Category: Cyber Security News

Gartner now forecasts global IT spending will reach $6.31 trillion in 2026, driven largely by rapid investment in AI infrastructure, data centers, and specialized hardware. Data center systems and high‑bandwidth memory are set to see the fastest growth while IT services and software remain the largest spending categories as organizations prioritize AI‑optimized compute. #Gartner #AIInfrastructure

A new study of 1,000 Android apps finds a large disconnect between runtime logging practices and what app privacy policies disclose, with most policies failing to mention sensitive data captured in logs. This mismatch — worsened by third‑party SDKs and absent review gates — creates substantive compliance risk under data protection laws #GDPR #CCPA

Kaja Ciglic of Microsoft says nation‑state cyber programs have evolved over the past three years from specialist capabilities into core instruments of state power, tightly integrated with military, economic, and diplomatic tools. She advocates for coordinated, cross‑domain responses—conditional economic pressure, state accountability for safe havens, and standing government–private coordination—alongside clearer NATO response pathways to deter persistent state‑backed cyber operations. #NorthKorea #SolarWinds #ColonialPipeline #Exchange #NATO #Microsoft

NCSC-UK and allied agencies warn that China-nexus threat actors are increasingly leveraging covert botnets made of compromised SOHO routers, IoT, and smart devices to conduct reconnaissance, deliver malware, and exfiltrate data against U.S. organizations. The advisory attributes many of these dynamic, shared networks to China-linked firms and notes groups such as Flax Typhoon and Volt Typhoon use them, complicating attribution and prompting recommendations for edge-device inventories, zero-trust, and active threat hunting. #FlaxTyphoon #VoltTyphoon

Researchers disclosed a Chinese APT called GopherWhisper that has been active since November 2023 and is targeting Mongolian government institutions, with ESET finding multiple backdoored systems. The group uses a variety of custom backdoors—LaxGopher, RatGopher, BoxOfFriends, CompactGopher, and SSLORDoor—that abuse mainstream cloud services for C2, indicating prolific but not highly sophisticated development. #GopherWhisper #Mongolia

Tropic Trooper, a China-linked APT, is changing its TTPs and expanding targets to individuals in Japan, Taiwan, and South Korea by using unconventional vectors like home Wi‑Fi DNS hijacks and trojanized software updates. Researchers uncovered new open-source and custom tools in its arsenal—including a watermarked Cobalt Strike beacon, loaders such as DaveShell and Donut, Go-based RATs Merlin and Apollo, and the C6DOOR backdoor—alongside exposed Amazon S3 data and tailored phishing decoys. #TropicTrooper #CobaltStrike

U.S. officials sanctioned Cambodian senator Kok An and 28 associates for running scam compounds that stole millions from American victims and enabled human trafficking and money laundering. The measures, coordinated with the DOJ’s Scam Center Strike Force, included asset seizures, indictments, domain takedowns, and reward offers to disrupt the transnational networks behind the schemes. #KokAn #ScamCenterStrikeForce

Old flaws, weak supply-chain controls, and simple but effective exploits keep enabling major breaches and stealthy persistence across ecosystems. This week’s incidents range from a $290M KelpDAO heist tied to TraderTraitor to widespread malicious npm packages deploying XWorm and minirat, active RCEs, AI prompt-injection attacks, and stealth execution techniques against trusted…

Bitwarden’s CLI npm package (@bitwarden/[email protected]) was briefly distributed with a malicious file (bw1.js) that used a preinstall hook to steal developer, CI, GitHub and cloud secrets and exfiltrate them to audit.checkmarx[.]cx and fallback GitHub repositories. The compromise is tied to the broader Checkmarx supply chain campaign—likely linked to TeamPCP and the…

Write 2 sentences summarizing the content. At the end, add hashtags for specific keywords mentioned in the article—such as names of malware, threat actors, or affected organizations/systems. Avoid general terms like #malware, #ransomware, or #cybersecurity. Use this format: #Keyword1 #Keyword2…

A critical RCE vulnerability in the Breeze Cache WordPress plugin (CVE-2026-3844) allows unauthenticated attackers to upload arbitrary files via the fetch_gravatar_from_remote function when the “Host Files Locally – Gravatars” add-on is enabled. Cloudways released version 2.4.5 to patch the flaw after Wordfence observed active exploitation attempts, and site owners should update immediately or disable the add-on to mitigate risk. #BreezeCache #CVE-2026-3844

ZionSiphon, a newly reported malware sample, was described as targeting Israeli water-treatment and desalination systems but experts say the sample is dysfunctional and unlikely to pose a real threat. Dragos and its lead analyst highlighted AI-generated errors, broken logic, and fictitious OT assumptions, warning that focusing on this hype could distract defenders from established threats like Volt Typhoon. #ZionSiphon #VoltTyphoon

U.S. and U.K. authorities disclosed that a state-sponsored group implanted a custom backdoor called Firestarter on Cisco network security devices that can survive firmware updates and standard reboots, enabling long-term persistence. The discovery, linked by Cisco Talos to threat actor UAT-4356 and related to earlier ArcaneDoor activity, prompted an emergency CISA directive requiring federal audits and memory snapshots of affected appliances. #Firestarter #UAT-4356

Vercel said ongoing analysis found the fallout from an attack on its internal systems affected more customers than previously known, with a “small number” of accounts impacted and investigations uncovering additional evidence of compromise. The incident originated at third‑party Context.ai, involved Lumma Stealer and the theft of API keys/tokens used to enumerate environment variables, creating potentially large downstream risk. #Vercel #LummaStealer

Researchers discovered a previously undocumented China-aligned threat actor, tracked as GopherWhisper, targeting a Mongolian government entity and using legitimate services such as Discord, Slack and Microsoft 365 Outlook to control compromised systems. The attackers deployed a Go-based backdoor called LaxGopher and a suite of tools — including RatGopher, SSLORDoor and CompactGopher — to maintain access and exfiltrate data to File.io, an operation consistent with espionage. #GopherWhisper #LaxGopher