Wynn Resorts on DanSec Daily

Cybersecurity Brief – 2026-04-07

Tue, 07 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

Wynn Resorts disclosed that 21,000 employees were affected by the ShinyHunters hack. The company reportedly paid a ransom to prevent data leakage.
Drift Protocol attributed its recent $280M cryptocurrency theft to a six-month, in-person operation where attackers established an operational presence inside the organisation.
Axios, a popular NPM package, was compromised in a supply chain attack involving sophisticated social engineering targeting maintainers. North Korean threat actors are linked to this and similar campaigns against Node.js maintainers.
Guardarian users were targeted via 36 malicious NPM packages impersonating Strapi plugins, enabling shell execution, container escape, and credential harvesting.
The European Commission experienced a significant cyber incident, as noted in Check Point’s threat intelligence report.

Newly Discovered Vulnerabilities

Flowise AI Agent Builder is under active exploitation for a CVSS 10.0 remote code execution vulnerability. Over 12,000 instances are exposed.
Fortinet issued an emergency patch for a zero-day authentication bypass flaw (CVE-2026-35616) in FortiClient EMS, which allows unauthenticated remote code execution. CISA has mandated federal agencies patch this vulnerability.
A new GPUBreach attack technique enables privilege escalation and system takeover through Rowhammer-induced bit-flips on GPU GDDR6 memory.
Exploit code for an unpatched Windows privilege escalation zero-day (“BlueHammer”) was leaked, allowing local attackers to gain SYSTEM or administrator privileges.
Automated credential harvesting campaigns are exploiting the React2Shell flaw in vulnerable Next.js applications.
Google DeepMind researchers identified “AI Agent Traps,” a vulnerability that allows attackers to manipulate and exploit AI agents via malicious web content.

Notable Threat Actor Activity

China-linked Storm-1175 has been observed exploiting zero-day and n-day vulnerabilities to rapidly deploy Medusa ransomware in high-velocity attacks.
Qilin and Warlock ransomware groups are using the bring-your-own-vulnerable-driver (BYOVD) tactic to disable over 300 endpoint detection and response (EDR) tools during ransomware deployment.
An Iran-linked threat actor is conducting password-spraying attacks against over 300 Israeli and UAE Microsoft 365 organisations.
DPRK-linked actors are using GitHub as command-and-control infrastructure in multi-stage attacks targeting South Korean entities.
North Korean threat actors are targeting Node.js maintainers with social engineering as part of supply chain attacks.
A threat cluster tracked as UAT-10608 is automating credential harvesting by exploiting web-exposed Next.js applications.

Trends, Tools, or Tactics of Interest

There is increased use of AI-assisted tools by threat actors in supply chain attacks, as seen in the PRT-scan campaign targeting GitHub misconfigurations.
Social engineering targeting open-source maintainers is becoming industrialised, with attackers leveraging complex, scalable tactics.
The BYOVD technique remains prevalent among ransomware operators for bypassing security controls.
Open redirects continue to be widely abused in phishing campaigns.
Infostealers are harvesting credentials and session cookies at scale, outpacing traditional breach monitoring capabilities.
Developer workstations are being increasingly targeted as entry points for credential theft and lateral movement.
Shadow AI use in healthcare persists, with medical professionals adopting unsanctioned AI tools.

Regulatory or Policy Developments Affecting the Security Industry

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch the actively exploited Fortinet EMS vulnerability by Friday.
The OWASP GenAI Security Project has updated its risk matrix, now recognising 21 generative AI risks and recommending tailored security approaches for GenAI and agentic AI systems.
German authorities have formally identified two Russian nationals as the leaders of the GandCrab and REvil ransomware operations between 2019 and 2021.
Microsoft has deprecated and removed the Support and Recovery Assistant (SaRA) tool from all supported Windows versions as of March 10.

Cybersecurity Brief – 2026-03-03

Tue, 03 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

Madison Square Garden confirmed a data breach resulting from the 2025 Oracle E-Business Suite hacking campaign, with the incident only publicly disclosed months after the initial attack.
Wynn Resorts, a major US-based casino and hotel operator, was listed among the top attack and breach victims in the recent Check Point threat intelligence report.
A 22-year-old Alabama man pleaded guilty to hacking and extorting hundreds of women by hijacking their social media accounts, including those of minors.
A Florida woman was sentenced to 22 months in prison for orchestrating a large-scale Microsoft license fraud operation, trafficking thousands of stolen Certificate of Authenticity (COA) labels.
A phishing campaign is leveraging a fake Google Account security page and a Progressive Web App (PWA) to steal credentials, multi-factor authentication codes, and cryptocurrency wallet addresses, as well as proxying attacker traffic.
A fake FileZilla website is distributing a tampered installer that communicates with attacker-controlled servers via encrypted DNS traffic, evading traditional network monitoring.
A phishing campaign is distributing malicious “purchase order” attachments that link to credential-harvesting web pages.

Newly Discovered Vulnerabilities

A critical, now-patched vulnerability in Google Chrome’s Gemini Live AI Assistant allowed malicious extensions to escalate privileges, access local files, and potentially violate user privacy.
OpenClaw, a popular AI agent tool, was found to have a critical vulnerability enabling malicious websites to open WebSocket connections to localhost, brute-force passwords, and hijack the AI agent.
Wireshark 4.6.4 was released, addressing three vulnerabilities and 15 bugs.
A 0-day vulnerability (CVE-2026-21513) in Microsoft MSHTML, exploited prior to the February 2026 Patch Tuesday, has been linked to APT28 activity.

Notable Threat Actor Activity

Russia-linked APT28 exploited the MSHTML 0-day (CVE-2026-21513) in targeted attacks before its public disclosure and patch.
North Korean threat actors published 26 malicious npm packages as part of the ongoing “Contagious Interview” campaign, embedding Pastebin-based command-and-control for a cross-platform remote access trojan (RAT).
Another North Korean APT campaign targeted air-gapped systems using Windows shortcut files, deploying new implants, loaders, propagation tools, and backdoors.
Pro-Western and Iranian threat actors are engaged in reciprocal cyberattacks amid ongoing Middle East conflict, including wiper malware, DDoS, and attacks on critical infrastructure.
The UK’s National Cyber Security Centre (NCSC) issued a warning to British organizations about increased risk of Iranian cyberattacks due to Middle East tensions.
Global law enforcement arrested 30 alleged members of the cybercriminal collective “The Com” in “Project Compass,” identifying nearly 180 group members in total.
Researchers linked the open-source AI security testing tool CyberStrikeAI to a threat actor responsible for breaching hundreds of Fortinet FortiGate devices.

Trends, Tools, or Tactics of Interest

Attacks on GPS and satellite navigation systems have spiked in the Middle East, with over 1,100 ships impacted since February 28 following US and Israeli actions against Iran.
There is a growing use of deepfakes and injection attacks to bypass identity verification processes, targeting onboarding and account recovery workflows.
Bot attacks against SaaS platforms are increasing, with attackers leveraging automated tools to generate fake sign-ups and abuse APIs.
A trend of threat actors leveraging AI-powered tools, such as CyberStrikeAI, for offensive security testing and exploitation has been observed.
The use of encrypted DNS by malware (as seen in the fake FileZilla campaign) is complicating detection and response efforts.
AI-driven development is contributing to tensions between speed and security, with firewall rule backlogs and automation impacting application security workflows.

Regulatory or Policy Developments Affecting the Security Industry

Samsung settled a lawsuit in Texas over the collection and monetization of smart TV viewing data using Automated Content Recognition (ACR), with implications for user privacy controls.
Google announced the development of quantum-resistant HTTPS certificates for Chrome, utilizing Merkle Tree Certificates (MTCs) to address future quantum computing threats.
AWS expanded its Security Hub into a cross-domain security platform, aiming to reduce tool sprawl and improve correlation of security findings.
Nick Andersen was appointed Acting Director of CISA (Cybersecurity and Infrastructure Security Agency), following a leadership change within the US Department of Homeland Security.

Cybersecurity Brief – 2026-02-26

Thu, 26 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Google, Mandiant, and partners disrupted a global espionage campaign by suspected China-nexus threat actor UNC2814, which breached at least 53 organizations across 42 countries, including telecom firms and government agencies. The campaign leveraged SaaS API calls to conceal malicious traffic.
UFP Technologies, a US-based medical device manufacturer, disclosed a cyberattack involving data theft and file-encrypting ransomware.
CarGurus suffered a data breach impacting over 12 million users, with hackers claiming theft of personally identifiable information and internal corporate data.
Wynn Resorts confirmed a data breach in which the ShinyHunters group exfiltrated employee data.
Marquis Software Solutions filed a lawsuit against SonicWall, alleging gross negligence and misrepresentation after a backup breach led to a ransomware attack.

Newly Discovered Vulnerabilities

Cisco disclosed CVE-2026-20127, a critical authentication bypass vulnerability in Catalyst SD-WAN Controller and Manager, actively exploited in the wild since 2023. The flaw allows remote attackers to gain administrative access.
Anthropic’s Claude Code AI-powered coding assistant was found to have multiple vulnerabilities (including CVE-2025-59536 and CVE-2026-21852) enabling remote code execution and API key exfiltration via project files.
Four malicious NuGet packages targeting ASP.NET developers were discovered, designed to steal sensitive data through supply chain compromise.
Zyxel released patches for a critical remote code execution vulnerability affecting over a dozen router models, which could allow unauthenticated attackers to execute commands remotely.
SolarWinds patched four critical vulnerabilities in its Serv-U product; exploitation would require administrative privileges.

Notable Threat Actor Activity

Scattered LAPSUS$ Hunters (SLH) cybercrime group was observed offering $500–$1,000 per call to recruit women for IT help desk vishing attacks, focusing on social engineering.
North Korean threat actors were linked to a campaign using malicious Next.js repositories and fake job interviews to backdoor developers’ devices and establish persistent access.
A former L3Harris (US defense contractor) employee was sentenced to over seven years in prison for selling eight zero-day exploits to a Russian broker. The US Treasury also sanctioned the Russian broker involved in purchasing stolen exploits.
RAMP ransomware forum was seized, causing disruption and fragmentation within the ransomware ecosystem.
Chinese police were implicated in using ChatGPT for politically motivated influence operations targeting foreign officials.

Trends, Tools, or Tactics of Interest

Google’s latest GTIG AI Threat Tracker report highlights increasing adversarial use of AI, including distillation, experimentation, and integration of AI for malicious purposes.
Attackers are increasingly using telephone-oriented attack delivery (TOAD) emails, which contain only a phone number as payload, to bypass email security gateways.
The OpenClaw supply chain threat has generated significant discussion on dark web and Telegram channels, though current telemetry suggests more hype than widespread exploitation.
The PCI Security Standards Council reported that threats to payment systems are accelerating, requiring faster adaptation by the industry.
IBM X-Force reported that 56% of tracked vulnerabilities in 2025 required no authentication for exploitation, raising concerns about the weaponisation of agentic AI and the impact of stolen credentials.
A “Richter Scale” model has been introduced to rate the severity and effects of cybersecurity incidents in operational technology (OT) environments.
Drug cartels, such as Mexico’s CJNG, are adopting AI, drones, and social media for criminal operations.
Manual processes for sensitive data transfers remain prevalent in national security organizations, increasing risk exposure.

Regulatory or Policy Developments Affecting the Security Industry

CISA issued an emergency directive requiring immediate action to secure Cisco SD-WAN systems affected by CVE-2026-20127.
Reddit was fined nearly $20 million by the UK data privacy watchdog for failures related to the protection of children’s personal information.

Cybersecurity Brief – 2026-02-25

Wed, 25 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Wynn Resorts confirmed an employee data breach following an extortion threat, with the ShinyHunters extortion group listing the company on its data leak site.
CarGurus suffered a data breach exposing information of 12.4 million accounts, with ShinyHunters publishing the stolen personal information.
ShinyHunters claimed responsibility for a breach at Dutch telecommunications provider Odido, reportedly affecting millions of user records.
A phishing campaign by the “Diesel Vortex” threat group targeted freight and logistics organisations in the US and Europe, stealing credentials via 52 domains.
Wynn Resorts, CarGurus, and Odido incidents all point to continued large-scale data theft and extortion targeting enterprises.
Roblox faces a lawsuit from Los Angeles County over alleged failure to protect children from predators.
A Taiwan security firm confirmed exploitation of a vulnerability in TeamT5 ThreatSonar Anti-Ransomware, likely by Chinese APTs.

Newly Discovered Vulnerabilities

SolarWinds patched four critical Serv-U remote code execution vulnerabilities that could allow attackers root access to unpatched servers.
VMware Aria Operations patched several vulnerabilities, including high-severity flaws enabling remote code execution.
CISA added FileZen CVE-2026-25108 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation.
A vulnerability in GitHub Codespaces allowed attackers to seize repository control by injecting malicious Copilot instructions via GitHub Issues.
A new supply chain attack, “Sandworm_Mode”, was discovered in the NPM ecosystem, propagating like a worm, poisoning AI assistants, exfiltrating secrets, and containing destructive capabilities.
Open redirect vulnerabilities remain overlooked, with continued potential for abuse in phishing and redirection attacks.

Notable Threat Actor Activity

The North Korea-linked Lazarus Group was observed using Medusa ransomware in attacks against US healthcare and Middle Eastern entities, also deploying the Comebacker backdoor, Blindingcan RAT, and Infohook infostealer.
UAC-0050, a Russia-aligned threat actor, targeted a European financial institution using a spoofed domain and RMS malware, likely for intelligence gathering or financial theft.
UnsolicitedBooker, a threat activity cluster, shifted focus to targeting telecommunications companies in Kyrgyzstan and Tajikistan, deploying LuciDoor and MarsSnake backdoors.
The ShinyHunters extortion group remains active, claiming responsibility for recent high-profile breaches.
“Diesel Vortex” threat group continues credential theft campaigns targeting freight and logistics sectors.
The “Arkanix Stealer” malware, written in C++ and Python, was observed exfiltrating system and browser data before disappearing shortly after its debut.
Arrests of Anonymous Fénix members in Spain disrupted part of the group’s operations.

Trends, Tools, or Tactics of Interest

Threat actors are increasingly using fake video meeting invites (Zoom, Teams, Google Meet) to trick users into installing remote monitoring and management (RMM) tools or surveillance software through social engineering.
1Campaign, a new cybercrime service, enables threat actors to run malicious Google Ads that evade detection and remain online for extended periods.
Attackers now require as little as 29 minutes to gain control of a network, aided by credential misuse, AI tools, and security blind spots.
GitHub Copilot can be abused to process malicious instructions embedded in issues, leading to repository takeover when launching Codespaces.
Social engineering remains a primary attack vector, with increasing sophistication in tactics.
Identity-first security is highlighted as critical, with AI agents now provisioning infrastructure and inheriting over-scoped privileges.
Password length recommendations are being revisited in light of AI and quantum computing threats.
Human risk management tools, such as the AIDA Orchestration Agent, are being introduced to address persistent social engineering risks.

Regulatory or Policy Developments

The UK Information Commissioner’s Office (ICO) fined Reddit £14.47 million for unlawfully collecting and processing children’s data under 13 without adequate safeguards.
Ofcom and the ICO fined both Reddit and a US-based pornographic website for failing to protect children’s privacy and safety online.
Microsoft expanded data loss prevention (DLP) controls to restrict Copilot AI from processing confidential Word, Excel, and PowerPoint documents, regardless of storage location.