The ransomware attack targeted zinorm.de in Germany, allegedly attributed to threat actor safepay. As a family-owned company founded in 1952 and headquartered in Ahrensburg, Schleswig-Holstein, the victim’s operations were impacted, leading to disruption in Germany #Germany
A proof-of-concept exploit for Certighost, tracked as CVE-2026-54121, shows how an authenticated attacker could abuse Active Directory Certificate Services to impersonate a domain controller and potentially compromise a Windows domain. Microsoft fixed the flaw in the July 2026 Patch Tuesday updates, while researchers H0j3n and Aniq Fakhrul released technical details and an exploit demonstrating domain-level compromise. #Certighost #CVE-2026-54121 #H0j3n #AniqFakhrul #ActiveDirectoryCertificateServices
Dysphoria is a fast-evolving botnet that has compromised about 200,000 devices worldwide and is being used for DDoS attacks and proxy relay operations. QiAnXin XLab found that it inherits traits from jackskid and fbot while adding blockchain-based C2 resolution through Ethereum ENS and Solana SNS, making it harder to trace and disrupt. #Dysphoria #QiAnXinXLab #EthereumENS #SolanaSNS #jackskid #fbot
Google Threat Intelligence Group has introduced a unified two-word naming system to replace overlapping hacker labels inherited from Mandiant and its internal Threat Analysis Group. The new taxonomy aims to make threat tracking more intuitive and will roll out across active groups, with mappings preserved for older names and cross-vendor references. #GoogleThreatIntelligenceGroup #Mandiant #CrowdStrike #Microsoft
The UK Supreme Court ruled that Bahrain cannot use state immunity to block a lawsuit brought by two dissidents who say their devices were infected with FinSpy spyware. The case alleges Bahraini officials used the spyware to monitor communications, access files, and remotely surveil Saeed Shehabi and Moosa Mohammed in the…
Dysphoria is an IoT botnet line that evolved after the March takedown of JackSkid infrastructure, using blockchain-based name services and infected-device relays to make disruption more difficult. Researchers from CNCERT, XLab, Nokia Deepfield, Comcast, and NICT linked its spread to weak Telnet/SSH credentials and IoT flaws, but said the reported bot…
NVIDIA and 36 other organizations have launched the Open Secure AI Alliance to build open technologies for securing software and AI agents, with NOOA as its first technical contribution. The effort comes amid growing interest in locally controlled defensive models, highlighted by the Hugging Face intrusion and the need for AI…
Zscaler ThreatLabz tracked a threat actor likely acting as an initial access broker for ransomware, using Microsoft Teams vishing, Quick Assist, and PowerShell to deploy the GoGRPC backdoor and related tools. The campaign evolved through four GoGRPC variants—Lep, Giver, Pet, and Kind—and additional tooling such as BlindDoor, RevSocket, PyGRPC, S3Siphon, and RSOX to support reconnaissance, proxying, and data theft. #GoGRPC #MicrosoftTeams #QuickAssist #BlindDoor #RevSocket #PyGRPC #S3Siphon #RSOX
MKS Transformator in TR was claimed to have been targeted by nightspire ransomware, impacting Accounting/Finance documents, Projects data, Purchasing/Procurement records, Quality/Document Control materials, and Maintenance documentation. The attackers also allegedly affected HR documents and Production/Manufacturing data, impacting TR#turkey
nightspire ransomware targeted Thai Seng International Co. Ltd in Thailand, encrypting administration documents and marketing data that included client information. The impacted country(s) is #Thailand
Akribis Systems Pte Ltd (SG) was targeted by the nightspire ransomware threat actor, involving the theft and encryption of Motor Design-related CAD files and sensitive employee and HR data. The incident also impacted Legal and Compliance information and machine details, affecting #Singapore
ShinyHunters has claimed responsibility for the Ernst & Young breach, alleging it used credentials obtained through a supply-chain attack to access EY systems and steal data. EY said a third-party support ticket platform was compromised, exposing documents that may contain client tax, personal, and financial information. #ShinyHunters #ErnstYoung #Jira #GitHub #Azure
Coca-Cola confirmed that hackers stole data from its Fairlife dairy subsidiary during a ransomware attack that disrupted production and affected some systems. The Anubis ransomware gang claimed responsibility, threatened to leak stolen files, and has now made the data available after its extortion deadline expired. #CocaCola #Fairlife #Anubis
Three plaintiffs allege they lost about $1.8 million in Bitcoin after downloading a fake Sparrow Wallet app from Apple’s App Store and entering their seed phrases. The lawsuit claims Apple failed to stop repeated scams impersonating Sparrow Wallet, even after earlier warnings, and asks the company to improve fraud detection and warn users about crypto app risks. #SparrowWallet #AppleAppStore #JamesRamirez #ChristopherEllis #JalenDelgado
Sen. Ron Wyden urged federal leaders to eliminate legacy internet-facing VPNs and replace them with modern remote-access technology and zero-trust architecture. He said agencies must stop relying on insecure VPN appliances that have been repeatedly targeted in incidents involving Cisco, Fortinet, Ivanti, and Check Point. #Cisco #Fortinet #Ivanti #CheckPoint #ArcaneDoor #FortiBleed