JPCERT/CC warned that attackers are leaking personal data from Japanese organizations by abusing mobile app APIs, exploiting weak access controls, and taking advantage of known flaws such as CVE-2026-72898 in Metabase. The incidents have affected a wide range of public-facing and internal systems, including Park24, Monogatari Corporation, and other organizations that…
This week’s roundup shows attackers succeeding through a mix of greed, carelessness, and weak security, from exposed infrastructure and rogue ransomware affiliates to malicious developer packages and phishing lures. It also highlights deeper risks like vulnerable medical devices, predictable session cookies, and AI-targeted prompt injection hidden inside phishing messages. #Qilin #BraZetsu…
Hackers tied to Integrity Technology Group used scanners, password spraying, and multiple exploits to break into networks and steal email from government, healthcare, law enforcement, and religious organizations across Southeast Asia and beyond. The advisory says they also used tools like SoftEther, DCSync, and custom mail theft bots to maintain access…
KC Pharmaceuticals, Inc in the US was targeted by the nightspire ransomware threat actor, with malicious activity aimed at disrupting operations and encrypting victim systems. The impacted country(s): #UnitedStates
Valvorobica Industriale S.p.A (IT) was reportedly targeted by ransomware attributed to the threat actor nightspire, resulting in operational disruption and likely data and system impacts. As reliable, verifiable details are unavailable, the specific effects cannot be independently confirmed. #Italy
SilentRansomGroup ransomware activity impacted Baker McKenzie, a global law firm headquartered in Chicago, Illinois, United States. The incident affected Baker McKenzie’s operations within the United States. #UnitedStates
MCM Telecom in MX reported a ransomware incident attributed to the qilin threat actor. The attack impacted the organization in MX#MX
The ransomware claim targets dipecarr.com.br in Brazil, attributed to the Eclipse threat actor. The impact is reported in #Brazil.
OpenAI said it disrupted Russian and Iranian influence operations that used ChatGPT and other AI tools to create fake journalist personas, covert think tanks, and propaganda that reached mainstream media. The Russian campaign “Dark Clark” targeted Latin America with anti-Ukraine narratives, while the Iranian operation placed dozens of stories through legitimate outlets about the U.S.-Iran war. #OpenAI #DarkClark #SocialResearchCenter #Politology
Authorities accuse MonsterCloud owner Zohar Pinhasi of misleading ransomware victims with false claims of proprietary decryption tools while secretly paying ransoms on their behalf. Prosecutors say the scheme defrauded hundreds of clients of more than $19 million and turned their desperation into profit. #ZoharPinhasi #MonsterCloud #ProPublica #FBI #JusticeDepartment
The Justice Department and FBI seized hacking tools tied to Flax Typhoon and China-based Integrity Technology Group, aiming to cut off access to Microscan and FishHub. U.S. agencies said the group is using scanning tools, botnets, and spearphishing to target critical infrastructure and steal sensitive data worldwide. #FlaxTyphoon #IntegrityTechnologyGroup #Microscan #FishHub
Andersen Group Inc. (NYSE: ANDG) reported $217.7 million in revenue for Q2 2026 and $838.7 million in the referenced period, and was claimed by SilentRansomGroup as being affected by its ransomware activity. #undefined
Eclipse is alleged to have targeted sanjoseattorneys.com with ransomware, disrupting services for a legal organization in the United States. The impacted country(s): #UnitedStates
Eclipse ransomware allegedly targeted simplexengg.in, a victim in India, encrypting files and disrupting operations. The intrusion purportedly resulted in data access and recovery impacts across affected systems in #India
Threat actors began exploiting CVE-2026-21589 shortly after technical details and PoC code were published, putting Atlassian self-hosted Data Center products at risk. When Jira is integrated with Crowd, leaked plaintext credentials can let attackers create users and gain Jira administrator access. #CVE-2026-21589 #Atlassian #Bitbucket #Confluence #Jira #Crowd #WatchTowr #Previdian…