Category: Cyber Security News

DragonForce used a custom Go-based backdoor called Backdoor.Turn to hide command-and-control traffic inside Microsoft Teams TURN relay infrastructure, making its communications look like trusted Microsoft traffic. Researchers say the campaign used sophisticated tradecraft, including BYOVD techniques and multiple malicious drivers, before exfiltrating data and deploying DragonForce ransomware. #DragonForce #BackdoorTurn #MicrosoftTeams #ScatteredSpider

CISA has ordered U.S. federal agencies to patch an actively exploited LiteSpeed cPanel user-end plugin flaw within three days, after the vulnerability was added to the Known Exploited Vulnerabilities Catalog. The issue, tracked as CVE-2026-48172 and reported by Namecheap, can let attackers with FTP or web shell access escalate to root on shared hosting servers running CloudLinux/CageFS. #CVE-2026-48172 #CISA #LiteSpeed #Namecheap #CloudLinux #CageFS

California Water Service is investigating claims by the Iran-linked threat actor Handala, which says it stole 5 GB of data from the utility and could have disrupted water service but chose not to. Dataminr’s analysis indicates the leaked files may include personal information and data from a customer billing database and…

TrustCloud says manual questionnaires for assessing trust in production applications do not scale, so it is replacing them with continuous, AI-driven monitoring across enterprise data sources. Its Application Assurance platform also addresses data residency, trust in TrustCloud, and emerging risks from agentic applications. #TrustCloud #ApplicationAssurance #TejasRanade #agenticapplications…

FulcrumSec claims it hacked Novo Nordisk by abusing a GitHub access token, stealing about 1.3 terabytes of data that may include drug program IP, compound structures, and AI models. Novo Nordisk says the exposed clinical-trial data was pseudonymized, while the group says its $25 million extortion attempt failed and it may…

iRhythm Holdings disclosed a data breach after attackers stole patients’ personal and health information from third-party-hosted business applications and attempted extortion. The company said the intrusion was carried out through social engineering, affected no clinical or medical device systems, and was not yet attributed to a named threat group. #iRhythmHoldings #NovoNordisk

ESET found Windows variants of the SprySOCKS backdoor used in attacks against government organizations in Taiwan, Thailand, Pakistan, and Honduras, and attributed the activity to Earth Lusca. The malware adds kernel-level stealth, multiple persistence methods, and TCP traffic diversion, with possible links to a UEFI bootkit component tied to CVE-2023-24932. #SprySOCKS #EarthLusca #FishMonger #AquaticPanda #RedDev10 #TAG22 #CVE202324932 #BlackLotus

Attackers are actively exploiting multiple critical Fortinet FortiSandbox vulnerabilities, including CVE-2026-39813, CVE-2026-39808, and CVE-2026-25089, which can enable privilege escalation and remote code execution without user interaction. Fortinet has issued patches, while CISA and Defused warn that Fortinet flaws continue to be attractive targets for ransomware and espionage campaigns. #Fortinet #FortiSandbox #CVE-2026-39813 #CVE-2026-39808 #CVE-2026-25089 #CVE-2026-21643 #CVE-2026-26083 #CVE-2025-61624 #CISA #Defused

ScarCruft (APT37) is using spear-phishing emails that impersonate Microsoft Account security alerts to trick victims into opening a ZIP file that launches a malicious LNK and installs NarwhalRAT. The malware runs through a multi-stage, in-memory infection chain, collects sensitive data, and uses Korean websites plus pCloud as command-and-control channels. #ScarCruft #APT37…

Cisco warned that a new zero-day, CVE-2026-20262, is being exploited in limited attacks against Catalyst SD-WAN Manager. The flaw allows arbitrary file writes through crafted HTTP requests and could be used to elevate privileges, prompting CISA to add it to the KEV catalog. #Cisco #CatalystSDWANManager #CVE-2026-20262 #CISA #KEV…

Kaluga Astral said a cyberattack earlier this month disrupted several of its services for about a week, affecting customers that depend on its software for tax reporting, electronic document management, and other business functions. The company said no customer data appears to have been leaked, but Russian government agencies are involved…

The Council of Europe is investigating ShinyHunters’ claim that it stole more than 429,000 documents containing HR and payroll data from multiple departments. The alleged leak includes payslips, personnel files, CVs, and sensitive personal and financial information for thousands of staff members. #CouncilOfEurope #ShinyHunters

Maine shut down public access to its breach reporting portal after fake notices were posted in the names of VRChat and Discord, including one bogus claim that 2.4 million VRChat customers were breached. The state says it is reviewing its procedures to prevent abuse while keeping breach reporting available, but the…

The UK plans to ban under-16s from using major social media platforms, with stricter age checks and new limits on harmful features such as livestreaming and stranger communication. The policy, aimed at protecting children online, could take effect by spring 2027 and may also restrict AI romantic companion chatbots and intimate…

A China-linked espionage cluster tracked as UNC6508 hid inside North American medical, academic, and military research networks for more than a year by exploiting REDCap servers and the INFINITERED backdoor. Instead of using obvious exfiltration tools, the attackers abused Google Workspace content compliance rules to silently copy sensitive email to an…