Oz Hair & Beauty (AU) reported a ransomware incident affecting its hair and beauty products after threat actor xpl0itrs deployed malicious encryption and extortion demands. The attack disrupted access to business systems and data, impacting operations in #Australia
Dynatrace, an AI observability platform based in AT, was reportedly targeted by ransomware associated with the threat actor xpl0itrs, impacting the organization’s systems and availability. The incident is claimed to have affected operations in Austria. #austria
![Cybersecurity News | Daily Recap [14 Aug 2026]](https://www.hendryadrian.com/tweet/image/DailyRecap.png "Cybersecurity News | Daily Recap [14 Aug 2026]")
Daily Recap, Attackers are actively exploiting an unpatched GeoServer zero-day, and they rapidly expanded pressure to SAP Commerce Cloud, VMware vCenter, Adobe Commerce, and WordPress 7.0.4 soon after disclosure. Microsoft also patched the LegacyHive Windows zero-day, while RingCentral reported a likely 1.6M-account impact and Apple issued new Threat Notification alerts tied to mercenary spyware operations. #GeoServer #LegacyHive #RingCentral #SAPCommerceCloud #VMwarevCenter #AdobeCommerce #WordPress704 #AmnesiaStealer #Mirai #Akira #DGFIP #BeaconCRM #Clop #Shell #BrightlySoftware #Apple #MercenarySpyware #Ukraine #SafeMode #EDR #MiraiVariant
Lepi Enterprises in the US is awaiting confirmation of a ransomware incident attributed to the threat actor securotrop. The impacted systems are reported at 692 GB, with the incident affecting #UnitedStates
SEARS (Grupo Sanborns, S.A. de C.V.) in Mexico has been claimed as a ransomware target by the spacebears threat actor, with “AttentionDemo” files expected to appear before a full-scale release. The incident impacts operations across Mexico. #Mexico
Evooo1Bot is a new Mirai-based modular Linux botnet that targets internet-facing gateway devices to turn them into SOCKS5 relay nodes while also enabling credential theft, SSH brute-forcing, and DDoS attacks. It has been observed exploiting multiple known vulnerabilities across devices from Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare, D-Link, and other platforms, with newer builds targeting Hikvision, Confluence, Zyxel, TP-Link, WSO2, Kubernetes ingress-nginx, and PHP-CGI systems. #Evooo1Bot #Mirai #Alcatel #NETGEAR #Tenda #MitsubishiElectric #Telesquare #DLink #Hikvision #AtlassianConfluence #Zyxel #TPLink #WSO2 #Kubernetes #ingress-nginx #PHP-CGI
Threat actor Barracuda targeted VR Advogados, a Brazilian law firm, claiming it neglected data storage and confidentiality, allegedly exposing clients’ documents, passport information, and powers of attorney by posting and sharing them on a Discord server. The actor states it has 3,000 client documents (about 10 GB) and threatens to sell the data due to lack of response, with the disclosure and alleged ransom demand affecting #Brazil.
The ransomware claim alleges that threat actor blackwater breached www.shalina.com in India and blocked systems as part of an extortion attempt. The incident impacted #India
The ransomware claim states that the threat actor blackwater breached www.amca.org.ar in AR and initiated data blocking as part of their attack. The compromised data and services have been impacted in #Argentina
There were 11 defacement incidents in total, targeting organizations and government sites in Brazil, Colombia, Guinea-Bissau, Indonesia, Malaysia, Mexico, and Tunisia. The attacks were carried out mostly by Trenggalek Cyber Army, with one incident attributed to CaptainSmok3r. #Brazil #Colombia #GuineaBissau #Indonesia #Malaysia #Mexico #Tunisia…
Researchers uncovered a custom Windows backdoor named RtkNGUI64.exe on a single Windows 7 workstation, where it hid its command-and-control address inside the number of spaces in a UTF-16LE `desktop.ini` file and persisted through a WMI subscription named “Realtek.” The implant called home to diagrtrack.com, impersonated Realtek software, and showed signs of a deliberately targeted operation rather than a broad campaign. #RtkNGUI64.exe #diagrtrack.com #Realtek #DiagTrack
BlueWhale targeted a Satellite Developer Server used by a software developer, deploying ransomware to disrupt operations and encrypt critical data. The impacted country(s) are: #undefined
BlueWhale ransomware actors compromised the FiferFox Minecraft Server, deploying ransomware to disrupt operations on this basic Minecraft Server. The incident impacted the unspecified country location(s). #UNKNOWN
The ransomware claim targets Alpine Electronics Europe (DE), a distributor of automotive electronics and audio products serving European markets, including automotive manufacturers and consumers. The threat actor Panzer is alleged to have compromised the organization’s systems, impacting Germany #Germany
A forum user known as exfilar claims to be selling a complete live extraction from FLY’s backend after Firebase rules were left absent, making Firestore and Cloud Storage readable and writable without authentication. The alleged dump includes rider resident registration numbers, plaintext passwords, customer delivery details, payment credentials, and other sensitive…