Intelligence Feed

1w ago · bleeping-computer

Wesco confirmed a cybersecurity incident involving its cloud CRM environment after the data extortion group ExfilSquad claimed to have stolen and leaked 2.6 million records containing customer and employee PII, CRM data, and authentication metadata. The company stated it does not believe sensitive data is at risk and reported no ransomware or malicious software found in its systems. ExfilSquad, known for targeting improperly configured Microsoft Power Pages, published the data after Wesco did not meet a ransom deadline. Researchers link the group's past activity to misconfigured Microsoft Dynamics 365 instances.

1w ago · bleeping-computer

Cisco has warned of two high-severity vulnerabilities in ClamAV, tracked as CVE-2026-20337 and CVE-2026-20338, affecting versions 1.5.0 through 1.5.3. These flaws reside in the ZIP archive parser and stem from improper boundary checks and memory handling, allowing unauthenticated remote attackers to cause a denial-of-service (DoS) condition by submitting a specially crafted ZIP file that crashes the ClamAV scanning process. Proof-of-concept exploit code is publicly available, though there is no evidence of active exploitation in the wild. The vulnerabilities have a high security impact on Windows platforms due to the privileged context in which ClamAV runs, and they were patched in ClamAV version 1.5.4 released on August 7, 2026.

1w ago · bleeping-computer

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that ransomware gangs are actively exploiting a high-severity remote code execution vulnerability, CVE-2026-45659, in Microsoft SharePoint. The flaw stems from deserialization of untrusted data, allowing low-privileged attackers to execute arbitrary code on unpatched servers with low attack complexity. CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on July 1, mandating federal agencies to patch within three days, and warned that over 200 internet-exposed SharePoint servers remain unpatched despite available updates.

1w ago · bleeping-computer

US and South Korean agencies issued a joint advisory warning of Gunra ransomware attacks targeting government and critical infrastructure organizations. The ransomware, first observed in April 2025, is derived from the leaked Conti source code and uses double extortion tactics. Gunra actors exploit vulnerabilities in Fortinet devices (CVE-2024-55591, CVE-2025-24472) and misconfigured SSH access on internet-facing systems to gain initial access, and have expanded operations through a ransomware-as-a-service (RaaS) model under the alias 'Golden Community'. The group has also recruited initial access brokers, including penetration testers, and has extended attacks to Linux environments since mid-2025.

1w ago · bleeping-computer

In December 2025, a threat actor linked to the Russian Electrum group breached a small Polish combined heat-and-power (CHP) plant by exploiting a misconfigured private Access Point Name (APN) network. The attackers gained initial access through a compromised FortiGate firewall and Teltonika cellular router at a wind farm, then moved laterally through the private APN to reach the CHP plant's operational technology (OT) network. They exploited default credentials on a WAGO PFC200 PLC, used it as a bridge to access Siemens PLCs, and ultimately shut down critical systems including the steam turbine and water treatment system.

1w ago · bleeping-computer

A supply-chain attack on BdThemes, a developer of premium WordPress plugins, allowed a threat actor to compromise its infrastructure and inject malicious JavaScript into a remote JSON feed used by its plugins. This feed is loaded in the WordPress admin dashboard, where the attacker exploited a cross-site scripting (XSS) vulnerability in the Biggop Library to create rogue administrator accounts on affected sites. The attack was stealthy, required no user interaction, and used a webshell for persistence. The same actor is believed to be behind recent similar attacks on other WordPress plugins.

1w ago · bleeping-computer

Valve notified European Steam hardware customers of a data breach resulting from a cyberattack on its shipping partner, CEVA Logistics, between July 29 and August 1, 2026. Attackers accessed CEVA's systems and likely exfiltrated customer data including names, addresses, phone numbers, email addresses, and details of hardware orders. Valve confirmed that no Steam account credentials, payment information, or other sensitive account data were exposed. The company warned customers about potential phishing attempts leveraging the stolen personal information.

1w ago · bleeping-computer

A China-based threat actor tracked as Storm-1175, previously associated with the Medusa ransomware operation, has shifted to using a new ransomware variant called StormEncryptor. The actor exploits a vulnerability in the N-central RMM tool (CVE-2026-18577) to gain initial access, then uses tools like AnyDesk, SimpleHelp, Advanced IP Scanner, and Mimikatz for lateral movement and credential dumping. StormEncryptor is written in C++, encrypts files appending the '.encrypted' extension, and drops a ransom note titled '!!!README_FIRST!!!.txt', threatening data leakage if payment is not negotiated within three days.

1w ago · bleeping-computer

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that ransomware gangs are actively exploiting two recently patched vulnerabilities in SonicWall SMA1000 appliances, tracked as CVE-2026-15409 and CVE-2026-15410. These flaws, including a critical server-side request forgery (SSRF) vulnerability, were exploited in zero-day attacks as early as June 22, prior to public disclosure. A threat actor known as UTA0533 has been linked to the exploitation of these vulnerabilities to deploy custom malware such as KNUCKLEBALL, Sou5, ROOTRUN, and ORANGETAIL on vulnerable systems. CISA added the vulnerabilities to its Known Exploited Vulnerabilities catalog, mandating federal agencies to patch within three days.

1w ago · bleeping-computer

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned that a critical command injection vulnerability, CVE-2026-8037, in Progress Kemp LoadMaster appliances is being actively exploited by attackers. The flaw allows unauthenticated remote attackers to execute arbitrary commands on unpatched systems due to unsanitized API inputs. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog and mandated federal agencies to patch affected systems within three days under Binding Operational Directive 26-04. Given the widespread use of LoadMaster in enterprise and government environments, including Fortune 500 companies and the U.S. Air Force, the risk of exploitation is considered high, and all organizations are urged to apply patches immediately.

1w ago · bleeping-computer

The hacktivist group Head Mare breached unpatched TrueConf video conferencing servers to replace legitimate client installers with trojanized versions delivering the PhantomCore and PhantomGraph backdoors. Attackers exploited vulnerabilities in TrueConf Server, including CVE-2026-3502, to gain unauthorized access, execute arbitrary code, and deploy web shells for persistent access. The malicious installers are distributed to organization members and third parties connecting to compromised servers, enabling credential theft via LSASS memory dumping and remote command execution through a OneDrive-based C2 channel.

1w ago · bleeping-computer

In October 2025, Unlimited Technology Systems, a healthcare software provider, suffered a data breach that exposed sensitive personal and medical information of approximately 3.8 million individuals. The breach occurred due to unauthorized access to its commercial data center between October 5 and October 10, 2025, during which attackers accessed files containing personal, financial, and health-related data. The company detected the activity on October 19, 2025, and confirmed the breach in July 2026, though no threat actor has been identified and no ransomware or extortion claims were made.

1w ago · bleeping-computer

The North Carolina Ports Authority confirmed a cyberattack that disrupted IT systems and port operations at the Port of Wilmington, Port of Morehead City, and Charlotte Inland Port. The incident was detected on August 4, 2026, leading to a systems-wide outage and operational delays starting August 5. The authority activated its cybersecurity contingency plan and began recovery efforts, but did not attribute the attack to a specific threat actor or confirm data exfiltration. Operations were gradually returning to normal by August 7, though delays were still expected.

1w ago · bleeping-computer

A critical unauthenticated SQL injection vulnerability in Metabase versions 1.58 and above was exploited in zero-day attacks to compromise customer instances, leading to data theft at organizations including Framework, Tally, and a third-party vendor used by LexisNexis. The vulnerability allowed attackers to gain administrator access to Metabase instances, enabling them to steal stored credentials, read accessible data, and export customer information. Metabase confirmed active exploitation and issued patches across multiple affected branches, urging self-hosted users to update immediately and rotate credentials.

1w ago · bleeping-computer

Researchers Daniël Trujillo and Mengjia Yan from MIT CSAIL discovered a new CPU-side speculative execution attack named TONTOU that bypasses Spectre v2 mitigations on Intel and AMD processors. The attack exploits a timing window between branch predictor neutralization and use by injecting timer interrupts to re-poison the branch predictor, enabling unprivileged code to leak sensitive kernel memory. The researchers demonstrated the attack on an AMD Zen 2 system, successfully extracting password hashes from /etc/shadow with 91.97% accuracy at 5.47 bytes per second, requiring only user-level access.

1w ago · bleeping-computer

Hackers breached the Swiss federal government's Microsoft SharePoint servers by exploiting a vulnerability disclosed in mid-July 2026, compromising approximately 200 user accounts. The Federal Office for Information Technology and Telecommunication (BIT) detected suspicious activity on July 28 and confirmed the breach by July 31, leading to immediate mitigation steps including blocking external access and resetting passwords. The attack likely leveraged either CVE-2026-56164 or CVE-2026-50522, both critical SharePoint flaws patched in the July 2026 updates, though the exact vulnerability used remains unconfirmed. No evidence of data exfiltration beyond credentials has been found, and no threat actor has claimed responsibility.

1w ago · bleeping-computer

A cybercriminal group tracked as UNC6671, previously known as BlackFile, has been conducting vishing attacks against hedge funds, private-equity firms, and other financial organizations. The attackers spoof corporate helpdesks and trick employees into visiting phishing domains that steal credentials and session cookies via adversary-in-the-middle kits. After gaining access to Microsoft 365 or Okta single-sign-on accounts, they exfiltrate data from linked cloud services and suppress detection by deleting security notifications. The group has diversified its extortion operations under multiple brand names including Redact, Pink, Helix, and Falcon, though Falcon claims it is only affiliated with Redact.

1w ago · bleeping-computer

A macOS-targeted Go-based infostealer malware distributed via ClickFix phishing attacks is stealing cryptocurrency, browser passwords, Apple Keychain data, and cached credentials. The malware establishes persistence by prompting for admin privileges using a fake error dialog and modifies cryptocurrency transactions to redirect a portion of funds to attacker-controlled wallets. It avoids Gatekeeper detection by removing the quarantine attribute and hides in a directory mimicking a legitimate macOS process. The malware communicates with C2 infrastructure hosted in AS210644, linked to the Russian Aeza Group, which has been sanctioned for providing bulletproof hosting to ransomware actors.

1w ago · bleeping-computer

Connor Riley Moucka, also known as Alexander Moucka and Waifu, pleaded guilty to participating in a cyberattack campaign that exploited weakly secured Snowflake cloud storage accounts to steal sensitive data from at least 165 organizations. Along with co-conspirator John Erin Binns, Moucka accessed accounts lacking multi-factor authentication using credentials obtained via infostealer malware, exfiltrated terabytes of data, and attempted to extort victims. The stolen data included personally identifiable information such as Social Security numbers, passport numbers, and financial records, affecting over 100 million individuals and resulting in over $9.5 million in losses. Moucka also engaged in re-extortion and sold stolen data on hacker forums, netting at least $2.5 million in bitcoin and $495,000 from data sales.

1w ago · bleeping-computer

Maksim Silnikau, the creator and administrator of the Ransom Cartel ransomware operation, was sentenced to 16 years in prison for his involvement in a global ransomware campaign targeting at least 18 organizations. He developed the ransomware starting in May 2021, recruited affiliates, provided tools and stolen credentials, and operated a management portal for attack coordination and ransom negotiations. The group caused over $6.7 million in identified losses, with attacks disrupting critical operations including a medical technology startup and multiple law firms. Ransom Cartel showed code similarities to REvil but lacked some obfuscation features, suggesting development by a former insider without full access to REvil's source code.

1w ago · bleeping-computer

Attackers exploited a SQL injection vulnerability in a public-facing Java application to gain access to an Oracle database and deployed a post-exploitation toolkit named 'khunt' directly within the database as a Java object. The toolkit, composed of multiple Java and PL/SQL components, enabled command execution, credential theft, file manipulation, and reconnaissance on the compromised Windows server. The attackers leveraged Oracle's embedded JVM to execute system commands with SYSTEM-level privileges, including dumping registry hives (SAM, SECURITY, SYSTEM) for credential extraction. The malicious activity originated from IP address 178.162.151[.]229, and the technique of hosting malware inside Oracle databases as Java objects is rarely observed in the wild.

2w ago · bleeping-computer

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned federal agencies of active exploitation of three critical vulnerabilities in IBM Langflow, N-able N-central, and Apache Tomcat. The Langflow flaw (CVE-2026-9198) allows unauthenticated remote code execution by chaining API endpoints, with proof-of-concept exploits publicly available. A second Langflow vulnerability (CVE-2026-0770) is also being exploited for root-level remote code execution. The N-central vulnerability (CVE-2026-18576) enables attackers to hijack administrative accounts without authentication, despite prior patching attempts. The Apache Tomcat flaw (CVE-2026-34486), stemming from an incomplete fix for a prior encryption issue, is being exploited by a Chinese-speaking threat actor to deploy reverse shells. CISA has added all three CVEs to its Known Exploited Vulnerabilities catalog and mandated mitigation within three days.

2w ago · bleeping-computer

A phishing campaign impersonating COLDCARD is distributing a malicious batch file named Coldcard_Diagnostic_Tool.bat, which installs ScreenConnect remote access software to gain persistent control over victims' systems. The attack leverages fears around a recent COLDCARD wallet vulnerability and a $88.6 million Bitcoin theft, using spoofed emails and a fake website (coldcardcompliance.com) to trick users into downloading the payload. The batch file drops and executes a signed ScreenConnect installer disguised as a legitimate diagnostic tool, connecting to a command-and-control server at activeretirementrelocation[.]com, enabling remote access, data theft, and potential ransomware deployment.

2w ago · bleeping-computer

The Greatness phishing-as-a-service (PhaaS) platform has evolved to conduct adversary-in-the-middle and device-code phishing attacks, primarily targeting Microsoft 365 accounts. It abuses the trusted reputation of RingCentral by spoofing emails from service@ringcentral[.]com, using lures like fake voicemail and performance review notifications to bypass email filters. Victims are redirected to phishing pages that capture MFA-approved tokens, enabling persistent access to mailboxes, Teams, SharePoint, and other Microsoft 365 services. The attackers may have leveraged data from a recent RingCentral breach to target legitimate users.

2w ago · bleeping-computer

TP-Link has patched 15 vulnerabilities in the zero-touch provisioning (ZTP) mechanism of its Omada business networking devices, which could be exploited to achieve remote code execution and network infiltration. The flaws, discovered by Forescout’s Vedere Labs, include hard-coded keys, information disclosure, device hijacking, and spoofing, and can be chained with previously disclosed command-injection vulnerabilities (CVE-2025-7850, CVE-2025-7851). Attackers could exploit a race condition during cloud adoption, use default credentials, and inject JavaScript to steal administrator credentials and reconfigure devices or establish unauthorized VPN access.

2w ago · bleeping-computer

Manifold Security discovered a campaign involving 77 malicious extensions on the Open VSX marketplace that impersonated legitimate developer tools to harvest system and development environment metadata. These 'evil twin' extensions exfiltrated information such as hostnames, workspace paths, Git metadata, CI/CD environment details, and developer identifiers to a common infrastructure at mangorbit[.]com. While source code and credentials were not accessed, the collected data could be used to profile organizations and private repositories. The extensions used tracking identifiers, supported fallback communication via DNS TXT records, and were removed from Open VSX by August 3, 2026, though manual removal from developer systems is required.

2w ago · bleeping-computer

A new variant of the XCSSET malware, version 40, is targeting macOS developers by compromising Xcode projects and GitHub repositories. The malware spreads when developers build infected projects, enabling it to propagate across systems and deploy 17 modules for credential theft, keystroke logging, clipboard manipulation, browser hijacking, and data exfiltration. This variant includes new capabilities such as a Chrome hijacker that enables real-time web traffic interception and a Telegram trojanizer that replaces the legitimate Telegram Desktop app with a malicious version. The malware employs advanced evasion techniques, disables macOS security features, and uses encrypted, build-unique ciphers to avoid detection.

2w ago · bleeping-computer

A massive supply-chain attack dubbed ChainDrop has compromised over 1,300 npm packages with a combined 2 billion monthly downloads. The attack began with the compromise of the Keyv maintainer's GitHub account, allowing the threat actor to push malicious code directly to main branches and publish poisoned versions through legitimate CI/CD workflows. The malware, named ChainDrop and based on the Shai-Hulud worm, includes a dropper (setup.mjs) and an obfuscated infostealer (Math_Symbol.js) that collects developer and cloud credentials, encrypts them, and exfiltrates them to a public GitHub repository. The attack spreads laterally by self-propagating to other packages maintained by developers whose environments were infected.

2w ago · bleeping-computer

Security researchers from Palo Alto Networks' Unit 42 identified three novel attacks, collectively named 'Pass-ta-key,' that exploit weaknesses in Google Password Manager's handling of passkeys on Windows devices with TPM. The attacks allow malware on an already-compromised device to hijack synced passkeys, impersonate trusted devices, register attacker-controlled verification keys, and extract the master encryption key (security domain secret) from Chrome's memory. While the cryptography of passkeys remains intact, the attacks bypass user verification and enable account takeover, particularly on services that fail to properly validate user verification flags. eBay was found vulnerable but has since patched the issue.

2w ago · bleeping-computer

Microsoft has identified a global campaign dubbed CaptiveCrunch, attributed to the Russian threat actor Midnight Blizzard (also known as APT29 or Storm-2945), targeting hotel and conference center Wi-Fi networks. The attackers manipulate DNS settings on captive portal equipment to redirect users to phishing pages impersonating Microsoft 365 login portals or abusing Microsoft Entra ID device code authentication flows. They also deploy custom malware, including the Go-based RAT CornFlake and the PowerShell-based ChocoShell, to steal credentials, session tokens, and conduct surveillance. A previously undisclosed tactic involves fake OS and browser update prompts (ClickFix) delivering malware to Windows and Android devices.