Threat Intel Feed | Hacking Activity

JetBrains warns of critical TeamCity remote code execution flaw

JetBrains has disclosed a critical authentication bypass vulnerability in TeamCity On-Premises, tracked as CVE-2026-63077, which allows unauthenticated attackers with HTTPS access to bypass authentication via the agent polling protocol and achieve remote code execution with server-level privileges. All on-premises versions of TeamCity are affected, while cloud customers are protected as mitigations are already applied. Successful exploitation could lead to exposure of sensitive data, credentials, build artifacts, and CI/CD pipeline compromise. Although no active exploitation was observed at the time of disclosure, the history of TeamCity targeting by ransomware and state-backed groups underscores the urgency of patching.

Analog Devices discloses data breach, says operations unaffected

4w ago · bleeping-computer

Analog Devices disclosed a data breach that occurred on June 23, 2026, when an unauthorized party gained access to certain company systems and exfiltrated files. The company activated incident response protocols and engaged external cybersecurity experts to assist with containment and investigation. While the specific data compromised remains unspecified, the company claims operations were unaffected and has not observed stolen data being leaked or misused. The breach may be linked to the data extortion group ExfilSquad, which briefly listed Analog Devices on its leak site before removing it, a common practice during ransom negotiations.

Microsoft Teams vishing attacks lead to Chaos ransomware attacks

4w ago · bleeping-computer

Threat actors are conducting vishing attacks via Microsoft Teams, impersonating IT support staff to trick employees into granting remote access to corporate devices. These intrusions are part of campaign STAC4749, tracked by Sophos, which led to the deployment of Chaos ransomware in at least three organizations. The attackers used fake IT-themed domains and spoofed identities to initiate contact, then deployed remote management tools like RemSupp and PowerShell-based backdoors to establish persistence and move laterally. The campaign targeted primarily North American organizations, with attacks spanning from February to June 2026, and demonstrated rapid progression from initial access to ransomware encryption—sometimes within 17 hours.

6 IoCs 1 Actors 1 Malware

ShinyHunters claims Brinks Home breach, threatens to leak stolen data

4w ago · bleeping-computer

ShinyHunters, a known extortion gang, claimed responsibility for a breach of Brinks Home on July 13, 2026, asserting they stole over 4.9 million Salesforce records containing personally identifiable information (PII) via a Microsoft Entra voice phishing (vishing) attack. The attackers reportedly exfiltrated more than 1.1 million customer data rows from the 'Contacts' Salesforce object, over 4,000 employee PII records, and 3.8 million customer support chat logs from a Brinks Care Cresta instance. Brinks Home confirmed the breach and an ongoing investigation, noting that alarm monitoring systems were unaffected, but warned customers of potential phishing and impersonation attacks stemming from the incident.

1 Actors

VMware fixes three critical flaws allowing auth bypass, VM escapes

4w ago · bleeping-computer

VMware, now under Broadcom, has released emergency security updates to address five vulnerabilities in vCenter, ESX, Workstation, and Fusion, including three critical flaws. CVE-2026-59309 and CVE-2026-59310 are critical authentication bypass and arbitrary code execution vulnerabilities in vCenter that can be exploited by unauthenticated attackers with network access. CVE-2026-47876 is a critical VM escape vulnerability in the VMXNET3 virtual network adapter, allowing a guest VM attacker with local admin privileges to execute code on the host. While there is no evidence of active exploitation, VMware servers are high-value targets for ransomware and advanced threat actors, and these flaws could enable broad lateral movement and persistence if left unpatched.

1 Malware

Amazon links Debug, Chalk NPM supply-chain attacks to North Korean hackers

4w ago · bleeping-computer

Amazon has linked multiple npm supply-chain attacks to the North Korean threat actor Sapphire Sleet (also known as BlueNoroff and Stardust Chollima) with medium confidence. The attacks began in March 2025 with the compromise of the typo-crypto package, followed by the trojanization of widely used packages debug and chalk in September 2025, impacting an estimated 10% of cloud environments within two hours. In March 2026, the axios library—used by over 100 million developers weekly—was targeted, with malicious updates distributed after attackers socially engineered maintainers to gain access. The campaign used sophisticated tactics including delayed execution in real environments, multi-stage payloads, and 'slopsquatting' of AI-hallucinated package names to expand reach.

4 IoCs 2 Actors

After the Break-In: What Attackers Do Once They're Already Inside

4w ago · bleeping-computer

Huntress investigated a real-world incident in June 2026 where an attacker gained initial access via a SQL injection vulnerability on a web server. After entry, the attacker conducted reconnaissance, created a backdoor user, enabled Remote Desktop, disabled Windows Defender, and deployed multiple payloads including the BadIIS malware and the XMRig cryptocurrency miner. The attacker used PowerShell scripts to maintain persistence and evade detection, highlighting the importance of not only removing malware but also identifying and patching the initial vulnerability to prevent reinfection.

1 IoCs 2 Malware

Russian hackers exploit Exchange OWA zero-day for long-term mailbox access

4w ago · bleeping-computer

Russian state-sponsored threat actor Laundry Bear (also known as Void Blizzard or TA488) is exploiting a zero-day cross-site scripting (XSS) vulnerability, CVE-2026-42897, in Microsoft Exchange Outlook Web Access (OWA) to deliver a sophisticated backdoor called OWAReaper. This 'half-click' exploit requires only that the user open a malicious email, which executes JavaScript due to improper HTML sanitization, enabling deployment of the payload without user interaction. OWAReaper establishes long-term persistence by abusing Outlook add-ins to steal OAuth tokens and granting Owner-level permissions to mail folders via the Default user, allowing continued access even after credential resets or system reimaging. The malware uses multiple command-and-control mechanisms, including GitHub commit messages and email parsing, and supports multiple data exfiltration methods, including encrypted HTTPS and DNS tunneling.

8 IoCs 1 Actors 1 CVEs

Cisco warns of FMC static credential flaw exploited in zero-day attacks

4w ago · bleeping-computer

Cisco has disclosed two critical vulnerabilities in its Secure Firewall Management Center (FMC) software that were actively exploited in zero-day attacks. The first, CVE-2026-20316, involves static credentials for a low-privilege account that allow unauthenticated remote attackers to gain unauthorized access. The second, CVE-2026-20079, is a critical authentication bypass flaw enabling unauthenticated attackers to execute commands as root via crafted HTTP requests. Both vulnerabilities have been patched with hot fixes, but no workarounds exist. Indicators of compromise include the presence of '/var/tmp/license.tmp' in system logs, and organizations are advised to rotate credentials and contact Cisco TAC if compromised.

1 IoCs

Health-ISAC warns of rising ShinyHunters data theft attacks on healthcare