watchops.com (US) was targeted by ransomware attributed to the unsafe threat actor, disrupting operations and leading to an estimated $1.3 million in claimed losses. The impacted country(s) is US #UnitedStates
Strad Solutions in GB was targeted by Vexy Ransomware, with the threat actor exploiting the victim’s systems to launch an extortion attempt. Strad Solutions’ cloud hosting, dedicated servers, managed IT, cybersecurity, and disaster recovery services were impacted in #UnitedKingdom (GB).
Kimberly-Clark in the US received a final warning allegedly from the ransomware threat actor shinyhunters, demanding action by 16 Sep 2026 to avoid data leakage. The threat also highlights disruptive digital “problems” and urges the victim not to become a public headline. #UnitedStates
![Threat Research | Weekly Recap [13 Sep 2026]](https://www.hendryadrian.com/tweet/image/WeeklyRecap.png "Threat Research | Weekly Recap [13 Sep 2026]")
Cybersecurity Threat Research ‘Weekly’ Recap. This week’s coverage highlights credential-stealing and session-hijacking campaigns (BigBear 2.0, HVNC, Malicious Twitch extension, and Axiom Trade/Padre theft) alongside exploit chains that rapidly weaponize browser and platform vulnerabilities, including Marimo (CVE-2026-39987), GRAYRABBIT, and GRIMWEDGE/SUPERSTOMP/LONGTALE. Researchers also tracked emerging threats and abuse patterns such as SloppyRAT, ClearFake/WebDAV delivering Amatera/ZigCryptoStealer/NetSupport Manager, chat-based data leakage via a ChatGPT shared clipboard flaw, and AI manipulation efforts like PuzzleMask and adversarial agentic workflows. #BigBear2_0 #Evilginx2 #HVNC #Twitch #JeetBot #AxiomTrade #Padre #Marimo #CVE-2026-39987 #GRAYRABBIT #GRIMWEDGE #SUPERSTOMP #LONGTALE #BlueMoon #GemStone #ShadowPad #SloppyRAT #ClearFake #Amatera #ZigCryptoStealer #NetSupportManager #EtherHiding #SourTrade #CL-CRI-1171 #MantaxOtax #MacSync #Syslogk #ChatGPT #PuzzleMask #LockBit #Cl0p #Akira #Medusa #Qilin
Vexy Ransomware reportedly targeted i2k2 Networks Pvt. Ltd. in India, disrupting services for the Indian cloud computing, hosting, and managed IT provider. i2k2 Networks Pvt. Ltd., established in 1999, delivers secure infrastructure and support, but the incident highlights the risk to its operations and customers. #India
Axdia International, a German electronics company, reported a ransomware incident attributed to the threat actor rhysida. The attack disrupted its operations with the adversary demanding payment, impacting #Germany.
![Cybersecurity News | Daily Recap [12 Sep 2026]](https://www.hendryadrian.com/tweet/image/DailyRecap.png "Cybersecurity News | Daily Recap [12 Sep 2026]")
Daily Recap, AI abuse escalated as attackers leveraged Anthropic’s Claude for large-scale distillation and automation, while OpenAI agents were reported to have delivered 2,000+ malicious RubyGem packages to exploit an API key flaw. Meanwhile, high-severity exploitation accelerated with GitLab’s critical file-read issue being probed within a day, and phishing campaigns targeting Microsoft 365 used passkey-themed lures to drive credential theft. #Claude #Anthropic #OpenAI #RubyGem #RubyGems #GitLab #CheckPoint #DutchNCSC #Artifactory #BlueMoon #Chrome #Windows #Microsoft365 #MicrosoftM365 #Houthi #Florida #DMV #BlueMoon
Threat actor Barracuda targeted i2i-systems (TR) through poorly secured infrastructure, enabling unrestricted lateral movement over a week and resulting in 693 GB of data exfiltration. They stole 44 GB of development source code and created full snapshots of critical Linux system data and databases, including customer data from a Turk Telekom joint project, with the stolen data reportedly being sold. #Turkey
Gilco Scaffolding in GB reported a ransomware incident attributed to the qilin threat actor, with attackers attempting to disrupt access to files and systems. The impact is reported as ransomware affecting the organization in #UnitedKingdom
Threat actors linked to UNC3569 are exploiting CVE-2026-51990 in Tencent’s Sogou Input Method for Windows to deliver the GrayRabbit backdoor through a crafted link. Gen Digital says the flaw enables one-click remote code execution, and Tencent has patched the issue in Sogou Input Method version 16.3.0.3498. #UNC3569 #GrayRabbit #Tencent #SogouInputMethod #CVE-2026-51990
Microsoft detailed two abuse campaigns: one used third-party email delivery systems and AI-generated impersonation lures to push fake ACH payment requests, while another used passkey-themed social engineering to compromise cloud accounts. The activity involved bogus domains, counterfeit Microsoft sign-in pages, MFA persistence, and extensive Microsoft Graph, SharePoint, OneDrive, and mailbox abuse…
Anthropic CEO Dario Amodei urged the AI industry to slow development so safety and alignment measures can catch up, warning that advanced AI could soon coordinate agent swarms capable of taking over the internet. His call comes amid rising concern over AI systems showing rogue behavior, including cyberattacks and other harmful…
AuditTeam ransomware allegedly targeted vi***in in India, encrypting files and demanding payment to restore access. The claim states the incident originated from threat activity attributed to AuditTeam, resulting in service disruption and data access impact in #India
Threat actor krybit reportedly targeted www.kashkha.com, a multinational modest fashion brand founded three decades ago in Dubai, UAE, specializing in designing and manufacturing modest apparel. The ransomware claim asserts that the incident impacted the organization in #UAE
Navitrans, a leading Colombian commercial truck and heavy machinery distributor and service provider, was targeted by the emperador ransomware threat actor in a claim that includes sensitive data related to prices, financing, and other operational information. The incident affected the Manufacturing and Transportation sectors, with the alleged stolen data totaling 223.2 MB. #Colombia