23 casos · pág. 1/2
Huntress analyzed an active credential-phishing campaign in which the lookalike domain watchguard-vpn.net harvests WatchGuard SSL VPN credentials. On October 7, 2026, an administrator at a managed service provider searched Bing for "watchguard vpn sll download" and clicked through to the fake page, which Huntress classifies as SEO poisoni…
The Netherlands' Tax and Customs Administration has abandoned its planned Microsoft 365 public-cloud rollout and will move to an on-premises, open-source approach, citing digital sovereignty and data control concerns. About 5,000 employees had already migrated when the Dutch Advisory Council on ICT Assessment recommended reversing the rol…
Between May 9 and May 18, 2026, GreyNoise observed a major spike in scanning of SonicWall SonicOS management interfaces. The May 12 peak of about 597,000 sessions was the largest single-day total on the SonicWall SonicOS API Scanner tag in 90 days, roughly 46x the typical daily volume. Earlier spikes on this tag (January 18, January 30 an…
Dutch police arrested a 24-year-old Amsterdam man on September 15 on suspicion of playing a role in the ShinyHunters criminal organisation. Police have not named him, but Brian Krebs identified him as Pepijn van der Stap, a convicted hacker. A search of his laptop reportedly turned up details of two murders "to be committed abroad", which…
Troy Hunt's Weekly Update 521 argues that media narratives about AI as a powerful hacking tool diverge from the facts. He cites a statistic that AI has had effectively 0% impact on insurance payouts, and a Dutch individual who is reportedly being tracked down from his voice. He also points to Scott's teardown of the MAG breach, which ulti…
Troy Hunt's weekly update reports two arrests linked to the ShinyHunters cybercrime group: an individual named Pepijn in the Netherlands and another named Saif in Jordan. Hunt calls the arrests an inevitable and likely outcome. He expects more members to follow, and anticipates substantial custodial sentences given the seriousness of the …
Mozilla and the Chrome Root Program confirmed on October 20 that the private keys of eight eMudhra intermediate CA certificates (emSign brand) are compromised. Anyone holding these keys could issue certificates for any website that a browser would accept. A researcher credited as "Wayne" reported the compromise on October 17, and Chrome a…
Ahold Delhaize, the Dutch-Belgian grocery group, is restoring services disrupted by a cyberattack that began on October 12, when it took systems offline in response to a security issue. The outage hit online orders and deliveries for most of its brands across Europe and the United States, though all stores stayed open. The company has not…
On October 20, the Go team released Go 1.27.3 and Go 1.26.10 on its URGENT track. The certificate verifier now rejects any chain passing through one of eight intermediate CA keys, citing unspecified "specific security concerns around their operation." A commenter on the Go issue matched the SHA-256 key hashes to intermediates of the India…
Ahold Delhaize, one of the world's largest food retailers, confirmed that a cyberattack discovered last week forced it to take systems offline, including brand websites and apps, in Europe and the United States. Affected brands include Albert Heijn, Etos and Gall & Gall in the Netherlands, Delhaize in Belgium, and Stop & Shop in the US, w…
Episode 486 of the Smashing Security podcast (host Graham Cluley, guest Dave Bittner) covers two main stories. An Auckland store's vibe-coded website reportedly let the public edit its inventory, and bogus listings appeared within hours, including socks, an $850 banana and New Zealand's national parks. A hacker collective also physically …
The FBI arrested a Canadian cybersecurity executive in Pennsylvania on October 8, 2026, in connection with its investigation into the ShinyHunters extortion group. Court records point to Edward Dubrovsky, a ransomware negotiation specialist formerly of Cypfer and now associated with CyberSteward. He faces charges of conspiracy to threaten…
Dutch authorities arrested a 24-year-old, reportedly Pepijn van der Stap (alias "Umbreon"), around Sept. 16, 2026 on suspicion of aiding data thefts and extortions by ShinyHunters. Van der Stap was previously convicted in 2023 for data theft and extortion. Days after the arrest, remaining ShinyHunters members escalated, breaching the FBI …
Ahold Delhaize, the Dutch grocery group behind Food Lion, Giant Food, Stop & Shop, Hannaford, Martin's and Albert Heijn, confirmed that a cyberattack caused by "malicious actions of others" forced it to proactively take IT systems offline, including websites and apps. The incident was first disclosed on October 12 and affected most of the…
Federal investigators examining ShinyHunters have uncovered potential links between the extortion group and executives at two ransomware negotiation firms, according to a KrebsOnSecurity report published on October 19. An executive at an unnamed U.S. consulting firm (reportedly 1,000+ employees) allegedly helped operate the group's extort…
A multinational advisory (CISA, NSA, FBI, AIVD, MIVD, NCSC-UK and others) warns that the Russian state-supported APT LAUNDRY BEAR (aka Void Blizzard, TA488) has compromised Western government, defense industrial base and NGO organizations running Zimbra Collaboration Suite (ZCS) since at least July 2025. The campaign uses a view-based XSS…
U.S. federal investigators pursuing ShinyHunters, which recently stole sensitive personnel data from the FBI recruitment site fbijobs.gov, reportedly identified executives at two ransomware negotiation firms with unusually close ties to the group. One U.S. consulting firm executive is suspected of helping operate the now-defunct extortion…
GreyNoise reports that 21 IP addresses in AS213438 (registered to ColocaTel Inc., Mahe, Seychelles) produced 1,856,167 of 2,753,274 global RDP Crawler sessions on April 7, 2026, or 67.4% of the worldwide total. Over April 5-7 the same fleet accounted for 49.7% of global RDP Crawler activity. All 21 IPs are geolocated to the Netherlands, w…
F5 Labs, using Efflux sensor telemetry, found that HTTP requests hitting its sensors rose from 5,125,557 in 2023 to 8,727,820 in 2024 (about 71%, or nearly 95% once normalized for sensor count). Most of the increase came from the BotPoke scanner, which looks for filenames associated with malware distribution sites. It was active mainly in…
F5 Labs, using Efflux sensor telemetry, reports that CVE-2023-1389, an RCE in TP-Link Archer AX21 routers, was the most scanned-for CVE in December 2024 for the fifth consecutive month, with traffic far above any other tracked CVE. Other heavily scanned flaws include CVE-2022-24847 (GeoServer), CVE-2022-22947 (Spring Cloud Gateway), CVE-2…
