Cybersecurity Brief – 2026-05-06

Wed, 06 May 2026 00:00:00 +0000

Major Incidents or Breaches

DAEMON Tools supply chain attack: Installers downloaded from the official DAEMON Tools website since 8 April were trojanised, delivering a sophisticated backdoor to thousands of systems globally. Government and scientific entities were among those targeted, though the backdoor was selectively deployed on a limited number of systems.
Vimeo data breach: The ShinyHunters extortion group accessed and exfiltrated personal information of over 119,000 users following a breach of the Vimeo platform in April.
Instructure breach: A hacker claims to have stolen 280 million data records from 8,809 educational institutions by breaching Instructure, exposing student and staff data.
Trellix source code breach: Attackers accessed source code for Trellix security products, potentially exposing detection mechanisms and product controls.
Taiwan high-speed rail hack: A university student was arrested for exploiting the TETRA communication system to trigger emergency brakes on Taiwan’s high-speed railway.
CloudZ RAT exploitation via Windows Phone Link: Researchers disclosed an incident involving the CloudZ remote access tool, leveraging a previously undocumented plugin (“Pheno”) to steal credentials and OTPs.
Government targeting by UAT-8302: China-linked APT group UAT-8302 was attributed to ongoing attacks against government entities in South America and South Asia, using malware shared across regions.

Newly Discovered Vulnerabilities

Palo Alto Networks PAN-OS (CVE-2026-0300): A critical buffer overflow vulnerability in PAN-OS User-ID Authentication Portal is under active exploitation, enabling remote code execution on PA and VM series firewalls.
Apache HTTP/2 (CVE-2026-23918): A severe vulnerability in Apache HTTP Server’s HTTP/2 implementation could allow denial-of-service and potential remote code execution. Security updates have been released.
MetInfo CMS (CVE-2026-29014): A critical flaw in the open-source MetInfo CMS is being actively exploited for remote code execution attacks.
Android System (CVE-2026-0073): A critical remote code execution vulnerability was patched in Android’s System component, exploitable without user interaction.
Ollama “Bleeding Llama”: A critical heap out-of-bounds read issue in Ollama LLM deployments could be exploited remotely and without authentication, potentially affecting up to 300,000 deployments.
WhatsApp: Two newly patched vulnerabilities could have allowed attackers to send malicious files to users, potentially leading to malware infection.
Microsoft Edge: Proof-of-concept exploits show that passwords are stored in process memory and can be extracted by users with admin privileges, posing an enterprise risk.

Notable Threat Actor Activity

ShinyHunters: Responsible for the Vimeo data breach, exfiltrating user personal information.
UAT-8302 (China-linked APT): Conducting cross-regional campaigns targeting government agencies using shared APT malware.
Karakurt ransomware group: A Latvian national, Deniss Zolotarjovs, was sentenced in the US for his role as a negotiator in extortion operations.
Quasar Linux (QLNX) malware: A new, previously undocumented Linux implant is targeting software developers with rootkit, backdoor, and credential-stealing features.

Trends, Tools, or Tactics of Interest

Supply chain attacks: DAEMON Tools and Trellix incidents highlight the ongoing risk of supply chain compromise, with attackers leveraging trusted software distribution channels.
OAuth token persistence: Many AI tools and productivity apps connected to Google or Microsoft environments leave persistent OAuth tokens without expiration or automated revocation, increasing lateral movement and persistence risks.
AI service exposure: Scans of one million exposed AI services reveal significant security gaps as businesses rapidly adopt AI technologies, with insecure deployments and insufficient access controls.
Social engineering and AI: Evolution in phishing and social engineering tactics, now leveraging AI to create more convincing lures and automate attacks, as noted in new KnowBe4 SAT platform updates and recent phishing campaigns.
Binary Transparency for Android: Google has expanded public verification of Android app binaries to prevent supply chain attacks.
Microsoft phishing campaign: Ongoing sophisticated phishing attacks against US organisations, using adversary-in-the-middle (AitM) techniques to harvest credentials.
Jailbreaking and data poisoning AI models: Security researchers are actively probing AI guardrails for weaknesses, using jailbreaking and data poisoning to demonstrate attack vectors.

Regulatory or Policy Developments

FTC action against Kochava: The US Federal Trade Commission will ban data broker Kochava and its subsidiary from selling Americans’ location data without explicit consent, as part of a legal settlement.
Oracle patch cadence: Oracle will now release monthly critical security patch updates, aiming to address high-priority vulnerabilities more rapidly.
SSL.com root certificate rotation: SSL.com rotated its root certificate as part of standard lifecycle management.
CISA critical infrastructure initiative: The US Cybersecurity and Infrastructure Security Agency (CISA) announced a new initiative to strengthen the security of critical infrastructure.

Cybersecurity Brief – 2026-04-29

Wed, 29 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

Vimeo has confirmed a data breach affecting user and customer data, resulting from the Anodot data anomaly detection company breach. The ShinyHunters group is threatening to leak the stolen files unless a ransom is paid.
Application security company Checkmarx has confirmed that the LAPSUS$ threat group leaked data stolen from its private GitHub repository.
Robinhood systems were leveraged to send legitimate-looking phishing emails, luring recipients to malicious websites.
Electric motorcycles (Zero Motorcycles) and scooters (Yadea) have been found vulnerable to attacks that could compromise rider safety.
A Chinese engineer reportedly stole US military and NASA software over several years by impersonating researchers and convincing organisations to provide sensitive code.

Newly Discovered Vulnerabilities

CVE-2026-42208: A critical pre-authentication SQL injection vulnerability in BerriAI’s LiteLLM Python package has been disclosed and is under active exploitation within 36 hours of public announcement. Attackers are targeting sensitive information stored by the LiteLLM gateway.
CVE-2026-3854: A critical remote code execution vulnerability affecting GitHub.com and GitHub Enterprise Server allows authenticated users to achieve RCE via a single Git push. The flaw exposed millions of repositories.
CVE-2026-25874: Hugging Face’s LeRobot open-source robotics platform is affected by a critical unpatched vulnerability that allows unauthenticated remote code execution.
Vulnerabilities in Robinhood systems enabled attackers to send phishing emails from legitimate infrastructure.
Vulnerabilities in Zero Motorcycles and Yadea electric scooters could allow attackers to compromise device security and rider safety.

Notable Threat Actor Activity

The Brazilian-origin cybercrime group LofyGang has resurfaced after three years, distributing a new stealer malware, LofyStealer (aka GrabBot), targeting Minecraft players.
The North Korean BlueNoroff group is conducting campaigns against cryptocurrency executives, using stolen victim videos, AI-generated avatars, and fake Zoom calls to enhance social engineering and malware delivery.
LAPSUS$ threat group has leaked stolen data from Checkmarx’s private GitHub repository.
Scattered Spider: A dual US-Estonian citizen, allegedly a prolific member of this group, has been arrested in Finland and faces US federal charges.
ShinyHunters is threatening to leak data stolen in the Vimeo breach if ransom demands are not met.
Feuding between ransomware groups 0APT and KryBit has led to the leaking of each other’s infrastructure and operational data, exposing details of ransomware operations.

Trends, Tools, or Tactics of Interest

Threat actors are rapidly exploiting newly disclosed vulnerabilities, with the LiteLLM SQL injection (CVE-2026-42208) being exploited within 36 hours of disclosure.
VECT 2.0 ransomware, due to a flaw in its encryption implementation, irreversibly destroys files larger than 131KB on Windows, Linux, and ESXi, effectively acting as a wiper rather than ransomware.
Threat actors are publishing structured OPSEC playbooks detailing layered infrastructure, identity separation, and long-term evasion strategies to improve operational security and evade detection.
The Vidar malware has become the leading infostealer in the market, filling the gap left by the takedown of Lumma and Rhadamanthys.
Attackers are scaling supply chain attacks by seeding over 70 cloned Open VSX extensions with GlassWorm malware, targeting the VS Code ecosystem.
Fake CAPTCHA scams are being used to trigger international SMS charges on victims’ phones, with scammers profiting from a share of the charges.
The use of AI-generated content and social engineering (e.g., fake Zoom calls, deepfakes) is increasing in targeted attacks, particularly by state-linked and financially motivated groups.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft will deprecate legacy TLS connections for POP and IMAP email clients in Exchange Online starting July 2026, blocking insecure protocols.
A member of the alleged Chinese state-backed Silk Typhoon group has been extradited to the US to face charges related to cyberattacks against US universities.
The FIDO Alliance, Google, and Mastercard are collaborating to address security concerns related to AI agents making autonomous purchases, aiming to prevent unauthorised transactions.
Increased focus on AI governance and agentic AI security, with industry initiatives and webinars promoting multi-layered governance frameworks and cost predictability for AI-driven security solutions.

Vimeo on DanSec Daily

Cybersecurity Brief – 2026-05-06

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments

Cybersecurity Brief – 2026-04-29

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry