16 casos · pág. 1/1
Quest Diagnostics disclosed in a Form 8-K that an unidentified party gained unauthorized access to its Quanum LSM (Lab Services Manager) system and may have accessed certain patient records. The company became aware of the incident on October 21, 2026. Quest paused access to the affected platform, activated incident response procedures, n…
A Chinese-speaking threat operator combined the agentic penetration-testing framework ARTEX with Claude Code, Codex and configurations requesting DeepSeek, GLM and Grok models to coordinate attacks on organizations worldwide. Recovered prompts dated August 4 to October 4, 2026 referenced targets in financial services, cryptocurrency, reta…
GhostAction has returned with an expanded credential-theft operation. By October 9, 2026, attackers had injected malicious GitHub Actions workflows into 790 repositories, according to OpenSourceMalware's validated total. The campaign was first documented by GitGuardian in 2025 (817 repositories, 3,325 stolen secrets). It relies on comprom…
Microsoft awarded researcher Sam Chen (Samchen) US$4,000 for reporting CVE-2026-81376, a critical (CVSS 3.1 score 9.6) Workspace Trust security feature bypass in Visual Studio Code versions before 1.136.2. A specially prepared workspace could connect to an attacker-controlled service and bypass Restricted Mode, potentially exposing local …
The seller of the StealC infostealer began advertising Stadia on October 16. It is a subscription-based modular remote access trojan that pairs credential theft with hidden desktop control. Varonis Threat Labs obtained a build, reverse engineered it and found StealC code inside the agent. The panel changelog records an upgrade to the Stea…
Straiker reports that a criminal group it tracks as AiPT-67 (operating as Tr4nsHack Team under the name Hexagon Security Labs Mexico) used a multi-agent system called CARLIY0S to coordinate attacks against more than 400 financial institutions and payment providers in Latin America. The system combined commercial AI models, Anthropic's Cla…
ThreatFabric has documented Hirudo, an Android banking remote-access trojan that steals credentials and gives operators remote control of the phone. Its distinguishing feature is replacing selected genuine banking apps with modified copies that interfere with security checks from inside the app. Victims first install a lure app (Shopora, …
Unit 42 (unit42.paloaltonetworks.com) tracks a campaign, CL-UNK-1211, that compromised government entities and state-affiliated Linux infrastructure between October 2025 and April 2026. Unit 42 published the research on October 15, and gbhackers.com covered it on October 22. The operators carried out reconnaissance, persistence and intell…
Kaspersky's analysis of Operation FlashHole describes a Lazarus Group (North Korea-linked) cyberespionage campaign against South Korean organizations. It follows Operation SyncHole, which abused the related Cross EX product and hit at least six organizations (gbhackers.com), and is placed within the broader Cascade Hole activity. The earl…
Attackers gained unauthorized access to the infrastructure of Onamae.com Desktop Cloud, a VPS service run by GMO Internet in Japan, and installed "unauthorized programs" in some customers' server environments. GMO confirmed the intrusion on October 20, 2026 (bleepingcomputer.com, gbhackers.com). It began rolling shutdowns of all Desktop C…
Symantec reports that the Russia-linked APT28 (aka Swallowtail, Fancy Bear, Forest Blizzard, BlueDelta), which the U.S. government links to the GRU, targeted organizations in two NATO member states. Victims were a naval shipbuilder, a manufacturer of military aircraft engines and a law enforcement agency (thehackernews.com, cyberscoop.com…
Zscaler ThreatLabz's 2026 Ransomware Report describes ransomware operators using generative AI to sharpen phishing, speed up reconnaissance and pick out the most sensitive corporate data to steal. The report records 896.2 TB exfiltrated by the top 10 ransomware groups between April 2025 and March 2026. The article cites a 275.8% annual in…
A Chinese-speaking operator used autonomous AI agents on the open-source Cairn platform to compromise the websites of more than 100 companies. NorForge tracks the most active campaign as AIA0001: over 1,100 attack projects across 14 dashboards, and more than 1,200 break-in attempts overall. Targets were e-commerce businesses in the United…
A supply chain campaign tracked as UNC7017 hijacked the update infrastructure of AOMEI Technology between April and July 2026 to distribute the CROSSROAD downloader and the SHINYROAD backdoor through AOMEI Backupper and AnyViewer update workflows. The attackers tampered with server configurations only briefly, then restored legitimate con…
Researcher Quentin Kaiser (QTNKSR) disclosed a memory corruption flaw in Broadcom's Wi-Fi Protected Setup (WPS) implementation. It allows an unauthenticated attacker within wireless range to disclose memory and execute code, including as root, on vulnerable routers. The attacker does not need the Wi-Fi password, network membership or a co…
Acronis Threat Research Unit found that the Gentlemen ransomware operation is using the BYOVD (bring your own vulnerable driver) technique with legitimate Lenovo and Safetica kernel drivers to terminate endpoint security software before encrypting files. Two custom dropper samples were recovered from a recent incident. They install the dr…
