Friday, 8 May 2026

Instructure/Canvas extortion: 330 institutions across six countries; May 12 extortion deadline; 44 Dutch institutions confirmed

(First covered 2026-05-06.) The Instructure/Canvas breach has expanded significantly in scope. The threat actor now claims access affecting 330 institutions across six countries, threatening to publish 16 million student and staff records. SURF (the Dutch National Research and Education Network) has confirmed 44 Dutch institutions among the victims. The attacker posted portal defacements at multiple universities and established a 2026-05-12 extortion deadline for ransom payment. Canvas services were taken offline again on 2026-05-07 for emergency patching. European DPAs in the Netherlands and Germany have opened preliminary inquiries into notification timing. Institutions using Canvas should assess GDPR Article 33/34 breach notification obligations before the May 12 deadline.

CERT-FR CERTFR-2026-ACT-016: Agentic AI tools introduce prompt-injection and supply-chain attack surfaces

France's CERT-FR published advisory CERTFR-2026-ACT-016 warning that deploying agentic AI orchestration platforms (LLM-driven workflows with tool-calling, MCP server integration, or autonomous execution capabilities) introduces novel attack vectors. The advisory identifies three risk classes: prompt-injection via processed documents or websites (attacker embeds instructions in content the agent processes, redirecting its actions); MCP server supply-chain compromise (a malicious or compromised Model Context Protocol server can issue instructions to all connected agents); and insufficient sandboxing of agent execution environments, where agents with filesystem or network access can be weaponised. CERT-FR recommends input/output guardrails, strict allowlisting of permitted tool calls, human-in-the-loop gates for high-impact actions, and treating all AI agent outputs as untrusted until validated. Relevant for organisations deploying Claude Agents, Microsoft Copilot Studio, AutoGen, or similar agentic frameworks for workflow automation.

MuddyWater (Iran/MOIS) deploys Chaos ransomware as false flag; harvests credentials via Teams

Security researchers documented a refreshed campaign by MuddyWater (attributed to Iran's Ministry of Intelligence and Security, MOIS), targeting government contractors and defence-adjacent organisations in Europe and the Middle East. The campaign deploys Chaos ransomware payloads with branding designed to mimic criminal ransomware groups, a deliberate false-flag technique intended to complicate attribution and delay incident response triage. A parallel social-engineering vector uses Microsoft Teams external-access invitations to gain remote-assistance sessions under a helpdesk pretext, after which credentials are harvested and used for further access via legitimate cloud services. Observed ATT&CK techniques: T1566.004 (Spearphishing via Teams), T1649 (Steal or Forge Authentication Certificates), T1486 (Data Encrypted for Impact). This is a single-source threat-intelligence vendor disclosure.

Poland's ABW: attackers breached five municipal water treatment plants in 2025 and in some cases altered equipment parameters, and hacktivists exploited weak passwords on exposed management panels at municipal sites

Poland's Internal Security Agency (ABW) reports in its 2024-2025 activity review that in 2025 "security breaches were reported at water treatment plants in the following towns: Jabłonna Lacka, Szczytno, Małdyty, Tolkmicko and Sierakowo", and that "by gaining access, in some cases, to industrial control systems, the attackers were able to alter the technical parameters of the equipment", a direct risk to the plants' continued operation and to water supply (ABW, 2026-05-25). ABW describes hacktivist groups as particularly active against municipal infrastructure and says they "exploited glaring vulnerabilities in the form of poor password policies and unsecured device management panels, accessible directly via the public internet" (ABW, 2026-05-25). The report names no actor and no access vector for the water-plant breaches and does not tie them to the hacktivist activity. The state-sponsored groups it names, APT28, APT29 and UNC1151, are described as carrying out "sophisticated, long-term espionage and sabotage operations" (ABW, 2026-05-25). ABW's press office told CyberDefence24 that the potentially compromised water and sewage operators had IT resources reachable from the public internet, including HMI panels controlling their processes (CyberDefence24, 2025-10-08). CyberDefence24, which lists the five plants among the sites hit, describes the attacks on the Polish water sector as the work of pro-Russian hacktivists (CyberDefence24, 2025-10-08).

Eurail breach: 308,777 travellers notified three months after a December 2025 data theft exposed names and passport numbers, and DiscoverEU participants' IBANs and health data may also be involved

Eurail, the Netherlands-based seller of Interrail and Eurail passes and supplier of the EU's DiscoverEU programme, says an unauthorized actor transferred files from its network on 2025-12-26 and sent letters on 2026-03-27 to 308,777 people whose names and passport numbers were exposed (BleepingComputer, 2026-04-09), and the European Commission told DiscoverEU participants that passport or ID copies, IBANs and health data may also be involved (European Commission, 2026-01-13).

Qilin claims a ransomware attack on the German party Die Linke; the party has not confirmed data theft

Die Linke detected a cyberattack on its IT network on Thursday, 26 March 2026, took parts of its IT infrastructure offline as a precaution and filed a criminal complaint. In a statement the next day it said it had indications of a ransomware attack by the Qilin group and that its member database was not affected (Die Linke, 2026-03-27). Heise reported that it had not yet been definitively clarified which internal data had been compromised (Heise Online, 2026-03-27). Qilin added the party to its leak site on 2026-04-01 without publishing data samples (BleepingComputer, 2026-04-03). Contradiction: BleepingComputer's headline says the party confirmed the data theft, while its own text says the party stopped short of confirming a data breach (BleepingComputer, 2026-04-03). The party says the attackers aim to publish sensitive internal data and personal information of headquarters staff, and that it cannot assess whether or to what extent this will succeed or has already happened (Die Linke, 2026-03-27).

The sources give no access vector, so the transferable ground is the target class: German political parties have been targeted by cyberattacks before (The Record, 2026-04-06), and Die Linke describes ransomware attacks as often part of hybrid warfare and this one as aimed at weakening democratic structures (Die Linke, 2026-03-27).

CVE-2026-6973: Ivanti EPMM admin-authenticated RCE exploited in limited attacks, fixed with four further EPMM flaws including unauthenticated Sentry certificate issuance (CVE-2026-5787)

Ivanti's May 2026 update for on-premises Endpoint Manager Mobile (EPMM) fixes five vulnerabilities. Ivanti states: "At the time of disclosure, we are aware of very limited exploitation of CVE-2026-6973, which requires admin authentication for successful exploitation", and "We are not aware of any customers being exploited by the other vulnerabilities disclosed today"; Ivanti Neurons for MDM, Ivanti EPM and Ivanti Sentry are not affected (Ivanti, 2026-05-07). CVE-2026-6973 (CVSS 7.2) is improper input validation that lets "a remotely authenticated user with administrative access to achieve remote code execution", fixed in 12.6.1.1, 12.7.0.1 and 12.8.0.1 (The Hacker News, 2026-05-07), and CISA added it to its Known Exploited Vulnerabilities catalog the same day (CISA KEV catalog, 2026-05-07).

The admin-login precondition is less reassuring than it looks. CERT-FR recalls that its guidance for January's exploited EPMM flaws CVE-2026-1281 and CVE-2026-1340 was to reset every local EPMM account password, and warns that where this was not done, attackers can reuse administrator passwords obtained then to exploit CVE-2026-6973 (CERT-FR, 2026-05-07). Ivanti makes the same link, saying customers who rotated credentials after January face a significantly reduced risk (BleepingComputer, 2026-05-07).

The four companion flaws are not reported exploited: CVE-2026-5786 (CVSS 8.8) lets an authenticated attacker gain administrative access, CVE-2026-5787 (CVSS 8.9) lets an unauthenticated attacker impersonate registered Sentry hosts and obtain valid CA-signed client certificates, CVE-2026-5788 (CVSS 7.0) lets an unauthenticated attacker invoke arbitrary methods, and CVE-2026-7821 (CVSS 7.4) lets an unauthenticated attacker enroll a device from a restricted set, exposing information about the appliance (The Hacker News, 2026-05-07). Shadowserver counted over 850 exposed EPMM instances, 508 of them in Europe and 182 in North America (BleepingComputer, 2026-05-07). No one has attributed the exploitation; SecurityWeek notes only that Chinese actors are often believed to be behind Ivanti zero-days (SecurityWeek, 2026-05-08).

GLPI CERTFR-2026-AVI-0551, Seven CVEs including SSRF and XSS in EU ITSM platform (advisory 2026-04-29)

France's CERT-FR published CERTFR-2026-AVI-0551 (April 29, 2026) covering seven CVEs in GLPI, the open-source IT Service Management platform widely deployed in European public-sector organisations and healthcare networks. Vulnerability types include SSRF (CVE-2026-32312), stored and reflected XSS (CVE-2026-42317, CVE-2026-42318, CVE-2026-42320, CVE-2026-42321), security policy bypass (CVE-2026-5385), and data integrity compromise (CVE-2026-40108). CVSS scores are not published in the advisory. No exploitation in the wild is confirmed. GLPI administrators should upgrade to version ≥ 10.0.25 (10.0.x branch) or ≥ 11.0.7 (11.x branch). Swiss federal and cantonal administrations and hospitals using GLPI as their ITSM are advised to schedule patching within the standard change window.

CVE-2026-32202 in Windows Shell: an incomplete fix for an APT28-exploited LNK flaw leaks NTLM hashes when a folder is opened, exploited and re-released in July (CVSS 4.3)

Microsoft describes CVE-2026-32202 as a "protection mechanism failure in Windows Shell" that "allows an unauthorized attacker to perform spoofing over a network", scored CVSS 4.3 and fixed on 2026-04-14; its record now shows exploitation detected (Microsoft Security Response Center, 2026-04-14). The flaw is what remained of Microsoft's February fix for CVE-2026-21510, which APT28 exploited together with CVE-2026-21513 through crafted LNK files: the February patch stopped code execution and the SmartScreen bypass, but Windows Explorer still opens an SMB connection to the attacker's server when it renders the folder that holds the shortcut, a connection "sending the victim's Net-NTLMv2 hash to the attacker, which can later be used for NTLM relay attacks and offline cracking" (Help Net Security, 2026-04-29). CISA added CVE-2026-32202 to its Known Exploited Vulnerabilities catalog on 2026-04-28 (CISA KEV catalog, 2026-04-28). No cited source says who exploits this CVE; the APT28 link belongs to its predecessors (Help Net Security, 2026-04-29).

CVE-2026-0300 (PAN-OS Captive Portal unauthenticated root RCE): CISA KEV deadline is today (2026-05-09); no patch until 2026-05-13

(First covered and deep-dived 2026-05-07.) The CISA KEV federal remediation deadline for CVE-2026-0300 is 2026-05-09, today. Palo Alto Networks has not released a permanent patch for any PAN-OS branch; the earliest patch ETA is 2026-05-13. The mandated mitigation remains: disable the Captive Portal / Authentication Portal feature on internet-facing GlobalProtect gateway interfaces, or restrict access exclusively to trusted internal management IP ranges. PAN-OS 11.1+ deployments should confirm Threat Prevention profile with Threat ID 510019 is active on the internet-facing zone. Organisations that have not yet applied the mitigation should treat this as a P0 action today before business opens.

Amazon SES weaponised for authenticated phishing and BEC (Kaspersky, 2026-05-04, ~96 h)

Kaspersky researchers documented a campaign technique using legitimate Amazon Simple Email Service (SES) accounts to deliver attacker-crafted phishing and business-email-compromise (BEC) lures. Because messages originate from genuine SES infrastructure, SPF and DKIM authentication passes and messages evade most email security gateway filters based on sender reputation. Attackers obtain SES API credentials from publicly exposed AWS configuration files (S3 bucket misconfigurations, leaked GitHub repositories). Observed campaign goals include invoice-fraud lures targeting finance departments and credential phishing pages hosted on AWS infrastructure. Kaspersky observed targeting of finance departments at European manufacturing firms. This report is approximately 96 hours old at publication; first coverage in this brief series.

Kaspersky Q1 2026 Exploits and Vulnerabilities Report: document-based exploits resurge; RaaS acquires zero-days

Kaspersky's quarterly exploitation analysis for Q1 2026 identifies a marked resurgence in document-based exploit delivery, with Microsoft Office and PDF readers accounting for the largest share of initial-access exploit deployments. The most exploited CVE class involved Office Protected View bypass chains (multiple CVEs published in January 2026 Patch Tuesday). Browser exploitation via V8 memory corruption grew 34% quarter-on-quarter. A significant structural trend: ransomware-as-a-service operators are increasingly acquiring zero-day exploits directly from private brokers rather than relying on publicly available PoC code, shortening the detection window between disclosure and mass exploitation. The report includes Excel macro delivery via cloud storage abuse as an emerging initial-access technique.

Dragos OT Cybersecurity Year in Review (2025 data): 81% of assessments found poor IT/OT segmentation and 73% of all-time IR cases involved compromised VPN or jump-host credentials

Dragos released its ninth annual OT Cybersecurity Year in Review, covering 2025, on 2026-02-17. Its field findings: "81 percent of assessments identified poor IT/OT segmentation. 73 percent of all-time IR cases involved compromised VPN or jumphost credentials", only 46% of assessments found adequate OT network monitoring, 56% of penetration tests abused living-off-the-land tools without triggering alerts, and 30% of incident cases began with operational issues the asset owner could not explain (Dragos, 2026-02-17). Dragos tracked 119 ransomware groups affecting 3,300 industrial organisations in 2025, up from 80 groups in 2024, and says many incidents are mislabelled as IT incidents when Windows servers hosting SCADA software or engineering workstations are compromised, and that ransomware groups target VMware ESXi hypervisors hosting OT applications (Dragos, 2026-02-17). A 2026-05-07 follow-up adds that 49% of Dragos Services reports carried elevated remote-access findings and 53% identified internet-facing systems (Dragos, 2026-05-07).