Topics
CVEs, actors, campaigns, incidents, tools, and annual reports tracked across briefs. The badge marks items covered in more than one brief — these are the "stories that unfolded".
Total topics
299
7 types
Recent (30 d)
209
entities with new coverage in window
Distinct sources
373
hosts cited at least once
Total appearances
474
brief-section attributions
Co-occurrence links
1604
entity ↔ entity in same item
By type
- campaign111 (37%)
- incident100 (33%)
- vulnerability-trend27 (9%)
- actor24 (8%)
- tool16 (5%)
- annual-report16 (5%)
- policy5 (2%)
Recent coverage
Aggregate mentions per ISO week, last 8 weeks.
- EFK audit: federal cyber-governance split leaves SEPOS/FS BIS without complete incident picture2026-06-22
- Brazil national Cell Broadcast emergency-alert platform hijacked; ~30M fake Extreme Alerts2026-06-22
- eBanking phishing using IPv4-mapped IPv6 URL notation to bypass regex URL scanners2026-06-22
- AryStinger botnet — reconnaissance/proxy network on EoL D-Link routers + QNAP NAS2026-06-22
- RoguePlanet: TOCTOU race in Microsoft Defender scan engine -> SYSTEM LPE, PoC, no CVE/patch2026-W252026-06-11
- ShinyHunters Oracle PeopleSoft data-theft campaign (100+ orgs, ~300 instances, education-heavy; Univ. of Nottingham confirmed)2026-W252026-W242026-06-162026-06-132026-06-12
- The Gentlemen ransomware (Storm-2697 / Phantom Mantis): self-propagating Go encryptor2026-W252026-06-12
- FortiBleed — 73,932 FortiGate device credentials exposed; active Russian-speaking brute-force/AD-lateral campaign2026-W252026-06-202026-06-18
- Mastra npm namespace backdoored via easy-day-js (dormant contributor account)2026-W252026-06-212026-06-18
- Operation Endgame expands to SocGholish/TA569 — 106 C2 servers, 14,971 WordPress sites2026-W252026-06-19
- Icarus extortion: dormant Klue credential → harvested OAuth tokens → bulk Salesforce CRM theft2026-W252026-06-212026-06-19
- Gentlemen RaaS — operator-maintained GentleKiller EDR-killer framework (BYOVD, 48 vendors)2026-W252026-06-202026-06-19
- Kodak confirms breach after ShinyHunters leak-site listing; June 18 deadline passed without publication2026-W252026-06-20
- Prinz Eugen — Go-based ransomware, recent-files-first, no ransom note2026-06-21
- Popa residential-proxy botnet (Vo1d plugin) tied to Alarum/NetNut by Krebs/Qurium2026-06-21
- UK ICO Commissioner John Edwards resigns with immediate effect2026-06-21
- HCRG Care Group notifies patients 16 months after Feb-2025 Medusa breach2026-06-21
- Texas Parks & Wildlife 3.08M licence holders exposed via third-party vendor2026-06-21
- One Medical (Amazon) legacy-storage breach; ShinyHunters 8.8TB claim unverified2026-W252026-06-21
- Nintendo employee data stolen from third-party HR-survey SaaS TinyPulse (Shadowbyt3$ extortion)2026-06-20
- usbliter8 — permanent unpatchable SecureROM boot-chain exploit for Apple A12/A13 silicon (checkm8 successor)2026-06-20
- AutoJack — single-web-page host RCE via AI agent's local MCP WebSocket (AutoGen Studio dev builds)2026-06-20
- UK ICO criminal caution — London Clinic insider accessed Princess of Wales medical records2026-06-19
- CryptoBandits — USB-LNK worm + Tor hidden-service C2 driving a clipboard hijacker2026-06-19
- Sophos X-Ops — cautious-but-concrete AI adoption in the cybercrime underground2026-06-19
- ScarCruft (APT37) NarwhalRAT — fake Microsoft OTP lures, compiled-Python RAT, pCloud dead-drop C22026-06-18
- China arrests 67 Silver Fox (Winos/ValleyRAT) cybercrime operators2026-06-18
- Zammad 7.1 — 13 vulns incl admin privesc/SSRF, BSI WID-SEC-2026-1981, DACH public-sector helpdesk2026-06-18
- 15 malicious JetBrains Marketplace plugins exfiltrate AI provider API keys (Aikido)2026-06-18
- Rust crypto clipboard-hijacker abusing VirusTotal community reputation (Check Point)2026-06-18
- Novo Nordisk discloses theft of clinical-trial and HCP data2026-06-172026-06-162026-06-13
- Munich LHM-Services GmbH — ~120,000 student records suspected on darknet, suspected insider threat, Bavarian DPA notified2026-06-17
- FishMonger (I-SOON) ports SprySOCKS backdoor to Windows (WIN_DRV/WIN_PLUS) with kernel-driver rootkit; government targets2026-06-17
- ErrTraffic — ClickFix MaaS distribution framework with EtherHiding/Polygon C2 resolution; EU WordPress targeting2026-06-17
- Potemkin loader + RMMProject RAT via ClickFix — Chromium App-Bound Encryption bypass, EtherRAT2026-06-17
- Rokarolla Android banking trojan — 217 banking/crypto apps, 137 commands, default call/SMS handler hijack2026-06-17
- DragonForce intrusion — first ITW Microsoft Teams TURN-relay C2 (Backdoor.Turn) + four-driver BYOVD chain2026-06-17
- FortiSandbox triple active exploitation (CVE-2026-39808/39813/25089) — simultaneous in-the-wild exploitation2026-06-17
- UNC6508 (PRC) — INFINITERED implant on internet-facing REDCap servers + Google Workspace BCC content-compliance rule for covert research/defence email exfiltration2026-06-16
- Awesome Motive CDN supply-chain attack — OptinMonster/TrustPulse/PushEngage scripts tampered on ~1.2M WordPress sites; rogue admins + hidden backdoor plugin (via CVE-2026-10795)2026-06-16
- DPRK UNK_DeadDrop (rel. Contagious Interview) — VS Code/Cursor tasks.json runOn:folderOpen auto-exec delivering Overlord Go C2 to developers; EU targets FR/DE/NL2026-06-16
- iRhythm Holdings (cardiac MedTech) — SEC 8-K Item 1.05: social engineering of third-party-hosted apps; PHI/PII/proprietary data theft + ransom demand2026-06-16
- Google lawsuit vs China-based "Outsider" PhaaS weaponising Gemini to generate phishing pages2026-06-152026-06-13
- Handala (Void Manticore) breaches California Water Service via internet-exposed RTKBase NTRIP/GNSS caster; billing PII pivot, no OT access2026-06-15
- Mini Shai-Hulud — TeamPCP SAP CAP npm supply-chain worm2026-W242026-W222026-W192026-06-102026-05-26
- UPDATE: Chaotic Eclipse Windows zero-days — MiniPlasma is third PoC (cldflt.sys CfAbortHydration, claimed CVE-2020-17103 regression on fully patched Win11)2026-W242026-W232026-W212026-05-19
- Rapid7 publishes unpatched Gogs argument-injection RCE with Metasploit module2026-W242026-W232026-05-29
- NCSC-CH pre-event cyber advisory for the G7 Évian summit (DDoS/intel-collection/mobile targeting)2026-W242026-06-03
- VerdantBamboo (UNC5221/WARP PANDA) — China-nexus; BRICKSTORM on edge devices, MSP supply-chain, M365 CA bypass, AGENTPSD/PLENET2026-W242026-W232026-06-05
- Maine AG breach portal abused for fraudulent VRChat/Discord filings2026-W242026-06-132026-06-12
- "Atomic Arch" AUR supply-chain — 400+ hijacked packages drop Rust stealer + eBPF rootkit2026-W242026-06-13
- Velvet Ant "Operation Highland" — decade-long Linux PAM/sshd auth-stack subversion (China-nexus)2026-W242026-06-13
- APT28 (GRU Unit 26165) tradecraft evolution — LameHug LLM-driven stealer, BeardShell cloud C2, FrostArmada router DNS hijack (Sekoia)2026-W242026-06-14
- Cyber Europe 2026 — first EU-wide test of 2025 EU Cyber Blueprint and first live activation of the EU Cybersecurity Reserve2026-06-14
- Conti loader developer Oleksii Lytvynenko pleads guilty in US federal court after extradition from Ireland2026-06-14
- Kyushu Electric subsidiary loses unencrypted SSD with 10.9M customer records — reportedly Japan's largest personal-data breach2026-06-14
- European Commission refers France and Spain to the CJEU over NIS2 non-transposition2026-W24
- Germany Bundestag first reading of CRA domestic-implementation bill (Drucksache 21/6134)2026-W24
- ENISA SBOM Adoption State of Play 2026 — first EU-wide SBOM baseline2026-W24
- South Korea PIPC record fine on Coupang over unrevoked former-employee signing key2026-06-13
- Check Point LangGraph checkpointer SQLi->RCE chain (CVE-2025-67644 + CVE-2026-28277 + CVE-2026-27022)2026-06-13
- "Agentjacking" — MCP injection of AI coding agents via forged Sentry error events (Tenet Security)2026-06-13
- AudiA6 ransomware crypto-laundering service dismantled (US/Europol, CH participating)2026-06-12
- GreatXML: Nightmare Eclipse unpatched BitLocker/WinRE bypass, public PoC2026-06-12
- CISA BOD 26-04 — risk-tiered federal remediation, supersedes BOD 22-01/19-022026-06-12
- OpenClaw AI agent: indirect prompt injection (Imperva) + agent phishing (Varonis)2026-06-12
- OceanLotus/APT32 SPECTRALVIPER via FireAnt MetaKit update-server supply-chain compromise2026-06-12
- npm v12 disables install lifecycle scripts by default (July 2026)2026-06-12
- ServiceNow unauthenticated REST endpoint (/api/now/related_list_edit/create) queried customer instance tables2026-06-11
- EDPB adopts harmonised GDPR Art. 33 breach-notification template; consultation to 5 Aug 20262026-06-11
- JDY botnet (Volt Typhoon-linked) expands to 1,500+ SOHO/IoT devices; sub-24h post-disclosure scanning2026-06-11
- CrowdStrike 2026 Technology Threat Landscape Report2026-06-11
- Tchap French government Matrix messenger breached via account takeover; 73,467 civil servants' metadata exposed, CNIL notified2026-06-10
- Ghost-Sender: Exchange Online inbound spoofing bypassing SPF/DKIM/DMARC on third-party-MX tenants (no patch)2026-06-10
- NCSC-CH Week 23: coordinated job-seeker targeting (fake interviews, reshipping ID theft, LinkedIn-to-GitHub infostealer)2026-06-10
- Meta Instagram AI support tool (High Touch Support) logic flaw: 20,225 account takeovers; Maine AG notified2026-06-10
- GIFTEDCROOK via UAC-0226 and Earth Dahu still exploiting WinRAR CVE-2025-8088 against Ukraine (Trend Micro)2026-06-10
- Unit 42 cloud-logging defense-evasion taxonomy across AWS CloudTrail and Google Cloud Logging2026-06-10
- Red Canary: Microsoft Entra Agent ID OBO OAuth abuse turns compromised AI agent into delegated phishing sender2026-06-10
- Check Point: TDS-gated ecosystem impersonating Ghidra/dnSpy/ILSpy delivers SessionGate, RemusStealer, AnimateClipper2026-06-10
- EU Cyber Resilience Act — first hard deadline (notifying-authority designation, 11 June 2026)2026-06-10
- Dragos Q1 2026 Industrial Ransomware Analysis — 1,020 incidents; The Gentleman 4x vs Romanian energy; IT-adjacent pattern2026-06-10
- Oxford University CareerConnect (Group GTI) SaaS breach2026-06-09
- Meta contempt complaint vs NSO Group over new WhatsApp spyware phishing2026-06-09
- Microsoft Teams external-chat phishing (APT29/Cloaked Ursa, UNC6692)2026-06-09
- AI-brand impersonation malware delivery (Storm-3075, Fox Tempest)2026-06-09
- TeamPCP Mini Shai-Hulud framework open-sourced; Phantom Gyp derivative2026-06-09
- EU Cybersecurity Package 2026 — NIS2 amendment COM(2026) 13 + Cybersecurity Act 2; PQC Article 7(2)(k) explicit obligation; CRA Single Reporting Platform 11 September 20262026-W232026-W19
- EU 20th Russia sanctions package — managed-security-services prohibition (eff. 25 May 2026); Switzerland adopted most measures 22 May2026-W232026-W21
- Germany's federal cabinet approves Cybersicherheitsstärkungsgesetz — BKA, BSI and Federal Police gain authority to redirect attacker traffic and disable infrastructure2026-W232026-05-28
- FBI FLASH CSA 260526 — Silent Ransom Group / Luna Moth / UNC3753 sends operatives physically into US law-firm offices to insert USB exfiltration devices when remote social engineering fails2026-W232026-06-062026-05-28
- Ghost Stadium PhaaS — 300+ FIFA domain clones targeting EU fans2026-W232026-05-30
- Miasma worm backdoors 32 @redhat-cloud-services npm packages (TeamPCP / Mini Shai-Hulud variant)2026-W232026-06-062026-06-02
- Gamaredon GammaPhish/GammaWorm — NTFS-ADS USB+network worm (Sekoia)2026-W232026-06-032026-06-02
- Sophos 2026 Active Adversary Report — identity-dominant root causes; Impacket/AnyDesk2026-W232026-06-03
- NCSC-CH: Booking.com breach feeds WhatsApp hotel-booking phishing (TWINT/bank spoof + booking-channel ATO)2026-W232026-06-04
- Shared booking-SaaS breach exposes guests at 100+ Dutch/Belgian/Irish hotels; phishing wave2026-W232026-06-04
- TA4922 — China-nexus financially-motivated cluster; Atlas RAT/RomulusLoader/SilentRunLoader, expands to DE/UK/IT2026-W232026-06-05
- DentaQuest — ShinyHunters extortion victim; 234 GB leaked, 2.6M dental-benefit records2026-W232026-06-05
- Five Eyes joint bulletin 'Safeguarding Our Secrets' — China military intel recruiting via LinkedIn/job platforms2026-W232026-06-06
- IronWorm — Rust npm supply-chain worm with eBPF kernel rootkit, Tor C2, cloud/AI-key sweep2026-W232026-06-06
- ENISA NIS360 2026 — public-sector receives 63% of EU hacktivist attacks; seven sectors in risk zone2026-W23
- FIFA World Cup 2026 pre-event threat cluster — GHOST STADIUM phishing-domain layer, Massiv/Perseus Android banking trojans via Zombinder in pirated streaming apps, 13,000+ malicious domains2026-06-08
- ICO secures £118,852 Proceeds of Crime Act confiscation from two former RAC employees who sold ~30,000 customer records (insider data theft)2026-06-08
- C0XMO — cross-platform Gafgyt DDoS botnet variant propagating via DD-WRT UPnP flaw (FortiGuard)2026-06-08
- Hijacked polyfill[.]io domain reactivates with HTTP 401 credential prompts2026-06-07
- Magecart skimmer hosted in Stripe customer metadata, exfiltrates via api.stripe.com2026-06-07
- Autonomous AI agent finds 21 FFmpeg zero-days for ~$1,000 (CVE-2026-39210–39218)2026-06-07
- SANS ISC: WeTransfer JS → steganographic JPEG loader on Cloudflare Workers/R22026-06-07
- OP-512 — China-linked cluster, cryptographically-unique self-reporting IIS web-shell framework2026-06-06
- ShinyHunters — financially motivated data-theft group2026-W222026-W192026-06-052026-05-272026-05-25
- Operation FlutterBridge (CL-CRI-1089) — notarized macOS FlutterShell backdoor via Google Ads malvertising2026-06-05
- UK National Federation of Subpostmasters ransomware via cPanel flaw2026-06-05
- claude-code-action [bot]-actor bypass + prompt injection → repo hijack / action poisoning (fixed v1.0.94)2026-06-05
- U-Toronto/Vector Institute adaptive AI worm PoC — open-weight LLM on compromised hosts synthesises per-target exploits2026-06-05
- UN WFP Palestine Self-Registration breach — ~600k Gaza households' IDs/locations exposed2026-06-04
- OFAC sanctions Nobitex + 3 Iranian exchanges as IRGC-affiliated ransomware proceeds conduit2026-06-04
- DesckVB RAT malspam laundering via Google DoubleClick; AMSI/ETW patching; DACH lures2026-06-04
- Unpatched Windows search: URI handler NTLMv2 leak; Microsoft declined to patch2026-06-04
- M365 Android debug flag (setIsDebugMode) enables silent OAuth-token theft across 6 apps2026-06-04
- One-click github.dev webview OAuth-token theft (postMessage origin flaw), unpatched + PoC2026-06-04
- Symantec: 5-month mailbox espionage vs global stock exchange; Aspose OST stealer, Dropbox/OneDrive exfil2026-06-04
- Dashlane TOTP brute-force — encrypted vaults of <20 personal-plan users downloaded2026-06-03
- Attacker-built AI-orchestrated EDR-evasion testing lab (Sophos X-Ops)2026-06-03
- SVG phishing wave using application/ecmascript MIME to evade WAF/email pattern-matching (SANS ISC)2026-06-03
- Operation XENOFISCAL — SideCopy/APT36 XenoRAT via mshta/HTA vs Afghan provincial treasuries2026-06-03
- ShinyHunters lists Charter Communications (Spectrum), claims 42M records; Charter denies sensitive PI/CPNI exfil2026-06-022026-05-25
- Spain arrests doxer publishing data on INCIBE/AG/Civil Guard staff (Police-ESP-Doxed)2026-06-02
- Meta AI support chatbot social-engineered into resetting Instagram passwords (pro-Iranian)2026-06-02
- WordPress malware abuses Steam profile comments as Unicode-steganography C2 (GoDaddy)2026-06-02
- Operation Dragon Weave — China-nexus espionage (Czech/Taiwan) with Azure Blob dead-drop C22026-06-02
- PostHog AWS exploit — researcher-confirmed; EU/US cloud credential rotation and outage2026-06-01
- npm dependency-confusion campaigns targeting internal corporate namespaces (Microsoft 33 pkgs / Sonatype 176 pkgs)2026-06-01
- SmartApeSG ClickFix stages unnamed RAT pivoting to weaponised NetSupport Manager2026-06-01
- Italy's low-cost commercial spyware economy — Morpheus (IPS Intelligence) and Spyrtacus (SIO) Android Accessibility-API abuse2026-06-01
- TeamPCP — threat actor targeting software supply chains2026-W222026-W192026-05-122026-05-06
- MuddyWater (Iran/MOIS) Chaos ransomware false-flag + Teams credential harvesting — Europe/Middle East2026-W222026-W192026-05-08
- The Gentlemen — RaaS surged Q1 2026 (192 attacks, 588% QoQ); 32% of victims European; FortiGate CVE-2024-55591 initial-access funnel2026-W222026-W192026-05-14
- Nightmare Eclipse Windows zero-day drops: YellowKey (BitLocker) and GreenPlasma (CTFMON LPE), public PoC2026-W222026-05-15
- UNC6671 / BlackFile — vishing-driven AiTM extortion with programmatic SharePoint exfiltration (GTIG 2026-05-15)2026-W222026-05-16
- Screening Serpens (UNC1549 / Smoke Sandstorm / Nimbus Manticore) — Iranian APT operationalising AppDomainManager hijacking; six new RAT variants MiniUpdate/MiniJunk V2 deployed Feb–Apr 20262026-W222026-W212026-05-272026-05-23
- GlassWorm developer-targeting botnet — all four C2 channels (Solana / BitTorrent DHT / Google Calendar / VPS) severed simultaneously by CrowdStrike / Google / Shadowserver2026-W222026-05-28
- Carnival Corporation confirms 5.99M-record ShinyHunters breach — Princess/Holland/Cunard/Costa2026-W222026-05-29
- Grandoreiro 2026 Iberian campaign — Delphi DLL side-loading, WebSocket/STUN C2; parallel ESET BTMOB Android RAT MaaS2026-W222026-05-29
- GREYVIBE — Russia-nexus AI-assisted threat cluster (Ukraine)2026-W222026-05-30
- Kimsuky HTTPSpy + HelloDoor with VS Code/Cloudflare tunnel C22026-W222026-05-30
- Mautic 7.1.2/6.0.9 — seven authenticated flaws (Focus SSRF CVE-2026-9557, API SQLi CVE-2026-4776)2026-05-31
- 'Signal Support' impersonation phishing harvesting cloud-backup recovery keys2026-05-31
- California AG sues former 23andMe (Chrome Holding Co.) over 2023 genetic-data breach2026-05-31
- Cisco Talos — DICOM-format heap OOB-write attack surface against Orthanc PACS (pydicom/GDCM)2026-05-31
- CNIL fines IQVIA €5M for health data warehouse security failures2026-05-30
- LLMShare malvertising via ChatGPT share links (Beagle infostealer)2026-05-30
- ESET APT Activity Report Q4 2025–Q1 20262026-05-30
- Sysdig first observed LLM-agent-driven intrusion via CVE-2026-399872026-05-30
- ChatGPhish — ChatGPT Markdown renderer trusts third-party image URLs2026-05-30
- Red Canary Entra Agent ID priv-esc via AgentIdentityBlueprint.AddRemoveCreds.All2026-05-30
- Nightmare Eclipse: Microsoft DCU threat, GreenPlasma/MiniPlasma unpatched, July 14 deadline2026-05-30
- TheGentlemen RaaS lists Czech University of Finance and Administration (VSFS) and Swiss DEVO-Tech AG on leak site2026-W212026-05-292026-05-20
- Apereo CAS 7.3.7.1 patches an OIDC-provider flaw reported by Coop Switzerland; CERT-FR issues advisory2026-05-29
- Dutch Police + NCSC dismantle Asocks residential-proxy botnet — 17M devices, 200 NL-hosted servers seized2026-05-29
- UK Visa Portal lookalike (ukvisaportal.com) — 100K passport scans/selfies exposed via misconfigured S3 bucket2026-05-29
- JINX-0164 — financially motivated cluster targeting crypto orgs via LinkedIn recruiter lures, AUDIOFIX macOS infostealer, MINIRAT npm pivot into CI/CD2026-05-29
- ILIAS LMS — nine fixes shipped 2026-05-27; critical access-control gaps (CVSS 9.8 + 9.3); NCSC.ch flags SOAP interface as primary unauthenticated attack surface2026-05-28
- Dutch National Police arrest 35-year-old from Buren over AFC Ajax breach — 300k+ fan accounts and 42k+ season tickets exposed via misconfigured API access-control and shared keys2026-05-28
- Iran MOIS attributed to LACMTA destructive breach via 'Ababil of Minab' hacktivist front — 700 GB exfiltrated, VMs and backups deliberately destroyed2026-05-28
- MuddyWater / Seedworm Q1 2026 — Symantec documents DLL side-loading via signed Fortemedia / SentinelOne binaries; ChromElevator ABE bypass; Node.js orchestration2026-05-28
- Microsoft Defender Experts — AI-chatbot search-poisoning extends SEO lure; GPU-utility lookalikes drop ScreenConnect, then process-hollowed miners (gminer/lolMiner/SRBMiner-MULTI) under signed Microsoft binary2026-05-28
- SANS ISC — Akira ransomware kill chain reconstructed entirely from SSLVPN syslog and Windows EVTX, no EDR2026-05-28
- Tycoon2FA PhaaS post-March-2026-takedown — OAuth Device Authorization Grant abuse on Microsoft 3652026-05-272026-05-18
- Lithuania Centre of Registers breach — ~600,000 property/legal-entity records exfiltrated via abused institutional API credentials; foreign-state actor suspected; agency head resigned2026-05-27
- TrapDoor cross-ecosystem supply-chain campaign (npm/PyPI/Crates.io); AI-assistant config poisoning2026-05-26
- ACR Stealer distributed via counterfeit Claude AI download pages + malicious search ads2026-05-26
- GTIG: Chinese-language PhaaS ecosystem — real-time OTP relay over RCS/iMessage defeats TOTP/SMS MFA2026-05-26
- Lazarus RemotePE — three-stage memory-only RAT (DPAPILoader/RemotePELoader/RemotePE); HellsGate+ETW patch2026-05-26
- Underminr - multi-tenant-CDN domain-fronting variant defeating DNS-layer filtering (ADAMnetworks)2026-05-25
- THORChain GG20 Threshold Signature Scheme vault drain — ~$11M across nine chains (Switzerland-based)2026-W212026-05-18
- ARWINI (Lower Saxony statutory-prescription audit body) — data exfiltration confirmed by LKA2026-W212026-05-19
- BigBlueButton bbb-web — three CVEs (sessionToken, checksum bypass, SSRF) on EU edu/gov virtual-classroom platform2026-W212026-05-19
- CISA / Nightwing contractor — AWS GovCloud admin keys + plaintext creds + Artifactory exposed in public GitHub for ~6 months2026-W212026-05-19
- 7-Eleven confirms ShinyHunters breach of 600K+ Salesforce franchise-application records (campaign same as Instructure / Vimeo / Wynn / Vercel / Medtronic)2026-W212026-05-19
- INTERPOL Operation Ramz — first MENA-region cybercrime sweep: 201 arrests, 53 servers, first Algerian PhaaS takedown (Oct 2025–Feb 2026)2026-W212026-05-19
- UPDATE: TeamPCP / Shai-Hulud — first copycat wave (OX Security npm packages w/ Phantom Bot + SSH/cloud stealers); Checkmarx Jenkins plugin trojanised (third in three months); SentinelLabs PCPJack rival worm2026-W212026-05-19
- UPDATE: Grafana Labs CoinbaseCartel — victim confirms source-code-only theft via Pwn-Request, no customer data, ransom rejected on FBI guidance2026-W212026-05-19
- Drupal core highly critical pre-patch warning — PSA-2026-05-18, patch window today 17:00-21:00 UTC; pre-auth, unauthenticated, full-site compromise; no CVE yet2026-W212026-05-212026-05-20
- Microsoft DCU disrupts Fox Tempest MSaaS — 1,000+ Artifact Signing certs revoked; SDNY court order; downstream Rhysida, INC, Qilin, Akira + Vanilla Tempest, Storm-0501 / 2561 / 02492026-W212026-05-20
- Fox Tempest — financially motivated MSaaS operator; signspace[.]cloud seized 2026-05-192026-W212026-05-20
- Sparx Enterprise Architect / Pro Cloud Server — five-CVE chain (CVE-2026-42096 to 42100); pre-auth SQL injection + WebEA race-condition RCE; CVSSv4 10.0 chained; PoC public; no vendor patch2026-W212026-05-20
- actions-cool/issues-helper GitHub Action compromised — 53 tags moved to imposter commit 1c9e803 reading Runner.Worker /proc/PID/mem for secrets; Mini Shai-Hulud cluster link2026-W212026-05-20
- Nx Console VS Code extension 18.95.0 compromised — stolen publisher credentials; 11-minute window 2026-05-18 12:36-12:47 UTC; multi-channel stealer + macOS Python backdoor2026-W212026-05-20
- Huawei VRP enterprise-router zero-day caused POST Luxembourg nationwide telecom outage (23 July 2025); no CVE assigned 10 months later2026-W212026-05-20
- Webworm (China-aligned; FishMonger / Aquatic Panda / SixLittleMonkeys / Space Pirates) — ESET documents 2025 EU pivot with EchoCreep (Discord C2) and GraphWorm (MS Graph / OneDrive C2) backdoors against Belgian / Italian / Serbian / Polish government targets2026-W212026-05-21
- Verizon 2026 DBIR — vulnerability exploitation overtakes credentials as primary breach vector first time in 19 years (31% vs 13%); only 26% KEV remediation (down from 38%); median patch time 43d (from 32d); supply-chain breaches +60% YoY now 48% of all breaches2026-W212026-05-21
- Operation Saffron: First VPN criminal anonymisation service dismantled; Switzerland JIT participant; Phobos RaaS link confirmed2026-W212026-05-22
- Calypso/Red Lamassu (Bronze Medley): Showboat (Linux) + JFMBackdoor (Windows) telco espionage campaign2026-W212026-05-22
- Netherlands FIOD arrests two over EU sanctions evasion for Stark Industries / WorkTitans bulletproof hosting; 800 servers seized; NoName057(16) DDoS infrastructure dismantled2026-W212026-05-23
- Kimwolf / 'Dort' DDoS-for-hire operator (Jacob Butler, 23, Ottawa) arrested; AISURU variant; 30+ Tbps peak; >25,000 attack commands; DoD-range targeting2026-W212026-05-23
- Megalodon mass-poisoned 5,561 GitHub repos in 6-hour window; SysDiag + Optimize-Build workflows exfiltrate cloud credentials, SSH keys, OIDC tokens2026-W212026-05-23
- Rhysida claims Landeshauptstadt Stuttgart (Baden-Württemberg state capital) municipal-data theft for 5 BTC; city denies confirmed incident2026-W212026-05-23
- ANSSI / CERT-FR CERTFR-2026-AVI-0635 on SPIP < 4.4.15 security-policy bypass; dominant French public-administration CMS, EU/CH Francophone government deployment2026-W212026-05-23
- ROADtools weaponised by Midnight Blizzard (APT29), Curious Serpens (APT33) and UTA0355 for Entra ID device registration, token theft and tenant enumeration2026-W212026-05-23
- Rapid7 Q1 2026 Threat Landscape Report — vulnerability exploitation overtakes social engineering as top initial-access vector (38% vs 24%); KEV median time 8.5→5.0 days2026-W212026-05-23
- Check Point Research March-April 2026 AI Threat Landscape Digest — single operator runs two AI platforms in parallel to breach nine Mexican government agencies; EvilTokens jailbreak-as-a-service2026-W212026-05-23
- Breach at billing processor Unimed exfiltrates ~97,600+ patient records from six German university hospitals (attribution open)2026-W212026-05-24
- Deleted Google Cloud API keys keep authenticating up to 23 minutes (GCP IAM eventual consistency)2026-05-24
- Atos TRC: hardware-gated Windows drivers made BYOVD-exploitable in software (PnP AddDevice / filter restacking / registry)2026-05-24
- npm 2FA-gated staged publishing GA + install-source restriction flags (supply-chain hardening)2026-W212026-05-24
- Packagist supply-chain wave: Laravel-Lang autoloader backdoor + 8-package cross-ecosystem postinstall strand2026-W212026-05-24
- FrostyNeighbor/Ghostwriter/UNC1151 March-May 2026 campaign: Poland, Lithuania, Ukraine2026-05-232026-05-15
- FBI PSA260521 warns on Kali365 — Telegram-distributed PhaaS exploiting OAuth device-code flow for persistent M365 token capture bypassing MFA2026-05-23
- ICO POCA confiscation £355,880: Markerstudy Insurance insider accessed 32K+ records off-hours and sold data2026-05-22
- B1ack-s Stash carding marketplace publicly releases 4.6M stolen payment card records — third free-release wave (after 1M Apr 2024 and 4M Feb 2025); SOCRadar attributes collection to e-skimming and phishing2026-05-21
- PinTheft — Linux kernel RDS zerocopy double-free + io_uring fixed-buffer page-cache overwrite LPE; PoC public; no CVE assigned; Arch Linux default-loaded (not Ubuntu/Debian/Fedora/RHEL/SUSE)2026-05-21
- Storm-2949 SSPR-to-Key-Vault Azure kill chain — voice-phishing SSPR → Entra ID → M365 Graph → App Service Kudu → Key Vault → SQL → Storage → Azure VM, no malware2026-05-20
- Storm-2949 — financially motivated, no nation-state attribution; SSPR voice-phishing → multi-resource Azure abuse2026-05-20
- Cisco Talos — demo.pdb BadIIS commodity MaaS ISAPI backdoor; lwxat developer alias; builder tool recovered; UAT-8099 / DragonRank link; 1,800+ IIS servers compromised globally2026-05-20
- Fast16 — Symantec/Carbon Black confirm contemporaneous-with-Stuxnet nuclear-simulation sabotage; LS-DYNA/AUTODYN hook engine targeting 30 g/cm³ density threshold; Zetter corrects 'pre-Stuxnet' framing2026-05-19
- Instructure (Canvas LMS) data breach — student and educator data2026-W192026-05-132026-05-122026-05-092026-05-08
- ENISA expands CVE Numbering Authority Root — 4 new CNAs, 7 migrated from MITRE; ~90 European CNAs eligible for transfer2026-W192026-05-092026-05-07
- Germany KRITIS-DachG (CER Directive transposition) in force March 2026 — public administration first time in CI scope; registration deadline 17 July 20262026-W19
- West Pharmaceutical Services SEC 8-K Item 1.05 — data exfiltrated, systems encrypted, global operations partially restarted (2026-05-11)2026-05-12
- Škoda Auto Deutschland online-shop breach exposes customer PII and password hashes; logging gap prevents exfiltration confirmation (2026-05-11)2026-05-12
- Foxconn confirms Nitrogen ransomware crippled North-American manufacturing sites — 8 TB/11M files claimed, ESXi decryptor mathematically broken2026-05-13
- BWH Hotels (Best Western / WorldHotels / Sure Hotels) — 181-day dwell in guest-reservation web app, EEA guests in scope2026-05-13
- Clinical Diagnostics LCPL / NMDL (NL) — Dutch IGJ ruling: failed NEN 7510 information-security standard at time of July 2025 Nova ransomware breach; ~941,000 patients incl. cervical-cancer screening2026-05-14
- UAT-8616 — Sophisticated actor exploiting Cisco SD-WAN infrastructure since 20232026-05-15
- Secret Blizzard / Turla / FSB Centre 16 — Kazuar P2P botnet anatomy (Microsoft Threat Intelligence 2026-05-14)2026-05-16
- Kimsuky (Ruby Sleet / APT43) PebbleDash toolkit evolution — Rust-based HelloDoor variant + TryCloudflare quick-tunnel C2 (Kaspersky GReAT analysis); South Korea primary, Germany spillover2026-05-17
- FunnelKit Funnel Builder for WooCommerce — unauthenticated checkout-endpoint injection, active Magecart skimmer on 40,000+ stores (no CVE assigned)2026-05-17
- Pwn2Own Berlin 2026 (May 14–16) — 47 zero-days, $1,298,250 awarded; DEVCORE Exchange three-bug SYSTEM RCE chain, STARLabs ESXi escape, every AI agent target fell; Compass Security Swiss participation2026-05-17
- node-ipc npm package backdoored via expired-domain account takeover (versions 9.1.6 / 9.2.3 / 12.0.1)2026-05-16
- Dream Market lead admin Owe Martin Andresen arrested in Germany (BKA + US multi-agency)2026-05-16
- AMD-SB-7052 — Zen 2 µop-cache corruption / SoC isolation LPE (May 2026 Windows CU / Xen XSA-490)2026-05-16
- Gremlin Stealer evolved — Unit 42 documents .NET XOR resource-section obfuscation, crypto-clipper, WebSocket browser-process session hijack2026-05-16
- SentinelOne — Living Off the Pipeline CI/CD subversion taxonomy with three case studies (TeamCity / GitLab service-account / Contagious Interview)2026-05-16
- OpenAI named as TeamPCP/Mini Shai-Hulud victim; code-signing certificate rotation enforced2026-05-15
- Datadog Shai-Hulud open-source static analysis framework for CI/CD pipeline security2026-05-15
- Sophos State of Identity Security 2026: Switzerland highest breach incidence globally2026-05-15
- GemStuffer — RubyGems registry weaponised as one-way exfiltration channel scraping UK local-authority ModernGov portals; new abuse pattern exploiting CI/CD inbound-monitoring blind spot2026-05-14
- FamousSparrow (UAT-9244) three-wave intrusion of Azerbaijani oil & gas operator Dec 2025 – Feb 2026; ProxyNotShell re-exploit + novel two-stage export-gated DLL sideloading2026-05-14
- CERTFR-2026-AVI-0564 — SPIP < 4.4.14 multiple RCEs (public + private area)2026-05-13
- CERTFR-2026-AVI-0572 — Centreon Infra Monitoring April 2026 bulletin (RCE / SQLi / XSS cluster)2026-05-13
- Microsoft MDASH — multi-model agentic vulnerability-discovery harness, 16 Windows CVEs found in network-stack kernel components2026-05-13
- TrickMo "TrickMo C" — Android banking trojan migrated C2 to The Open Network blockchain, adds SOCKS5/SSH device-as-pivot; FR/IT/AT campaigns2026-05-13
- NCSC-UK "10 questions to ask when using AI models to find vulnerabilities" — operational checklist2026-05-13
- ICO fines South Staffordshire Water £963,900 — Cl0p ZeroLogon 20-month dwell, 5% SOC coverage (UK NIS2/CER precedent)2026-05-12
- BKA + ZIT dismantle relaunched Crimenetwork darknet marketplace; German operator arrested in Mallorca on European Arrest Warrant (2026-05-08)2026-05-12
- Google Threat Intelligence Group AI Threat Tracker (May 2026) — first AI-generated zero-day exploit ITW; AI-augmented malware (CANFAIL, LONGSTREAM, PROMPTFLUX, HONESTCUE); state-actor Gemini abuse (UNC2814, APT45, APT27, UNC5673)2026-05-12
- TeamPCP backdoors Checkmarx Jenkins AST plugin version 2026.5.09; SANDCLOCK exfiltrates CI/CD secrets (2026-05-09 to 2026-05-10)2026-05-12
- SMS-blaster smishing establishing itself in Switzerland — portable IMSI-catchers force 2G downgrade, bypass operator SMS filtering2026-05-11
- UAT-8302 — China-nexus APT targeting government entities in South America and southeastern Europe2026-W192026-05-06
- World Leaks — rebranded Hunters International; data-theft extortion without encryption2026-W192026-05-06
- France ANTS government identity agency breach — 11.7M citizen records confirmed2026-W192026-05-072026-05-06
- DigiCert support portal compromise — 60 fraudulent EV code-signing certificates2026-W192026-05-06
- Trellix source code repository breach2026-W192026-05-06
- ADT Inc. cloud environment breach — customer PII (SEC 8-K 2026-04-24)2026-W192026-05-06
- Mediaworks Kft (Hungary) — World Leaks data-theft extortion2026-W192026-05-06
- Europol IOCTA 2026 — Internet Organised Crime Threat Assessment2026-W192026-05-06
- DAEMON Tools Lite supply chain — QUIC RAT, EU governments targeted2026-W192026-05-09
- ChipSoft (Netherlands) healthcare software vendor — Embargo ransomware, 66 Dutch DPA notifications2026-W192026-05-07
- Vimeo data breach via Anodot third-party SaaS compromise — 119,200 accounts2026-W192026-05-07
- Europol shadow IT systems — decade of unregulated data processing outside EU oversight2026-W192026-05-07
- Mandiant M-Trends 2026 — Annual Threat Intelligence Report2026-W192026-05-07
- DragonForce — ransomware-as-a-service operator exploiting SimpleHelp RMM2026-W192026-05-07
- Embargo — ransomware group; responsible for ChipSoft Netherlands attack2026-W192026-05-07
- OceanLotus (APT32) — Vietnam-nexus APT; PyPI supply chain campaign2026-W192026-05-07
- CL-STA-1132 — likely state-sponsored exploitation cluster for CVE-2026-0300 (PAN-OS)2026-W192026-05-07
- Pro-Russian hacktivist OT intrusion at five Polish water treatment facilities — pump settings modified2026-W192026-05-092026-05-08
- Die Linke (Germany) — Qilin ransomware, 1.5 TB claimed, DPA notified (April 2026)2026-W192026-05-08
- Eurail breach (December 2025) — 308 777 travellers notified April 2026; Dutch DPA and EDPS reviewing delayed notification2026-W192026-05-08
- CERT-FR CERTFR-2026-ACT-016 — Agentic AI tool risks: prompt injection, MCP supply chain, sandboxing2026-W192026-05-08
- Dragos 2025 OT Cybersecurity Year in Review — Frontlines IR Edition2026-W192026-05-08
- Kaspersky Q1 2026 Exploits and Vulnerabilities Report2026-W192026-05-08
- Inditex (Zara) — ShinyHunters third-party analytics breach, 197,400 EU customers2026-W192026-05-09
- DENIC .de DNSSEC outage — HSM integration defect, 3.5 h disruption2026-W192026-05-09
- Groupe 3R (Réseau Radiologique Romand) — Akira ransomware, 48 GB claimed, Swiss medical imaging2026-W192026-05-10
- Braintrust AI evaluation platform — AWS account breach exposes customer org-level LLM provider keys2026-W192026-05-10
- JDownloader official site compromised — Windows/Linux installers swapped for Python RAT (~48 h window)2026-W192026-05-10
- PCPJack — modular cloud-credential-theft worm chaining 5 public CVEs; evicts TeamPCP2026-W192026-05-10
- Bauman University 'Department No. 4' — leaked GRU cyber-operator training pipeline (joint The Insider / Guardian / Le Monde / Spiegel investigation)2026-W192026-05-10
- Beagle backdoor distributed via fake Claude AI site (claude-pro[.]com) — DonutLoader + DLL sideloading on signed G DATA AV updater (Sophos STAC4713)2026-05-10
- ClickFix expands to macOS — Macsync / Shub Stealer / AMOS via Base64 Terminal-paste lures bypass Gatekeeper (Microsoft research)2026-05-10
- DENIC .de DNSSEC outage — technical post-mortem confirms three private keys with keytag 33834, only one DNSKEY published2026-W192026-05-10
- Akira — ransomware operator targeting EU healthcare and SME via edge-device CVE chains and intermittent-encryption EDR evasion2026-W19
- Qilin / Agenda — Rust-based ransomware-as-a-service; Q3 2025 German operational tempo tripled (GTIG); 23 Q1 2026 healthcare claims2026-W19
- Q1 2026 ransomware quarterly synthesis — Emsisoft / ReliaQuest / ZeroFox / Comparitech convergence2026-W19
- Google Threat Intelligence Group — Europe Data Leak Landscape 2025 (Germany dominant, 96% of victims <5,000 employees)2026-W192026-05-07
- LG Berlin II Apobank ruling — bank liable €218K phishing loss; PSD2 IP-analytics obligation clarified as case law2026-W192026-05-09
- EDPB Coordinated Enforcement Framework 2026 — 25 DPAs target GDPR Articles 12-14 transparency obligations2026-W19
- NCSC Switzerland BACS assessment on AI in vulnerability management — defenders warned against over-reliance on AI detection2026-W19
- Poland NIS2 transposition (UKSC amendment) in force 3 April 2026 — water-sector essential-entity status2026-W19
- MEPs demand Europol expansion pause after shadow-IT disclosure; EDPS sanctioning toolkit identified as binary2026-W19
- PamDOORa — malicious PAM module with credential harvesting and log scrubbing, sold on Rehub2026-05-09
- Amazon SES abuse for authenticated BEC/phishing (Kaspersky, 2026-05-04)2026-05-08
- QLNX (Quasar Linux) — developer-targeting Linux RAT with eBPF rootkit and PAM backdoor2026-05-07
- ZiChatBot — OceanLotus PyPI supply chain backdoor using Zulip API C22026-05-07
- Amatera — InstallFix campaign infostealer targeting browser credentials and e-wallets2026-05-07
- InstallFix — malvertising campaign distributing Amatera infostealer via fake AI tool install pages2026-05-07
- ScarCruft (APT37 / Reaper) — North Korea-aligned APT2026-05-06
- BirdCall — ScarCruft Android/Windows backdoor2026-05-06