291 casos · pág. 13/15
Kaspersky identified MovieReaper, a previously unknown modular, multi-stage crimeware framework distributed since mid-August 2026 through movie-themed torrents, including fake "The Odyssey (2026)" releases. Rather than compromising individual trackers, the actor modified the public torrent file repository itorrents.org, so trackers relyin…
In April 2026, Kaspersky GERT responded to an incident at a Middle East manufacturing organization where the actor gained domain admin-equivalent control of Active Directory. The actor created and linked a malicious GPO named PAYLOAD at the domain root. It pushed ransom notes, a wallpaper and lock screen, a logon banner and a local admini…
Kaspersky researchers describe a new MacSync macOS infostealer variant, first seen in the wild in September 2026, that replaces the earlier AppleScript-based droppers with FAT Mach-O binaries written in Objective-C and Swift. MacSync is sold as malware-as-a-service, so delivery varies by operator. In this campaign it spread through malici…
Unit 42 researchers found that in default AWS AgentCore Harness deployments, prompt injection can steer the agent's built-in shell tool to exfiltrate plaintext credentials resolved from AgentCore Identity. The shell tool is enabled by default and runs as root, in the same UID as the harness runtime (PID 1, python3.10 -m loopy.server). Tha…
Unit 42 attributes with high confidence to an Iranian state-aligned actor, tracked as CL-STA-1178, a campaign called Blinder Tunnel. In March 2026 it targeted an individual in Iraq's critical infrastructure sector, after infrastructure staging that began as early as November 2025. The actor impersonated the Dubai Airports IT department an…
Unit 42 reports that threat actors are moving supply chain malware C2 from hardcoded endpoints to Web3 mechanisms, so an entire botnet or worm infrastructure can be re-pointed with a single blockchain transaction. The ChainDrop npm worm (Shai-Hulud family, 400+ npm packages) and the PolinRider campaign (npm, Go modules, Packagist) target …
Unit 42 detailed a multi-stage intrusion in September 2024 against a telecommunications managed service provider, tracked as CL-STA-0954 (aka UNC5820). The attackers gained initial access by exploiting CVE-2024-47575 (FortiJump) on a central FortiManager and exfiltrated an archive with running configurations, credentials and private keys …
Dropbox confirmed that roughly 5,000 customer accounts were accessed between 4 and 21 August after attackers abused a legacy login integration between Dropbox and Lenovo ID, Lenovo's identity system. Lenovo ID did not verify that a person registering an account actually controlled the email address used. Because Dropbox implicitly trusted…
The US Coast Guard and FBI boarded the Liberian-flagged supertanker VL Prosperity mid-voyage after its network may have been compromised by a foreign actor. The vessel was carrying about 2.3 million barrels of crude oil from Egypt's Sidi Kerir terminal to Galveston, Texas. The Coast Guard reports no disruption to operations, injuries or e…
The FBI has publicly called on remaining ShinyHunters members to surrender. Cyber division assistant director Brett Leatherman released a video thanking Dutch police for arresting a 24-year-old in Amsterdam. The FBI calls him "one of the alleged leaders" of the group, while Dutch police say only that he played a role. He is also suspected…
In August 2026, healthcare and pharmaceutical company McKesson was targeted in a ShinyHunters "pay or leak" extortion campaign. The group published a substantial corpus of data allegedly taken from the company, including 6.4M unique email addresses alongside other personal and corporate attributes. The data relates to marketing campaign r…
The FBI arrested a Canadian cybersecurity executive in Pennsylvania on October 8, 2026, in connection with its investigation into the ShinyHunters extortion group. Court records point to Edward Dubrovsky, a ransomware negotiation specialist formerly of Cypfer and now associated with CyberSteward. He faces charges of conspiracy to threaten…
Microsoft released updates fixing more than 1,400 vulnerabilities in Windows and other software, far above September's record of nearly 1,000 fixes. Only one flaw is a confirmed zero-day exploited in the wild: CVE-2026-96951, a security feature bypass in Windows Shell affecting Windows 10, Windows 11 and some Windows Server versions. At l…
U.S. federal investigators pursuing ShinyHunters, which recently stole sensitive personnel data from the FBI recruitment site fbijobs.gov, reportedly identified executives at two ransomware negotiation firms with unusually close ties to the group. One U.S. consulting firm executive is suspected of helping operate the now-defunct extortion…
Check Point Research disclosed two high-risk vulnerabilities in LiteLLM, the open-source AI gateway that sits between enterprise applications and providers such as OpenAI, Anthropic and Google. A user with minimal privileges could take full control of the gateway, read sensitive files, execute arbitrary code and harvest the provider API k…
Huntress researchers detailed an SEO-poisoning campaign on 13 October that harvests SSL VPN credentials through a lookalike WatchGuard download page, watchguard-vpn.net, and then delivers the legitimate, validly signed Mobile VPN with SSL installer. Earlier waves used trojanised installers, but this iteration contains no malware, so endpo…
Forescout's Vedere Labs has documented ROMULUS, a previously unknown malware delivery platform used in ClickFix campaigns, and new delivery techniques for loaders tied to Vice Society ransomware activity. The server hosting the ROMULUS panel was found during an incident investigation, and six IP addresses exposed the same authentication i…
OpenCode, an open-source AI coding agent, disclosed on Saturday that attackers broke into an older system overnight and affected 1.4% of users of its online platform, OpenCode Console. Some of those users store API keys for AI services there. The company called it a "large-scale distillation attack", but skeptics say it was a straightforw…
The German municipality of Tangerhütte (Saxony-Anhalt) was hit by a cyberattack that its software provider Innocon believes was carried out with artificial intelligence. Attackers exploited a previously unknown vulnerability in Innocon software behind the municipality's digital town hall, according to an MDR investigation. A municipal IT …
A threat actor using the handle ByteToBreach claims to have copied 10 databases from Ampath Laboratories, out of an environment said to contain roughly 375 databases. The claimed data includes HR and employee records, multiple patient databases, financial information and system-configuration data. The actor says the laboratory admissions …
