236 casos · pág. 5/12
A supply chain campaign tracked as UNC7017 hijacked the update infrastructure of AOMEI Technology between April and July 2026 to distribute the CROSSROAD downloader and the SHINYROAD backdoor through AOMEI Backupper and AnyViewer update workflows. The attackers tampered with server configurations only briefly, then restored legitimate con…
In September 2024 the French national pension fund Assurance Retraite suffered a data breach affecting approximately 370k assistance beneficiaries. The dataset was added to Have I Been Pwned on 20 Oct 2026 and contains 70.4k unique email addresses. Exposed data includes names, dates of birth, physical addresses, phone numbers, income leve…
A joint advisory (AA25-343A) from FBI, CISA, NSA and some 18 other US, European, Five Eyes and Czech agencies warns that pro-Russia hacktivist groups are conducting opportunistic, low-sophistication attacks on critical infrastructure OT. The groups named are Cyber Army of Russia Reborn (CARR), Z-Pentest, NoName057(16) and Sector16. They e…
GreyNoise reports a proxyjacking campaign by a malicious cyber actor (tracked as skynox7) that exploited network edge devices globally to covertly install Pawns.app proxyware and monetize victims' bandwidth. At least 143 devices in 34 countries were compromised, and the actor also appeared to target other DVR/NVR brands such as Hikvision …
GreyNoise observed an increase in scanning and exploitation attempts against Digital Video Recorders (DVRs) in Ukraine between 21 September and 1 October 2026, coinciding with an escalation in Russian strikes. Most of the activity targeted CVE-2021-36260, an unauthenticated command injection flaw in unpatched Hikvision products. GreyNoise…
A multinational advisory (CISA, NSA, FBI, AIVD, MIVD, NCSC-UK and others) warns that the Russian state-supported APT LAUNDRY BEAR (aka Void Blizzard, TA488) has compromised Western government, defense industrial base and NGO organizations running Zimbra Collaboration Suite (ZCS) since at least July 2025. The campaign uses a view-based XSS…
A joint advisory (AA26-194a) from NSA, CISA, FBI, DC3 and 15 allied agencies warns that Russian FSB Center 16 cyber actors continue to opportunistically compromise poorly configured and vulnerable networking devices worldwide, primarily routers. The advisory builds on the FBI's August 2025 PSA on the decade-plus campaign and adds TTPs. Go…
The FBI, CISA, DC3, NSA, USSS and the Republic of Korea's KNPA issued joint advisory AA26-222A on Gunra ransomware. Gunra appeared in April 2025 as a double-extortion variant derived from the leaked Conti source code. It launched a structured RaaS affiliate program in January 2026, also operating under the alias Golden Community, and recr…
The NSA, CISA, FBI, DOE and EPA issued a joint advisory (AA26-231A) warning of an active threat to Siemens S7 Series PLCs in U.S. critical infrastructure. Unattributed threat actors are conducting reconnaissance and capability development against U.S.-based installations using AI-generated exploitation scripts disguised as legitimate OT m…
The NSA, CISA and FBI issued joint advisory AA26-251A warning that China-based AI companies are running industrial-scale knowledge distillation campaigns against U.S. frontier AI models. The named companies are DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI. According to the agencies, they have extracted billions of tokens acro…
A joint advisory (AA26-281A) attributes China-based malicious cyber activity to Integrity Technology Group (Integrity Tech), a for-profit company with links to the Chinese government. The company builds and sells tools, hosts infrastructure and compromises networks worldwide. The actors' TTPs are consistent with Flax Typhoon, Ethereal Pan…
CISA added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. Two affect JFrog Artifactory: CVE-2026-42016 (incorrect authorization) and CVE-2026-42018 (improper authentication). The third is CVE-2026-84869 in ConnectWise ScreenConnect (improper privilege management and mis…
CISA added two Linux Kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation: CVE-2025-39964, a race condition flaw, and CVE-2026-53266, an out-of-bounds write flaw. CISA describes these vulnerability types as a frequent attack vector for malicious cyber actors and a significant…
CISA added one vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog on 2026-09-16 based on evidence of active exploitation: CVE-2026-58704, an improper authorization vulnerability in Google Pixel. CISA describes this vulnerability type as a frequent attack vector for malicious cyber actors and a significant risk to the feder…
CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation: CVE-2026-65660, a code injection flaw in Microsoft SharePoint, and CVE-2026-67279, an improper enforcement of behavioral workflow flaw in MikroTik RouterOS. CISA describes these vulnerability types as a frequent at…
CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation: CVE-2026-5430, a path traversal flaw in multiple WSO2 products, and CVE-2026-71362, an incorrect authorization flaw in Adobe Commerce and Magento. CISA describes these vulnerability types as a frequent attack vecto…
CISA added one vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog on 2026-09-18 based on evidence of active exploitation: CVE-2025-39682, an Improper Check for Unusual or Exceptional Conditions flaw in the Linux Kernel. CISA describes this vulnerability type as a frequent attack vector for malicious cyber actors and a sign…
CISA added one vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog on 2026-10-01, citing evidence of active exploitation: CVE-2026-104286, a path traversal flaw in Fortinet FortiMail. CISA describes this vulnerability type as a frequent attack vector for malicious cyber actors and a significant risk to the federal enterpris…
CISA added one vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog on 2026-09-29, citing evidence of active exploitation: CVE-2026-86950, an out-of-bounds write flaw affecting multiple Apple products. CISA describes this vulnerability type as a frequent attack vector for malicious cyber actors and a significant risk to the …
CISA added one vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog on 2026-09-30, citing evidence of active exploitation: CVE-2026-76504, a hex encoding vulnerability in Cisco Catalyst SD-WAN Manager. CISA describes this vulnerability type as a frequent attack vector for malicious cyber actors and a significant risk to the …
