AI-generated output, a tactic known as “slop squatting” ^[2].
Mass-scanning campaigns are targeting internet-exposed Vite development servers to extract cloud credentials and configurations from AWS and Azure environments ^[5]^[24].
Attackers are exploiting the Marimo RCE vulnerability to reach SSH bastions in as little as eight seconds, with AI accelerating the timeline from discovery to exploitation ^[3]^[14].
The whitelist-bypass tool tunnels traffic through commercial video-calling platforms using WebRTC, bypassing network domain restrictions ^[34].
Fake Bitrefill checkout pages are appearing in search results, tricking users into sending cryptocurrency to scammers ^[47].
A Twitch browser extension with 30,000 installs was found to be exposing users’ OAuth session tokens to a commercial bot service ^[22].
Google’s new search result redirects make it more difficult for users to verify link destinations before clicking, potentially increasing phishing risk ^[48].
Homebrew 7.0.0 introduces a built-in vulnerability scanner and stronger security controls ^[21].
WordPress is launching automated security reviews for every plugin release before distribution through its update API ^[13].

Regulatory or Policy Developments Affecting the Security Industry

Microsoft introduced an AI Code of Conduct establishing boundaries for cyberattack capabilities, chain of command, and safety constraints, differentiating between defensive research and operational attack use ^[38].
The Manhattan District Attorney’s Office seized 12 deepfake websites targeting around 1,200 victims, marking the largest legal action against harmful deepfake sites to date ^[31].
The CEO of Anthropic called for slowing the pace of frontier AI development to allow security and risk prevention efforts to catch up, prompting public debate and a response from China’s Ministry of Foreign Affairs advocating for international cooperation on AI ^[28]^[41].

Sources

Japan's Digital Agency says VPN flaw exposed 246,000 personnel records - bleepingcomputer.com
240,000 Hit by Data Breach at Japan’s Digital Agency - securityweek.com
Personal, Financial Info Exposed in Revolut Data Breach - securityweek.com
Hackers hijack HBO Max Reddit account to push malware in ClickFix ads - bleepingcomputer.com
Hacked HBO Max Reddit Account Used for Malware Delivery via ClickFix Attack - securityweek.com
HBO Max’s verified Reddit account hijacked to spread malware - malwarebytes.com
LiteSpeed Enterprise Flaw Could Let One Hosting Account Gain Root Access on a Shared Server - thehackernews.com
Cisco Secure Email Gateway Flaw Exploited in the Wild, Enables Root Command Execution - thehackernews.com
Cisco patches Secure Email Gateway zero-day exploited in attacks - bleepingcomputer.com
Root RCE Zero-Day in Cisco Secure Email Gateway Under Active Exploitation - securityweek.com
New DDRop Attack Breaks Intel TDX and AMD SEV-SNP Confidential Computing - thehackernews.com
Maximum Severity GitLab Flaw Puts Supply Chains at Risk - darkreading.com
Telegram Desktop Flaw Lets Hidden JavaScript Exfiltrate Messages From HTML Exports - thehackernews.com
Apple Updates Everything, (Mon, Sep 14th) - isc.sans.edu
Apple Patches 200 Vulnerabilities With New iOS 27, macOS Golden Gate 27 Releases - securityweek.com
China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE - thehackernews.com
Red Heron Exploits Gitea RCE to Compromise 13 Organizations Across Six Countries - thehackernews.com
'Sandworm' Chains Cisco Vulnerabilities to Deploy Cyclops Blink - darkreading.com
CISA: Critical VMware RCE flaw now exploited by ransomware gangs - bleepingcomputer.com
Suspected Black Axe gang leaders face cybercrime charges in the US - bleepingcomputer.com
3BB Attacker Used MeshCentral Backdoor for Root Access, Targeted Subscriber Credentials - thehackernews.com
Social Engineering Campaign Uses Phony NDAs to Avoid Detection - blog.knowbe4.com
Warning: “Slop Squatting” Directs AI Users to Phishing Pages - blog.knowbe4.com
Mass-Scanning Campaign Exploits Vite Flaw to Extract Cloud Credentials From Exposed Dev Servers - thehackernews.com
Hackers target exposed Vite dev servers to steal AWS, Azure secrets - bleepingcomputer.com
Human Attacker Exploits Marimo RCE, Reaches SSH Bastion in Eight Seconds - thehackernews.com
⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and Rootkits - thehackernews.com
whitelist-bypass – WebRTC Tunnels Through Video-Calling Platforms - darknet.org.uk
Search results are sending people to fake Bitrefill checkouts - malwarebytes.com
Twitch extension with 30K installs exposes users’ OAuth tokens - bleepingcomputer.com
Google’s new search redirects make links harder to check before you click - malwarebytes.com
Homebrew 7.0.0 gets built-in GUI, better security controls - bleepingcomputer.com
WordPress Adds Automated Plugin Reviews to Block High-Risk Updates Before Distribution - thehackernews.com
Microsoft AI Code of Conduct Sets Cyberattack Boundaries, Chain of Command, Safety Constraints - securityweek.com
New York Seizes a Dozen Celebrity Deepfake Websites - wired.com
Anthropic CEO: Time to Shift From Improving to Controlling AI - darkreading.com
Beijing Hits Back at Anthropic CEO’s Call to Curb China’s AI Development - securityweek.com

Cybersecurity Brief – 2026-07-08

Wed, 08 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

Accenture confirmed a security breach after a threat actor claimed to have stolen 35 GB of source code and other data, which was subsequently offered for sale online ^[17].
A small Ohio county reportedly paid $1 million to a cyber extortion group to prevent the public release of sensitive stolen data ^[31].
A critical flaw in GitHub Agentic Workflows was demonstrated to allow unauthenticated attackers to craft issues in public repositories and exfiltrate data from private repositories ^[10]^[27].
Ubiquiti disclosed seven critical vulnerabilities in UniFi OS, including a maximum-severity command injection flaw, and released security updates ^[15].
A hidden authentication backdoor was discovered in multiple Tenda router firmware versions, potentially granting attackers administrative access to the device’s web management panel ^[19].

Newly Discovered Vulnerabilities

Researchers disclosed GhostLock (CVE-2026-43499), a 15-year-old Linux kernel flaw enabling root access and container escape on most unpatched Linux distributions ^[5].
The Januscape vulnerability, a 16-year-old Linux kernel flaw, was revealed to allow virtual machine escape and arbitrary code execution on Intel and AMD systems running KVM ^[23]^[37].
A critical Gitea vulnerability (CVE-2026-20896) is under active exploitation, allowing attackers to bypass authentication with a single HTTP header and access repositories and secrets ^[32].
A critical flaw in Google Dialogflow CX could have allowed attackers with edit rights on one Code Block-enabled agent to compromise other agents in the same Google Cloud project ^[8]^[26].
A critical session isolation vulnerability in the Writer AI platform, now patched, could have exposed session tokens across tenants ^[12].
Four actively exploited vulnerabilities in Adobe, Joomla, and Langflow were added to CISA’s Known Exploited Vulnerabilities catalog due to evidence of active exploitation ^[6].
A recently patched maximum-severity vulnerability (CVE-2026-48282) in Adobe ColdFusion is being actively exploited in the wild ^[16]^[34].

Notable Threat Actor Activity

Chinese threat group UAT-7810 is actively evolving its malware, including the new LONGLEASH variant, to expand their Operational Relay Box (ORB) network by compromising primarily unpatched router devices ^[18].
Suspected China-aligned actors exploited vulnerabilities in Roundcube webmail software to target physics and engineering departments at US and Canadian universities for espionage ^[14].
Iran-linked threat actors have been observed using a modular command and control framework and compromising IT service providers to reach high-value targets in Israel ^[35].
A new Android malware operation, RedWing, is being offered as a bank fraud-as-a-service on Telegram, enabling even low-skill criminals to take over devices and steal banking credentials ^[7].
A Microsoft 365 device code phishing campaign, leveraging collaboration-themed lures and abusing the device-code flow, has been observed targeting M365 accounts since late June 2026 ^[9].
A suspected member of pro-Russian hacktivist groups CyberArmy of Russia Reborn and Z-Pentest was arrested in Spain ^[20].
Scammers are using fake job offers from well-known brands, nested redirects, and phishing tactics to compromise marketing professionals’ Google accounts ^[25]^[40].
New scams on Reddit and Discord are tricking users into giving up login codes through false report claims ^[39].

Trends, Tools, or Tactics of Interest

Attackers are exploiting flaws in GitHub Agentic Workflows by creating public issues to trigger workflows that can leak data from private repositories ^[10]^[27].
ActiveState highlighted that certain attack chains in GitHub Actions can evade traditional CI security scanners, indicating a need for improved governance and detection ^[21].
The RedWing malware-as-a-service model demonstrates increased accessibility of sophisticated Android banking fraud tools via Telegram ^[7].
Phishing campaigns are increasingly using brand impersonation, nested redirects, and fake prompts to evade detection and increase success rates ^[25]^[40].
Scammers are leveraging AI to create convincing fraudulent products, such as fake flowers, and to embed hidden trackers in AI-generated code ^[41]^[42].
CISA is reportedly using Anthropic’s Mythos AI platform to scan government software for vulnerabilities, indicating a trend toward AI-driven security assessments ^[33].
The use of modular malware frameworks by Iran-linked actors and evolving malware by Chinese groups shows a trend toward adaptable, persistent threat infrastructure ^[18]^[35].

Regulatory or Policy Developments Affecting the Security Industry

CISA ordered US federal agencies to patch a maximum-severity Adobe ColdFusion vulnerability by Friday in response to active exploitation ^[16].
Microsoft announced that Windows settings backup and restore will be enabled by default on Microsoft Entra-joined or hybrid-joined enterprise systems after upgrading to Windows 11 26H2 ^[24].

Sources

Accenture confirms breach after hacker offers stolen data for sale - bleepingcomputer.com
County Government Reportedly Paid $1 Million to Cyber Extortion Group - securityweek.com
Public GitHub Issue Could Trick GitHub Agentic Workflows Into Leaking Private Repo Data - thehackernews.com
'GitLost' Flaw Leaks Private Data From GitHub's Agentic Workflows - darkreading.com
Ubiquiti warns of new max severity UniFi OS vulnerability - bleepingcomputer.com
Hidden backdoor in Tenda router firmware grants admin access - bleepingcomputer.com
15-Year-Old GhostLock Flaw Enables Root and Container Escape on Most Linux Distros - thehackernews.com
New Januscape Linux flaw allows VM escape on Intel, AMD devices - bleepingcomputer.com
Linux Kernel Vulnerability Allows VM Escape on Intel and AMD Systems - securityweek.com
Critical Gitea Flaw Under Active Exploitation, Researchers Warn - securityweek.com
Rogue Agent Flaw Could Have Let Attackers Hijack Google Dialogflow CX Chatbots - thehackernews.com
Dialogflow CX 'Rogue Agent' Flaw Enabled AI Chatbot Data Theft - darkreading.com
Writer AI Flaw Could Let Agent Previews Leak Session Tokens Across Tenants - thehackernews.com
CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV - thehackernews.com
CISA orders feds to patch max severity ColdFusion flaw by Friday - bleepingcomputer.com
Critical Adobe ColdFusion Vulnerability Exploited in Attacks - securityweek.com
Chinese hackers develop LONGLEASH malware to expand ORB network - bleepingcomputer.com
Suspected China-Aligned Hackers Exploit Roundcube Flaws Against Universities - thehackernews.com
Iran-Linked Hackers Using Modular C&C Framework in Cyberattacks - securityweek.com
RedWing MaaS Packages Android Bank Fraud as a Telegram Rental Service - thehackernews.com
DEBULL Tooling Abuses Microsoft Device-Code Flow to Target M365 Accounts - thehackernews.com
Spain arrests suspected member of pro-Russian hacktivist groups - bleepingcomputer.com
Big Brand Jobs Scam Targets Marketing Pros' Google Accounts - darkreading.com
Fake Netflix, Coca-Cola, and FIFA job scams target marketers - malwarebytes.com
How the Reddit and Discord false report scam steals accounts - malwarebytes.com
The GitHub Actions Attack Pattern Your CI Security Scanners Miss - bleepingcomputer.com
Claude Code’s hidden tracker was an “experiment,” says Anthropic - malwarebytes.com
Scammers are using AI to sell impossible flowers - malwarebytes.com
CISA Reportedly Using Anthropic’s Mythos to Scan Government Software for Flaws - securityweek.com
Microsoft to enable Windows settings backup by default for orgs - bleepingcomputer.com

Cybersecurity Brief – 2026-05-04

Mon, 04 May 2026 00:00:00 +0000

Major Incidents or Breaches

Instructure, an educational technology company, confirmed a data breach following claims by the ShinyHunters extortion group. Data stolen includes names, email addresses, student ID numbers, and user messages. Service disruptions were also reported.
A coordinated international law enforcement operation involving U.S. and Chinese authorities resulted in the arrest of 276 suspects, the shutdown of nine cryptocurrency scam centers, and the seizure of $701 million. The operation targeted large-scale cryptocurrency investment fraud schemes.

Newly Discovered Vulnerabilities

Wireshark released version 4.6.5, addressing 43 vulnerabilities (38 CVEs) and 35 additional bugs.

Notable Threat Actor Activity

The ShinyHunters extortion group claimed responsibility for the Instructure breach, threatening to leak stolen data.
Researchers identified large-scale abuse of Telegram’s Mini App feature by threat actors to conduct cryptocurrency scams, impersonate well-known brands, and distribute Android malware.

Trends, Tools, or Tactics of Interest

Microsoft Defender is generating widespread false-positive detections, incorrectly identifying legitimate DigiCert root certificates as Trojan:Win32/Cerdigent.A!dha, and in some cases removing certificates from Windows systems.
Threat actors are leveraging Telegram Mini Apps to facilitate both financial fraud and malware delivery, expanding attack vectors beyond traditional phishing and messaging schemes.

Regulatory or Policy Developments Affecting the Security Industry

The U.S. Department of Defense reached agreements with seven technology companies (Google, Microsoft, Amazon Web Services, Nvidia, OpenAI, Reflection, and SpaceX) to deploy their artificial intelligence solutions on classified military systems, aimed at supporting operational decision-making.

Cybersecurity Brief – 2026-04-22

Wed, 22 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

French Government Agency Data Breach: France Titres, responsible for issuing administrative documents, confirmed a breach after a hacker claimed to have stolen citizen data and offered it for sale.
Healthcare Data Breaches in the US: Data breaches were reported by Southern Illinois Dermatology, Saint Anthony Hospital, and North Texas Behavioral Health Authority, collectively affecting approximately 600,000 individuals.
Kelp DAO Crypto Heist: North Korean threat actors are attributed to a $290 million theft from Kelp DAO, exploiting LayerZero’s DVN by compromising RPC endpoints and using DDoS attacks to force failover to malicious infrastructure.
Perforce Server Exposures: Over 1,500 Perforce P4 version control servers were found to be unsecured, exposing sensitive data from major organizations.

Cybersecurity Brief – 2026-04-15

Wed, 15 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

Kraken Cryptocurrency Exchange Breach: Kraken confirmed a cybercrime group is attempting to extort the company by threatening to release videos showing internal systems hosting client data, following an insider breach.
McGraw-Hill Data Breach: McGraw-Hill disclosed that hackers exploited a Salesforce misconfiguration to access internal data, following an extortion threat.
Basic-Fit Data Breach: Europe’s largest gym chain, Basic-Fit, reported a breach affecting 1 million members, with stolen data including names, dates of birth, and bank account details.
RCI Hospitality Data Breach: RCI Hospitality disclosed a breach due to an IDOR vulnerability in RCI Internet Services, exposing contractor data.
Fake Ledger Live App on Apple’s App Store: A malicious Ledger Live app for macOS, distributed via Apple’s App Store, stole approximately $9.5 million in cryptocurrency from at least 50 victims.
Malicious Chrome Extensions Campaign: Researchers identified over 100 malicious Chrome extensions in the official Chrome Web Store, stealing Google OAuth2 tokens, deploying backdoors, and carrying out ad fraud. The campaign affected at least 20,000 users, with data also exfiltrated from Google and Telegram accounts.

Newly Discovered Vulnerabilities

Microsoft Patch Tuesday (April 2026): Microsoft released patches for 167 vulnerabilities, including two zero-days-one affecting SharePoint Server and another publicly disclosed flaw. Over half of the vulnerabilities were privilege escalation bugs.
PHP Composer Vulnerabilities: Two high-severity flaws in PHP Composer could allow arbitrary command execution. Patches have been released.
Adobe Vulnerabilities: Adobe issued patches for 55 vulnerabilities across 11 products, with critical ColdFusion vulnerabilities noted as especially at risk for exploitation.
SAP Critical ABAP Vulnerability: SAP released 19 new security notes addressing flaws in over a dozen products, including a critical ABAP vulnerability.
ICS Patch Tuesday: Eight major industrial vendors (Siemens, Schneider Electric, Aveva, Rockwell Automation, ABB, Phoenix Contact, Mitsubishi Electric, Moxa) published advisories and patches for newly identified vulnerabilities.
Windows and Adobe Acrobat Exploited Vulnerabilities: Organizations were warned about actively exploited vulnerabilities in Windows and Adobe Acrobat that enable privilege escalation and remote code execution.
Windows 10 and 11 Security Updates: Microsoft released cumulative and extended security updates (KB5082200, KB5083769, KB5082052) addressing vulnerabilities, including two zero-days.
Google Pixel Rust-Based DNS Parser: Google integrated a Rust-based DNS parser into Pixel 10 modem firmware to mitigate memory safety vulnerabilities.

Notable Threat Actor Activity

Mirax Android RAT: The Mirax remote access trojan has infected over 220,000 devices, primarily targeting Spanish-speaking countries via Meta platform ads. Compromised devices are being converted into SOCKS5 proxies.
AI-Driven Pushpaganda Scam: A novel ad fraud scheme leverages AI-generated content and SEO poisoning to distribute scareware and perpetrate ad fraud via Google Discover.
Triad Nexus Cybercrime Operation: Triad Nexus continues to evade international sanctions by abusing major infrastructure providers, complicating takedown efforts.
Telegram Hosting Sanctioned Crypto Scam Market: Telegram is hosting Xinbi Guarantee, a sanctioned $21 billion crypto scam operation, despite UK government designations.
Omnistealer Malware: Omnistealer is targeting password managers, saved logins, cloud storage, and crypto wallets, using blockchain-based techniques for data exfiltration.

Trends, Tools, or Tactics of Interest

AI in Cybersecurity:
- OpenAI launched GPT-5.4-Cyber, a model optimized for defensive cybersecurity applications, following Anthropic’s release of Mythos. Both models are driving increased focus on AI-powered cyber defense and accelerating the pace of vulnerability discovery and exploitation.
- The Cloud Security Alliance (CSA) is urging CISOs to prepare for high-velocity cyberattacks enabled by advanced AI models.
- KnowBe4 released Agent Risk Manager to address risks from autonomous AI agents.
- Increased scanning activity targeting AI models (e.g., Claude, OpenClaw, HuggingFace) has been observed since March 2026.
EDR-Killer Ecosystem Expansion: Threat actors are increasingly using bring-your-own-vulnerable-driver (BYOVD) techniques to bypass endpoint detection and response (EDR) solutions, necessitating stronger defensive measures.
Zero Trust Adoption: Stolen credentials remain a primary breach vector, with identity-first Zero Trust approaches being highlighted for their effectiveness in limiting privilege escalation and lateral movement.
Social Media Manipulation: Simulated wargame exercises are demonstrating the effectiveness of bot-driven influence campaigns in manipulating public opinion and elections.
Memory-Safe Programming: Google’s adoption of Rust for DNS parsing in Pixel devices reflects a growing industry trend toward memory-safe programming languages for security-critical components.

Regulatory or Policy Developments

UK Sanctions on Crypto Scammers: The UK government designated Xinbi Guarantee as a sanctioned enabler of crypto scams and human trafficking, but enforcement is hindered by continued operation on Telegram.
Microsoft’s Investment in Japan: Microsoft announced a $10 billion investment to accelerate AI adoption, workforce training, and cybersecurity partnerships in Japan.
CSA Guidance on AI Threats: The Cloud Security Alliance is advising CISOs to prepare for the accelerated threat landscape resulting from advanced AI models like Mythos.
Microsoft Hardware Developer Account Policy: Microsoft introduced a fast-track reinstatement process for Windows Hardware Program developer accounts following widespread suspensions.

Cybersecurity Brief – 2026-04-09

Thu, 09 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

Bitcoin Depot Hack
- Bitcoin Depot, a major Bitcoin ATM operator, reported a breach in which attackers stole approximately $3.665 million from its crypto wallets. Attackers gained access to credentials and transferred over 50 bitcoins out of company wallets.
Massachusetts Hospital Cyberattack
- Signature Healthcare in Massachusetts experienced a cyberattack that forced ambulance diversions, cancellation of some services, and disruption of pharmacy operations.
Zendesk Ticket Theft by UNC6783
- Threat actor UNC6783 compromised business process outsourcing (BPO) providers to steal corporate Zendesk support tickets from high-value companies across multiple sectors.
Magento E-commerce Card Skimming Campaign
- Nearly 100 online stores running the Magento platform were impacted by a campaign embedding credit card-stealing code within a pixel-sized SVG image.
TeamPCP Supply Chain Attack Update
- TeamPCP supply chain campaign update reveals Cisco source code was stolen via a breach linked to the Trivy security scanner. Google GTIG tracks the group as UNC6780.

Cybersecurity Brief – 2026-03-31

Tue, 31 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

The Dutch Ministry of Finance took its treasury banking portal and some systems offline following a detected cyberattack, as investigations into the breach continue.
Healthcare IT firm CareCloud disclosed a data breach exposing sensitive patient data and causing an eight-hour network disruption.
The European Commission reported a cyber intrusion and data theft, with the ShinyHunters group claiming to have stolen over 350GB of information from Commission cloud systems.
The FBI confirmed Iranian hackers compromised the personal email account of Kash Patel, noting the data accessed was outdated.
Researchers report that nearly 66 billion stolen identity records are now circulating on criminal forums, a 23% increase from the previous year.
Stolen tax documents are being actively sold on the dark web, with prices ranging from $4 to $20 per identity.
TeamPCP supply chain campaign continues to expand, with Telnyx targeted and Databricks investigating an alleged compromise. The campaign involves dual ransomware operations and data leaks, including AstraZeneca data.

Newly Discovered Vulnerabilities

Citrix NetScaler ADC and Gateway appliances are affected by a critical memory leak vulnerability (CVE-2026-3055) that is being actively exploited to obtain sensitive data, including authenticated administrative session IDs. CISA has ordered U.S. federal agencies to patch the flaw by Thursday.
F5 BIG-IP APM vulnerability (CVE-2025-53521), initially classified as a high-severity DoS, has been reclassified as a critical remote code execution (RCE) vulnerability. Active exploitation has been observed, with attackers deploying webshells on unpatched devices.
A previously unknown vulnerability in OpenAI ChatGPT allowed exfiltration of sensitive conversation data without user consent. Additionally, a critical vulnerability in OpenAI Codex was discovered that could have enabled compromise of GitHub tokens.
A critical, alleged “no-click” vulnerability in Telegram, reportedly triggered by a corrupted sticker and rated 9.8 CVSS, is being disputed by Telegram.
A newly identified RoadK1ll WebSocket implant enables lateral movement within breached networks.
Axios npm package versions 1.14.1 and 0.30.4 were compromised in a supply chain attack, pushing a malicious dependency.
Apple added a security feature in macOS Tahoe 26.4 to block potentially harmful commands in Terminal, specifically targeting ClickFix attack vectors.

Notable Threat Actor Activity

Russian-origin CTRL remote access toolkit is being distributed via malicious LNK files masquerading as private key folders. The toolkit hijacks RDP sessions using FRP tunnels.
Russian APT Star Blizzard is using the DarkSword iOS exploit kit in campaigns targeting government, higher education, financial, legal, and think tank sectors.
Iranian state-affiliated threat group Handala Hack has been linked to recent attacks, and Iran-linked groups are increasingly turning to high-volume, low-impact cyberattacks, often leveraging AI.
The ShinyHunters group claimed responsibility for the European Commission data theft.
TeamPCP is running dual ransomware operations and leveraging compromised software supply chains to target multiple organisations.

Trends, Tools, or Tactics of Interest

Secrets sprawl is accelerating, with GitGuardian reporting a significant increase in exposed secrets across public Git repositories in 2025.
The DeepLoad malware loader, distributed via ClickFix social engineering, uses AI-assisted code obfuscation and WMI persistence to evade detection and steal browser credentials.
LLMs (Large Language Models) are increasingly used by attackers and defenders; however, improper use can inadvertently weaken access controls due to errors or hallucinations in generated policy code.
Application control bypass techniques are being used for data exfiltration, highlighting ongoing risks of data loss even where backup policies are robust.
AI-powered SOC agents are being evaluated for their impact on alert fatigue and operational efficiency, with Gartner providing guidance on assessment.
Manufacturing and healthcare sectors continue to struggle with access management, often viewing it as a roadblock, while attackers exploit weak password practices.

Regulatory or Policy Developments Affecting the Security Industry

CISA issued a directive requiring U.S. federal agencies to patch Citrix NetScaler appliances against an actively exploited vulnerability by Thursday.
Apple has implemented mandatory age checks for certain UK users and introduced new macOS security features to counter emerging threats like ClickFix.

Cybersecurity Brief – 2026-02-13

Fri, 13 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Dutch telecommunications provider Odido suffered a cyberattack resulting in exposure of personal data belonging to 6.2 million customers.
Romania’s national oil pipeline operator Conpet S.A. confirmed data theft by the Qilin ransomware gang.
ApolloMD disclosed a data breach impacting 626,000 individuals, with patient information from affiliated physicians and practices stolen.
Hackers breached Senegal’s national biometric database, compromising personal and biometric data of nearly 20 million residents.
The Outlook add-in AgreeTo, after being abandoned by its developer, was repurposed into a phishing kit that stole 4,000 credentials and payment data.

Newly Discovered Vulnerabilities

Apple patched a zero-day vulnerability (CVE-2026-20700) in the ‘dyld’ component, which allowed arbitrary code execution and was exploited in the wild.
A critical pre-authentication remote code execution vulnerability in BeyondTrust Remote Support and Privileged Remote Access appliances is being actively exploited following the public release of a proof-of-concept.
The WPvivid Backup & Migration plugin for WordPress (900,000+ installs) is vulnerable to a critical RCE flaw allowing attackers to upload arbitrary files.
Multiple vulnerabilities in Windows LNK shortcut files were disclosed, enabling attackers to deploy malicious payloads, though Microsoft does not classify them as vulnerabilities.
Ivanti EPMM zero-day bugs continue to be exploited in active attacks.

Notable Threat Actor Activity

Google reported North Korea-linked UNC2970 using the Gemini AI model for reconnaissance and attack support.
The Lazarus Group launched a campaign targeting npm and PyPI repositories with malicious packages under the guise of fake recruitment, aiming to compromise developers.
Google observed state-backed actors from Russia, China, North Korea, and Iran, as well as cybercriminals and hacktivists, targeting the global defense sector.
The Qilin ransomware gang was identified as responsible for the Conpet S.A. breach.
30 malicious Chrome extensions, posing as AI tools and installed by over 300,000 users, were used to steal credentials, emails, and browsing data.
The AMOS infostealer is targeting macOS users via popular AI apps and extension marketplaces to harvest credentials.
AI website builders are being leveraged by criminals to clone and impersonate major brands for phishing and fraud campaigns.

Trends, Tools, or Tactics of Interest

Voice phishing (vishing) kits with real-time control capabilities have emerged, enabling threat actors to bypass multifactor authentication.
Sophisticated phishing campaigns are bypassing Microsoft 365 MFA, targeting North American organizations.
Ransomware groups are increasingly using “naming and shaming” tactics, exposing corporate data on leak sites to pressure victims.
Attackers are increasingly abusing trusted tools and established methods, rather than relying on novel exploits.
AI prompt-based RCE and “Claude 0-click” vulnerabilities are being discussed in the context of new attack vectors.
AI recommendation poisoning was uncovered in 31 companies across 14 industries, facilitated by turnkey tools.
Criminals are using AI-assisted website builders to rapidly clone legitimate brand websites for phishing.
Abandoned software projects, such as the AgreeTo Outlook add-in, are being hijacked and weaponised for credential theft.
Booz Allen released Vellox Reverser, an AI-powered tool for automated malware analysis and reverse engineering.
SpecterOps launched BloodHound Scentry, a platform for identity attack path management and analysis.

Regulatory or Policy Developments Affecting the Security Industry

Russia is attempting to block WhatsApp and Telegram as part of a broader crackdown on non-government-controlled communication platforms.
Microsoft announced forthcoming “Windows Baseline Security” measures, enabling runtime integrity safeguards by default to ensure only properly signed software runs.
China has revived the Tianfu Cup hacking contest with increased secrecy and reduced rewards.
Meta is facing landmark trials alleging failure to protect children from sexual exploitation, grooming, and addiction-related harms on its platforms.

Cybersecurity Brief – 2026-01-13

Tue, 13 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Target Corporation: Hackers claim to have stolen and are selling internal source code from Target, with samples published online. Target’s development server has been taken offline.
University of Hawaii Cancer Center: Ransomware attack in August 2025 resulted in theft of participant data, including documents with Social Security numbers dating back to the 1990s.
Endesa (Spanish Energy Provider): Data breach disclosed, with hackers accessing customer contract-related information, including personal details.
BreachForums: The notorious cybercriminal forum was breached, exposing data on 324,000 administrators and members.
Manage My Health (New Zealand): Identified as a top breach in recent threat intelligence reporting, affecting patient portals and healthcare data.
Instagram: Data leak incident where user data appeared on the dark web, coinciding with a password reset vulnerability (see below).
Apex Legends: Live matches disrupted as threat actors hijacked player characters, disconnected users, and changed nicknames.

Newly Discovered Vulnerabilities

n8n Workflow Automation Platform:
- “Ni8mare” vulnerability impacts nearly 60,000 online instances; maximum-severity flaw remains largely unpatched.
- Supply chain attack observed, with malicious npm packages masquerading as integrations to steal OAuth credentials from developers.
Gogs (Git Service): High-severity remote code execution (RCE) flaw exploited in zero-day attacks. CISA has ordered US federal agencies to patch.
Instagram: Password reset vulnerability allowed third parties to send reset emails to users, contributing to a recent data leak.
Telegram: Hidden proxy links can expose user IP addresses with a single click due to how proxy links are handled. Telegram has announced plans for a fix.

Notable Threat Actor Activity

GoBruteforcer Botnet: New campaigns target over 50,000 Linux servers, especially those supporting cryptocurrency and blockchain projects, exploiting weak credentials and AI-generated configurations.
APT28 (Russia): Targeting energy research and defense collaboration entities by impersonating webmail and VPN portals (Microsoft OWA, Google, Sophos VPN).
Kimsuky (North Korea): FBI flagged QR-code phishing (“quishing”) campaigns targeting US and foreign government agencies, NGOs, and academia.
LLM/AI Service Exploitation: Multiple campaigns targeting exposed large language model (LLM) endpoints and misconfigured proxy servers to access sensitive APIs and data.
VoidLink Malware: Discovery of a stealthy, cloud-native Linux malware framework, attributed to a Chinese threat cluster, designed for persistence and evasion in cloud environments.
Facebook Credential Theft: Increased use of “browser-in-the-browser” (BitB) phishing techniques to steal Facebook login credentials over the past six months.

Trends, Tools, or Tactics of Interest

Supply Chain Attacks: Growing use of malicious npm packages for credential theft, specifically targeting workflow automation platforms.
Botnet Evolution: GoBruteforcer botnet demonstrates ongoing adaptation, now preying on servers with weak or AI-generated credentials.
AI and LLM Security: Surge in attacks against exposed LLM endpoints and APIs, highlighting expanding attack surfaces in organizations’ AI deployments.
Phishing Techniques: Rise in “quishing” (QR-code phishing) and “browser-in-the-browser” attacks, increasing the sophistication of credential theft campaigns.
Healthcare AI Adoption: Anthropic launched Claude AI for healthcare, introducing HIPAA-ready tools for providers and payers, reflecting broader AI integration in sensitive sectors.
Endpoint Security Expansion: Hexnode announced entry into endpoint security with its new XDR (Extended Detection and Response) platform.

Regulatory or Policy Developments Affecting the Security Industry

CISA Directive: US federal agencies ordered to patch Gogs RCE vulnerability exploited in active attacks.
EU Regulatory Review: The European Union set a February deadline for its verdict on Google’s $32B acquisition of Wiz, following US approval.
Deepfake Regulation: Global regulators are scrutinizing Grok, an AI tool, over its role in generating illegal sexual deepfake content, including child sexual abuse material.
Privacy and Cybersecurity Law Complexity: Ongoing analysis indicates compliance challenges will persist into 2026, with limited progress on comprehensive federal cybersecurity legislation.

Cybersecurity Brief – 2025-12-24

Wed, 24 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

The French national postal service experienced a cyberattack that disrupted online services, including digital banking and postal operations, affecting millions of users.
Baker University disclosed a data breach affecting over 53,000 individuals, with attackers accessing personal, health, and financial information after compromising the network a year prior.
Nissan confirmed exposure of personal information for 21,000 customers due to a compromise of Red Hat’s GitLab instances.
The U.S. Department of Justice seized a domain and database used in a $14.6 million bank account takeover scheme, which involved phishing and credential theft.
Hacktivists claimed to have scraped nearly all content from Spotify, raising concerns about data exposure.
INTERPOL coordinated an operation across 19 African countries, resulting in 574 arrests and the recovery of $3 million, dismantling business email compromise (BEC), ransomware, and cyber-fraud networks.

Newly Discovered Vulnerabilities

Two malicious Chrome extensions, both named “Phantom Shuttle,” were discovered in the Chrome Web Store. These extensions intercepted user traffic, stole credentials from over 170 sites, and posed as proxy service plugins.
A malicious npm package with over 56,000 downloads was found to steal WhatsApp credentials and data, while also providing legitimate functionality to evade detection and deploying a backdoor.

Notable Threat Actor Activity

The Evasive Panda APT group was analyzed for using poisoned DNS requests to deliver the MgBot implant. The infection chain includes shellcode encrypted using DPAPI and RC5.
The WebRAT malware is being spread via fake vulnerability exploit repositories on GitHub, specifically targeting cybersecurity researchers by masquerading as proof-of-concept code.
State-sponsored North Korean operatives attempted to infiltrate Amazon through fraudulent IT job applications, with Amazon reportedly fending off approximately 1,800 such attempts.
Chinese cybercriminals are leveraging Telegram to run large-scale cryptocurrency scams, contributing to the growth of darknet markets.

Trends, Tools, or Tactics of Interest

Phishing campaigns are abusing free Cloudflare Pages services to host malicious content and conduct credential theft.
Brushing scams are on the rise, where individuals receive unsolicited packages as a method for fraudsters to validate stolen data and boost seller ratings.
Microsoft Teams will enable messaging safety features by default in January to better protect against malicious content.
The Google Workspace Password Manager (“Passwd”) was detailed, highlighting its business-focused design for secure credential management.
ServiceNow announced the acquisition of Armis for $7.75 billion, aiming to enhance autonomous cybersecurity capabilities and build a proactive AI-driven security stack.

Regulatory or Policy Developments

Italy’s antitrust authority fined Apple €98.6 million ($116 million) for using its App Tracking Transparency (ATT) framework to restrict competition in the App Store. Apple has announced plans to appeal the decision.
The healthcare industry continues to oppose proposed changes to the US HIPAA Security Rule, arguing that the new rules are insufficient given the rise in healthcare-targeted cyberattacks.

Cybersecurity Brief – 2025-12-23

Tue, 23 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

Nissan confirmed that thousands of customer records were compromised due to the Red Hat data breach in September.
The University of Phoenix disclosed a data breach impacting nearly 3.5 million students, staff, and suppliers, attributed to the Clop ransomware group.
Coupang, a major e-commerce company, reported a data breach affecting 33.7 million users, with unauthorized access to personal data persisting for almost five months.
The Romanian National Water Authority (Administrația Națională Apele Române) suffered a ransomware attack over the weekend.
France’s national postal service and associated banking operations experienced significant disruption from a cyberattack, impacting package deliveries and online payments during the Christmas period.
Pornhub warned users of potential sextortion emails following a data exposure incident.
The UK government acknowledged an ongoing investigation into a cyber incident after reports that hackers linked to China accessed thousands of confidential documents.

Newly Discovered Vulnerabilities

Over 115,000 WatchGuard Firebox firewall devices remain unpatched and exposed to a critical remote code execution (RCE) vulnerability in the Fireware OS’s iked process, which is being actively exploited in the wild. WatchGuard has released a patch.
A new phishing kit, “BlackForce,” was identified leveraging Man-in-the-Browser (MitB) techniques to steal credentials and bypass multi-factor authentication (MFA).
A malicious npm package masquerading as a WhatsApp API was discovered, capable of intercepting messages, collecting contacts, and stealing login tokens.
The latest variant of the MacSync information stealer for macOS is being distributed via a digitally signed, notarized Swift application, allowing it to evade Gatekeeper checks and eliminating the need for user terminal interaction.

Notable Threat Actor Activity

The Clop ransomware group was responsible for the University of Phoenix breach, continuing its campaign against large organizations.
A Ukrainian national pleaded guilty in the US to conspiracy to commit computer fraud as an affiliate of the Nefilim ransomware gang, targeting high-revenue businesses internationally.
An Interpol-led operation (Operation Sentinel) resulted in 574 arrests and the recovery of $3 million related to business email compromise, extortion, and ransomware, and enabled the decryption of six ransomware strains.
ATM attacks using Ploutus malware led to charges against 54 individuals, including members of the Tren de Aragua crime syndicate.
Android SMS stealer malware is actively targeting Telegram users in Uzbekistan, with attackers refining their methods.

Trends, Tools, or Tactics of Interest

Attackers are increasingly targeting trusted edge devices, including firewalls and browser add-ons, to achieve significant impact without large-scale attacks.
The use of notarized, signed applications to bypass macOS security controls is on the rise, as demonstrated by the MacSync malware.
Phishing kits, such as BlackForce, are adopting advanced MitB tactics to defeat MFA protections.
Malicious npm packages continue to pose supply chain risks, as seen with the fake WhatsApp API library.

Regulatory or Policy Developments

The US Federal Communications Commission (FCC) announced a ban on all drones and critical components manufactured in foreign countries, citing national security concerns.

Cybersecurity Brief – 2025-11-12

Wed, 12 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

GlobalLogic, a Hitachi group company, is notifying over 10,000 current and former employees of data theft following a breach of Oracle E-Business Suite (EBS).
The Rhadamanthys infostealer malware operation has been disrupted, with operators and customers losing access to their servers.
A Chinese national known as the “Bitcoin Queen” was sentenced in London to over 11 years in prison for laundering Bitcoin from a $7.3 billion cryptocurrency investment scam.

Newly Discovered Vulnerabilities

Microsoft’s November 2025 Patch Tuesday addressed 63 vulnerabilities, including one actively exploited Windows kernel zero-day and several critical flaws. Emergency and cumulative updates were also released for Windows 10 and Windows 11 to address security vulnerabilities and ESU enrollment issues.
Synology patched a critical remote code execution vulnerability in BeeStation products, demonstrated at Pwn2Own Ireland.
Gladinet’s Triofox file-sharing and remote-access platform was found to have a critical vulnerability that allowed attackers to exploit the built-in antivirus feature to gain SYSTEM privileges and deploy remote access tools.
SAP released patches for multiple vulnerabilities, including a maximum severity flaw in SQL Anywhere Monitor due to hardcoded credentials and a critical code execution issue in Solution Manager.
Adobe released security updates addressing 29 vulnerabilities across multiple products, including InDesign, InCopy, Photoshop, Illustrator, Pass, Substance 3D Stager, and Format Plugins.
A critical zero-day vulnerability affecting Samsung mobile devices was exploited in the wild to deliver LANDFALL spyware.
Mozilla introduced new fingerprinting protections in Firefox, reducing the number of trackable users.
A new side-channel attack, dubbed “Whisper Leak,” allows attackers intercepting network traffic to infer user prompt topics in large language model (LLM) conversations, despite end-to-end encryption.

Notable Threat Actor Activity

Threat actors are distributing a new banking malware called “Maverick” via WhatsApp, targeting major Brazilian banks. Maverick shares similarities with the Coyote banking malware.
GootLoader malware has resurfaced, now using a novel font-based obfuscation technique to hide malicious payloads on compromised WordPress sites.
A malicious npm package, “@acitons/artifact”, was discovered typosquatting the legitimate “@actions/artifact” package, targeting GitHub-owned repositories.
The Fantasy Hub Android remote access trojan (RAT) is being sold on Russian-speaking Telegram channels as a Malware-as-a-Service (MaaS), turning Telegram into a distribution hub for threat actors.
Kimsuky (DPRK-linked) APT group is exploiting Google Find Hub to compromise South Korean Android devices, remotely wiping devices and abusing the KakaoTalk messaging app.
RansomHub ransomware was detected during an in-progress attack, initiated via fake browser updates and leading to domain-admin privilege escalation.
Scammers are using AI-generated fake faces combined with real body images in extortion scams, and leveraging AI voice cloning and open-source data for social engineering attacks, particularly targeting the elderly.
Thieves are increasingly phishing Apple ID credentials through fake “Find My” messages to unlock stolen iPhones.

Trends, Tools, or Tactics of Interest

AI-enabled supply chain attacks increased by 156% over the past year, with CISOs advised to reassess traditional defenses.
Script-kiddie-level phishing campaigns remain effective at rapidly stealing credentials, even with poorly crafted lures.
The use of Telegram as a central hub for malware distribution and MaaS offerings is increasing.
Threat actors are exploiting built-in software features (e.g., antivirus in Triofox) to escalate privileges and deploy malware.
Fake browser update lures are being used as initial access vectors for ransomware attacks.
Social engineering attacks are leveraging AI-generated content and public data to bypass human defences.

Regulatory or Policy Developments

The US Department of Defense began enforcement of Cybersecurity Maturity Model Certification (CMMC) requirements for contractors on 10 November 2025.
Microsoft announced end of security update support for Windows 11 23H2 Home and Pro editions; extended security updates for Windows 10 are now available.
Firefox introduced new privacy protections to reduce user tracking.
Tenzai, an Israeli startup, raised $75 million in seed funding to develop an AI-powered penetration testing platform.

Cybersecurity Brief – 2025-07-16

Wed, 16 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Century Support Services, a Pennsylvania-based debt settlement firm, disclosed a data breach impacting 160,000 individuals after its systems were compromised in November 2024.
US department store chain Belk was targeted by the DragonForce ransomware group, which claims to have stolen over 150GB of data during a May 2025 attack.
Abacus Market, a major Western darknet drug marketplace, has gone offline in a suspected exit scam, shutting down its public infrastructure.
McDonald’s hiring platform inadvertently exposed data of approximately 64 million job applicants due to the use of default credentials.
Several companies in Italy’s Lombardy region suffered business disruption after a Romanian ransomware group known as ‘Diskstation’ attacked NAS devices. The group was dismantled by international law enforcement.

Newly Discovered Vulnerabilities

Google released a security update for Chrome version 138, patching its fifth zero-day vulnerability of 2025.
Microsoft issued emergency update KB5064489 to address an issue preventing Azure virtual machines from launching when Trusted Launch is disabled and Virtualization-Based Security is enabled.

Notable Threat Actor Activity

North Korean threat actors associated with the “Contagious Interview” campaign published 67 malicious packages to the npm registry, delivering the XORIndex malware loader to developer systems.
A state-backed group is targeting Southeast Asian government organizations with the novel HazyBeacon Windows backdoor, utilizing AWS Lambda for command-and-control and data exfiltration.
Attackers leveraged over 600 domains to distribute a trojanized Telegram Android app, stealing data from Chinese-speaking users, particularly those on older Android versions.
A new variant of the Android malware Konfety uses malformed APKs and obfuscation techniques to evade detection and analysis.
Threat actors are embedding obfuscated JavaScript in SVG files to enable browser-native redirection to malicious sites.

Trends, Tools, or Tactics of Interest

AsyncRAT, an open-source remote access trojan first released in 2019, has proliferated into a complex ecosystem of forks and variants, fueling global cybercrime and democratizing access to malware capabilities.
GLOBAL GROUP, a newly emerged ransomware-as-a-service (RaaS) operation, is expanding its activities across Australia, Brazil, Europe, and the United States, employing AI-driven negotiation tools to enhance extortion processes.
Cloudflare reported mitigation of 7.3 million DDoS attacks in Q2 2025, with hyper-volumetric attacks reaching a record 7.3 Tbps. The company noted that the total number of DDoS attacks blocked in 2025 has already exceeded the total for 2024.
Criminal networks continue to exploit insider vulnerabilities within organizations, adapting rapidly to bypass traditional security measures.
Alternate Data Streams (ADS) in NTFS are being used by keylogger malware to hide captured data, providing stealth persistence.
AI prompt attacks and the security of agentic AI systems are highlighted as emerging concerns, with risks associated with high-privilege authentication and invisible identity access in automated workflows.

Regulatory or Policy Developments Affecting the Security Industry

MITRE launched the AADAPT framework, designed to complement the ATT&CK framework, focusing on detection and response to cyberattacks targeting cryptocurrency assets and financial systems. The framework provides documentation for identifying, investigating, and mitigating weaknesses in digital asset payments.

Cybersecurity Brief – 2025-06-24

Tue, 24 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

McLaren Health Care reported a data breach impacting 743,000 patients following a July 2024 attack by the INC ransomware gang.
Nucor, North America’s largest steel producer, confirmed data theft in a recent cyber incident.
A database containing 184 million plaintext passwords from platforms including Facebook and Google was discovered exposed online without encryption or protection.

Newly Discovered Vulnerabilities

Citrix released patches for critical vulnerabilities in NetScaler ADC and Gateway appliances, urging customers to update to prevent exploitation.
A Windows LNK flaw was exploited by the XDigo malware in attacks against Eastern European government entities.
Scanning activity targeting Ichano AtHome IP Cameras was observed, indicating potential exploitation attempts.

Notable Threat Actor Activity

The China-linked Salt Typhoon group exploited a critical Cisco vulnerability to breach Canadian telecommunications firms, as confirmed by the Canadian Centre for Cyber Security and the FBI.
Russian state-sponsored APT28 used Signal chats to deliver two new malware strains, BeardShell and SlimAgent, in attacks targeting Ukrainian government entities.
Pro-Iranian hackers and hacktivists are assessed as likely to escalate cyberattacks against U.S. networks following recent U.S. airstrikes on Iranian nuclear sites, according to warnings from the U.S. Department of Homeland Security.
Four REvil ransomware members arrested in Russia in 2022 were released after serving time for carding and malware distribution charges.
Attackers exploited misconfigured Docker APIs and used Tor for anonymity in a cryptocurrency theft campaign, resembling tactics previously used by the Commando Cat actor.
Telegram purged Chinese crypto scam markets from its platform, but these markets quickly re-emerged under new branding.

Trends, Tools, or Tactics of Interest

SparkKitty, a new Trojan spyware for iOS and Android, was found distributed via the App Store, Google Play, and untrusted websites. It steals images, including cryptocurrency wallet seed phrases, from device galleries.
The XDigo malware, written in Go, was used in targeted attacks on Eastern European governments, leveraging the Windows LNK flaw for initial access.
A new jailbreaking technique, “Echo Chamber,” enables attackers to bypass guardrails in large language models (LLMs) like OpenAI and Google Gemini, prompting the generation of harmful content.
Attackers are increasingly using encrypted messaging apps (e.g., Signal) for malware delivery in targeted campaigns.
Google announced new multi-layered defences for its generative AI systems to address risks such as indirect prompt injection attacks.
SOCs are exploring AI-enabled workflow automation to address analyst burnout and improve operational efficiency.

Regulatory or Policy Developments Affecting the Security Industry

The U.S. Department of Homeland Security and FBI issued advisories regarding increased cyber threats from Iranian and pro-Iranian actors in response to geopolitical events.
The Canadian Centre for Cyber Security released guidance following state-sponsored intrusions into national telecom infrastructure via Cisco vulnerabilities.

Cybersecurity Brief – 2025-06-04

Wed, 04 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

Victoria’s Secret has delayed its Q1 2025 earnings release due to ongoing corporate system restoration efforts following a security incident on 24 May.
A data breach at Coinbase has been attributed to bribed customer support representatives at TaskUs in India, leading to data theft from the crypto exchange.

Newly Discovered Vulnerabilities

Hewlett Packard Enterprise (HPE) released security patches for eight vulnerabilities in StoreOnce, including a critical remote authentication bypass flaw.
A critical 10-year-old vulnerability in Roundcube webmail software allows authenticated users to execute malicious code.
Google patched a new Chrome zero-day vulnerability currently being exploited in the wild; this is the third Chrome zero-day exploited this year.
Two newly disclosed vBulletin vulnerabilities (CVE-2025-48827, CVE-2025-48828) are easily exploitable and present risks to bulletin board deployments.
CISA has issued a warning regarding active exploitation of a recently patched ConnectWise ScreenConnect vulnerability that allows remote code execution.

Notable Threat Actor Activity

Scattered Spider has been linked to high-profile attacks on UK retailers Marks & Spencer and Co-op, using tactics such as vishing, adversary-in-the-middle (AiTM) phishing, and exploiting multi-factor authentication gaps to hijack cloud accounts. The group operates as an identity-first threat model rather than a single entity.
Threat actors are using fake DocuSign and Gitcode websites to distribute the NetSupport RAT via multi-stage PowerShell attacks.
The Acreed infostealer has overtaken LummaC2 as the dominant credential theft malware on the Russian Market, reflecting a shift in the threat landscape.
Malicious RubyGems packages impersonating Fastlane CI/CD plugins have been found redirecting Telegram API requests to attacker-controlled servers to steal data.

Trends, Tools, or Tactics of Interest

The Crocodilus Android banking trojan has expanded its targeting from Turkey to eight countries across Europe and South America, now incorporating tactics such as adding fake contacts to victims’ devices to spoof trusted callers.
A new unrestricted AI chatbot, Venice[.]ai, has emerged, capable of generating phishing messages and malware code to assist cybercriminal activity.
Kaspersky research highlights the challenge of determining attack origins in environments lacking container visibility, emphasizing the importance of distinguishing between host-based and container-based threats.
Mozilla has introduced a new system to detect and block Firefox add-ons that function as cryptocurrency drainers.
LayerX has launched ExtensionPedia, and TXOne Networks introduced intelligent vulnerability mitigation capabilities, both reflecting ongoing innovation in endpoint and OT security.

Regulatory or Policy Developments Affecting the Security Industry

Google Chrome will distrust digital certificates issued by Chunghwa Telecom and Netlock due to compliance and conduct issues, effective from August.
Microsoft and CrowdStrike have launched a shared threat actor glossary to align their threat actor taxonomies and reduce attribution confusion.

Cybersecurity Brief – 2025-05-15

Thu, 15 May 2025 00:00:00 +0000

Major Incidents or Breaches

Coinbase Data Breach and Extortion Attempt
- Coinbase disclosed a data breach affecting approximately 1% of its users after cybercriminals bribed customer support agents. Attackers accessed sensitive customer information, including government IDs, and attempted to extort $20 million. The extortion attempt failed, but the incident highlights ongoing risks to cryptocurrency platforms from both insider and external threats.
Nova Scotia Power Data Breach
- Nova Scotia Power confirmed a cyberattack resulting in the theft of sensitive customer data. The breach was discovered last month and underscores the persistent targeting of critical infrastructure and utility providers.

Newly Discovered Vulnerabilities

SAP NetWeaver (CVE-2025-31324)
- A critical vulnerability in SAP NetWeaver is being actively exploited by multiple threat actors, including ransomware groups BianLian and RansomExx. The flaw allows remote code execution and has led to a surge in attacks against unpatched systems. Immediate patching is strongly advised.
Samsung MagicINFO 9 Server (CVE-2025-4632)
- Samsung patched a critical vulnerability (CVSS 9.8) in MagicINFO 9 Server that was actively exploited to deploy Mirai botnet variants. Organizations using this software should update immediately.
Google Chrome High-Severity Flaw
- Google released emergency updates addressing a high-severity Chrome vulnerability that has a public exploit and is being used in the wild for cross-origin data leaks via the Loader Referrer Policy. All users are advised to update promptly.
Ivanti Endpoint Manager Mobile (EPMM) Zero-Day Flaws
- Ivanti confirmed exploitation in the wild of zero-day vulnerabilities in EPMM, affecting a limited number of customers. The flaws stem from open source library issues and are being used in chained attacks.

Cybersecurity Brief – 2025-05-14

Wed, 14 May 2025 00:00:00 +0000

Major Incidents and Breaches

Marks & Spencer confirmed customer data was stolen in a recent cyberattack. While no account passwords were compromised, customers are being required to reset passwords as a precaution.
Dior disclosed a cybersecurity incident resulting in the exposure of customer information.
Nucor Corporation, a major steel producer, experienced network disruptions due to a cyberattack, forcing parts of its systems offline for containment.
The Australian Human Rights Commission suffered a data breach in which private documents were leaked online and indexed by search engines.
Xinbi Guarantee, a Chinese-language Telegram marketplace, has been linked to $8.4 billion in illicit transactions, including crypto crime, romance scams, and North Korean money laundering.
North Korean IT worker scams are being exposed at scale, with researchers publishing 1,000 email addresses and photos linked to infiltration of Western companies.
Kosovo extradited the admin of BlackDB, an online cybercrime marketplace, to the US to face charges.

Newly Discovered Vulnerabilities and Exploits

Microsoft Patch Tuesday (May 2025): Microsoft released fixes for 78 vulnerabilities, including five zero-days under active exploitation. Notably, a CVSS 10 vulnerability impacts Azure DevOps Server.
Samsung patched CVE-2025-4632 in MagicINFO 9 Server, a critical flaw (CVSS 9.8) exploited to deploy Mirai botnet malware.
Fortinet addressed CVE-2025-32756, a zero-day RCE flaw in FortiVoice enterprise phone systems, confirmed as exploited in the wild.
Ivanti released updates for two vulnerabilities in Endpoint Manager Mobile (EPMM) that have been chained for remote code execution in limited attacks.
SAP NetWeaver vulnerability is being actively exploited by multiple ransomware groups, including BianLian and RansomExx, to deploy malware such as PipeMagic Trojan.
Google Chrome is rolling out a security change to prevent browser launches with admin privileges on Windows, reducing attack surface.
Open redirect vulnerabilities in trusted domains (e.g., google.com) continue to be abused in phishing campaigns.
Focused phishing attacks are leveraging trusted domains, real CAPTCHAs, and server-side validation for more targeted credential theft.

Notable Threat Actor Activity

Earth Ammit, a cyber espionage group, was linked to supply chain breaches in the drone sector via ERP systems in the VENOM and TIDRONE campaigns targeting Taiwan and South Korea.
Scattered Spider (aka UNC3944) tactics, previously used against UK retail chains, are now being deployed against US retailers.
Ransomware gangs are increasingly exploiting SAP NetWeaver vulnerabilities for initial access and malware deployment.
Meta Mirage, a global phishing campaign, is targeting Meta Business Suite users to hijack high-value business accounts.
Horabot malware is being distributed through invoice-themed phishing emails, targeting Windows users across six Latin American countries.

Trends, Tools, and Tactics of Interest

Phishing campaigns are becoming more sophisticated, with increased use of trusted domains, CAPTCHAs, and real-time validation to evade detection and improve targeting.
Telegram-based black markets remain a significant vector for cybercrime, with recent enforcement actions leading to shutdowns and exposure of major illicit marketplaces.
Shadow SaaS and AI usage is an emerging risk, with new tools (e.g., LastPass SaaS monitoring) being developed to detect unauthorised employee use of unsanctioned cloud and AI services.
Supply chain attacks via ERP systems and targeting of high-value sectors (e.g., drones, retail) remain prevalent.
AI agent security: Research indicates that AI agents can be manipulated by implanting fake “memories,” raising concerns about the integrity of autonomous systems.
Device hygiene: Daily phone reboots are recommended as a practical defense against persistent zero-click mobile exploits.

Regulatory and Policy Developments

Consumer Financial Protection Bureau (CFPB) in the US has canceled plans for tighter regulation of data brokers, potentially impacting privacy and data protection standards.
Telegram enforcement: Following media inquiries, Telegram banned thousands of accounts tied to crypto scam money laundering, disrupting several major illicit marketplaces.

Cybersecurity Brief – 2025-05-13

Tue, 13 May 2025 00:00:00 +0000

Major Incidents or Breaches

Output Messenger Zero-Day Exploited in Espionage
- A Türkiye-backed threat actor exploited a zero-day vulnerability in Output Messenger, an Indian enterprise communication platform, to deploy Golang-based backdoors on Kurdish servers. The campaign, ongoing since April 2025, targeted Kurdish military operations in Iraq as part of a cyber espionage effort.
Airline Confirms Cyberattack
- An airline involved in deportation flights for the US government disclosed a cybersecurity incident to the SEC, confirming reports of a cyberattack.
DoppelPaymer Ransomware Arrest
- Moldovan authorities arrested a suspect linked to DoppelPaymer ransomware attacks against Dutch organisations in 2021.
Global Botnet Operation Disrupted
- Four hackers were arrested for operating a global botnet that infected outdated wireless routers with Anyproxy and 5socks malware, allowing covert reconfiguration and use for malicious activities.