51 casos · pág. 3/3
U.S. federal investigators pursuing ShinyHunters, which recently stole sensitive personnel data from the FBI recruitment site fbijobs.gov, reportedly identified executives at two ransomware negotiation firms with unusually close ties to the group. One U.S. consulting firm executive is suspected of helping operate the now-defunct extortion…
A still-unknown actor hacked thousands of remote-controlled refrigeration systems across hundreds of French grocery stores, spiking temperatures, spoiling food and sparking fires. The incident fits a broader trend of extortionists and other attackers going after physical systems to maximise real-world pressure on victims. Earlier examples…
This SentinelOne weekly roundup (Week 39, 2026) covers one law enforcement success and two active threat campaigns. A US court sentenced Armenian national Karen Serobovich Vardanyan ("Maneeken"/"Karl Lagerfeld"), an initial access specialist for Ryuk ransomware, to two years in prison and over $1.2 million in restitution. SentinelLABS ide…
The FBI has publicly called on remaining ShinyHunters members to surrender. Cyber division assistant director Brett Leatherman released a video thanking Dutch police for arresting a 24-year-old in Amsterdam. The FBI calls him "one of the alleged leaders" of the group, while Dutch police say only that he played a role. He is also suspected…
CrowdStrike researchers analyzed AI infrastructure left openly exposed on web servers by four previously unreported criminal groups (Chinese-, Spanish/English-, Indonesian- and Russian-speaking). The groups ran attacks between May and August 2026 using mostly older versions of Anthropic's Claude and open-weight Deepseek models. All four b…
Between April and July 2026, a threat actor tracked as UNC7017 compromised AOMEI update and notification infrastructure and used it to push malware to users of AOMEI Backupper. The attackers briefly altered two configuration files and restored them within minutes to evade detection. The campaign was uncovered by ManageEngine's Threat Anal…
Censys observed a 71% drop in internet-exposed Danfoss StoreView control panels in France in three days after the October 11 cyber-attack on hundreds of French supermarkets. The attack targeted refrigeration controllers that Danfoss confirmed were mostly older models without security updates (AK-SM800, AK-SC355) or newer models on outdate…
Bitdefender documented Midnight Mimosa, an Android malware campaign that embeds a platform-signed malicious system app in the firmware of low-cost, MediaTek-based handsets and counterfeit flagship models before they reach buyers. Thousands of infected devices were observed in more than 150 countries over roughly two years. The implant dri…
Flashpoint's weekly Middle East brief for October 9-15 describes sustained kinetic escalation alongside cyber and information operations. Ansarallah (Houthis) ran a multi-day missile, drone and cruise-missile campaign against King Khalid International Airport in Riyadh. It killed at least 14 people and closed the airport through at least …
Between April and July 2026, the threat actor UNC7017 tampered with the AOMEI Backupper update infrastructure several times to deliver the CrossRoad downloader and the ShinyRoad modular backdoor. Each tampering window lasted only five to ten minutes before reverting to authentic files. This made the campaign hard to detect and suggests it…
Between May and July 2026, attackers tracked by Google Threat Intelligence Group (GTIG) as UNC7017 altered files on AOMEI's own update servers for windows of 5 to 10 minutes. Any copy of AOMEI Backupper that checked for updates during a window downloaded and ran a backdoor. GTIG, Mandiant and ManageEngine's Threat Analysis Lab disclosed t…
