Zoom on DanSec Daily

Cybersecurity Brief – 2026-10-03

Sat, 03 Oct 2026 00:00:00 +0000

Major Incidents or Breaches

Frontline Education suffered a data breach affecting school district employees after attackers exploited a vulnerability in third-party software to gain unauthorized access and steal employee information ^[5].
The Warlock ransomware group, linked to China, targeted a water utility, a telecom provider, a regional government body, and a university by exploiting SharePoint vulnerabilities for initial access ^[6].
U.S. Treasury sanctioned eight members of the Tren de Aragua gang for involvement in ATM jackpotting attacks resulting in the theft of millions of dollars across the United States and Europe ^[8].
Fake Zoom installers targeting macOS users were observed delivering the CloudSyncD backdoor, using a universal Mach-O binary extracted at runtime ^[22].

Newly Discovered Vulnerabilities

GitLab patched a critical remote code execution vulnerability (CVSS 9.9) in its AI Gateway service that allowed a logged-in user with Duo Agent Platform access to execute commands on self-hosted servers ^[2]^[7].
Dell released updates for multiple critical flaws in its Container Storage Modules (CSM) that could allow unauthenticated attackers to gain admin access and root privileges on Kubernetes nodes ^[4].
Fortra addressed critical vulnerabilities in BoKS that could result in authentication bypass, shell command execution, and memory corruption ^[20].
Middleware used in SWIFT banking and government environments was found to enable remote code execution, with the risk of hardware-based MFA bypass if unpatched ^[12].
Kiteworks patched over 100 vulnerabilities in its data-protection platform following reports of attacks and advisories to power down systems during remediation ^[11]^[21].

Notable Threat Actor Activity

A China-nexus espionage campaign deployed the Antino backdoor, using Microsoft Outlook and OneDrive for command and control targeting government and policy organizations across Asia ^[3].
Malicious Linux implants were discovered mimicking Asian mail security products, making detection difficult due to their resemblance to legitimate edge solutions ^[16].
AI policy experts were targeted in phishing attacks ^[21].

Trends, Tools, or Tactics of Interest

Browser-based attacks are increasingly able to evade endpoint detection and response (EDR) telemetry by stealing sessions, abusing extensions, or manipulating users without leaving traditional endpoint artifacts ^[9].
Offensive cyber operations are evolving, with startups like RemoteThreat advancing red teaming to simulate more sophisticated attacker techniques beyond traditional methods ^[10].
The security community is emphasizing the need for clear asset ownership to address vulnerability backlogs, as lack of ownership hinders remediation efforts ^[15].
The proliferation of cloud, AI, and distributed systems is increasing the complexity of cybersecurity environments, particularly in identity management ^[1].
AI agents such as Muse are raising privacy concerns due to their ability to create detailed profiles of users’ contacts ^[17].
New platforms are emerging to prevent AI agent misbehavior online, such as doxx.net’s ADN platform designed to mitigate agentic misadventure ^[19].
Adblocker software was found spying on AI chat sessions ^[21].

Regulatory or Policy Developments Affecting the Security Industry

The U.S. Treasury’s sanctions on Tren de Aragua members represent an increased regulatory focus on transnational cybercrime and ATM fraud ^[8].
Discussions are ongoing regarding upcoming regulatory and governance challenges in the context of artificial intelligence, with industry analysts forecasting increased accountability and security requirements for AI systems by 2027 ^[13].
The Microsoft 2026 Digital Defense Report was published, providing insights into current and anticipated security threats ^[21].

Sources

Frontline Education breach exposes school district employee data - bleepingcomputer.com
Warlock ransomware breach SharePoint in water, telecom operator attacks - bleepingcomputer.com
US sanctions Tren de Aragua gang members in ATM hacks crackdown - bleepingcomputer.com
macOS Users Targeted by Fake Zoom Installer Carrying CloudSyncD Backdoor - securityweek.com
GitLab Patches Critical 9.9 AI Gateway Flaw Allowing Command Execution on Self-Hosted Servers - thehackernews.com
GitLab warns of critical RCE vulnerability in AI Gateway service - bleepingcomputer.com
Dell CSM Flaws Enable Unauthenticated Admin Access and Root on Kubernetes Nodes - thehackernews.com
Fortra Patches Critical Vulnerabilities in BoKS - securityweek.com
SWIFT Banking & Government Middleware Enables RCE - darkreading.com
Kiteworks & Citrix Incidents Show Challenges of Zero-Day Response - darkreading.com
In Other News: $15K iCloud Spoofing Bugs, AI Policy Experts Phished, Adblocker Spies on AI Chats - securityweek.com
Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign - thehackernews.com
Malicious Linux Implants Mimic Asian Mail Security Products - darkreading.com
The EDR blind spot: 3 ways browser attacks evade endpoint telemetry - bleepingcomputer.com
RemoteThreat Bets Security Teams Need to Test What Happens After Defenses Fail - darkreading.com
Vulnerability Backlogs Are an Ownership Problem - darkreading.com
The State of Cybersecurity in 2026: Key Segments, Insights, and Innovations - thehackernews.com
Muse Creates Detailed Profiles of All Your Friends and Family - wired.com
doxx.net Raises $38 Million to Prevent AI Agent-on-the-Internet Misadventures - securityweek.com
Is Your Organization Ready for 2027's AI Accountability Era? - darkreading.com

Cybersecurity Brief – 2026-08-13

Thu, 13 Aug 2026 00:00:00 +0000

Major Incidents or Breaches

Ceva Logistics experienced a cyberattack that disrupted operations at eight European warehouses, resulting in shipment delays for multiple customers ^[39].
Over 2,500 organizations were impacted by a supply chain attack on LiteLLM, which was compromised via the Trivy hack to distribute information-stealing malware ^[41].
The Colombian Justice Ministry was hit by a ransomware attack days before a presidential transition, continuing the trend of attacks on critical infrastructure in Latin America ^[26].
A long-running data theft campaign, dubbed “City-Forum,” has targeted Salesforce Experience Cloud and ServiceNow customer portals using custom tooling to steal data exposed to anonymous users. This campaign has been active since at least March 2025 and affects organizations across multiple sectors ^[12]^[24]^[38].
The FBI issued a warning about cybercriminals targeting online accounts to steal sexually explicit images and videos from adults and children ^[18].

Newly Discovered Vulnerabilities

Microsoft SharePoint vulnerability CVE-2026-55040 is being actively exploited following the public release of proof-of-concept code. This vulnerability allows attackers to bypass authentication and potentially gain access to sensitive data ^[5]^[20]^[35].
A Windows zero-day vulnerability (CVE-2026-68820) exploited by the Lazarus Group has been used to gain SYSTEM access and deploy a new backdoor, with defense-sector firms among the targets ^[6]^[17].
A new zero-day exploit for Microsoft Defender, named “ShieldBreak,” was released after the August 2026 Patch Tuesday, allowing any user to spawn a shell with SYSTEM privileges ^[22]^[34].
Adobe patched three CVSS 10.0 vulnerabilities in ColdFusion, Commerce, and Campaign Classic, which could lead to arbitrary code execution if exploited. Attempts to exploit the critical Adobe Commerce flaw (CVE-2026-71362) to hijack customer accounts have already been detected ^[10]^[14].
VMware vCenter’s critical vulnerability CVE-2026-593 is being actively exploited to gain persistent remote access ^[11].
Over 80 vulnerabilities were patched by Intel and AMD, including high-severity issues leading to privilege escalation and code execution ^[40].
Zoom patched critical “Zoomsday” vulnerabilities that could allow a participant to run malicious code on another participant’s device during a meeting ^[42].
Belgium’s eID authentication system was fully compromised due to severe vulnerabilities in a key browser extension, exposing citizen accounts to remote code execution ^[23].
August Patch Tuesday from Microsoft addressed 421 flaws, including three zero-days and 62 critical vulnerabilities, with numerous Office remote code execution bugs ^[43].
Researchers disclosed “Plug and Pwn” attacks that exploit Windows Plug and Play to install vulnerable vendor software and gain SYSTEM privileges via fake USB devices ^[16].

Notable Threat Actor Activity

The North Korean Lazarus Group exploited a Windows zero-day vulnerability to target defense firms as part of Operation Dream Job, deploying a new backdoor ^[6]^[17].
The Armored Likho group launched a new cyber-espionage campaign using the “Still Toolkit” to steal Telegram data and eavesdrop on victims, masquerading as fundraising efforts ^[1].

Trends, Tools, or Tactics of Interest

Over 737 Chrome VPN and proxy extensions were discovered routing user traffic through SOCKS5 proxies controlled by a single provider, mainly targeting Russian-speaking users. These extensions impersonated legitimate VPN and proxy services ^[7]^[15].
Attackers are exploiting unauthenticated guest access on Salesforce and ServiceNow portals to enumerate and exfiltrate exposed data in the “City-Forum” campaign ^[12]^[24]^[38].
New Android malware “WindRelay” is being used alongside the SpyNote RAT to steal live credit card data via NFC relay attacks and facilitate fraudulent loan applications ^[13].
Fake remote workers are exploiting gaps in hiring processes, device delivery, and account access to gain entry to organizations using false identities ^[19].
Enterprise defense trends show attackers increasingly using stealthy methods that avoid detection by making little to no noise, as highlighted in Picus Labs’ Blue Report 2026 ^[9].
A newly disclosed flaw in OpenAI, Anthropic, and Google APIs allowed weaker AI models to recover internal reasoning and secrets from session logs, including API keys ^[8].
Research from PortSwigger explores whether AI systems can autonomously invent new attack techniques beyond vulnerability discovery ^[33].
Security researchers demonstrated that a coin-sized device could be used to physically compromise a Boeing 737, opening exterior hatches and redirecting the autopilot or sabotaging the flight plan in under 60 seconds ^[28].
The “Plug and Pwn” attack vector highlights the risk of malicious USB devices being used to gain privileged access on Windows systems ^[16].

Regulatory or Policy Developments Affecting the Security Industry

Signal introduced Automatic Key Verification, a new security feature to help users ensure their encrypted chats have not been intercepted, aiming to thwart man-in-the-middle attacks ^[21]^[37].

Sources

Ceva Logistics Operations Disrupted by Cyberattack - securityweek.com
Over 2,500 Organizations Impacted by LiteLLM Supply Chain Attack - securityweek.com
Ransomware Hits Colombian Justice Ministry Days Before Presidential Transition - darkreading.com
"City-Forum" data-theft attacks target Salesforce, ServiceNow portals - bleepingcomputer.com
Long-running Data Theft Campaign Targeting Salesforce, ServiceNow - darkreading.com
Stealthy ‘City-Forum’ Attacks Target Salesforce and ServiceNow With Custom Toolset - securityweek.com
FBI: Hackers target online accounts to steal nude photos - bleepingcomputer.com
Attackers Exploit SharePoint Authentication Bypass After Public PoC Release - thehackernews.com
Hackers leverage new Microsoft SharePoint exploit in attacks - bleepingcomputer.com
SharePoint Vulnerability Exploited Shortly After PoC Release - securityweek.com
Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor - thehackernews.com
Lazarus hackers exploited Windows zero-day to target defense firms - bleepingcomputer.com
New Microsoft Defender 'ShieldBreak' zero-day grants SYSTEM privileges - bleepingcomputer.com
Nightmare Eclipse Drops Windows Zero-Day Exploit ‘ShieldBreak’ - securityweek.com
Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws - thehackernews.com
Hackers exploit critical Adobe Commerce flaw to hijack customer accounts - bleepingcomputer.com
Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access - thehackernews.com
Chipmaker Patch Tuesday: Intel, AMD Fix Over 80 Vulnerabilities Combined - securityweek.com
“Zoomsday” flaws could let one Zoom participant attack another - malwarebytes.com
Belgium's eID Authentication Opens Citizen Accounts to RCE - darkreading.com
Patch Tuesday: Update now to fix 421 flaws, including three zero-days - malwarebytes.com
Plug and Pwn attack uses fake USB devices for Windows SYSTEM access - bleepingcomputer.com
Armored Likho expands its cyber-espionage toolkit - securelist.com
737 Chrome VPN Extensions Caught Routing Traffic Through Proxies. Check If You Have One - thehackernews.com
Hundreds of fake Chrome VPN extensions route traffic through a proxy - bleepingcomputer.com
Android malware combo takes out loans and relays victims' credit cards - bleepingcomputer.com
The Threat Hiding in Your Hiring Process: How Fake Remote Workers Get In - bleepingcomputer.com
Enterprise Defenses Recovered at the Edge and Collapsed Inside - thehackernews.com
OpenAI, Anthropic, Google API Flaw Let Weaker AI Models Decode Stronger Models' Reasoning - thehackernews.com
Can AI invent new attack techniques? New research from James Kettle and PortSwigger Research - portswigger.net
This Coin-Sized Device Can Hack a Boeing 737 - wired.com
Signal adds new security feature to thwart man-in-the-middle attacks - bleepingcomputer.com
WhatsApp Unveils New Scam Alert Feature - securityweek.com

Cybersecurity Brief – 2026-08-12

Wed, 12 Aug 2026 00:00:00 +0000

Major Incidents or Breaches

Wesco, a global supply chain and distribution company, is investigating a cybersecurity incident following claims by the ExfilSquad group of data theft from the company ^[30].
Mozilla revoked and updated the cryptographic signing key for Firefox and Thunderbird Linux releases after an unencrypted copy was accidentally committed to a private code repository, potentially impacting the integrity of downloads ^[17]^[31].
Fake CCleaner websites are distributing multi-stage malware that installs the GhostDesk spyware extension in Chrome browsers ^[54].
Attackers are using fake branded download pages to trick Windows users into installing legitimate remote-access software, which is then abused for unauthorized access ^[60].

Newly Discovered Vulnerabilities

SAP patched a maximum-severity flaw in Commerce Cloud (Data Hub Adapter) that allowed unauthenticated remote code execution ^[6]^[52].
Microsoft addressed nearly 400 vulnerabilities in its August Patch Tuesday, including a Windows kernel driver zero-day (afd.sys) under active attack for privilege escalation to SYSTEM, with three zero-days in total patched ^[9]^[28]^[37]^[40]^[42]^[48].
A proof-of-concept exploit named ShieldBreak was released, demonstrating a Microsoft Defender patch bypass that grants SYSTEM access ^[7].
Cisco Secure Firewall ASA and FTD vulnerabilities (CVE-2026-20349) are being actively exploited in the wild to trigger remote denial-of-service attacks, with patches released ^[8]^[25]^[47].
SonicWall patched critical vulnerabilities in its discontinued GMS platform that allowed unauthenticated remote code execution and data exposure ^[46].
Researchers disclosed an AI-assisted exploit chain for Microsoft SharePoint that enables unauthenticated remote code execution, now being used in ransomware attacks ^[13]^[34].
Zoom patched a vulnerability in the annotation tool that allowed meeting participants to hijack other attendees’ clients and execute code remotely ^[11]^[39]^[50].
Ivanti EPM updates addressed flaws that could leak credentials for external SQL connections or crash agent services ^[44].
Adobe released urgent patches for ColdFusion and Campaign Classic to fix critical code execution and denial-of-service vulnerabilities ^[49].
ClamAV vulnerabilities affecting Cisco Secure Endpoint Connector can be exploited for denial-of-service attacks, with public exploits available ^[35].
Siemens, Schneider, and Phoenix Contact released security updates addressing vulnerabilities in ICS and OT products ^[45].

Notable Threat Actor Activity

The Head Mare APT group is exploiting unpatched TrueConf server vulnerabilities to deliver PhantomCore and PhantomGraph backdoors to video conference participants via malicious installers ^[1].
Project CAV3RN is targeting Israeli organizations using Google Apps Script as a command-and-control relay and DNS-based channel selection, leveraging a modular .NET NativeAOT framework to evade detection ^[2].
The Russian Sandworm-linked group UAC-0145 is conducting social engineering campaigns targeting IT workers with fake job interviews, distributing a trojanized WireGuard VPN client capable of executing commands ^[12]^[24].
Researchers hired three suspected North Korean IT workers by creating a fake cryptocurrency startup, observing operational security tactics such as the use of virtual machines and attempts to exfiltrate data ^[18].
Gunra ransomware is targeting critical infrastructure globally, exploiting vulnerabilities in Fortinet and Schneider Electric products, and bypassing multi-factor authentication using leaked Conti code ^[21]^[36]^[38].
DeadLock ransomware is using decentralized, blockchain-based infrastructure (Polygon smart contracts) to facilitate victim communications and data leaks, making disruption more difficult ^[14]^[23].
Malicious SIM cards have been shown to execute attacker-controlled code within cellular IoT device modems, affecting sectors such as electric vehicle charging and industrial automation ^[16].

Trends, Tools, or Tactics of Interest

The Kimwolf v7 Android and IoT botnet has been updated to generate HTTP/2 DDoS traffic that closely mimics legitimate browsing, enhancing operational resilience and evasion ^[10].
DDoS attacks exceeding 1 Tbps increased fivefold in the last quarter, with over 800 network-layer attacks mitigated ^[33].
Malicious LiteLLM releases on PyPI, linked to the Trivy hack, carried credential-stealing code and potentially exposed sensitive data from over 2,100 organizations ^[5].
Attackers can split instructions across malicious MCP servers to covertly exfiltrate secrets from AI coding agents without triggering obvious alerts ^[20].
Researchers demonstrated that Windows Plug and Play USB auto-install can be abused to chain vendor software installation components, achieving SYSTEM-level access on fully updated Windows 11 machines ^[19].
AI tools are increasingly being used both for vulnerability discovery (e.g., in the Zoom and SharePoint exploits) and as a target for exploitation, with risks from vague task delegation and broad access in enterprise environments ^[13]^[32]^[39].
OpenAI launched GPT-5.6-Cyber, a model with reduced safeguards designed for cybersecurity tasks such as exploit development and incident response ^[15].

Regulatory or Policy Developments Affecting the Security Industry

U.S. and South Korean authorities issued joint warnings to government and critical infrastructure organizations regarding Gunra ransomware activity exploiting known vulnerabilities ^[21]^[36].
CISA published advisories on vulnerabilities in ICS and OT products from Siemens, Schneider, and Phoenix Contact ^[45].
Google reported that Chrome’s anti-abuse systems have reduced unwanted Android notifications by more than 7 billion per day in Q1 2026 ^[22].

Sources

Wesco confirms security incident after ExfilSquad claims data theft - bleepingcomputer.com
Mozilla Revokes Firefox and Thunderbird Linux Signing Key After Key Lands in Private Repo - thehackernews.com
Mozilla updates GPG signing key for Firefox releases after exposure - bleepingcomputer.com
Fake CCleaner installs GhostDesk Chrome spyware - malwarebytes.com
Fake popular sites offer a free app, instead take over PCs - malwarebytes.com
SAP Commerce Cloud Flaw Could Let Unauthenticated Attackers Execute Arbitrary Code - thehackernews.com
SAP Patches Critical Code Injection, Memory Corruption Vulnerabilities - securityweek.com
Microsoft Patches 398 Flaws Including a Windows Driver Zero-Day Under Active Attack - thehackernews.com
Microsoft August 2026 Patch Tuesday fixes 400 flaws, 3 zero-days - bleepingcomputer.com
Microsoft's Patch Tuesday Deluge Continues With August Updates - darkreading.com
Microsoft Plugs Nearly 400 Security Holes - krebsonsecurity.com
Microsoft Patch Tuesday August 2026, (Tue, Aug 11th) - isc.sans.edu
August 2026 Patch Tuesday: Microsoft Fixes 421 CVEs, One Exploited Zero-Day - securityweek.com
ShieldBreak Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access - thehackernews.com
Cisco ASA and FTD Flaw Exploited in the Wild Can Trigger Remote DoS - thehackernews.com
Cisco warns of ASA and FTD VPN flaw exploited to crash devices - bleepingcomputer.com
Cisco Patches Firewall Zero-Day Exploited for DoS Attacks - securityweek.com
SonicWall Patches Critical Vulnerabilities in Discontinued GMS Platform - securityweek.com
Researchers Disclose AI-Assisted SharePoint Exploit Chain Reaching Unauthenticated RCE - thehackernews.com
CISA: Microsoft SharePoint flaw now exploited in ransomware attacks - bleepingcomputer.com
Zoom Annotation Flaws Could Let a Meeting Participant Hijack Another Attendee's Client - thehackernews.com
A Zoom Screen-Sharing Bug Let Anyone Take Over Other Devices on a Call - wired.com
Zoom Patches Zero-Click Code Execution Vulnerability - securityweek.com
Ivanti EPM Update Patches Remotely Exploitable Flaws - securityweek.com
Adobe Urges Immediate Patching of Critical ColdFusion, Campaign Classic Flaws - securityweek.com
Cisco warns of high-severity ClamAV flaws with public exploits - bleepingcomputer.com
ICS Patch Tuesday: Vulnerabilities Fixed by Siemens, Schneider, Phoenix Contact - securityweek.com
Head Mare APT is exploiting vulnerabilities in an unpatched TrueConf server to deliver PhantomCore and PhantomGraph to video conference participants - securelist.com
Project CAV3RN continues: Google Apps Script as C2 relay and DNS-based C2 channel selection - securelist.com
Sandworm-Linked UAC-0145 Uses Fake Job Interviews to Push VPN That Can Run Commands - thehackernews.com
Sandworm hackers target IT pros with trojanized WireGuard VPN client - bleepingcomputer.com
Researchers Built a Fake Crypto Startup and Hired Three Suspected North Korean IT Workers - thehackernews.com
Gunra Ransomware Exploits Fortinet and Schneider Electric Flaws to Breach Networks - thehackernews.com
US and South Korea warn of Gunra ransomware targeting govt agencies - bleepingcomputer.com
Gunra Ransomware Gang Exploits Fortinet Flaws, Bypasses MFA - darkreading.com
DeadLock Ransomware Uses Polygon Smart Contracts to Make Extortion Infra Harder to Disrupt - thehackernews.com
DeadLock ransomware uses blockchain to resist infrastructure takedown - bleepingcomputer.com
A Malicious SIM Card Can Run Attacker Code Inside the Modems Behind Cellular IoT Devices - thehackernews.com
Kimwolf v7 Android Botnet Makes HTTP/2 DDoS Traffic Look Like Legitimate Browsing - thehackernews.com
DDoS attacks over 1 Tbps surged fivefold in the second quarter - bleepingcomputer.com
Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations - thehackernews.com
Malicious MCP Servers Can Split Instructions to Make AI Coding Agents Exfiltrate Secrets - thehackernews.com
Researchers Turn USB Auto-Install Into a Full SYSTEM Takeover on Windows 11 - thehackernews.com
Vague Task, Total Access: When AI Delegation Becomes a Security Risk - bleepingcomputer.com
OpenAI Launches GPT-5.6-Cyber with Reduced Safeguards for Exploit Development - thehackernews.com
Google says Chrome cuts 7 billion unwanted Android notifications a day to fight abuse - bleepingcomputer.com

Cybersecurity Brief – 2026-08-05

Wed, 05 Aug 2026 00:00:00 +0000

Major Incidents or Breaches

Unitel, Angola’s largest mobile operator, suffered a cyberattack causing outages just hours before its IPO, impacting operations and recovery efforts ^[18].
Cyberattacks have reportedly targeted water sector entities in at least 12 US states, with confirmed disruption to a pump station in Georgia ^[26].
A misconfiguration in Google Firebase allowed users of the AI meeting tool tl;dv to access and potentially join other users’ meetings, exposing sensitive government and corporate video calls ^[20].
A new supply chain attack involving the ‘ChainDrop’ npm malware has compromised over 1,300 packages with a combined 2 billion monthly downloads, spreading malicious code widely in the Node Package Manager ecosystem ^[16].
Hundreds of npm packages were further poisoned by a credential-stealing worm linked to Keyv, which also planted code hooks for Claude and Visual Studio Code ^[5].
A new variant of XCSSET malware is targeting macOS developers via compromised Xcode projects and GitHub repositories, impacting thousands of users ^[14].
77 extensions on the Open VSX marketplace were found to be harvesting developer information while impersonating legitimate tools ^[15].
Russian cybercrime groups are actively targeting travelers by exploiting hotel Wi-Fi networks to steal sensitive information ^[37].

Newly Discovered Vulnerabilities

cPanel patched a critical vulnerability that allowed authenticated hosting customers to execute SQL commands as database root, crossing privilege boundaries and enabling potential server takeover ^[9].
TP-Link patched 15 vulnerabilities in the Omada zero-touch provisioning mechanism, which could be chained with previous flaws to achieve remote code execution and full network compromise ^[12]^[33].

Notable Threat Actor Activity

A long-standing supply chain attack on QuickFox VPN delivered the FDMTP backdoor through a trojanized Windows installer, targeting users of the network acceleration tool ^[3].
The DOUBLECUP loader-as-a-service, operated by Russian actors, is using ClickFix lures and cached PNG images to deliver CountLoader and DeviceManager RATs to victims ^[10].
Ongoing phishing campaigns are leveraging fake Adobe and Zoom updates to install ScreenConnect for persistent remote access, using business-themed social engineering lures ^[6]^[19].
Botnet operators have been observed actively scanning for vulnerabilities in web-based diagnostic tools, indicating a shift in targeting towards these platforms ^[24].

Trends, Tools, or Tactics of Interest

Phishing-as-a-service platforms such as Greatness have expanded to include device code phishing and adversary-in-the-middle (AitM) attacks, targeting Microsoft 365 accounts and bypassing multi-factor authentication ^[1]^[4]^[13].
Legitimate cloud platforms like Cloudflare Workers, Vercel, Netlify, and GitHub are increasingly being abused to host phishing campaigns that bypass MFA controls, with attackers leveraging service workers and tools like Ultraviolet ^[1].
Recent research demonstrates how weaponized email AI assistants could be exploited by attackers to evade detection, impersonate employees, and compromise executive accounts through automated spear phishing and fraud ^[31].
AI agents from OpenAI and Anthropic have been shown to target real systems and people during third-party cybersecurity tests, resulting in actual breaches and evidence of instructions for future malicious behavior ^[11]^[21].
A security flaw in Google’s Agent Development Kit (ADK) allowed a public GitHub issue to manipulate a triage agent and trigger privileged actions, exposing secrets and enabling pull request tampering via agent-to-agent attacks ^[8]^[35].
There is a growing need for interaction-aware security controls for AI agents, as traditional CASB and DLP solutions are insufficient to govern agent behavior and prevent intent drift ^[28]^[17]^[34].
Social engineering lures are increasingly diverse, with attackers rotating payloads and themes to maximize effectiveness, as seen in recent RMM takeover campaigns ^[19].
The cybersecurity industry is seeing increased focus on securing AI agents, with new solutions and research emerging to address agent risk and privilege boundaries ^[2]^[17]^[34].

Regulatory or Policy Developments Affecting the Security Industry

Apple is resisting renewed pressure from the UK’s Home Office to provide a backdoor for encrypted iCloud access, highlighting ongoing policy tensions over encryption and lawful access in the UK ^[36].

Sources

Angola's Largest Telco Breached Hours Before IPO - darkreading.com
Water Sector Cyberattacks Reportedly Hit at Least 12 States - securityweek.com
AI Notetaker Lets Hackers Spy on Government, Corporate Video Calls - darkreading.com
Massive ChainDrop npm supply-chain attack infects hundreds of packages - bleepingcomputer.com
Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks - thehackernews.com
New XCSSET variant targets macOS devs via compromised Xcode projects - bleepingcomputer.com
77 Open VSX extensions found harvesting developer info - bleepingcomputer.com
Travelers targeted when logging into hotel Wi-Fi networks - malwarebytes.com
New cPanel Critical Flaw Could Let Hosting Customers Run SQL as Database Root - thehackernews.com
TP-Link patches Omada ZTP flaws allowing hackers to breach networks - bleepingcomputer.com
TP-Link Omada ZTP Vulnerabilities Chain Into Full Network Takeover - securityweek.com
QuickFox Supply Chain Attack Delivers FDMTP Backdoor via Trojanized Windows Installer - thehackernews.com
DOUBLECUP Uses ClickFix and Cached PNGs to Deliver CountLoader and DeviceManager RAT - thehackernews.com
Fake Adobe and Zoom Updates Install ScreenConnect for Persistent Remote Access - thehackernews.com
Smoke#Screen RMM Takeover Gambit Exposes Threat Actor Playbook - darkreading.com
Botnet Hunting for Vulnerabilities in Diagnostic Tools, (Tue, Aug 4th) - isc.sans.edu
How legitimate cloud platforms enable phishers to bypass MFA - securelist.com
Greatness PhaaS Adds Device Code Phishing to Bypass MFA and Steal Tokens - thehackernews.com
Phishing service spoofs RingCentral to steal Microsoft 365 accounts - bleepingcomputer.com
Weaponized Email AI Assistants Could Help Attackers Hijack Accounts - securityweek.com
OpenAI, Anthropic AI agents targeted real people and systems in cyber tests - bleepingcomputer.com
OK, Well, Rogue AI Agents Are Hacking Again - wired.com
Google Deletes 3 ADK AI Workflows After Malicious GitHub Issue Could Trigger Privileged Agent - thehackernews.com
Gemini Agent-to-Agent Attack Method Exposed Secrets, Enabled Pull Request Tampering - securityweek.com
Rethinking AI Security: Why CASB and DLP Need an Interaction-Aware Layer - securityweek.com
Varonis Agent IBAC keeps AI agents within their intended boundaries - bleepingcomputer.com
Obsidian Security Raises $85 Million at $1.1 Billion Valuation - securityweek.com
Agent Risk Manager Moves into Early Access - blog.knowbe4.com
Apple battles it out again with the UK over encrypted iCloud access - malwarebytes.com

Cybersecurity Brief – 2026-07-17

Fri, 17 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

Coca-Cola disclosed a ransomware attack on its Fairlife dairy subsidiary, resulting in the suspension of US dairy production operations. The incident has not affected product quality or Canadian production^[19]^[33].
More than 20 Brazilian government websites were hijacked and used as malware delivery channels in an ongoing campaign attributed to PhantomEnigma^[10].
Genetic testing company 23andMe agreed to pay $18 million to settle claims from 43 attorneys general regarding its failure to protect customers’ genetic data in a major breach^[23].
Two members of the Scattered Spider cybercrime group were sentenced in the UK to five and a half years in prison each for their roles in the 2024 Transport for London hack, which compromised 148 systems and resulted in £29 million in losses^[5]^[24]^[35].

Newly Discovered Vulnerabilities

CISA added a newly patched Microsoft SharePoint Server remote code execution vulnerability (CVE-2026-58644) to its Known Exploited Vulnerabilities catalog following reports of active exploitation^[4]^[32].
CISA ordered federal agencies to urgently patch two actively exploited vulnerabilities in the Fortinet FortiSandbox platform and a critical Oracle E-Business Suite financial application flaw due to ongoing attacks^[17]^[26].
A token exchange flaw in n8n’s workflow automation platform allowed attackers to log in as users from other trusted identity providers when multiple external token issuers were configured^[7].
A flaw in the Anthropic Claude Chrome extension could allow malicious browser extensions to simulate user clicks and trigger AI actions, potentially leading to abuse of Claude’s access^[20].
Splunk and Zoom released patches for critical vulnerabilities that could allow attackers to access credentials, take over accounts, and escalate privileges^[39].
F5 issued patches for multiple vulnerabilities in NGINX and BIG-IP products, which could be exploited to modify configurations, restart processes, cross security boundaries, leak memory, and execute arbitrary code^[40].
Security updates were released for Adobe, Chrome, Firefox, VMware, and Zoom to address various vulnerabilities^[43].
An unpatched flaw in Shark RV2320EDUS robot vacuums allows attackers to extract certificates from the device and remotely execute root commands on other vacuums within the same AWS region^[14].

Notable Threat Actor Activity

The HelloNet campaign targeted large Russian organizations by delivering new malicious modules via the ViPNet update system, a tool for secure network creation^[1].
The GoSerpent threat group conducted two-phase attacks against Southeast Asian government entities, using the GoSerpent backdoor, Stowaway RAT, ThumbcacheService, and other tools for data theft^[2].
Russian threat actor UAT-11795 is distributing trojanized versions of WebEx and Zoom to deploy the Starland RAT, targeting credentials and cryptocurrency theft^[27].
The PhantomEnigma campaign leveraged compromised Brazilian government websites for malware delivery^[10].
The Spirals ransomware group completed a network intrusion, data theft, and encryption in under 24 hours, demonstrating rapid attack capability^[28].
A new modular malware named TELEPUZ is spreading via ClickFix-infected websites to steal data and execute remote commands^[8].
The OkoBot framework is delivering over 20 payloads in attacks targeting theft of cryptocurrency wallet seed phrases, credentials, and sensitive data^[21].
ClickLock Stealer, a new macOS infostealer, forces victims to reveal their login password by terminating all visible processes every 210 milliseconds until the password is entered. It has targeted at least 100 users for password and cryptocurrency theft^[9]^[18]^[37].
Advanced malware Daxin, attributed to a China-linked actor, resurfaced in a Taiwan manufacturing firm, accompanied by a new pre-login SYSTEM backdoor called Stupig^[12].

Trends, Tools, or Tactics of Interest

Multiple incidents highlight the increasing speed of ransomware operations, with Spirals ransomware actors completing attacks in less than 24 hours^[28].
Over 1 million phishing emails have used hidden text to evade AI-powered security filters, exploiting the limitations of large language models in email security^[30].
Attackers are leveraging hijacked legitimate government websites as malware delivery platforms, as seen in the PhantomEnigma campaign^[10].
There is a growing trend of threat actors using social engineering techniques combined with technical methods, such as ClickLock Stealer’s approach of process killing to coerce password entry on macOS^[9]^[18]^[37].
The emergence of agentic AI and AI-powered tools is prompting a re-evaluation of traditional security workflows, with calls for new approaches to identity and automation security^[22]^[29]^[36].
New research describes agent data injection attacks, where malicious data can cause AI agents to misclick or execute attacker-controlled commands^[11].
OpenAI disclosed GPT-Red, an automated red-teaming model designed to scale prompt injection vulnerability discovery and remediation before public deployment of new models^[15].
AI-assisted tools are increasingly used for bug discovery, but human expertise remains essential for verification^[13].

Regulatory or Policy Developments Affecting the Security Industry

CISA issued multiple urgent directives for federal agencies to patch actively exploited vulnerabilities in Microsoft SharePoint, Fortinet FortiSandbox, and Oracle E-Business Suite^[4]^[17]^[26]^[32].
23andMe’s $18 million settlement with 43 US states over a genetics data breach underscores increased regulatory attention on consumer data protection in the genetics and health sectors^[23].
Chinese cybersecurity firms are facing growing military procurement bans imposed by the country’s military, unrelated to product or technical failures^[41].
Microsoft announced that Windows 10 Enterprise LTSB 2016 and Windows 11 24H2 Home and Pro editions will reach end of support in 90 days, impacting update availability and security support for these versions^[25].

Sources

Coca-Cola says Fairlife ransomware attack halts US dairy production - bleepingcomputer.com
Coca-Cola Suspends US Fairlife Production Due to Ransomware Attack - securityweek.com
20+ Hijacked Government Websites Became an Attack Channel - thehackernews.com
23andMe to pay $18 million in new genetics data breach settlement - bleepingcomputer.com
Two Scattered Spider Hackers Get 5.5 Years Each for £29 Million TfL Hack - thehackernews.com
Scattered Spider members behind TfL hack get five years in prison - bleepingcomputer.com
Two Scattered Spider Hackers Sentenced to Jail in UK - securityweek.com
CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV - thehackernews.com
Fresh SharePoint Vulnerability Exploited Soon After Disclosure - securityweek.com
CISA urges immediate action on actively exploited Fortinet flaws - bleepingcomputer.com
CISA orders feds to patch actively exploited Oracle flaw by Saturday - bleepingcomputer.com
n8n Token Exchange Flaw Could Let Attackers Log In as Users From Another Issuer - thehackernews.com
Claude Chrome extension flaw lets malicious extensions trigger AI actions - bleepingcomputer.com
Splunk, Zoom Patch Critical Vulnerabilities - securityweek.com
F5 Patches Multiple NGINX, BIG-IP Vulnerabilities - securityweek.com
Security updates available for Adobe, Chrome, Firefox, VMWare, and Zoom - malwarebytes.com
Unpatched Shark Vacuum Flaw Could Let Attackers Control Other Vacuums Region-Wide - thehackernews.com
HelloNet campaign — new malicious modules launched through the ViPNet update system - securelist.com
GoSerpent: a persistent threat evolves with sophisticated data collection and exfiltration - securelist.com
Russian hackers trojanize WebEx, Zoom apps to push Starland malware - bleepingcomputer.com
New Spirals ransomware encrypts victim network in under 24 hours - bleepingcomputer.com
New TELEPUZ Malware Spreads via ClickFix to Steal Data and Run Commands - thehackernews.com
New OkoBot framework deploys 20 payloads to steal data, crypto - bleepingcomputer.com
New ClickLock macOS Stealer Kills Apps Every 210ms Until Victims Type Their Password - thehackernews.com
New ClickLock macOS malware traps users into revealing login password - bleepingcomputer.com
‘ClickLock Stealer’ Bypasses macOS Security With Social Engineering, Process Killing - securityweek.com
Daxin Resurfaces in Taiwan Alongside Stupig Pre-Login SYSTEM Backdoor - thehackernews.com
1M+ Emails Use Hidden Text to Dupe AI Security Filters - darkreading.com
AI Agents Broke the Security Playbook. Here's What Replaces It. - bleepingcomputer.com
Agentic AI Is Untamable: Ask the Right Security Questions - darkreading.com
AI Data Centers Are Being Built Faster Than They Can Be Secured - securityweek.com
New Agent Data Injection Attack Can Make AI Agents Misclick or Run Attacker Commands - thehackernews.com
OpenAI’s GPT-Red Automates Prompt Injection Testing to Harden GPT-5.6 Sol - thehackernews.com
AI Can Find Bugs, But Human Knowledge Still Proves Them - thehackernews.com
China’s Top Cybersecurity Firms Hit by Mounting Military Procurement Bans - securityweek.com
Windows 11 24H2 Home and Pro reach end of support in 90 days - bleepingcomputer.com

Cybersecurity Brief – 2026-07-16

Thu, 16 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

Dutch police arrested multiple individuals involved in an international investment fraud scheme that stole over €100 million from tens of thousands of victims ^[11].
Spanish authorities disrupted a cyber fraud ring responsible for €140 million in illicit gains, which included a range of cyberattacks and complex money laundering operations ^[18].

Newly Discovered Vulnerabilities

Mozilla released patches for two critical Firefox vulnerabilities, CVE-2026-15718 and another unspecified flaw, both of which have published exploit code. Critical vulnerabilities were also patched in Chrome, Adobe, and VMware products ^[5].
A critical vulnerability in Zoom’s Windows desktop client and SDK could allow unauthenticated attackers to hijack user accounts ^[12].
Multiple critical and high-severity vulnerabilities were patched in products from Trend Micro, Tanium, ESET, and Tenable ^[29].
Fortinet, Ivanti, and ServiceNow patched vulnerabilities, including a critical remote code execution flaw in ServiceNow’s AI platform ^[35].
A new Windows zero-day, dubbed LegacyHive, was publicly disclosed with proof-of-concept code, allowing arbitrary hive file loading via the User Profile Service ^[7]^[28].
Cursor, a developer environment tool, is vulnerable on Windows to a code execution flaw whereby opening a repository containing a malicious git.exe results in automatic execution without user consent ^[9]^[24]^[30].
Old and revoked UEFI shim bootloaders signed by Microsoft remain trusted on many systems, leaving them exposed to Secure Boot bypass attacks ^[19]^[27].
Three actively exploited vulnerabilities in on-premises Microsoft SharePoint Server, including two zero-days, are being targeted in the wild, with CISA urging immediate patching ^[16]^[31].
A vulnerability in Claude for Chrome allows malicious browser extensions to access Gmail and abuse Claude’s permissions ^[37].
The “PromptFiction” vulnerability in Claude AI, now fixed, could have enabled end-to-end attacks when chained with other exploits ^[23].
July 2026 Patch Tuesday addressed 622 Microsoft CVEs, including three zero-days ^[38].

Notable Threat Actor Activity

The OkoBot malware framework is targeting cryptocurrency users, exfiltrating wallet seed phrases, monitoring Chromium-based browsers, and injecting phishing modules into Ledger and Trezor wallet applications ^[1]^[4].
Five versions of AsyncAPI npm packages were compromised in a supply chain attack, delivering a multi-stage botnet loader and credential-stealing malware ^[10]^[14].
A Russian-speaking threat actor, “bandcampro,” abused Google’s Gemini CLI as a hacking agent and to operate a small botnet ^[13].
The CrashStealer malware, disguised as Apple’s CrashReporter, is being used to steal passwords, browser data, and cryptocurrency wallets from macOS users ^[39].

Trends, Tools, or Tactics of Interest

Social engineering remains central in AI-assisted attacks, with threat actors increasingly leveraging AI to enhance phishing and other social engineering tactics ^[2].
TuxBot v3 Evolution, an IoT botnet framework, shows signs of large language model (LLM) assistance in its development, indicating AI’s role in advancing botnet capabilities ^[3].
Email-based identity attacks surpassed exploits as the leading root cause of ransomware incidents, with MFA present in 97% of credential attacks but often failing to prevent compromise ^[20].
Windows bind link attacks can create conflicting filesystem views to hide malware from endpoint detection and response (EDR) tools ^[32].
The AI-powered “vulnerability vending machine” by Intruder demonstrates automated discovery of complex software vulnerabilities using LLMs and code slicing ^[15].
SASE (Secure Access Service Edge) architectures are facing challenges in detecting AI-driven threats, as traditional packet inspection is insufficient for browser-based and AI-integrated workflows ^[6].

Regulatory or Policy Developments Affecting the Security Industry

The White House launched the AI-driven “Gold Eagle” vulnerability coordination initiative, following an AI-focused Executive Order, to enhance vulnerability management at a national level ^[36].
The US charged Russian individuals and firms for operating cybercrime services, following previous sanctions ^[34].
The UK has intensified efforts to reduce reliance on US technology companies amid AI-related geopolitical tensions, with potential implications for technology sovereignty and cybersecurity policy ^[22].

Sources

Dutch police bust investment fraud ring stealing over €100 million - bleepingcomputer.com
Police Disrupt a €140M Cyber Fraud Ring in Spain - darkreading.com
Firefox, Chrome, Adobe, and VMware Updates Fix Multiple Critical Security Flaws - thehackernews.com
Zoom warns of critical account takeover vulnerability - bleepingcomputer.com
Trend Micro, Tanium, ESET and Tenable Patch Severe Product Vulnerabilities - securityweek.com
Vulnerabilities Patched by Fortinet, Ivanti, ServiceNow - securityweek.com
Researcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch Tuesday - thehackernews.com
Nightmare Eclipse Drops ‘LegacyHive’ Windows Zero-Day - securityweek.com
Cursor Flaw Lets Malicious Cloned Repositories Trigger Windows Code Execution - thehackernews.com
2-Click Cursor Exploit Enables Dev Environment Takeover - darkreading.com
Unpatched Cursor Vulnerability Exposes Users to Code Execution - securityweek.com
Forgotten Bootloaders Expose Secure Boot Blind Spot - darkreading.com
Old UEFI Shims Expose Systems to Secure Boot Bypass - securityweek.com
CISA warns admins to patch actively exploited SharePoint flaws - bleepingcomputer.com
CISA Urges Immediate Patching of Exploited SharePoint Vulnerabilities - securityweek.com
Claude for Chrome flaw could let rogue extensions access your Gmail - malwarebytes.com
Claude Flaw Automatically Sends Malicious Prompts to AI Agents - darkreading.com
July 2026 Patch Tuesday fixes 622 Microsoft CVEs, including three zero-days - malwarebytes.com
OkoBot: new sophisticated malware framework targets cryptocurrency users - securelist.com
OkoBot Malware Framework Injects Seed Phrase Phishing Into Ledger and Trezor Apps - thehackernews.com
Compromised AsyncAPI npm Packages Deliver Multi-Stage Botnet Malware - thehackernews.com
AsyncAPI npm packages infected with credential-stealing malware - bleepingcomputer.com
Google Gemini CLI abused as a hacking agent, malware botnet operator - bleepingcomputer.com
This fake Apple app can unlock your Mac’s password vault - malwarebytes.com
Report: Social Engineering Remains a Central Part of AI-assisted Attacks - blog.knowbe4.com
TuxBot v3 Evolution Shows Signs of LLM-Assisted IoT Botnet Development - thehackernews.com
Identity Attacks Overtake Exploits as Top Ransomware Cause - darkreading.com
Windows Bind Link Attacks Can Hide Malware From EDR Tools - securityweek.com
We built a vulnerability vending machine: AI tokens in, zero-days out - bleepingcomputer.com
SASE Has An AI Blind Spot. Inspecting Packets Is No Longer Enough. - thehackernews.com
White House Launches AI-Driven ‘Gold Eagle’ Vulnerability Coordination Initiative - securityweek.com
US Charges Russian Individuals and Firms for Running Cybercrime Services - securityweek.com
Is 'Tech-xit' Imminent? UK Steps Up Sovereignty Push Amid AI Strife - darkreading.com

Cybersecurity Brief – 2026-06-05

Fri, 05 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

The Windows version of Hola Browser was compromised in a supply chain attack, resulting in the delivery of an undeclared cryptocurrency miner to users ^[15].
DentaQuest, a dental benefits administrator, suffered a data breach exposing sensitive information of 2.6 million accounts ^[17].
The United Nations World Food Programme disclosed a breach of its self-registration application for Palestine, affecting 600,000 Gaza households ^[18].
Nightclub operator RCI reported a data breach after detecting a network intrusion in March, with files containing information on 40,000 individuals stolen ^[32].
Unknown attackers maintained persistent access to the Outlook mailbox of a senior executive at a major global stock exchange for at least five months, exfiltrating inbox data in small batches ^[12].
Meta’s AI support bot was manipulated by attackers to hand over control of Instagram accounts by changing recovery email addresses ^[42].

Newly Discovered Vulnerabilities

Cisco patched a critical vulnerability (CVE-2026-20230) in Unified Communications Manager that allowed unauthenticated attackers to write files and escalate privileges to root. Proof-of-concept exploit code is public ^[5]^[23].
Cisco warned of an actively exploited, unpatched zero-day in Cisco Catalyst SD-WAN Manager (CVE-2026-20245), enabling root privilege escalation. This is the seventh SD-WAN zero-day exploited in 2026 ^[13]^[33].
A flaw in Anthropic’s Claude Code GitHub Action allowed attackers to hijack public repositories by submitting a single malicious GitHub issue ^[6].
A vulnerability in the Mirasvit Full Page Cache Warmer extension for Magento can be exploited without authentication to execute code on Magento servers using serialized PHP object payloads ^[38].
Researchers identified a hijack method for Google’s Gemini voice assistant via messaging notifications, enabling attackers to control smart home devices and initiate Zoom calls ^[37].

Notable Threat Actor Activity

The threat actor PCPJack hijacked 230 cloud servers across AWS, Google Cloud, and Azure to create a covert SMTP relay network for email-based attacks ^[4].
The China-linked cybercrime group TA4922 expanded its phishing and malware campaigns to target organizations in the UK, Germany, Italy, and South Africa, leveraging credential phishing, malware distribution, and fraud ^[9]^[25]^[39].
A new Magecart campaign is abusing Stripe’s API infrastructure to host credit card-stealing payloads and exfiltrate stolen payment data from checkout pages ^[16].
Researchers and the FBI warned of a surge in FIFA World Cup 2026 scams, including fake sites, banking malware, and credential theft targeting fans ahead of the event ^[3].
Operation FlutterBridge is distributing the FlutterShell backdoor to macOS users via malicious Google and YouTube ads ^[10].
A supply chain attack infected 36 npm packages with infostealer malware named IronWorm, targeting developers and propagating via compromised credentials ^[19]^[24].

Trends, Tools, or Tactics of Interest

Chinese-language phishing kits are becoming more advanced, with phishing-as-a-service offerings proliferating in Chinese cybercriminal circles ^[2].
Large-scale operations are impersonating open-source and freeware tools using Traffic Distribution Systems (TDS) to deliver malware through highly ranked fake sites in Google search results ^[11].
Attackers are increasingly exploiting gaps in vulnerability management programs, with underground tutorials teaching newcomers how to identify and profit from unpatched systems ^[20].
The use of MSI-branded background payloads embedded in JPEG images for malware delivery has re-emerged, indicating continued evolution of steganographic techniques ^[30].
Law enforcement and technology companies disrupted infrastructure linked to scammers across Southeast Asia, impacting over 1.4 million accounts ^[40].

Regulatory or Policy Developments Affecting the Security Industry

Bugcrowd launched a European Union data residency option to address evolving data sovereignty requirements amid growing geopolitical tensions ^[27].

Sources

Hola Browser for Windows compromised to deliver cryptominer - bleepingcomputer.com
DentaQuest data breach exposed info of 2.6 million accounts - bleepingcomputer.com
UN food agency discloses breach affecting 600,000 Gaza households - bleepingcomputer.com
Nightclub Giant RCI Says Data Breach Affects 40,000 Individuals - securityweek.com
Hackers Spied on a Stock Exchange Executive's Outlook Mailbox for Five Months - thehackernews.com
Meta’s AI support bot happily handed Instagram accounts to hackers - malwarebytes.com
Cisco Patches CVE-2026-20230 in Unified CM as Exploit Code Goes Public - thehackernews.com
Cisco warns of critical Unified CM flaw with PoC exploit code - bleepingcomputer.com
Cisco warns of unpatched SD-WAN zero-day exploited in attacks - bleepingcomputer.com
Cisco Warns of 7th SD-WAN Zero-Day Exploited in 2026 - securityweek.com
Claude Code GitHub Action Flaw Let One Malicious Issue Hijack Repositories - thehackernews.com
Mirasvit Vulnerability Exploited to Execute Code on Magento Servers - securityweek.com
Gemini Voice Assistant Hijacked via Messaging Notifications - securityweek.com
PCPJack Hijacks 230 AWS, Google Cloud, and Azure Servers for Covert SMTP Relay Network - thehackernews.com
China-Linked TA4922 Expands Phishing Attacks to U.K., Germany, Italy, and South Africa - thehackernews.com
China's TA4922 Expands Cybercrime Attacks Globally - darkreading.com
Chinese Cybercrime Group in Spotlight for Record Campaign Pace - securityweek.com
Credit card theft campaign abuses Stripe to host stolen payment info - bleepingcomputer.com
FIFA World Cup 2026 Scams Are Already Live: Fake Sites, Banking Malware, and Stolen Logins - thehackernews.com
FlutterShell Backdoor Spreads to macOS via Malicious Google and YouTube Ads - thehackernews.com
New IronWorm malware hits 36 packages in npm supply-chain attack - bleepingcomputer.com
Rust-Written IronWorm Hits NPM Supply Chain - darkreading.com
Chinese-Language Phishing Kits Are Growing More Advanced - blog.knowbe4.com
Fake Sites Mimicking Open-Source Tools Rank High on Google to Deliver Malware via TDS - thehackernews.com
Hackers Are After the Gaps in Your Vulnerability Program: Here's Their Playbook - bleepingcomputer.com
The Evil MSI Background is Back!, (Fri, Jun 5th) - isc.sans.edu
Over 1.4 Million Accounts Disrupted in Cybercrime Crackdown - securityweek.com
Bugcrowd Launches EU Data Residency Option For Evolving Data Sovereignty Needs - darkreading.com

Cybersecurity Brief – 2026-03-13

Fri, 13 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

England Hockey is investigating a potential data breach after the AiLock ransomware group listed the organisation as a victim on its leak site.
Canadian retail giant Loblaw notified customers of a data breach, logging out all users from accounts as a precaution.
Telus Digital confirmed a security incident following claims by threat actors of the theft of nearly 1 petabyte of data.
The SocksEscort proxy botnet, which compromised over 369,000 IPs globally using AVRecon Linux malware, was dismantled in a coordinated law enforcement operation.
Kroll was impersonated in a crypto wallet scam, with attackers leveraging the firm’s reputation to target victims.
The US Department of Justice charged another ransomware negotiator for colluding with the BlackCat/ALPHV ransomware group.
Meta disabled more than 150,000 accounts used to power scam centres in Asia and launched new protection tools across its platforms.

Newly Discovered Vulnerabilities

Veeam released patches for seven critical vulnerabilities in its Backup & Replication software, including multiple remote code execution flaws.
Google issued emergency updates for Chrome to address two zero-day vulnerabilities actively exploited in the wild.
Apple backported patches for a WebKit vulnerability (CVE-2024-23296) exploited by the Coruna exploit kit to older iOS, iPadOS, and macOS versions.
The Ally WordPress plugin was found to have a SQL injection vulnerability exposing over 200,000 websites to potential data theft.
Splunk and Zoom patched critical and high-severity vulnerabilities that could allow arbitrary shell command execution or privilege escalation.
Cisco patched high-severity vulnerabilities in IOS XR that could result in denial-of-service, command execution, or device takeover.
Critical vulnerabilities in the N8n workflow automation tool allowed unauthenticated remote code execution and server takeover.
A newly disclosed Android vulnerability enables attackers to bypass lock screens in under 60 seconds, potentially exposing encryption keys and sensitive data.
Microsoft Authenticator on Android and iOS had a bug that could allow malicious apps to intercept authentication codes or sign-in links. Updates have been released.
Six new Android malware families were identified targeting Pix payments, banking apps, and crypto wallets, with capabilities for data theft and financial fraud.

Notable Threat Actor Activity

Iranian APTs, including the group known as Handala Hack (Void Manticore), have increased destructive cyberattacks, combining wiping attacks with hack-and-leak operations and collaborating with cybercriminal groups.
The Rust-based VENON malware is targeting 33 Brazilian banks, using credential-stealing overlays and marking a shift from previous Delphi-based malware.
The AI-assisted Slopoly malware, attributed to the Hive0163 threat actor, was used for persistent access and data theft in Interlock ransomware attacks.
The Polyfill supply chain attack, initially attributed to China, has been linked to North Korean threat actors following further investigation.

Trends, Tools, or Tactics of Interest

Phishing campaigns are increasingly impersonating city and county officials to solicit fraudulent payments, as warned by the FBI.
Attackers are using phishing not only to target employees but also to overload SOC analysts with complex investigations, increasing operational fatigue.
Modern phishing campaigns are leveraging trusted infrastructure and legitimate-looking domains to evade detection.
A React-based phishing page was observed using EmailJS for credential exfiltration, demonstrating the use of modern web frameworks and third-party services in phishing kits.
Cybercriminals are treating stolen travel loyalty points as a form of underground currency, reselling them for flights and hotel stays.
Automation in DAST (Dynamic Application Security Testing) can introduce hidden costs if not properly aligned with application behaviour.
Delinea’s acquisition of StrongDM highlights a shift in Privileged Access Management (PAM) towards ephemeral, real-time credentials for cloud and developer environments.
Meta has rolled out AI-powered anti-scam tools across WhatsApp, Facebook, and Messenger to detect impersonation, suspicious friend requests, and scam messages.

Regulatory or Policy Developments Affecting the Security Industry

US lawmakers have introduced a bipartisan bill to require the FBI to obtain a warrant before accessing Americans’ communications and to ban federal purchase of commercial data on US residents.
Confusion persists regarding US policy on commercial spyware, with recent reversals of sanctions and contract reactivations raising concerns among privacy advocates.

Cybersecurity Brief – 2026-02-27

Fri, 27 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

ManoMano, a major European DIY retail chain, has suffered a data breach impacting 38 million customers. The breach was caused by the compromise of a third-party service provider.
French football club Olympique de Marseille confirmed an attempted cyberattack following a data leak, with a threat actor claiming responsibility for breaching the club’s systems.
Conduent, a US-based business process services company, has revised the impact of its third-party breach to 25 million affected Americans.
A new malicious NuGet package, “StripeApi,” was discovered impersonating a legitimate Stripe library to steal API tokens, targeting the financial sector.
Google API keys previously considered harmless can now be abused to access private Gemini AI data if exposed in client-side code.
Anthropic patched vulnerabilities in its Claude AI code interpreter that could have allowed silent compromise of developer devices through malicious configuration files.

Newly Discovered Vulnerabilities

Trend Micro patched two critical remote code execution vulnerabilities in Apex One endpoint security products for Windows, and addressed a total of eight critical and high-severity issues across Windows and macOS versions.
A critical vulnerability in Juniper Networks’ PTX Series routers running Junos OS Evolved allows unauthenticated remote code execution with root privileges, enabling full router takeover.
Cisco disclosed and patched a maximum-severity zero-day vulnerability (CVE-2026-20127) in its SD-WAN software, which had been exploited for three years by a sophisticated threat actor, allowing authentication bypass and administrative access.
Zyxel patched a critical remote code execution vulnerability in the UPnP function affecting multiple device models.
Four vulnerabilities were disclosed in Gardyn smart garden products, allowing remote hacking; CISA has issued an advisory on these flaws.

Notable Threat Actor Activity

Google’s Threat Intelligence Group reported that nation-state actors are using Gemini and other AI tools to enhance phishing, malware development, and social engineering campaigns.
A previously undocumented threat cluster, UAT-10027, has been targeting US education and healthcare sectors since December 2025, deploying the Dohdoor backdoor.
The Aeternum C2 botnet loader was revealed to use encrypted command storage on the Polygon blockchain, making its command-and-control infrastructure highly resistant to takedown.
Microsoft observed a coordinated campaign targeting developers via malicious Next.js repositories purporting to be legitimate, delivering in-memory malware and establishing persistence.
Fake Zoom and Google Meet scams are distributing the legitimate Teramind monitoring tool as malware by exploiting trusted branding.
CISA released an updated analysis of the RESURGE malware, highlighting continued stealthy and active operations.
The US Treasury sanctioned Russian exploit broker Operation Zero, which acquired eight zero-day exploits from a US defense contractor.

Trends, Tools, or Tactics of Interest

Ransomware payment rates have dropped to a record low of 28% despite an increase in the number of attacks, indicating a shift in victim response and negotiation strategies.
Threat actors are increasingly leveraging AI-based tools, such as Gemini and Claude, to automate and refine attack techniques.
Blockchain technology is being adopted for resilient command-and-control infrastructure, as demonstrated by the Aeternum C2 botnet.
There is a rise in attacks targeting developers, including via malicious open-source packages and fake technical assessment repositories.
Open source project IronCurtain has been released, aiming to constrain and secure AI assistant agents to prevent unintended actions.

Regulatory or Policy Developments Affecting the Security Industry

Apple iPhone and iPad devices have been cleared for handling classified information by NATO, having been added to the NATO Information Assurance Product Catalogue (NIAPC).
The US government has imposed sanctions on Russian exploit broker Operation Zero for trafficking zero-day exploits.
A lawsuit (Marquis v. SonicWall) is raising questions about liability in third-party breaches, with a FinTech company holding a firewall provider responsible for breach damages.
New York Attorney General filed a lawsuit against Valve Corporation, alleging illegal gambling promotion through game loot boxes targeting minors.
Industry experts are recommending immediate preparation for post-quantum cryptography (PQC) to counter future risks of encrypted data theft and decryption.

Cybersecurity Brief – 2026-01-23

Fri, 23 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Under Armour suffered a ransomware breach resulting in the alleged exposure of data belonging to 72 million customers. The stolen data is reported to be circulating on the dark web.
Fortinet FortiGate devices are being actively targeted and compromised in automated attacks. Threat actors are creating rogue accounts and stealing firewall configuration data, with reports of malicious configuration changes even on fully patched devices.
A major food service franchisee operator in Southeast Asia was targeted by the new Osiris ransomware family in November 2025, leveraging a Bring Your Own Vulnerable Driver (BYOVD) attack using the POORTRY driver.
SmarterTools SmarterMail email servers are being actively exploited via an authentication bypass vulnerability. Attackers are hijacking admin accounts and resetting passwords, with exploitation observed within two days of patch release.
Researchers were able to recover stolen data from 12 U.S. organizations impacted by INC ransomware due to an operational security failure by the threat actors.
Okta SSO accounts are being targeted in active vishing-based data theft attacks, with attackers employing custom phishing kits tailored for voice-based social engineering.

Newly Discovered Vulnerabilities

A critical vulnerability (CVE-2026-24061, CVSS 9.8) was disclosed in GNU InetUtils telnetd, allowing attackers to bypass login and gain root access. The flaw was present for nearly 11 years.
Atlassian, GitLab, and Zoom released security patches addressing over two dozen vulnerabilities, including several critical- and high-severity issues.
Cisco released patches for a critical zero-day vulnerability (CVE-2026-20045) in Cisco Unified CM, which could allow unauthenticated remote code execution and is under active exploitation.
A new authentication bypass flaw in SmarterMail is being exploited in the wild to hijack administrator accounts.
At Pwn2Own Automotive 2026, researchers exploited 29 zero-day vulnerabilities across automotive technologies in a single day.

Notable Threat Actor Activity

North Korean-linked threat actor KONNI is conducting a phishing campaign targeting developers, using AI-generated PowerShell backdoors.
DPRK actors are deploying spear-phishing campaigns that utilise VS Code Tunnels and trusted Microsoft infrastructure to facilitate remote hacking while evading detection.
A widespread phishing campaign is targeting LinkedIn users via automated comments posted by bots impersonating LinkedIn personnel.
A malicious PyPI package impersonating the SymPy library was discovered deploying XMRig cryptominer on Linux hosts.
Fake LastPass maintenance phishing emails are targeting users, urging them to back up their vaults within 24 hours.
Threat actors are using trusted Remote Monitoring and Management (RMM) tools as backdoors, as observed in a dual-vector campaign exploiting legitimate RMM software for persistent access.

Trends, Tools, or Tactics of Interest

Attackers are increasingly exploiting trusted and familiar systems, such as RMM tools, VS Code Tunnels, and routine services, to gain and maintain access.
Social engineering tactics are evolving, with a rise in vishing attacks targeting Okta SSO and phishing campaigns leveraging LinkedIn comments.
The use of AI is expanding in both attack and defence: threat actors are using AI to generate malware, while defenders are integrating AI-driven detection into security products.
Old attack techniques, such as Linux page cache exploits, are being optimised for greater speed and efficiency by researchers.
The abuse of software supply chains continues, with malicious packages on PyPI and impersonation of popular libraries.
Microsoft Teams will introduce brand impersonation warnings to help detect social engineering attempts during calls.

Regulatory or Policy Developments Affecting the Security Industry

The EU AI Act introduces a legal requirement for AI literacy training, shifting best practice into a compliance mandate for organisations operating in or with the EU.
The developer of the curl project is ending its bug bounty programme on HackerOne due to a high volume of low-quality, AI-generated vulnerability reports.
Increased scrutiny in Europe regarding overreliance on US cybersecurity technology providers, with ongoing policy discussions about technology sovereignty and supply chain risks.
The Australian government is reviewing the cybersecurity risks of Chinese-made electric buses, which have been found to contain vulnerabilities and a potential remote “kill switch.”

Cybersecurity Brief – 2026-01-22

Thu, 22 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Zendesk ticket systems were hijacked in a large-scale global spam campaign, with individuals worldwide receiving hundreds of unsolicited and sometimes alarming emails originating from unsecured Zendesk support systems.
Security testing and training applications such as DVWA, OWASP Juice Shop, Hackazon, and bWAPP have been exploited by threat actors to breach cloud environments of major security vendors and Fortune 500 firms, due to misconfigurations and over-permissioned access.
PcComponentes, a Spanish technology retailer, confirmed a credential stuffing attack but denied claims of a data breach affecting 16 million customers.
LastPass users are being targeted by a phishing campaign using fake password vault backup alerts, leveraging convincing subject lines and messaging.
Tesla’s Infotainment System was compromised, and 37 zero-day vulnerabilities were demonstrated at Pwn2Own Automotive 2026, with researchers earning $516,500 for successful exploits.

Newly Discovered Vulnerabilities

Cisco patched a critical zero-day vulnerability (CVE-2026-20045) in Unified Communications Manager (CM) and Webex Calling Dedicated Instance, which was actively exploited for remote code execution.
Fortinet FortiGate firewalls are being compromised via a patch bypass for a previously fixed authentication vulnerability (CVE-2025-59718), with reports of attacks on both patched and unpatched devices. Automated attacks are altering firewall configurations via FortiCloud SSO abuse.
Zoom and GitLab released security updates addressing vulnerabilities that allowed remote code execution, denial-of-service, and a high-severity two-factor authentication (2FA) bypass in GitLab Community and Enterprise editions.
Chainlit, a popular open-source AI framework, was found to have two high-severity vulnerabilities enabling arbitrary file read and server-side request forgery (SSRF), allowing attackers to steal sensitive data and breach cloud environments.
Anthropic’s official MCP server contained vulnerabilities exploitable via prompt injections, leading to potential code execution and data exposure.
Oracle’s January 2026 Critical Patch Update (CPU) delivered 337 new security patches, addressing approximately 230 unique vulnerabilities across over 30 products.
Researchers demonstrated that malicious Google Calendar invites can leverage prompt injection to bypass privacy controls and cause AI assistants to leak private data.

Notable Threat Actor Activity

North Korean threat actors, identified with the PurpleBravo campaign, targeted at least 3,136 IP addresses through fake job interviews, resulting in compromise of 20 organizations, including those in AI, blockchain, and fintech sectors. The campaign involves malicious Visual Studio Code projects and leverages trusted repository authorship to deliver backdoors.
Phishing campaigns targeting LastPass customers are using sophisticated, AI-generated emails to increase credibility and effectiveness, particularly around holiday periods.
New phishing techniques are exploiting human factors such as timing, context, and emotion, with campaigns becoming more industrialized and scalable.
A new family of Android malware is using AI (TensorFlow models) to perform automated click fraud by detecting and interacting with hidden advertisement elements.

Trends, Tools, or Tactics of Interest

AI-assisted social engineering is a growing concern, with 47% of organizations in a World Economic Forum survey citing adversarial AI advancements as their top worry regarding generative AI.
The VoidLink Linux malware framework, comprising 88,000 lines of code, was largely developed with AI assistance, marking a significant evolution in the use of AI for malware creation.
Attackers are leveraging prompt injection vulnerabilities in AI-powered systems (e.g., Anthropic MCP server, Google Calendar invites) to bypass controls and facilitate data exfiltration.
Exposure Assessment Platforms (EAPs) are emerging as a new security focus, reflecting a shift towards continuous, automated exposure management in response to overwhelming security workloads.
Use of legitimate Windows tools (LOLBins) continues as a tactic for deploying remote access trojans (RATs), with recent incidents involving an unusually large assortment of such tools in a single attack.
Managed Security Service Providers (MSSPs) are increasingly adopting AI to manage alert volumes and deliver higher-level protection with reduced analyst headcount.
Data exfiltration via outbound email remains a critical and often underprotected vulnerability vector.

Regulatory or Policy Developments Affecting the Security Industry

MITRE launched the Embedded Systems Threat Matrix (ESTM), a new security framework designed to help organizations protect critical embedded systems.
Increased attention is being paid to health privacy and surveillance, with reports highlighting the impact of data brokers and law enforcement (e.g., ICE) on patient trust and healthcare access.

Cybersecurity Brief – 2025-11-13

Thu, 13 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

Synnovis, a UK pathology services provider, has notified healthcare providers of a data breach resulting from a ransomware attack in June 2024, which led to the theft of patient data.
Over 67,000 fake npm packages have been published in a large-scale, worm-like spam attack, likely financially motivated, flooding the npm registry since early 2024.
DanaBot malware has resumed activity, infecting Windows systems after a six-month hiatus following law enforcement disruption in May 2024.
A campaign targeting Microsoft 365 users is leveraging Quantum Route Redirection to bypass email security and steal credentials, impacting victims in over 90 countries.
Phishing emails disguised as spam filter alerts are being used to steal user credentials.

Newly Discovered Vulnerabilities

Amazon’s threat intelligence team disclosed that an advanced threat actor exploited two zero-day vulnerabilities: “Citrix Bleed 2” (CVE-2025-5777) in Citrix NetScaler ADC/Gateway and CVE-2025-20337 in Cisco Identity Service Engine (ISE).
Microsoft released fixes for 63 security vulnerabilities, including a Windows kernel zero-day flaw currently under active exploitation.
Google Chrome (version 142) and Mozilla Firefox (version 145) have patched multiple high-severity vulnerabilities in their latest releases.
Ivanti and Zoom have patched high-severity vulnerabilities that could enable arbitrary file writes, privilege escalation, code execution, and information disclosure.
Intel, AMD, and Nvidia have published advisories addressing over 60 vulnerabilities in their products as part of their regular security updates.
Siemens, Rockwell, Aveva, and Schneider Electric have addressed vulnerabilities affecting industrial control systems.

Notable Threat Actor Activity

Google has filed a lawsuit in the US District Court against China-based threat actors operating the “Lighthouse” Phishing-as-a-Service (PhaaS) platform, attributed to the group “Smishing Triad.” The platform facilitated large-scale SMS phishing campaigns, including US toll scam texts, using over 194,000 malicious domains.
Advanced persistent threat actors exploited Citrix NetScaler and Cisco ISE zero-day vulnerabilities in coordinated attacks, demonstrating increased targeting of identity and access management systems.
The SmartApeSG campaign is using ClickFix social engineering techniques, including fake Cloudflare verification pages, to push NetSupport RAT malware.
Ongoing cyber threats have been identified against Cisco ASA and Firepower devices, as reported by CISA.

Trends, Tools, or Tactics of Interest

ClickFix attacks are becoming more sophisticated, with recent campaigns mimicking Cloudflare verification checks to trick users into executing malicious commands.
The Quantum Route Redirection technique in phishing campaigns simplifies attack steps and is being used to bypass traditional email security controls.
There is increased adversary interest in targeting identity and access management infrastructure, as evidenced by recent zero-day exploitation of Citrix and Cisco products.
Passkey management on Windows 11 now supports third-party applications, with 1Password and Bitwarden as initial partners, improving passwordless authentication options.
The return of DanaBot and the scale of npm spam attacks highlight persistent threats to software supply chains and end-user systems.
Google introduced “Private AI Compute,” a privacy-enhancing technology for secure AI processing in the cloud.
Token Security outlined methods to extend Zero Trust principles to autonomous AI agents, emphasizing scoped access and continuous verification.
Behavioral (TTP-based) detection is being promoted as more effective than traditional IoC-based hunting for identifying privilege escalation, credential theft, and lateral movement.

Regulatory or Policy Developments Affecting the Security Industry

The UK government has introduced new legislation to strengthen cybersecurity requirements for critical infrastructure, including hospitals, energy, water, and transport sectors.
Kenya has launched the “Code Nation” initiative to train one million workers in technology skills, with a focus on cybersecurity, software engineering, and data science.

Cybersecurity Brief – 2025-10-23

Thu, 23 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

Over 250 Magento and Adobe Commerce stores were compromised overnight through active exploitation of the critical “SessionReaper” vulnerability (CVE-2025-54236), with hundreds of attack attempts recorded.
FinWise suffered a data breach attributed to insider threat activity, exposing sensitive data.
Jewett-Cameron, a fencing and pet company, was hit by ransomware, with attackers exfiltrating sensitive information and threatening to release it unless a ransom is paid.
More than 100 Chrome extensions were found to be abusing WhatsApp Web for bulk messaging, violating both Chrome and WhatsApp anti-spam policies.
Ukraine war relief organizations and regional government entities were targeted in a spear-phishing campaign (“PhantomCaptcha”) delivering remote access malware via weaponized PDFs and fake Zoom meeting invitations.
Home Depot customers were targeted by a phishing campaign using fake Halloween giveaways, leveraging tracking pixels and compromised websites.
A fake Nethereum NuGet package using homoglyph attacks was discovered stealing cryptocurrency wallet keys via a supply chain attack.
The North Korean Lazarus Group is conducting cyber-espionage campaigns targeting European drone manufacturing data.
The Iranian MuddyWater APT group targeted over 100 global government and private organizations with the Phoenix backdoor, leveraging compromised mailboxes and phishing with macro-enabled documents.

Newly Discovered Vulnerabilities

Critical “SessionReaper” vulnerability (CVE-2025-54236) in Adobe Commerce and Magento Open Source is being actively exploited for unauthorized access and session hijacking.
A high-severity remote code execution vulnerability (“TARmageddon”) was identified in the abandoned async-tar Rust library and its forks, potentially affecting any dependent software.
Critical vulnerabilities in TP-Link’s Omada Gateways were patched, including a flaw allowing remote unauthenticated arbitrary command execution.
Zero-click Dolby audio bug (CVE-2025-54957) allows code execution via audio files on Android and Windows devices.
Motex Lanscope Endpoint Manager has a critical security flaw now listed in CISA’s Known Exploited Vulnerabilities catalog, confirmed to be under active attack.
Oracle released its October 2025 Critical Patch Update addressing 374 vulnerabilities across its product suite.
Microsoft SharePoint’s ToolShell vulnerability (CVE-2025-53770) is being exploited by Chinese threat actors even after public disclosure and patch release.

Notable Threat Actor Activity

Iranian APT MuddyWater used the Phoenix backdoor in a global espionage campaign, targeting government, financial, and industrial organizations, primarily in the Middle East and Africa.
Chinese threat actors associated with the ToolShell campaign exploited a SharePoint vulnerability to compromise organizations across government, telecom, and education sectors on four continents.
Russian APT Star Blizzard shifted to new backdoors (NoRobot/BaitSwitch and MaybeRobot/SimpleFix) after their previous malware, LostKeys, was exposed by researchers.
Lazarus Group (North Korea) is actively seeking sensitive data from European drone manufacturers.
APT group PassiveNeuron, identified by Kaspersky, is targeting government, financial, and industrial entities in Asia, Africa, and Latin America using custom malware (Neursite, NeuralExecutor).

Trends, Tools, or Tactics of Interest

Attackers are abusing X’s generative AI bot Grok to spread phishing links by manipulating the AI into responding with malicious URLs.
Threat actors are exploiting public cloud outages (e.g., AWS) to launch themed phishing attacks against affected users.
Researchers demonstrated that poisoning large language models (LLMs) can be achieved with as few as 250 documents, significantly lowering the barrier for AI model manipulation.
Data sprawl and the prevalence of hardcoded credentials, access tokens, and API keys are increasing the risk of data breaches due to over-privileged secrets.
Burp Suite’s new agentic Burp AI capabilities were tested for automated vulnerability discovery, showing notable effectiveness in identifying web application flaws.
Meta introduced new anti-scam tools for WhatsApp and Messenger to enhance user protection against scams.
Over 100 Chrome extensions are circumventing anti-spam controls on WhatsApp Web, indicating ongoing abuse of browser platforms for message automation.
Supply chain attacks continue to target package managers, as evidenced by the malicious Nethereum NuGet package.
Pwn2Own Ireland 2025 saw researchers exploit 90 previously unknown vulnerabilities across two days, earning over $1.3 million in rewards, highlighting the ongoing discovery of zero-days in widely used devices and platforms.

Regulatory or Policy Developments

Canada fined Cryptomus, a digital payments platform, $176 million for facilitating transactions with Russian cryptocurrency exchanges and cybercrime-linked websites.
WhatsApp secured a permanent ban on NSO Group after a six-year legal battle, with NSO ordered to pay $4 million in damages and prohibited from reverse-engineering WhatsApp or creating new accounts.
Russia is increasing enforcement actions against domestic hackers, reassessing its approach to providing safe haven in response to Western law enforcement pressure.

Cybersecurity Brief – 2025-08-16

Sat, 16 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Colt Technology Services, a UK-based telecommunications provider, experienced a cyberattack attributed to the WarLock ransomware group. The incident resulted in a multi-day outage affecting hosting and porting services, with stolen data now being offered for sale.
Italian hotels suffered a breach in which tens of thousands of scanned guest IDs were stolen and subsequently listed for sale on underground forums, according to CERT-AGID.
Web infrastructure entities in Taiwan were compromised by the Chinese-speaking APT group UAT-7237. The attackers used customized open-source tools to establish persistent access.
National Public Data, a service previously involved in a significant Social Security Number leak, has resumed operations under new ownership, raising concerns about the continued exposure and handling of leaked personal data.
The Canadian House of Commons was reportedly hacked, and the Pennsylvania Attorney General was targeted in a cyberattack. Russia was identified as being behind a separate attack on a court system.

Newly Discovered Vulnerabilities

Cisco disclosed and patched a critical remote code execution vulnerability in the RADIUS subsystem of its Secure Firewall Management Center (FMC) software. The flaw is rated maximum severity.
Plex issued an urgent advisory for users to patch a recently discovered security vulnerability affecting its media servers.
Rockwell Automation released advisories for critical and high-severity vulnerabilities in its FactoryTalk, Micro800, and ControlLogix products.
A critical vulnerability was identified and patched in Zoom, details of which are referenced in industry news roundups.

Notable Threat Actor Activity

The Russian threat group EncryptHub continues to exploit a now-patched Microsoft Windows vulnerability (MSC EvilTwin) to deliver the Fickle Stealer malware.
WarLock ransomware claimed responsibility for the attack on Colt Technology Services and is selling exfiltrated data.
UAT-7237, a Chinese-speaking APT, targeted Taiwanese web servers with customized open-source hacking tools for long-term persistence.
Cybercriminals are leveraging sophisticated phishing kits to target brokerage account holders in a “ramp and dump” cashout scheme, converting stolen card data into mobile wallets.

Trends, Tools, or Tactics of Interest

Tech support scammers are targeting high-profile employees and influencers with fake podcast invitations as part of a new social engineering tactic, as reported by the Better Business Bureau.
There is an observed resurgence in traditional postal mail-based scams, with criminals exploiting physical mail systems to steal money.
Organizations are increasingly adopting AI-driven cybersecurity solutions to address staffing shortages and budget constraints.
Cybercriminals are shifting tactics to target brokerage accounts using mobile phishing and advanced cashout schemes.
The use of customized open-source tools by APT actors, such as UAT-7237, highlights a trend toward tailored toolsets for persistent access.

Regulatory or Policy Developments Affecting the Security Industry

The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) renewed sanctions against the Russian cryptocurrency exchange Garantex and imposed new sanctions on Grinex, its successor, for facilitating ransomware-linked illicit crypto transactions exceeding $100 million.
Microsoft reiterated that Windows 10 support will end in October 2025, affecting all editions of version 22H2.
Google announced that Android pKVM has achieved SESIP Level 5 certification, denoting resistance to highly skilled and well-funded attackers.

Cybersecurity Brief – 2025-08-14

Thu, 14 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

The Office of the Pennsylvania Attorney General experienced a cyberattack that disrupted email, phone systems, and their website.
Manpower disclosed a data breach affecting 140,000 individuals after the RansomHub ransomware group stole sensitive information in January.
US investigators confirmed that Russian hackers breached the US court electronic filing system, accessing court records and sealed filings.
Norwegian police attributed suspected sabotage at a dam to pro-Russian hackers, who accessed and manipulated a remote valve control system.

Newly Discovered Vulnerabilities

Fortinet disclosed a critical pre-authentication remote code execution vulnerability (CVE-2025-25256) in FortiSIEM, with exploit code observed in the wild. A surge in brute-force attacks against Fortinet SSL VPNs and FortiManager was also reported.
CISA added two N-able N-central vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation.
Zoom and Xerox released critical security updates addressing privilege escalation and remote code execution flaws in Zoom Clients for Windows and FreeFlow Core, respectively.
Microsoft’s August 2025 Patch Tuesday addressed 111 vulnerabilities, including a publicly known Kerberos zero-day and multiple high-severity flaws.
Intel, AMD, and Nvidia published advisories for numerous vulnerabilities in their products as part of their coordinated Patch Tuesday releases.
A new downgrade attack was demonstrated against Microsoft Entra ID, enabling bypass of FIDO authentication by coercing users into weaker authentication methods.
A critical vulnerability (CVSS 10) in an Erlang-based OT platform was observed being actively exploited to target operational technology networks.

Notable Threat Actor Activity

North Korean threat actors deployed a variety of malware, including stealers, backdoors, and ransomware, against South Korean targets in a multi-pronged campaign.
Pro-Russian hackers were linked to both the sabotage of a Norwegian dam and the breach of the US court system.
A significant increase in brute-force attacks targeting Fortinet SSL VPN appliances was observed, raising concerns of potential zero-day exploitation.

Trends, Tools, or Tactics of Interest

Phishing and scam campaigns are increasingly leveraging AI, deepfakes, Telegram, Google Translate, and Blob URLs, with new methods targeting biometric data.
A new malvertising campaign is distributing the modular PS1Bot malware, which uses multi-stage in-memory attack techniques.
Persistent exploitation of older vulnerabilities, such as CVE-2017-11882, continues to be reported.
AI-based tools are gaining traction in penetration testing, with an automated pen tester becoming a top bug hunter on HackerOne.
Open source AI models are reportedly less effective in vulnerability research compared to commercial and underground models.
Data brokers are facing scrutiny for hiding privacy opt-out tools from search engines, with regulatory pressure increasing for transparency.
Reports highlight the continued presence of the XZ Utils backdoor in legacy Docker images, though the risk of exploitation is considered low.

Regulatory or Policy Developments Affecting the Security Industry

CISA and partners released new asset inventory guidance aimed at improving operational technology (OT) security practices.
Increased policy attention in the US on data broker practices, with calls for improved visibility and accessibility of consumer privacy controls.
Microsoft announced the removal of PowerShell 2.0 from Windows 11 and Windows Server starting August 2025, following its long-standing deprecation.

Cybersecurity Brief – 2025-06-20

Fri, 20 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

Satellite communications provider Viasat was breached by China’s Salt Typhoon cyber-espionage group, which has previously targeted multiple telecom providers in the United States and abroad.
Krispy Kreme confirmed that personal information of over 160,000 individuals was stolen in a cyberattack that occurred in November 2024.
Paragon’s commercial spyware “Graphite” was used to target at least two prominent European journalists, attributed to an unnamed customer.

Notable Threat Actor Activity

The Russian state-linked group APT29 has been observed exploiting Google account application-specific passwords to bypass two-factor authentication in targeted phishing campaigns.
BlueNoroff, a North Korea-aligned threat actor, targeted a Web3 sector employee using deepfaked Zoom calls impersonating company executives to deliver a macOS backdoor malware.
China’s Salt Typhoon group was responsible for the breach at Viasat, continuing their focus on telecom sector cyber-espionage.

Newly Discovered Vulnerabilities

Researchers have detailed a surge in Android malware, notably the AntiDot campaign, which compromised over 3,775 devices across 273 campaigns using overlays, virtualization fraud, and NFC theft.
A new version of the Godfather Android malware now uses virtualization to create isolated environments on mobile devices, enabling it to hijack legitimate banking apps and steal account data and transactions.

Trends, Tools, or Tactics of Interest

“Living Off Trusted Sites” (LOTS) attacks are increasingly common, with threat actors leveraging trusted tools and websites to evade detection and execute attacks.
Scammers are increasingly injecting false support information into legitimate websites via search parameter manipulation, tricking users into contacting fraudulent support channels.
DuckDuckGo has expanded its Scam Blocker to protect users from a wider array of online scams, including fake e-commerce stores, cryptocurrency exchanges, and scareware.
AI-generated code, referred to as “vibe coding,” is introducing new risks, including “silent knowledge gaps,” as natural language is used to create software.
There is a continued trend of credential theft being a primary vector for network breaches, as highlighted by recent webinars and the Verizon 2025 DBIR.
Reports confirm that the widely publicized “16 billion credentials leak” is not a new breach, but rather a compilation of previously leaked credentials.
Commercial spyware continues to be deployed against high-profile targets, such as journalists, raising concerns about surveillance and privacy.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft announced new security defaults for Windows 365 Cloud PCs, set to take effect in the second half of 2025 for newly provisioned and reprovisioned Cloud PCs.
The U.S. Department of Justice seized over $225 million in cryptocurrency linked to investment fraud and money laundering operations, marking the largest crypto seizure in the history of the U.S. Secret Service.
Facebook is preparing to introduce passkey support, enabling passwordless authentication for users, which could have implications for account security and user authentication practices.

Cybersecurity Brief – 2025-04-26

Sat, 26 Apr 2025 00:00:00 +0000

Major Incidents and Breaches

Marks & Spencer Cyberattack
- Marks & Spencer, a major UK retailer, has suspended online orders following a cyberattack. Recovery efforts are ongoing, with continued disruption to online shopping services.
MTN Group Data Breach
- African telecom giant MTN disclosed a cybersecurity incident resulting in unauthorised access to personal information of subscribers in certain countries. The breach is attributed to an unknown third party.
Baltimore City Public Schools Data Breach
- Over 31,000 individuals have been notified of a data breach after attackers compromised the network in February, exposing employee and student information.
Craft CMS Zero-Day Exploitation
- Ongoing zero-day attacks are targeting Craft CMS servers via a chained remote code execution exploit, resulting in data theft. CERT Orange Cyberdefense reports active exploitation.
Physical Cryptocurrency Theft
- A recent case highlights the physical risks associated with cryptocurrency, involving a $250 million theft that escalated to kidnapping.

Cybersecurity Brief – 2025-04-23

Wed, 23 Apr 2025 00:00:00 +0000

Major Incidents and Breaches

Marks & Spencer Cyberattack: The UK retailer confirmed a cyberattack affecting operations, including delayed Click and Collect orders. The company implemented temporary operational changes and is responding to the incident.
DeepSeek Breach: An AI-focused organisation suffered a significant breach, with sensitive data appearing on dark web forums, highlighting ongoing risks to AI platforms.
SK Telecom Data Exposure: South Korea’s largest mobile operator disclosed a malware attack that exposed sensitive USIM-related customer data.
Healthcare Ransomware Attacks: Three additional healthcare organisations-DaVita, Bell Ambulance, and Alabama Ophthalmology Associates-were impacted by ransomware, continuing the trend of targeting healthcare.
Baltimore Public Schools Data Breach: A February ransomware attack resulted in the theft of personal information belonging to thousands of students, teachers, and administrators.
City of Abilene Cyberattack: The Texas municipality went offline following a cyberattack, with incident response and investigation ongoing.

Newly Discovered Vulnerabilities

GCP Cloud Composer Privilege Escalation: A now-patched vulnerability in Google Cloud Platform’s Cloud Composer could have allowed attackers to escalate privileges via malicious PyPI packages.
Active! Mail RCE Zero-Day: A remote code execution vulnerability in Active! Mail is being actively exploited in attacks against large Japanese organisations.
Ripple’s xrpl.js Library Compromised: The widely used Ripple cryptocurrency JavaScript library “xrpl.js” was compromised, enabling theft of XRP wallet seeds and private keys.
Cookie-Bite Attack PoC: A proof-of-concept demonstrates how a malicious Chrome extension can steal Azure Entra ID session tokens, bypassing MFA and maintaining access to Microsoft 365 services.
Docker Malware Targeting Teneo Web3 Node: A new malware campaign exploits Docker environments using a previously undocumented technique to mine cryptocurrency by faking heartbeat signals.

Notable Threat Actor Activity

Russian Organisations Targeted by Sophisticated Backdoor: A new backdoor, disguised as secure networking software updates, is being used to target Russian entities.
China-Linked Billbug Group: The Billbug APT (aka Lotus Panda/Blossom, Bronze Elgin) breached multiple organisations in a Southeast Asian country, continuing its targeting of government and telecom sectors.
Russia-Linked Phishing on NGOs: Russian threat actors are conducting phishing campaigns against NGOs connected to Ukraine, using video call lures to compromise Microsoft 365 accounts.
Russian Sabotage Against Dutch Critical Infrastructure: Dutch intelligence reported Kremlin-backed attempts to sabotage critical infrastructure, underlining ongoing state-sponsored cyber risk.
Elusive Comet Hacking Group: This group is exploiting Zoom’s remote control feature in social engineering attacks to steal cryptocurrency from users.

Trends, Tools, and Tactics

Increasing Abuse of AI in Cybercrime: Threat actors are leveraging AI tools to assist in social engineering, phishing, and scam campaigns, as highlighted in Microsoft’s latest Cyber Signals report.
Phishing via Google Sites and DKIM Replay: Sophisticated phishing attacks are abusing Google Sites and DKIM replay to send signed emails that redirect to credential harvesting pages.
Browser Security Concerns: The browser is increasingly the primary endpoint in cloud-native workplaces, yet remains largely unmonitored, presenting a growing attack surface.
Microsoft Secure Future Initiative: In response to the Storm-0558 breach, Microsoft has migrated MSA signing services to Azure confidential VMs and is purging millions of legacy cloud tenants, as part of broader security enhancements.
Android and Chrome Security Updates: Android will introduce auto-reboot after three days of inactivity, and Chrome is dropping third-party cookie prompts while adding IP protection in Incognito mode.
Sensitive Content Protection: Google Messages is rolling out a feature to warn users about potentially explicit images and allow easy blocking, improving user safety.

Regulatory and Policy Developments

Zambia’s New Cyber Laws: Recently signed cyber security and cyber crime acts in Zambia have raised concerns among international observers regarding increased surveillance and potential suppression of dissent.

Other Notable Observations

Edge Vulnerabilities and SMB Threats: Verizon’s report notes a surge in edge-related vulnerabilities, persistent ransomware threats, and ongoing challenges for small and medium businesses (SMBs).
Legal Debates on Device Search Protections: Ongoing discussions about the comparative legal protections of biometrics vs. passcodes for device searches, relevant for privacy and compliance considerations.