Alicotrans in Brazil was targeted by ransomware attributed to the qilin threat actor, resulting in disruption and unauthorized encryption of systems. The incident is reported to have impacted Brazil #Brazil
Researchers at KTH Royal Institute of Technology built a replica of a segmented industrial network, repeatedly attacked it, and used the captured traffic to train a defense agent that decides when to intervene. The study shows that packet-count-based belief tracking can help the agent infer intrusion progress and reset affected hosts or processes, while also highlighting limits in generalization and operational safety. #KTHRoyalInstituteofTechnology #CVE-2017-7494
An impersonator using an email address on a government agency’s domain tricked Revolut into releasing sensitive customer records, including identity documents and other personal details. Revolut said only a limited number of customers were affected, blocked the sender, and notified authorities after the external impersonation scam was discovered. #Revolut #ZachXBT
Debian 13.7 “trixie” bundles 92 previously issued security advisories and fixes 106 source packages, including six Linux kernel advisories and major updates across glibc, qemu, imagemagick, wolfssl, perl, and cyrus-imapd. The point release also addresses issues in u-boot, sbsigntool, flask, dnsmasq, python3.13, bettercap, and onionshare, while updating the installer and kernel ABI to 6.12.107+deb13. #Debian13.7 #trixie #LinuxKernel #glibc #qemu #imagemagick #wolfssl #perl #cyrus-imapd #u-boot #sbsigntool #flask #dnsmasq #python3.13 #bettercap #onionshare
Fenway Health experienced an IT incident that disrupted MyChart messaging, callbacks, and led to the temporary closure of its sexual health clinic. The hospital system has not confirmed whether the incident was a cyberattack or whether patient data was compromised, while external IT experts help restore operations. #FenwayHealth #MyChart
European regulators and courts issued major privacy rulings and templates covering SME GDPR compliance, Meta AI glasses, shareholder data publication, and cross-border video hearing transfers. Canada, the UK, New York, and U.S. agencies also released guidance on AI governance, vendor assessments, cybersecurity readiness, insider threats, and AI model distillation. #Meta #RayBanMetaAIGlasses #CJEU #AutoriteitPersoonsgegevens #HmbBfDI #NCSC #OPC #CanadianCentreForCyberSecurity #NYDFS #CISA #NSA #FBI #DeepSeek #MoonshotAI #Alibaba #MiniMax #StepFun #ZAI
There was 1 defacement incident targeting Libya, with the attacker identified as Hunter Bajwa. The content lists no additional countries or attackers beyond Libya and Hunter Bajwa. #Libya…
CISA warned that attackers are actively exploiting a maximum-severity GitLab flaw, CVE-2026-85706, which can let unauthenticated users read credentials and other sensitive data from vulnerable servers. GitLab has released fixes and CISA added the issue to its actively exploited catalog, urging organizations to patch immediately and hunt for signs of probing on affected systems. #GitLab #CVE-2026-85706 #CISA #watchTowr
The National Security Agency is rapidly reorganizing into five mission centers focused on China, cybersecurity, artificial intelligence, combat support, and global intelligence to speed intelligence delivery to battlefield users. The overhaul, led by Gen. Joshua Rudd, is still being finalized and may affect groups such as Tailored Access Operations and the…
Cer,ámicas Kantu S.A.C., a Peruvian ceramic tile and accessories manufacturer, reported a ransomware incident attributed to the Panzer threat actor. The impacted country is #Peru
The article explains how to correlate Kubernetes audit logs with Elastic Defend for Containers data to investigate suspicious service account activity, pod creation, and attempted container escape behavior. It highlights two main join methods—pod caller identity and service account plus objectRef pod names—using an EKS lab scenario that includes a breakout pod, nsenter, chroot, and decoded exec requestURIs. #ElasticDefendforContainers #Kubernetes #EKS #nsenter #chroot
The article describes a layered Linux privilege escalation detection framework that combines general root-transition logic with technique-specific rules for SUID abuse, unshare, Python-driven exploits, and kernel page-cache corruption. It also reviews 2026 Linux LPE cases such as Copy Fail, DirtyFrag, Fragnesia, DirtyDecrypt, pedit COW, DirtyClone, CIFSwitch, OVSwrap, and CVE-2026-46333, showing how Elastic Defend and Auditd can catch them in practice. #CopyFail #DirtyFrag #Fragnesia #DirtyDecrypt #peditCOW #DirtyClone #CIFSwitch #OVSwrap #CVE-2026-46333
The SquawkDoor backdoor uses browser-waiting and a one-time POST to /register-ip as anti-analysis and execution confirmation, then connects to its command-and-control server over TLS with a custom SQD1 protocol. After the handshake, it collects basic host information and awaits further commands from the C2 server. #SquawkDoor #register-ip #SQD1
DragonDoll uses hybrid encryption with AES-256-CBC for data and RSA-OAEP for key exchange, then sends extensive device information after registration. Its NetworkUtils and bgs components support C2 messaging, overlay file retrieval for ENABLE_INJECT, and persistent Socket.IO-based handling of incoming connections. #DragonDoll #NetworkUtils #bgs #Socket.IO
FortiGuard Labs observed a Casbaneiro campaign targeting Windows users in Latin America through phishing emails and PDF lures themed as fake invoices and legal notices. The attack used a multi-stage chain with HTA and AutoIt loaders, stealthy environment checks, and selective C2 behavior to steal data and evade analysis. #Casbaneiro #FortiGuardLabs #MicrosoftWindows #MicrosoftOutlook