Xu Zewei, a Chinese national accused of belonging to a state-backed hacking group, was extradited from Milan to the U.S. and is being held in Houston on charges tied to intrusions that allegedly stole COVID-19 vaccine research from a Texas university. U.S. prosecutors say he participated in the HAFNIUM (aka Silk Typhoon) and Microsoft Exchange server attacks at the direction of China’s Ministry of State Security and Shanghai State Security Bureau, and he faces up to 77 years in prison if convicted. #HAFNIUM #MicrosoftExchange
Category: Cyber Security News
Researchers say a China-linked influence campaign tied to the Spamouflage network pushed inauthentic social media accounts and AI-generated images to undermine elections for the Tibetan parliament-in-exile but attracted virtually no organic engagement. DFRLab found the operation used dozens of ordinary-looking Facebook and Instagram profiles to amplify attacks against leader Penpa Tsering and cast doubt on the vote, continuing a long-running pattern targeting Tibetan organizations. #Spamouflage #TibetanParliamentInExile #PenpaTsering #DFRLab
SentinelOne researchers uncovered fast16, a previously undocumented Lua-based malware framework from 2005 designed to corrupt high-precision scientific and engineering calculations. The tool predates Stuxnet, used a “cluster munition” wormlet delivery to spread, and targeted packages like LS-DYNA 970, PKPM, and MOHID, showing this sabotage vector remains relevant today. #fast16 #LSDYNA970
BlackFile is conducting ongoing voice‑phishing and social engineering campaigns by impersonating IT support to steal credentials and gain persistent access to corporate environments. The group targets multiple industries and leverages phishing pages, executive account compromise, and data‑leak sites to extort seven‑figure ransoms #BlackFile #CordialSpider
Google researchers analyzed indirect prompt injection attempts on public websites and found an increase in malicious injections over recent months, though most were low in sophistication. Their scan of Common Crawl snapshots using Gemini and human review revealed pranks, SEO and deterrent prompts as well as malicious exfiltration and destruction attempts,…
OpenSSH versions released over the past 15 years are vulnerable to CVE-2026-35414, which mishandles comma characters in certificate principals and can lead to full root access. The flaw bypasses log-based detection because the server treats the authentication as legitimate, and it was fixed in OpenSSH 10.3 — organizations should audit and…
Akamai found that an incomplete patch for Windows SmartScreen and Windows Shell prompts created a new vulnerability chain enabling zero-click attacks and remote code execution via malicious LNK and HTML files. The Russia-linked APT28 exploited the chain (CVE-2026-21513 and CVE-2026-21510), leading to an authentication coercion flaw tracked as CVE-2026-32202 that Microsoft…
Medtronic disclosed a breach of certain corporate IT systems after the extortion group ShinyHunters claimed to have stolen more than 9 million records and terabytes of internal data. The company says products, patient safety, and manufacturing were unaffected, and an investigation is underway to determine whether personal data was accessed, with notifications and support to be provided if exposure is confirmed. #Medtronic #ShinyHunters
Many cyberattacks begin with public or semi-public signals—credential requests, exploit chatter, or access listings—that are often overlooked before exploitation occurs. BleepingComputer, Flare Systems, and researcher Tammy Harper will host a webinar on Thursday, April 30 at 2:00 PM ET to show how to turn noisy dark web and Telegram signals into actionable threat intelligence. #FlareSystems #BleepingComputer #TammyHarper #Telegram #DarkWeb
The ShinyHunters extortion group breached ADT earlier this month and published an 11GB archive of stolen personal information, with Have I Been Pwned estimating 5.5 million affected. ADT said the April 20 intrusion exposed names, phone numbers, addresses and, in a small percentage of cases, dates of birth and last four digits of SSNs/Tax IDs, but no payment data or customer security systems were compromised. #ShinyHunters #ADT
Pack2TheRoot is a high-severity TOCTOU race condition in PackageKit (CVE-2026-41651) that allows unprivileged users to install arbitrary RPM packages with root privileges by corrupting transaction flags. The flaw, disclosed by Deutsche Telekom’s Red Team, affects many distributions shipping vulnerable PackageKit versions and was fixed in PackageKit 1.3.5 with patches rolled into…
Google Threat Intelligence Group identified UNC6692 conducting a campaign that bombarded targets with emails and posed as IT support over Microsoft Teams to lure users to a fake mailbox repair page. The page harvested credentials and silently delivered AutoHotKey binaries that installed the Snowbelt Chromium extension, which, together with Snowglaze and…
Itron detected unauthorized access to some of its systems on April 13 and has launched an investigation while stating that operations have continued in all material respects. The company says it remediated the activity with no subsequent unauthorized access observed, found no issues in customer-hosted systems, has not identified any ransom…
Traditional identity and access management was designed for human logins and fails in a world where AI agents and machine identities drive over 90% of authentications. Enterprises need an application-centric, runtime authorization model using short-lived, context-rich tokens and standards like OAuth 2.0, a gap Curity Access Intelligence aims to close. #CurityAccessIntelligence #OAuth2
Aptori expanded its Runtime-Driven Validation Platform with autonomous offensive testing that simulates real-world attacks at runtime to validate vulnerabilities and provide AI-driven remediation within development workflows. Early deployments report reduced remediation backlogs and faster fixes while supporting enterprise needs like on-premises and air-gapped deployments. #Aptori #AISecurityCenter