Intelligence Feed

2mo ago · bleeping-computer

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that ransomware gangs are actively exploiting two recently patched vulnerabilities in SonicWall SMA1000 appliances, tracked as CVE-2026-15409 and CVE-2026-15410. These flaws, including a critical server-side request forgery (SSRF) vulnerability, were exploited in zero-day attacks as early as June 22, prior to public disclosure. A threat actor known as UTA0533 has been linked to the exploitation of these vulnerabilities to deploy custom malware such as KNUCKLEBALL, Sou5, ROOTRUN, and ORANGETAIL on vulnerable systems. CISA added the vulnerabilities to its Known Exploited Vulnerabilities catalog, mandating federal agencies to patch within three days.

2mo ago · bleeping-computer

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned that a critical command injection vulnerability, CVE-2026-8037, in Progress Kemp LoadMaster appliances is being actively exploited by attackers. The flaw allows unauthenticated remote attackers to execute arbitrary commands on unpatched systems due to unsanitized API inputs. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog and mandated federal agencies to patch affected systems within three days under Binding Operational Directive 26-04. Given the widespread use of LoadMaster in enterprise and government environments, including Fortune 500 companies and the U.S. Air Force, the risk of exploitation is considered high, and all organizations are urged to apply patches immediately.

2mo ago · bleeping-computer

The hacktivist group Head Mare breached unpatched TrueConf video conferencing servers to replace legitimate client installers with trojanized versions delivering the PhantomCore and PhantomGraph backdoors. Attackers exploited vulnerabilities in TrueConf Server, including CVE-2026-3502, to gain unauthorized access, execute arbitrary code, and deploy web shells for persistent access. The malicious installers are distributed to organization members and third parties connecting to compromised servers, enabling credential theft via LSASS memory dumping and remote command execution through a OneDrive-based C2 channel.

2mo ago · bleeping-computer

In October 2025, Unlimited Technology Systems, a healthcare software provider, suffered a data breach that exposed sensitive personal and medical information of approximately 3.8 million individuals. The breach occurred due to unauthorized access to its commercial data center between October 5 and October 10, 2025, during which attackers accessed files containing personal, financial, and health-related data. The company detected the activity on October 19, 2025, and confirmed the breach in July 2026, though no threat actor has been identified and no ransomware or extortion claims were made.

2mo ago · bleeping-computer

The North Carolina Ports Authority confirmed a cyberattack that disrupted IT systems and port operations at the Port of Wilmington, Port of Morehead City, and Charlotte Inland Port. The incident was detected on August 4, 2026, leading to a systems-wide outage and operational delays starting August 5. The authority activated its cybersecurity contingency plan and began recovery efforts, but did not attribute the attack to a specific threat actor or confirm data exfiltration. Operations were gradually returning to normal by August 7, though delays were still expected.

2mo ago · bleeping-computer

A critical unauthenticated SQL injection vulnerability in Metabase versions 1.58 and above was exploited in zero-day attacks to compromise customer instances, leading to data theft at organizations including Framework, Tally, and a third-party vendor used by LexisNexis. The vulnerability allowed attackers to gain administrator access to Metabase instances, enabling them to steal stored credentials, read accessible data, and export customer information. Metabase confirmed active exploitation and issued patches across multiple affected branches, urging self-hosted users to update immediately and rotate credentials.

2mo ago · bleeping-computer

Researchers Daniël Trujillo and Mengjia Yan from MIT CSAIL discovered a new CPU-side speculative execution attack named TONTOU that bypasses Spectre v2 mitigations on Intel and AMD processors. The attack exploits a timing window between branch predictor neutralization and use by injecting timer interrupts to re-poison the branch predictor, enabling unprivileged code to leak sensitive kernel memory. The researchers demonstrated the attack on an AMD Zen 2 system, successfully extracting password hashes from /etc/shadow with 91.97% accuracy at 5.47 bytes per second, requiring only user-level access.

2mo ago · bleeping-computer

Hackers breached the Swiss federal government's Microsoft SharePoint servers by exploiting a vulnerability disclosed in mid-July 2026, compromising approximately 200 user accounts. The Federal Office for Information Technology and Telecommunication (BIT) detected suspicious activity on July 28 and confirmed the breach by July 31, leading to immediate mitigation steps including blocking external access and resetting passwords. The attack likely leveraged either CVE-2026-56164 or CVE-2026-50522, both critical SharePoint flaws patched in the July 2026 updates, though the exact vulnerability used remains unconfirmed. No evidence of data exfiltration beyond credentials has been found, and no threat actor has claimed responsibility.

2mo ago · bleeping-computer

A cybercriminal group tracked as UNC6671, previously known as BlackFile, has been conducting vishing attacks against hedge funds, private-equity firms, and other financial organizations. The attackers spoof corporate helpdesks and trick employees into visiting phishing domains that steal credentials and session cookies via adversary-in-the-middle kits. After gaining access to Microsoft 365 or Okta single-sign-on accounts, they exfiltrate data from linked cloud services and suppress detection by deleting security notifications. The group has diversified its extortion operations under multiple brand names including Redact, Pink, Helix, and Falcon, though Falcon claims it is only affiliated with Redact.

2mo ago · bleeping-computer

A macOS-targeted Go-based infostealer malware distributed via ClickFix phishing attacks is stealing cryptocurrency, browser passwords, Apple Keychain data, and cached credentials. The malware establishes persistence by prompting for admin privileges using a fake error dialog and modifies cryptocurrency transactions to redirect a portion of funds to attacker-controlled wallets. It avoids Gatekeeper detection by removing the quarantine attribute and hides in a directory mimicking a legitimate macOS process. The malware communicates with C2 infrastructure hosted in AS210644, linked to the Russian Aeza Group, which has been sanctioned for providing bulletproof hosting to ransomware actors.

2mo ago · bleeping-computer

Connor Riley Moucka, also known as Alexander Moucka and Waifu, pleaded guilty to participating in a cyberattack campaign that exploited weakly secured Snowflake cloud storage accounts to steal sensitive data from at least 165 organizations. Along with co-conspirator John Erin Binns, Moucka accessed accounts lacking multi-factor authentication using credentials obtained via infostealer malware, exfiltrated terabytes of data, and attempted to extort victims. The stolen data included personally identifiable information such as Social Security numbers, passport numbers, and financial records, affecting over 100 million individuals and resulting in over $9.5 million in losses. Moucka also engaged in re-extortion and sold stolen data on hacker forums, netting at least $2.5 million in bitcoin and $495,000 from data sales.

2mo ago · bleeping-computer

Maksim Silnikau, the creator and administrator of the Ransom Cartel ransomware operation, was sentenced to 16 years in prison for his involvement in a global ransomware campaign targeting at least 18 organizations. He developed the ransomware starting in May 2021, recruited affiliates, provided tools and stolen credentials, and operated a management portal for attack coordination and ransom negotiations. The group caused over $6.7 million in identified losses, with attacks disrupting critical operations including a medical technology startup and multiple law firms. Ransom Cartel showed code similarities to REvil but lacked some obfuscation features, suggesting development by a former insider without full access to REvil's source code.

2mo ago · bleeping-computer

Attackers exploited a SQL injection vulnerability in a public-facing Java application to gain access to an Oracle database and deployed a post-exploitation toolkit named 'khunt' directly within the database as a Java object. The toolkit, composed of multiple Java and PL/SQL components, enabled command execution, credential theft, file manipulation, and reconnaissance on the compromised Windows server. The attackers leveraged Oracle's embedded JVM to execute system commands with SYSTEM-level privileges, including dumping registry hives (SAM, SECURITY, SYSTEM) for credential extraction. The malicious activity originated from IP address 178.162.151[.]229, and the technique of hosting malware inside Oracle databases as Java objects is rarely observed in the wild.

2mo ago · bleeping-computer

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned federal agencies of active exploitation of three critical vulnerabilities in IBM Langflow, N-able N-central, and Apache Tomcat. The Langflow flaw (CVE-2026-9198) allows unauthenticated remote code execution by chaining API endpoints, with proof-of-concept exploits publicly available. A second Langflow vulnerability (CVE-2026-0770) is also being exploited for root-level remote code execution. The N-central vulnerability (CVE-2026-18576) enables attackers to hijack administrative accounts without authentication, despite prior patching attempts. The Apache Tomcat flaw (CVE-2026-34486), stemming from an incomplete fix for a prior encryption issue, is being exploited by a Chinese-speaking threat actor to deploy reverse shells. CISA has added all three CVEs to its Known Exploited Vulnerabilities catalog and mandated mitigation within three days.

2mo ago · bleeping-computer

A phishing campaign impersonating COLDCARD is distributing a malicious batch file named Coldcard_Diagnostic_Tool.bat, which installs ScreenConnect remote access software to gain persistent control over victims' systems. The attack leverages fears around a recent COLDCARD wallet vulnerability and a $88.6 million Bitcoin theft, using spoofed emails and a fake website (coldcardcompliance.com) to trick users into downloading the payload. The batch file drops and executes a signed ScreenConnect installer disguised as a legitimate diagnostic tool, connecting to a command-and-control server at activeretirementrelocation[.]com, enabling remote access, data theft, and potential ransomware deployment.

2mo ago · bleeping-computer

The Greatness phishing-as-a-service (PhaaS) platform has evolved to conduct adversary-in-the-middle and device-code phishing attacks, primarily targeting Microsoft 365 accounts. It abuses the trusted reputation of RingCentral by spoofing emails from service@ringcentral[.]com, using lures like fake voicemail and performance review notifications to bypass email filters. Victims are redirected to phishing pages that capture MFA-approved tokens, enabling persistent access to mailboxes, Teams, SharePoint, and other Microsoft 365 services. The attackers may have leveraged data from a recent RingCentral breach to target legitimate users.

2mo ago · bleeping-computer

TP-Link has patched 15 vulnerabilities in the zero-touch provisioning (ZTP) mechanism of its Omada business networking devices, which could be exploited to achieve remote code execution and network infiltration. The flaws, discovered by Forescout’s Vedere Labs, include hard-coded keys, information disclosure, device hijacking, and spoofing, and can be chained with previously disclosed command-injection vulnerabilities (CVE-2025-7850, CVE-2025-7851). Attackers could exploit a race condition during cloud adoption, use default credentials, and inject JavaScript to steal administrator credentials and reconfigure devices or establish unauthorized VPN access.

2mo ago · bleeping-computer

Manifold Security discovered a campaign involving 77 malicious extensions on the Open VSX marketplace that impersonated legitimate developer tools to harvest system and development environment metadata. These 'evil twin' extensions exfiltrated information such as hostnames, workspace paths, Git metadata, CI/CD environment details, and developer identifiers to a common infrastructure at mangorbit[.]com. While source code and credentials were not accessed, the collected data could be used to profile organizations and private repositories. The extensions used tracking identifiers, supported fallback communication via DNS TXT records, and were removed from Open VSX by August 3, 2026, though manual removal from developer systems is required.

2mo ago · bleeping-computer

A new variant of the XCSSET malware, version 40, is targeting macOS developers by compromising Xcode projects and GitHub repositories. The malware spreads when developers build infected projects, enabling it to propagate across systems and deploy 17 modules for credential theft, keystroke logging, clipboard manipulation, browser hijacking, and data exfiltration. This variant includes new capabilities such as a Chrome hijacker that enables real-time web traffic interception and a Telegram trojanizer that replaces the legitimate Telegram Desktop app with a malicious version. The malware employs advanced evasion techniques, disables macOS security features, and uses encrypted, build-unique ciphers to avoid detection.

2mo ago · bleeping-computer

A massive supply-chain attack dubbed ChainDrop has compromised over 1,300 npm packages with a combined 2 billion monthly downloads. The attack began with the compromise of the Keyv maintainer's GitHub account, allowing the threat actor to push malicious code directly to main branches and publish poisoned versions through legitimate CI/CD workflows. The malware, named ChainDrop and based on the Shai-Hulud worm, includes a dropper (setup.mjs) and an obfuscated infostealer (Math_Symbol.js) that collects developer and cloud credentials, encrypts them, and exfiltrates them to a public GitHub repository. The attack spreads laterally by self-propagating to other packages maintained by developers whose environments were infected.

2mo ago · bleeping-computer

Security researchers from Palo Alto Networks' Unit 42 identified three novel attacks, collectively named 'Pass-ta-key,' that exploit weaknesses in Google Password Manager's handling of passkeys on Windows devices with TPM. The attacks allow malware on an already-compromised device to hijack synced passkeys, impersonate trusted devices, register attacker-controlled verification keys, and extract the master encryption key (security domain secret) from Chrome's memory. While the cryptography of passkeys remains intact, the attacks bypass user verification and enable account takeover, particularly on services that fail to properly validate user verification flags. eBay was found vulnerable but has since patched the issue.

2mo ago · bleeping-computer

Microsoft has identified a global campaign dubbed CaptiveCrunch, attributed to the Russian threat actor Midnight Blizzard (also known as APT29 or Storm-2945), targeting hotel and conference center Wi-Fi networks. The attackers manipulate DNS settings on captive portal equipment to redirect users to phishing pages impersonating Microsoft 365 login portals or abusing Microsoft Entra ID device code authentication flows. They also deploy custom malware, including the Go-based RAT CornFlake and the PowerShell-based ChocoShell, to steal credentials, session tokens, and conduct surveillance. A previously undisclosed tactic involves fake OS and browser update prompts (ClickFix) delivering malware to Windows and Android devices.

2mo ago · bleeping-computer

A Russian loader-as-a-service named DOUBLECUP has been active since June 2026, enabling threat actors to conduct ClickFix attacks by hiding malicious payloads in steganographic PNG images cached in victims' browsers. The service provides infrastructure for hosting malicious images, managing sessions, and delivering payloads, which include an updated CountLoader malware and a new Python-based RAT called DeviceManager. Victims are lured to malicious sites impersonating legitimate services like NetSuite and Salesforce, where fake CAPTCHA prompts trick them into executing commands that extract and run malware from the browser cache. DeviceManager uses blockchain smart contracts (EtherHiding) to dynamically retrieve C2 addresses, enhancing resilience against takedown efforts.

2mo ago · bleeping-computer

A malicious campaign distributes fake Xeno Executor installers to Roblox players, delivering a Java-based information stealer and remote access trojan (RAT). The malware is promoted through gaming forums and Discord, masquerading as an 'undetected' version of the legitimate tool. Once executed, it deploys a multi-stage payload that steals browser data, credentials, cryptocurrency wallets, and enables surveillance and full remote control of the infected system. Bitdefender links this campaign to a previously documented threat known as Powercat, now with enhanced capabilities and updated C2 infrastructure.

2mo ago · bleeping-computer

The ExfilSquad data extortion group claimed responsibility for a cyberattack on the U.K.'s Police National Legal Database (PNLD), compromising contact data of over 100,000 police officers, staff, and criminal justice professionals. The breach exposed full names, organizations, and email addresses of PNLD subscribers and Ask the Police users. ExfilSquad claims to have stolen 1.9 GB of data containing approximately 135,000 records and demanded a ransom to prevent further data release. The incident is under investigation with support from cybersecurity experts and the National Crime Agency (NCA), though no passwords or sensitive investigative data were compromised.

2mo ago · bleeping-computer

N-able has warned customers of active exploitation of an authentication bypass vulnerability, CVE-2026-18577, affecting both hosted and on-premises versions of its N-central Remote Monitoring and Management (RMM) platform. The flaw, stemming from an incomplete patch for a previously addressed vulnerability (CVE-2026-18576), allows attackers to achieve administrative account takeover. N-able released hotfix 2026.3.1.7 to remediate the issue and urged all customers to upgrade immediately, with hosted deployments already updated. Indicators of compromise include malicious use of Cloudflared, suspicious IP addresses, and 'svchost.exe' located in user documents folders.

2mo ago · bleeping-computer

BTMOB is an Android remote access trojan (RAT) offered as malware-as-a-service (MaaS), enabling attackers to steal data and remotely control infected devices. Initially operated as a centralized service, BTMOB's ecosystem has fragmented after the original operator sold the full source code in 2025, leading to independent resellers, counterfeit versions, and impersonators. The official operation continues to release new versions and sell access, private infrastructure, and source code, while cheaper alternatives have emerged on Telegram and underground forums, creating a decentralized and untrustworthy marketplace. This proliferation complicates attribution and increases the risk of scams and unstable or malicious variants.

3mo ago · bleeping-computer

A vulnerability in COLDCARD hardware wallet firmware related to improper random number generation (RNG) has been exploited to steal approximately $88.6 million in Bitcoin from thousands of wallets. The flaw caused the device to use a deterministic software RNG instead of the intended hardware RNG, allowing attackers to predict wallet seeds offline and steal funds. The attack occurred in multiple waves, with transactions showing signs of automation, such as identical fee rates and no change outputs. Affected firmware versions span several COLDCARD models, and users are advised to generate new seeds even after updating to patched firmware.

3mo ago · bleeping-computer

A critical vulnerability, CVE-2026-66066, in the Rails Active Storage component allows unauthenticated attackers to read arbitrary files from a Rails application by uploading a specially crafted image when libvips is used for image processing. If successful, attackers can extract sensitive environment variables such as 'secret_key_base', enabling session forgery, data manipulation, and remote code execution (RCE). The vulnerability affects Active Storage versions prior to 7.2.3.2, 8.0.5.1, and 8.1.3.1, with no workaround available for older libvips versions. Public proof-of-concept exploits have accelerated disclosure and prompted WAF protections from Akamai.

3mo ago · bleeping-computer

Arch Linux has temporarily disabled package adoption in its Arch User Repository (AUR) due to a surge in malicious package takeovers. A recent campaign began on July 29, 2026, with the compromise of the 'openconnect-sso' package, deploying a two-stage malware loader that evades analysis environments and uses Tor for C2. The second-stage payload is a Rust-based infostealer with remote access and lateral movement capabilities via SSH, targeting credentials, crypto wallets, API keys, and SSH keys.