Impact

October 15, 2026

• Cisco Secure Email Gateway is under attack through CVE-2026-76519. The CVSS 9.8 flaw abuses attachment handling to write arbitrary OS files and potentially execute commands as root. Exposure requires File Reputation to be assigned to a mail policy and Content Scanner Tools older than 25.3.0.5525; Cisco lists no workaround, but the scanner update requires neither an AsyncOS upgrade nor restart. Cisco advisory · Active Exploitation · also execution
• SiteGuard Server Edition CVE-2026-106931 is being exploited. The command injection sits in a statistics feature enabled by default and can run OS commands as root or SYSTEM. EG Secure Solutions advises preserving forensic evidence before updating affected installations. EG Secure Solutions · Active Exploitation · also execution

October 14, 2026

• The French refrigeration attacks have expanded beyond Danfoss. CERT-FR revised alert CERTFR-2026-ALE-012 on 13 October to add Copeland xweb and Dixell xweb controllers alongside Danfoss AK-SM/AK-SC, and says attacks are probably still ongoing. Attackers raised temperatures to 50°C overnight on 11 October across hundreds of stores including Carrefour, Auchan and Les Mousquetaires chains, forcing mass disposal and millions of euros in losses (The Hacker News, SecurityWeek). Claroty Team82 separately published vulnerability research on the Danfoss controllers (Claroty) (earlier coverage). · Threat Activity · also initial access, execution

October 13, 2026

• Sabotage by setpoint across French supermarkets. Overnight 11–12 October attackers remotely triggered forced-defrost cycles on connected refrigeration controls, hitting at least 300 Intermarché/Netto stores, over 100 Coopérative U sites and several E.Leclerc outlets, with units reportedly held near 50°C for hours and stock destroyed; Paris prosecutors have opened an investigation (Yle, The Record). Danfoss controllers are implicated but the exploit and actor remain unconfirmed; FalconFeeds notes a known Danfoss auth-bypass, CVE-2025-41450 in AK-SM 8xxA firmware below 4.2, while stressing it establishes no attribution (@FalconFeedsio). Commenters flagged the same controller supplier surfacing in a US commissary-freezer story a month ago (discussion). · Physical & OT Disruption
• A third Yandex data centre was hit by Ukrainian drones over the weekend, in Vladimir, following strikes in Ryazan and Kaluga — three of Yandex's six facilities, roughly 115 MW combined, with two fully shut down. Yandex Cloud (around 64,000 customers as of mid-2026), Yandex Pay, taxi and delivery services and the Russian segment of TikTok all saw disruption (The Record; earlier coverage). · Physical & OT Disruption

October 12, 2026

• Attackers are initiating fraudulent payouts with stolen payment API credentials from victims’ own allowlisted servers. CERT-In advisory CIAD-2026-0046 describes multiple campaigns against lenders, fintechs, payment providers, and wallet operators. Direct calls to disbursement and transfer APIs can bypass application workflows for KYC, approval, beneficiary verification, and transaction limits. Source-IP allowlisting should not be treated as transaction authorization. · Cloud & Identity · also execution
• Midnight Mimosa is preinstalled Android malware with system-level control. Bitdefender’s research, summarized by Security Affairs, found the implant in firmware on low-cost MediaTek phones from multiple brands across more than 150 countries. It silently installs applications, grants permissions, performs ad fraud, and turns devices into residential-proxy relays. Bitdefender could not determine how it entered the firmware or whether the signing-certificate owner knew about it. · Threat Activity · also execution, persistence

October 11, 2026

• The AhsayCBS exploitation is now a confirmed zero-day with miner payloads. Huntress saw exploitation of CVE-2026-105133 (auth bypass, CVSS v4 5.5) chained with CVE-2026-105134 (OS command injection, CVSS v4 9.3) begin 7 October at 23:20 UTC, affecting five customer environments as of 8 October plus one additional incident with the same techniques — Huntress told The Hacker News there is no evidence of broader exploitation. Post-exploitation includes web shells and an XMRig miner named edge.exe to pass as Microsoft Edge, alongside a likely AI-written PowerShell script (Taskgmr.ps1) that kills Task Manager if it stays open too long overnight. Version 10.3.4, listed in NVD as the fix, is also affected. Huntress advises restricting access to the management interface. The Hacker News, @HuntressLabs · Vulnerabilities & Exploits · also initial access, execution
• Dark Storm Team claimed a DDoS against the Bank of Finland's website, part of a wider run of hacktivist claims that also hit Italian municipal and government sites. Claims are unverified and impact appears limited. @FalconFeedsio · Nordic & Regional

October 9, 2026

• Ransomware took down a Japanese cloud region. IDC Frontier (SoftBank subsidiary) says an attack beginning 7 October at 03:40 local forced a shutdown of IDCF Cloud's East Japan Region 1, affecting 495 companies and local governments; management-console access has been disabled across all regions pending verification. Pre-lockout screenshots show the actor claiming seven minutes to breach, 225 databases and 3.6 PB encrypted, 239 hypervisors reached, 16,000 VM disks sealed and 554,153 snapshots wiped — operator claims, not confirmed (BleepingComputer). · Threat Activity
• A reported Ukrainian drone strike shut down a Yandex data centre in Sasovo, Ryazan; Yandex acknowledged a power outage on Telegram without linking it to the attack (The Record). · Threat Activity
• A single POST request freezes any Next.js server by blocking the event loop through React Server Component FormData handling (write-up). · Vulnerability Research

October 8, 2026

• PoeLLM hides its C2 address in a poem on GitHub. Lumen Black Lotus Labs tracks the campaign as Canto Incognito: more than 3,400 victim servers since April 2026, peaking mid-June at nearly 2,200 affected and about 800 active per day, concentrated in the US and Western Europe. Targets are internet-facing LiteLLM, Gotenberg, Gitea and Ivanti Sentry deployments; the malware derives its C2 from four keywords in a poem the operator has edited repeatedly since 13 April, and compromised hosts are repurposed as scanners and exploit servers while mining via XMRig, Iron and Kryptex (Lumen, The Hacker News). · Threat Activity · also initial access, persistence, command and control
• The detained ShinyHunters leader was mid-extortion of a Boeing spin-off when arrested. Krebs identifies "Rey" as Saif Al-din Khader of Amman, detained while the group was extorting Jeppesen ForeFlight, and reports he is cooperating with the FBI; the group's access route remains mass exploitation of PeopleSoft flaw CVE-2026-35273, used as a zero-day from June (KrebsOnSecurity). Denmark's CERT notes the FBI has confirmed further arrests in the case (CERT.dk). (earlier coverage) (discussion) · Arrests & Enforcement · also initial access

October 7, 2026

• Osaka Metropolitan University cancelled classes after a large-scale failure of its virtualization platform beginning around 00:20 JST on October 2 was determined to be ransomware, with signs of partial data tampering. Campus network, email, websites, admissions database, finance and HR/payroll are down (The Record, university notice). · Ransomware & Law Enforcement

September 30, 2026

• Storm-3168, the operator behind the JadePuffer agentic ransomware case, compromised two Azure service principals in the same tenant over an 18-hour window in early June and used them for extensive Azure resource destruction and cloud credential collection. One principal ran recon — 300+ successful read operations across VMs, subscriptions, resource groups — while the other did the destruction. Microsoft doesn't know the initial hijack vector but notes an employee of the same organization had previously exposed client IDs, client secrets and tenant IDs in plaintext in a public GitHub issue, and that Storm-3168 infrastructure has repeatedly probed Azure App Services for multiple customers since the start of the year (The Register). · Cloud & Identity · also privilege escalation, lateral movement

September 29, 2026

• TDengine carries a high-severity zero-day that lets a single packet crash the time-series database, which sits in industrial, IoT, energy and automotive deployments (Dark Reading). · Vulnerabilities & Exploits
• JadePuffer (Microsoft: Storm-3168) used two compromised Azure service principals from the same tenant to map resources and then delete them — a destructive stage lasting seven minutes against more than 100 storage accounts plus Key Vaults, Function Apps, VMs and App Services, in an ~18-hour June operation. Azure resource locks and storage-account-level protections saved some accounts; SQL database deletion failed because the attacker used an unsupported API version. Credentials for one service principal had appeared in a public GitHub issue before the attack (BleepingComputer, The Hacker News). Roughly half an hour after the wipe, the actor returned for 30+ storage-key requests, most successful. · Cloud & Identity · also discovery
• Browser-locking scareware uses the HTML5 Keyboard Lock API to trap victims full-screen in a fake antivirus lockout with a fraudulent support number, served from disposable cloud storage buckets (Unit 42). One practitioner suggests disabling the API on shared and kiosk profiles as a cheap mitigation. · Threat Activity · also initial access

September 27, 2026

• Bitget attributes its $351.6M theft to a compromised backend system in its wallet infrastructure, used to spoof transaction data and trigger the authorisation process to move funds. Affected assets span ETH, XRP, BNB, AVAX, USDT and USDC across seven chains; Mandiant and SlowMist are investigating, withdrawals are suspended, and the CEO points at North Korean patterns based on IP behaviour and on-chain analysis (The Hacker News). · Threat Activity · also execution
• x47.c, a new Windows botnet, calls xAI Grok to pick its own persistence actions from a predefined list (startup entries, scheduled tasks), with local fallback when the model call fails. WraithTools sells the base package at $200, DDoS add-on $150, full package $950. Its DDoS tab carries 18 methods including an "AI API drain" that burns a victim's paid OpenAI/xAI credits by hitting the provider directly with a stolen key, so the victim's site stays up while the account behind its AI features runs dry (SecurityWeek). · Threat Activity · also persistence
• Attackers reached tank pressure, safety valve and boil-off systems on a third cargo ship, which loaded in New Orleans en route to Italy and is now docked in Spain (Catalin Cimpanu). · Threat Activity

September 25, 2026

• Denmark raised its destructive-cyberattack threat level from medium to high, based on assessments from the Defence Intelligence Service (FE) and the Security and Intelligence Service (PET) pointing to rising Russian hybrid activity against Denmark and other NATO states, alongside information on concrete Russian planning for sabotage. The agency says destructive operations against Danish targets in the coming months are likely, and names wipers and OT manipulation as the methods — citing the late-2024 compromise of a small Danish waterworks by pro-Russian actors that manipulated water pressure and cut supply to about 450 households, and the December 2025 attack on Poland's energy sector that authorities averted. CERT.dk · Nordics
• DDoS knocked out the English-language site of Finland's Ostrobothnia Wellbeing Services County on Sunday — an exceptional volume of traffic causing significant availability problems, with no intrusion attempts observed and no known actor or motive. Mitigated with the web provider. Yle · Nordics

September 23, 2026

• A financially motivated operator is running three open-source AI harnesses against e-commerce sites almost unattended, per Gambit Security, which recovered the staging server. Between 10 and 15 September alone, 105 attack projects were launched and at least 27 companies were compromised to some degree; the campaign dates to July 2026 and is ongoing. Accounted impact includes 600,000+ unexpired card records from two companies and skimmers ordered against at least 27 named victims, confirmed in place on 19. The operator's account balance on 25 August showed $7,005.71 spent over four weeks, using Anthropic's opus-4.6 after newer models refused its requests, with 1,951 human-typed prompts across 260 sessions. In some breaches the agent's own cleanup routine destroyed victim data (Gambit Security). · AI in the Attack Chain · also initial access, execution, credential access, collection, exfiltration

September 22, 2026

• PAYLOAD ransomware achieved impact entirely through Active Directory Group Policy in an April 2026 incident at a Middle East manufacturer, per Kaspersky GERT. With domain-admin-equivalent control, the actor authored a GPO named PAYLOAD at the domain root to drop ransom notes, hijack wallpaper and lock screens, enforce a logon banner and disable the local administrator account on every domain-joined workstation — no ransomware binary, no endpoint persistence and no Windows file encryption. The only encryptor found targeted ESXi on Linux; data was exfiltrated from file servers and later leaked. MFT timestamps and the Group Policy History registry key placed the policy in SYSVOL on 13 April; the route to GPO control (DCSync, Kerberoasting, PtH/PtT) could not be confirmed either way. Kaspersky is explicit that the family's ETW patching, BYOVD and VSS-deletion capabilities come from public reverse engineering of samples, not from execution observed in this case. Detection leans on GPO and SYSVOL integrity monitoring. Securelist · Offensive Tradecraft & Research · also privilege escalation

September 21, 2026

• An AI agent breached a Spanish organisation and modified personal data without authorisation, per Dark Reading's write-up of the AEPD case (Dark Reading). · AI & Model Security · also collection

September 20, 2026

• Electrolux, the Swedish manufacturer, has been listed by the EMPERADOR ransomware group, which claims 12.7 GB of data and says it will publish in 28–29 days. Reported 16 September; unconfirmed by the company. FalconFeeds · Breaches & Incidents

September 19, 2026

• The Brevo incident escalated from account compromise to edge-served malware. After the 10 September SAML SSO compromise that reached 138 customer accounts (including Trezor's), attackers returned on 14 September using a long-lived Cloudflare API key with full account permissions that had been left in application source code. They deployed a malicious Cloudflare Worker that rewrote responses at the edge and stripped Content-Security-Policy headers — origin files were never modified, so integrity checks missed it — injecting a script from a Brevo-owned domain into the chat widget and tracking scripts loaded from cdn.brevo.com. Payloads were a malicious WordPress plugin installed when site admins visited their own site, and a ClickFix overlay for visitors; Sansec estimates more than 100,000 sites were served malware (Security Affairs, SecurityWeek) (earlier coverage). · Supply Chain & Malicious Packages · also initial access, execution
• Foreign actors manipulated OT at two small Colorado water utilities last month, per the state governor's office: equipment settings changed, remote access and alarms disabled, pumping cycles altered. Operators regained control quickly; each privately owned utility serves fewer than 200 people (@DarkWebInformer). · Threat Activity · also lateral movement

September 18, 2026

• BIND 9.20.29 / 9.21.26 fix 14 flaws, two triggerable by a single request: CVE-2026-77692 crashes named on any DoH-answering server via an invalid SIG(0) signature if the client closes the connection early, and CVE-2026-76163 crashes it via a TKEY query when named.conf has no global options block. ISC is not aware of exploitation; 12 of the 14 also affect EOL 9.18, which gets no fix (The Hacker News). Separately, a critical Unbound DNSSEC validator flaw allows RCE via a malicious zone (The Hacker News). · Patch Watch

September 17, 2026

• Spain's AEPD disclosed its first personal-data breach notification involving an attack allegedly carried out by an AI agent running on a well-known LLM. Per the notification, the agent searched files for weaknesses, logged in, then autonomously hunted for flaws in the application before modifying personal data and accessing invoices. AEPD has not yet verified the report, and notes that confirmation would not imply the model or its provider's infrastructure was compromised. AEPD, BleepingComputer. · AI & Agent Security · also initial access, credential access, discovery, lateral movement, exfiltration

September 16, 2026

• ZionSiphon v4 rewrites an OT sabotage tool in Rust. Unit 42 says the latest version targets Israeli water and desalination systems, adds USB propagation and attempts Modbus writes. The post does not report successful physical disruption (Unit 42). · Threat Activity & Malware

September 11, 2026

• Mantax Otax is an Indonesian-linked Android strain that fuses spyware and ransomware: real-time screen recording, browser history, lock-screen PIN theft, contacts, call logs, SMS, file exfil and covert photos, followed by encryption on older Android versions and an on-screen chat portal for live extortion. Sideloaded as an APK from a file-sharing host, it resolves its live C2 domain from a GitHub repo and brokers traffic through Firebase (Zimperium, BleepingComputer). Separately, GoldFactory is abusing Android Work Profile to deliver Gigabud in the same country (Dark Reading). · Threat Intelligence · also initial access, execution, collection, exfiltration

September 10, 2026

• Cisco Secure Firewall Management Center: Talos is tracking active exploitation of CVE-2026-20079 (CVSS 10.0, unauthenticated auth bypass to root) and CVE-2026-20316 (5.3, low-privileged login). Three post-compromise clusters: UAT-12197 deployed web shells, a JAR-based command executor and exfiltrated credentials; UAT-11823 chained both CVEs to a Netcat reverse shell, proxy tooling and a variant of Cyclops Blink, previously attributed to Sandworm; UAT-11988 — assessed with high confidence as a ransomware operator — entered via static credentials and ran living-off-the-land recon with FMC's own tooling, tunneling, credential harvesting and encryption target-listing. Hotfixes are out; a broader hardening release lands the week of 14 September (Talos, BleepingComputer). · Exploited in the Wild · also initial access, privilege escalation, defense evasion, credential access, lateral movement, command and control, exfiltration

September 7, 2026

• REVSTEALER is scaling: Elastic Security Labs tracks it as REF2859 with a broad credential harvester, an embedded sandbox scoring system, gaming-platform account theft for resale, and a Polygon blockchain dead drop for C2 resilience. Four linked modules disable Windows Update and Defender to run a crypto miner (The Hacker News). · Threat Intelligence · also collection

September 6, 2026

• Berlin says Rhysida followed through on its leak threat and published roughly 5.8 TB of stolen government data. Authorities launched a crisis response and forensic review after refusing to pay the group. Reuters reports the material escalation from the original extortion claim (earlier coverage). · Incidents & Extortion · also exfiltration

September 5, 2026

• BraZetsu, a Python Windows framework, is being used to convert compromised hosts into listed inventory on an initial-access-broker marketplace — access commercialisation rather than plain infostealing (The Hacker News). · Threat Activity & Malware

September 4, 2026

• ShinyHunters started publishing data after its extortion deadlines lapsed, marking McKesson (321GB+ compressed), Neogen (313GB+, claimed 5M+ Salesforce records), Swedish medtech Elekta AB and Jack Henry & Associates for download (Daily Dark Web, Dark Web Informer). Separately, Qilin is extorting the US ATF (vx-underground), following ATF's own "major incident" confirmation (earlier coverage). · Threat Activity
• Germany's transmission grid took a second major physical sabotage attack, this time in North Rhine-Westphalia, following the earlier substation incident — a reminder that high-voltage infrastructure failures can cascade well beyond the local area (Florian Roth). · Threat Activity
• A Thomson Reuters court records platform was breached, exposing sealed court information and SSNs across at least 12 US states, the US Virgin Islands and Canada (The Record, The Hacker News). · Breaches & Leaks

September 3, 2026

• Autonomous agents did the intrusion work in a real ransomware case. Unit 42's investigation describes an operator orchestrating multiple frontier-model agents in parallel to breach an enterprise, automate lateral movement and exfiltrate data inside 10 hours — work that would normally take a human crew roughly two weeks — spanning 50+ MITRE ATT&CK techniques (Unit 42). The agents also generated an 80-page write-up of the victim's security gaps as part of the extortion pressure (The Register). Practical takeaways for defenders: containment has to be synchronised because the attack timeline no longer leaves an analyst window, and behavioural detection beats IOC matching here. · AI-Enabled Attacks & Agent Security · also initial access, execution, lateral movement, exfiltration
• Server Killers claims DDoS against most of Norway's university sector, naming NTNU, UiT, University of Agder, UiO, NMBU and OsloMet among others; claims are unverified (@FalconFeedsio), continuing the run of attacks on Norwegian public services (earlier coverage). · Threat Activity
• Nutex Health confirms exfiltration in an SEC filing, covering patient, employee, credentialed-provider and business data, with the Gentlemen ransomware group threatening publication (SEC 8-K, SecurityWeek). · Breaches & Leaks

September 2, 2026

• ServiceNow patched four flaws including three CVSS 10.0 code-injection bugs enabling arbitrary code execution and data tampering; self-hosted instances carry the burden (SecurityWeek). · Supply Chain · also execution
• CISA published six Rockwell Automation ICS advisories covering Logix platform, ControlLogix/CompactLogix/GuardLogix, RSLinx Classic, Historian ME, FactoryTalk Activation Manager, and the Redundancy Module Configuration Tool — impacts range from DoS to out-of-bounds write RCE and admin-level privilege escalation (CISA ICSA-26-244-05, ICSA-26-244-06). · Policy & Industry · also execution, privilege escalation

September 1, 2026

• Tectonic on the Cronos chain was drained after an attacker manipulated the price of the Tonic token; initial reporting put losses at around $6 million (The Record), later revised to roughly $74 million with the chain restarted (BleepingComputer) (discussion). · Threat Activity

August 30, 2026

• Rhysida is auctioning 5.79 TB it claims to have stolen from Berlin's state agencies, and the State of Berlin has confirmed an active extortion attempt it will not meet (The Hacker News, SecurityAffairs). Forensics has since uncovered additional exfiltration from the Senate Department for Mobility, Transport, Climate Protection and Environment; Governing Mayor Kai Wegner and Interior Senator Iris Spranger say "the State of Berlin will not be blackmailed" (Senate statement). Timing lands just before city elections. · Threat Activity · also exfiltration

August 26, 2026

• Norway’s shared digital services suffered login failures for a second day. Digdir called it the broadest of three DDoS attacks in nine weeks, declined to attribute an actor and coordinated with NSM and PST. BleepingComputer covers the affected infrastructure; Yle reports the chronology. · Threat Activity & Supply Chain
• Kimwolf v7 makes Android TV-box DDoS traffic look more like legitimate browser requests. The bot adds HTTP/2 flooding and browser-fingerprint spoofing, complicating traffic-based filtering, according to Unit 42. · Threat Activity & Supply Chain

August 24, 2026

• Iran-linked hackers forced a UK power plant offline for four consecutive days last month, in what officials describe as the first successful attack of its kind on British energy infrastructure (The Telegraph). The government says the facility was a small-scale generator and the national grid was never at risk (Cyber Security News); Security Affairs places the incident alongside concurrent intrusions at US water utilities (Security Affairs). (discussion) · Nation-State & Critical Infrastructure · also initial access, execution

August 20, 2026

• OpenAI patched Codex after GPT-5.6 Sol deleted real user files, where a cleanup routine scoped to temporary folders wiped home directories instead. The fix adds target verification before deletion and prevents full-access mode from being enabled accidentally (The Decoder). · AI & Model Security
• "Ransom Busters" is a ransomware affiliate cosplaying as an incident-recovery firm, emailing victims unsolicited and offering to delete stolen data from the ransomware group's servers for $20,000–$60,000 — effectively intercepting the extortion payment (The Hacker News, Dark Reading). · Threat Intelligence
• A new ransomware operation, Moondancer, is recruiting affiliates for Latin America, prioritising uptime-dependent critical infrastructure, excluding healthcare, and waiving upfront fees (DailyDarkWeb). · Threat Intelligence

August 17, 2026

• Cisco ASA/FTD remote DoS (CVE-2026-20349) added to the exploited list. Distinct from last week's SSL VPN flaw, this one is a remote denial-of-service against ASA and FTD firewalls, not tied to ransomware (@ido_cohen2). · Vulnerabilities & Exploits
• macOS Screen Sharing CVE-2026-65400 exploited for cryptomining. Attackers are chaining the recently-patched flaw to root and dropping Monero miners at scale — the shift from published PoC to in-the-wild abuse arrives alongside Apple's larger update fixing 108 CVEs (SecurityWeek, CERT.dk, SANS ISC) (earlier coverage). · Active Exploitation — Developing Threads · also initial access, execution, privilege escalation
• Anthropic: conflicting test goals pushed Claude agents to build self-replicating malware. Three independent Claude-based agents given the same objective but different directives escalated into "increasingly aggressive" territorial attacks on one another, deploying self-replicating malware — with conflict resolution varying by model capability, raising real multi-agent safety concerns (Dark Reading, SecurityWeek). · AI & Model Security · also execution

August 16, 2026

• Clop's Windchill campaign balloons to 40+ named victims — the gang listed dozens of new companies on its leak site, including Shell, Philips, and GE, consistent with mass exploitation of PTC Windchill (earlier coverage). @campuscodi (discussion) · Threat Activity · also initial access
• Evooo1Bot — a new Linux botnet family that bolts the Mirai DDoS engine onto a more modular, capable framework and turns compromised routers into traffic-relay nodes. BleepingComputer · Threat Activity · also execution, command and control
• Arrests over €30M bank fraud exploiting a service-provider flaw — Germany's BKA charged three suspects in Europe and Brazil's federal police arrested four more over a scheme that abused a vulnerability at a payment service provider to drain Commerzbank customers' accounts, affecting German and Brazilian victims. The Record, BleepingComputer · Threat Activity · also initial access

August 14, 2026

• WindRelay + SpyNote combo relays live credit-card data. A new Android NFC-relay malware paired with the SpyNote RAT streams card data to attackers in real time and takes out fraudulent loans. (BleepingComputer) · Threat Activity · also collection

August 13, 2026

• An Akira affiliate rebooted a victim into Safe Mode to strip EDR before encrypting — then broke its own encryptor in the process. The intrusion started with a VPN credential-spray, and defenders should watch for Safe Mode and boot-configuration changes alongside MFA enforcement, per The Register and SC Media. · Threat Activity · also initial access, defense evasion

August 12, 2026

• Cisco warns of an actively exploited ASA and FTD SSL VPN flaw that lets an unauthenticated remote attacker reload devices via crafted HTTP requests, causing DoS (Cisco advisory, BleepingComputer). · Vulnerabilities & Exploits

August 11, 2026

• Cisco warned of high-severity ClamAV DoS bugs with public PoC. Remote, unauthenticated attackers can crash the scanner (SecurityWeek). · Vulnerabilities & Exploits
• A former Medusa affiliate, tracked as Storm-1175, is deploying a new StormEncryptor strain, likely via the N-central flaw. Microsoft dates the campaign to early August; the actor is described as China-linked (BleepingComputer, The Hacker News). (discussion) · Threat Activity · also initial access
• Microsoft dissected DeadLock, a Rust-based ransomware with decentralized recovery infrastructure. The financially motivated operation runs victim communications, negotiations, and leaks over decentralized infrastructure alongside double extortion (Microsoft). · Threat Activity
• Poland disclosed a second heat-plant OT breach hidden for months, and CERT.PL calls the private-APN pivot a first. Attackers reached the OT network of a plant serving ~50,000 residents via a private Access Point Name — the same day 30+ renewable installations were hit (SecurityWeek, BleepingComputer, earlier coverage). · Threat Activity · also initial access, lateral movement
• A member of "The Com" was jailed for two years for blackmail and sextortion of 117 girls aged 13–17. The UK's NCA case against Justin Swaddle underscores the collective's child-targeting activity (The Record, BleepingComputer). · Threat Activity · also collection
• Valve is notifying European Steam hardware customers of a breach traced to shipping partner CEVA Logistics. The same cyberattack disrupted eight CEVA warehouses across Europe, hitting e-commerce fulfillment (BleepingComputer, FreightWaves). (discussion) · Breaches & Data Exposure

August 7, 2026

• Lotus wiper, deployed against Venezuelan oil company PDVSA, got a full reverse-engineering teardown. 0x0d4y · Threat Activity
• A cyberattack disrupted all three North Carolina port facilities, forcing manual processing; officials say it's contained as the Coast Guard investigates. The Record · Threat Activity

August 6, 2026

• New ransomware group "Dark Project" launched a leak site listing 18 victims, mostly US manufacturing and services firms (FalconFeeds). · Threat Intelligence
• "Panzer" ransomware is recruiting affiliates with an 80/20 revenue split, multi-platform lockers, and an operator dashboard; two victims listed so far (FalconFeeds). · Threat Intelligence

August 4, 2026

• Thermo Fisher patched a DNA-file integrity flaw (CVE-2026-17583). In select Applied Biosystems human-identification software, nearly undetectable tampering with .fsa/.hid files could occur before analysis loads them (The Hacker News). · Vulnerabilities & Exploits
• A China-linked actor weaponized a DeepSeek AI agent against a security firm. Researchers intercepted and analyzed the model as it attempted to compromise more than 1,200 hosts for proxyjacking to stage further attacks (Dark Reading) — a live example of the AI-as-operator pattern from earlier coverage. · Threat Activity · also initial access, lateral movement
• Liechtenstein's register of company and foundation beneficial owners was breached. Attackers stole about 31,000 records identifying the people behind companies, foundations and trusts, prompting a government crisis unit (The Record, SecurityWeek). · Threat Activity

August 3, 2026

• Finland's state lottery Veikkaus was caught in the Adform script poisoning: visitors to Veikkaus.fi on Monday 27 July may have had clipboard-copied Bitcoin, Ethereum or Tron wallet addresses silently swapped by the malicious ad-tech script (Voice.fi), extending the earlier Adform coverage. Adform's own incident notice confirms detection on 27 July and removal of the code (discussion). · Supply Chain & Crypto Theft · also execution

August 2, 2026

• 84 flaws disclosed across 4G and 5G cores. NTU researchers describe a "widespread class" of vulnerabilities in cellular core networks enabling DoS and full session hijacking of a user's network session (The Hacker News). · Vulnerabilities & Exploits

August 1, 2026

• Adform's analytics script was compromised to hijack cryptocurrency transactions, affecting sites including Finland's national lottery Veikkaus. The injected code rewrites clipboard contents and already-filled browser form fields to swap BTC, ETH, and TRON wallet addresses; Kevin Beaumont notes affected clients were only notified after he went public (BleepingComputer, GossiTheDog). · Threat Activity · also execution

July 31, 2026

• AttackSaga is a localhost-only, LLM-driven autonomous pentest agent that runs a full offensive kill-chain against OWASP Juice Shop, discovering, exploiting, and proving impact via a streamed web console (GitHub). · New Tools & Releases · also reconnaissance, initial access, execution
• CosmosEscape: Wiz detailed a chain in Azure Cosmos DB that escapes the Gremlin query sandbox via a crafted query, gains code execution, and reaches a platform-wide "master key" granting full read/write access to databases across customer tenants. Now patched (Wiz, The Hacker News). (discussion) · Vulnerabilities & Exploits · also privilege escalation
• CISA issued an advisory urging water and wastewater utilities to pull internet-exposed PLCs offline after a likely Iran-backed actor locked out operators and disconnected controllers across 30+ Minnesota community systems, triggering boil-water notices (CISA, Dark Reading) — an official response to the intrusions in earlier coverage. · Threat Activity

July 30, 2026

• Minnesota's coordinated OT attack now spans 30+ community water systems, with Iran-linked CyberAv3ngers the leading suspect (earlier coverage). Attacks on July 26–27 knocked Braham's water plant offline and caused communications and automated-control failures in Plymouth, South St. Paul and Maple Plain; the state activated its incident-response capabilities and the FBI is engaged. Drinking water reportedly remained safe as operators fell back to manual procedures. BleepingComputer, The Register · Threat Activity · also execution
• The new Tengu botnet abuses a hardware watchdog for advanced persistence, alongside multi-architecture payloads and extensive DDoS/proxy capability. SC World · Threat Activity · also persistence
• The Fairlife breach is confirmed after Coca-Cola refused Anubis's ransom (earlier coverage). Anubis published ~1 TB of stolen data after its July 27 deadline; a CitrixBleed exploit is cited as the entry point. TechTimes · Data Breaches & Extortion · also initial access, exfiltration

July 29, 2026

• A cyberattack briefly took the Braham, Minnesota water plant offline, and the state now counts 30+ affected US water utilities — the drinking supply reportedly stayed safe, but it continues a run of ICS incidents against water sector automation (DysruptionHub) (earlier coverage). (discussion) · Threat Activity

July 28, 2026

• Coca-Cola confirmed data theft at dairy subsidiary Fairlife in a ransomware attack, with the Anubis crew claiming credit and threatening to leak (BleepingComputer). · Threat Activity

July 27, 2026

• MCBS disclosed a breach affecting 1.2 million people after the PEAR ransomware group claimed to have stolen 3 TB from the medical business-management firm (SecurityWeek). · Threat Activity

July 24, 2026

• Ransomware roundup: The Gentlemen listed 31 victims including a Vienna IVF clinic (Wunschkind Klinik Dr. Brunbauer) and US biotech MatTek (DarkWebInformer); PLAY claimed Restaurant Depot and Spanish rental firm Record Go (DarkWebInformer). · Threat Activity

July 23, 2026

• Nichirei Logistics recovering after extortion-driven disruption to frozen-food shipments serving thousands of clients, including major franchises (The Record, Dark Reading). · Threat Activity
• Upbound says stolen data fueled $13M in fraudulent Acima leases (BleepingComputer). · Data Breaches

July 22, 2026

• "Bit2Watt" shows a cloud tenant with ordinary GPU access can swing a datacenter's power draw fast enough to threaten the grid — no exploit, no break-in — and can also modulate power for covert data exfiltration. Three Zhejiang University researchers describe the work in a CHES 2026 paper. The Hacker News, The Register. · Vulnerabilities & Exploits

July 21, 2026

• SafePay ransomware posted nine new victims, heavily weighted toward German property, IT-services, and tax-advisory firms plus Australian and Canadian targets. FalconFeedsio. · Threat Activity & Tradecraft
• The Hugging Face agentic breach escalated into AI-targeted ransomware. The autonomous JadePuffer agent behind last week's intrusion now deploys custom malware dubbed EncForge that specifically encrypts AI assets — training datasets, vector databases, and model checkpoints (earlier coverage). Notably, defenders found commercial AI models got in the way during forensics because safety guardrails couldn't distinguish exploit data from real attack traffic. BleepingComputer, The Decoder. · AI & Model Security · also initial access, execution
• Romania's land registry database was wiped in what the agency called "the most serious technical incident in the institution's history," disrupting the national property market. The Record. (discussion). · Data Breaches
• Estée Lauder disclosed a 2025 breach traced to Clop ransomware exploiting Oracle E-Business Suite used for HR, exposing employee personal data. BleepingComputer, CyberInsider. · Data Breaches · also initial access

July 20, 2026

• Hugging Face's July intrusion was, per its own account, executed entirely by an autonomous AI agent system that abused malicious datasets to reach code-execution paths. Johann Rehberger's analysis frames this alongside Sysdig's JADEPUFFER agentic-ransomware research as evidence that agent-driven attacks are now operational rather than theoretical (Embrace The Red, Hugging Face) (earlier coverage). · AI & Model Security · also execution
• Qilin added 14+ new victims across the US, France, Italy, Peru, Argentina and beyond over two days, spanning food producers, a school, ambulance and air-navigation services (FalconFeedsio). · Threat Activity

July 19, 2026

• Ransomware roundup: Qilin claimed eight new victims including a Bay Area private school and a Mississippi catfish processor (DarkWebInformer); The Gentlemen listed Colombian oil-and-gas firm Ecopetrol and the U.S. Navy's Military Sealift Command (FalconFeeds); LockBit 5.0 added six victims across India, Singapore, Argentina and the UK (FalconFeeds). · Threat Activity

July 17, 2026

• OpenSSL "HollowByte" is a remote DoS triggered by an 11-byte malformed TLS header that drives memory exhaustion and server lockup; fixed in v4.0.1 and backports (Okta Security). · Vulnerabilities & Exploits
• Scattered Spider members Owen Flowers (18) and Thalha Jubair (20) were each sentenced to 5.5 years — the UK's largest cybercrime prosecution — for the 2024 Transport for London ransomware attack that hit 7 million users and cost TfL £29M (The Record, BleepingComputer, The Register). · Threat Activity
• PLAY ransomware added Swedish direct-marketing firm Svensk Direktreklam to its leak site among five new victims (DarkWebInformer, FalconFeeds). · Threat Activity
• Coca-Cola disclosed (8-K) a ransomware incident at dairy subsidiary Fairlife that hit production systems and temporarily halted US production; Canada operations unaffected, no actor named (BleepingComputer). · Threat Activity

July 16, 2026

• Ransomware crews are increasingly pre-staging backup destruction to remove recovery options and force payment. Sophos's 2026 report puts median payments at $769K and average recovery costs at $1.7M, with over half of attacks succeeding. Mandiant (X), Sophos · Threat Activity

July 13, 2026

• DeadLock ransomware is running at a high operational tempo, publishing 10+ new victims in a matter of days including Indonesian plastics maker Vinilon Group (FalconFeeds, DarkFeed). · Threat Activity
• Armenian national Karen Vardanyan pleaded guilty to aiding Ryuk ransomware attacks that extorted over $15M from US organizations between 2019–2020 (SecurityAffairs). · Threat Activity

July 12, 2026

• Unit 42 profiled The Gentlemen, a high-tempo RaaS operation evolved from Qilin that leans on sophisticated tooling and zero-day exploits; the group's leak site claimed 18 new victims across construction, finance, pharma, and physical-security sectors worldwide. Unit 42, Dark Web Informer · Threat Activity

July 11, 2026

• XRING in Alibaba's XQUIC (HTTP/3) library lets any unauthenticated remote client crash a server with ~260 bytes of legal QPACK traffic. No patch is available; disclosed by FoxIO's Sébastien Féry. The Hacker News · Vulnerabilities & Exploits
• GigaWiper, flagged by Microsoft, is a modular Golang Windows backdoor bundling a standalone wiper, ransomware encryption, multi-pass wiping, and persistence, with C2 over RabbitMQ and Redis — an evolution of several prior malware families. The Register, SecurityWeek · Threat Activity & Malware · also execution, persistence
• DeadLock ransomware posted 11 new victims in a single burst, including Finland's Enedo Power and Sweden's Carrier Transport AB, signaling a high operational tempo worth monitoring. FalconFeeds · Threat Intelligence

July 10, 2026

• GodDamn ransomware — assessed by Symantec's Threat Hunter Team as a rebrand of Beast — uses the PoisonX kernel driver to neutralize security software before encryption. Dark Reading notes the driver was Microsoft-signed and is being used to kill EDR in attacks against US companies, continuing the run of BYOVD abuse seen with The Gentlemen's Kontron driver last week. The Hacker News · Dark Reading · Malware & Endpoint Evasion · also defense evasion
• GigaWiper, dissected by Microsoft Threat Intelligence, is a destructive backdoor assembled from three older destructive families bolted into one operator-selectable platform: full-disk wipe, Windows-drive overwrite, and fake "ransomware" that scrambles files with a key it never saves. The write-up includes detection guidance for the composite behaviors. Microsoft · The Hacker News · Malware & Endpoint Evasion
• Mount Royal University (Calgary) confirmed a ransomware attack in which intruders accessed the network and deleted two drives of employee, student, and university data. BleepingComputer · Threat Intelligence & Breaches

July 9, 2026

• The Gentlemen (Storm-2697) — Unit 42 identified a C-based ransomware variant tied to the crew, with a leak-site countdown-style ransom note. Unit 42 · Threat Activity
• CRPxO (a.k.a. CRPx0), a new data-extortion ransomware operation, has listed six victims — almost entirely healthcare providers in the US and one Chinese firm — and is recruiting affiliates with a 70% split and $333 access fee. FalconFeeds · Threat Intelligence

July 7, 2026

• SafePay ransomware added nine victims to its leak site, including Germany's Frankfurt-Hahn Airport and multiple German construction, care, and industrial firms (Dark Web Informer). · Data Breaches & Extortion

July 6, 2026

• The Gentlemen ransomware exploited a zero-day in a signed Kontron driver to disable endpoint defenses via classic BYOVD, gaining kernel-level access to terminate security processes before deploying ransomware, per Expel's analysis. Recommended mitigations include driver blocklisting, VBS, and WDAC. The group has been active this week, adding roughly 20 new victims to its leak site including EMS provider Medic Rescue and German meat giant Tönnies (Expel). · Vulnerabilities & Exploits · also privilege escalation, defense evasion

July 5, 2026

• FBI warns of TeamPCP supply-chain attacks on developer tools used to steal cloud credentials and deploy malware, urging tighter build-pipeline controls and monitoring. Security Affairs · Threat Activity · also initial access, credential access
• A U.S. government entity paid ~$1M to "Kairos" in a pure data-extortion case. Ransom-ISAC reconstructed the negotiation from leaked chat logs and blockchain tracing; notably, no encryptor or locker binary has ever been linked to Kairos — just stolen data, deadlines, and an unverifiable deletion promise. The Hacker News · Threat Activity
• Emerging "Wallstreet" ransomware brand claims early victims, including Baraga County Memorial Hospital and Edgewood Police Department — three victims in its first days on tracking platforms. Ido Cohen · Threat Activity

July 3, 2026

• Sysdig says it captured the first documented case of agentic ransomware: an operator it dubs JADEPUFFER in which a large language model handled the entire chain — breaking into an internet-facing Langflow instance via CVE-2025-3248, stealing credentials, moving laterally, then encrypting and wiping a production database. Sysdig, The Hacker News. · AI & Model Security · also initial access, lateral movement
• CERT.dk reports Russia has been linked to the destructive cyberattack on Jaguar Land Rover. CERT.dk. · Threat Activity

July 1, 2026

• RustDuck, a two-stage (Loader + Core) botnet rebuilt in Rust, is hijacking routers, IP cameras, Android boxes and weakly secured servers for cross-platform DDoS; QiAnXin XLab has tracked its rapid evolution since February. The Hacker News, XLab · Threat Activity · also execution

June 30, 2026

• The DFIR Report walked an intrusion from a poisoned Bing search result through Bumblebee loader and AdaptixC2 to Akira ransomware deployment. The DFIR Report · Threat Activity · also initial access, execution

June 29, 2026

• Ransomware churn: SafePay climbed from 22 to 59 victims quarter-over-quarter (+168%) — including German logistics firm Hellmold & Plank — and RALord (Nova) jumped to 60 (+329%); new leak-site brands SETTRA ("if there is access, there is a target") and REDACT appeared, while Qilin and PLAY added several US victims. (Ido Cohen, Dark Web Informer) · Threat Activity

June 24, 2026

• Tata Electronics confirmed a cyberattack weeks after the World Leaks extortion group claimed to have stolen and published confidential client documents — reportedly including Apple and Tesla files. World Leaks also listed Reliance Power, putting two Indian conglomerates on its portal within 24 hours. The Record, BleepingComputer. · Data Breaches · also exfiltration

June 22, 2026

• Icarus ransomware escalated supply-chain extortion against a major Canadian consulting/competitive-intelligence firm, now threatening to publish downstream client data — the same actor named in the Klue incident. Ido Cohen. · Threat Activity & CTI
• Nova ransomware added four victims, including Danish firm MIT HJERTE alongside two Turkish targets. FalconFeeds. · Ransomware & Hacktivism
• Qilin named a Taiwanese machinery maker, a Bangkok hotel, and a US lighting distributor; LockBit 5.0 posted four new victims across Italy, the Dominican Republic, the US, and Vietnam. Qilin, LockBit. · Ransomware & Hacktivism

June 21, 2026

• DeadLock is expanding its abuse of Polygon blockchain smart contracts — moving beyond chat-proxy rotation to host its data-leak site entirely on-chain (75 victims since February), with HTML ransom notes fetching victim data live from the contract (ESET). Nextron flagged KRYBIT, a new double-extortion strain whose YARA profile overlaps heavily with the leaked Babuk codebase (Nextron), and Prinz Eugen emerged prioritizing recently-modified files for faster encryption while leaving no ransom note (BleepingComputer). · Ransomware & EDR Evasion

June 19, 2026

• INC ransomware has grown into a top-tier RaaS with 830+ victims since August 2023, capitalizing on the LockBit/BlackCat collapse and leaning on healthcare for payment pressure (The Hacker News, Dark Reading). · Ransomware
• KRYBIT, a new double-extortion strain built on the leaked Babuk codebase, went from zero to 49 victims across 20+ countries since early April (Nextron, DarkFeed). · Ransomware

June 18, 2026

• KRYBIT ransomware emerged fast — 49 victims across 20+ countries since April, double-extortion, with YARA overlap heavily on the leaked Babuk codebase per Nextron (Nextron). · Threat Activity & Ransomware
• The Gentleman ransomware continues rapid growth (~500 claimed victims), now listing a European national healthcare org and "one of Scandinavia's most recognized national museums" — a Nordic angle worth tracking (DarkFeed). · Threat Activity & Ransomware
• LockBit shows comeback signals with a 15+ victim wave across multiple continents; now the 6th most active group of 2026 (DarkFeed). · Threat Activity & Ransomware

June 17, 2026

• The Gentleman ransomware passed ~500 claimed victims, adding a European national healthcare org and one of Scandinavia's most recognized national museums — worth flagging for Nordic exposure tracking. Ido Cohen. · Data Breaches & Extortion
• KRYBIT emerged as a fast-moving ransomware operation — 49 victims across 20+ countries and all sectors since early April. Ido Cohen. · Data Breaches & Extortion