Category: Cyber Security News

A high-severity bug (CVE-2026-3502) in the TrueConf video conferencing tool is being actively exploited, prompting CISA to order federal agencies to patch within two weeks. Check Point links the campaign, called TrueChaos, to Chinese actors using Havoc and ShadowPad who pushed weaponized updates through compromised on-premises TrueConf servers. #TrueConf #CVE-2026-3502…

The FCC proposed a $4.5 million fine against voice provider Voxbeam for allegedly carrying suspicious call traffic from Czechia-based Axfone, which was not authorized to transmit calls over U.S. networks. The agency says the calls—tens of thousands sent March 31–April 3, 2025—were financial impersonation robocalls using dormant accounts and spoofing numbers…

Two critical-severity vulnerabilities in the ShareFile content collaboration platform can be chained to achieve unauthenticated remote code execution by abusing an Execution After Redirect flaw and an arbitrary file upload bug. Both issues (CVE-2026-2699 and CVE-2026-2701) were reported to ShareFile and fixed in version 5.12.4; ShareFile 6.x is not affected. #ShareFile…

This week’s roundup highlights a range of threats and disclosures, from new Android banking and rootkit campaigns to major data breaches, critical patches, and attacks on infrastructure. Notable items include the Mirax banking trojan for hire, the Operation NoVoice rootkit in Google Play, Intesa Sanpaolo’s €31.8M fine, a patched ChatGPT code-execution…

A Chinese threat actor exploited a zero-day in TrueConf’s update mechanism (CVE-2026-3502) to distribute a malicious update from a compromised on-premises server in attacks against government entities in Asia. The trojanized installer used DLL sideloading to deploy an implant for reconnaissance, persistence and C2 communications, and TrueConf released version 8.5.3 while…

The Qilin ransomware group has stolen data from the German political party Die Linke and is threatening to publish the stolen information. Die Linke confirmed a cyber incident after the compromise, reported no impact to its membership database, filed a police complaint, and noted Qilin added the party to its leak site on April 1st. #Qilin #DieLinke

Telehealth provider Hims & Hers disclosed that support tickets were stolen from a third‑party customer service platform after suspicious activity was detected between February 4–7, 2026, potentially exposing names and contact information but not medical records. BleepingComputer reports the breach was carried out by the ShinyHunters extortion gang using compromised Okta SSO access to reach the company’s Zendesk instance, and Hims & Hers is offering 12 months of free credit monitoring to impacted customers. #HimsAndHers #ShinyHunters

CERT-EU attributes the March breach of the European Commission’s Amazon cloud environment to the TeamPCP threat group, which used a compromised AWS API key stolen in the Trivy supply-chain attack to access and exfiltrate data. ShinyHunters published a 90GB archive of stolen files containing names, email addresses, and email content that potentially affects 42 Commission clients and at least 29 other Union entities. #TeamPCP #ShinyHunters

A former core infrastructure engineer, 57-year-old Daniel Rhyne, pleaded guilty to remotely accessing his employer’s network and locking Windows administrators out of 254 servers as part of an extortion attempt. He allegedly reset hundreds of account passwords to “TheFr0zenCrew!”, deleted domain admin accounts, threatened daily server shutdowns unless paid 20 bitcoin, and investigators found evidence of a hidden VM and web searches used to plan the attack. #DanielRhyne #WindowsDomainController

Ransomware incidents in 2025–2026 caused major operational disruptions across healthcare, finance, and manufacturing—most notably taking the University of Mississippi Medical Center’s Epic EHR offline and crippling BridgePay’s payment network. The shift to double- and multi-extortion tactics, the emergence of dozens of new ransomware groups, and AI-enabled tools have made data-neutralizing encryption and process-based access controls like D.AMO critical for blocking attacks and enabling rapid recovery. #UMMC #BridgePay

Microsoft is investigating intermittent Exchange Online mailbox access issues that have affected Outlook mobile and the new Outlook for Mac for weeks. The problem was linked to a newly introduced virtual account, Microsoft has restarted the Notification Broker service as a mitigation, and the incident was reclassified from EX1256020 to EX1268771 as the root cause remains under investigation. #ExchangeOnline #OutlookMobile #OutlookForMac #NotificationBroker #EX1256020 #EX1268771

T-Mobile says a recent breach notification was caused by an isolated insider incident that impacted a single account and did not involve compromised credentials. Exposed data included full name, contact information, account number, account PIN (which was reset), date of birth, driver’s license number, and SSN, and T-Mobile has notified law…

This week’s Cyber Express roundup summarizes a wave of high-impact incidents—from the Hasbro operational disruption and the Mercor/LiteLLM supply-chain compromise linked to TeamPCP and Lapsus$, to Lazarus Group’s Axios library attack, the FBI director’s email leak, and the CareCloud health-records breach. The report emphasizes that organizations must strengthen supply-chain oversight, enforce…

Drift Protocol lost at least $280 million after a threat actor seized Security Council administrative powers in a planned, timed operation. Blockchain intelligence firms Elliptic and TRM Labs linked the attack to North Korean (DPRK) tradecraft based on Tornado Cash usage, CarbonVote timing, cross-chain bridging patterns, and rapid laundering. #DriftProtocol #DPRK