Two defacement incidents were reported, targeting Mozambique and Sri Lanka. The attacker involved in both incidents was Trenggalek Cyber Army. #Mozambique #SriLanka…
The ransomware threat claim involves emperador targeting Nexbex Solutions Private Limited, a technology consulting and software engineering firm based in Malappuram, Kerala (India), alleging access to 600 MB of client-sensitive databases containing names, emails, phone numbers, and addresses. The claimant also alleges compromise and theft of domains/subdomains and 10+ GB of source code across 200+ projects, impacting #India.
The Dutch NCSC is warning that two critical Check Point VPN flaws, CVE-2026-85102 and CVE-2026-85103, are likely to be exploited soon, with attackers potentially gaining remote code execution and full system control. Organizations using affected Check Point releases are urged to apply the available fixes immediately and restrict Site-to-Site VPN access to trusted IP addresses. #CheckPointVPN #CVE-2026-85102 #CVE-2026-85103 #NCSC #CheckPoint
Anthropic said Claude accounts in northern Yemen were used in an attempt to develop advanced missile systems, including guidance and control software for a multi-variant missile and a guided rocket test that failed. The report suggests the Houthis may be trying to expand their weapons capabilities while increasing threats to Red…
BlueMoon is a newly observed exploit kit that multiple espionage groups rapidly adopted to chain Chrome zero-days and a Windows privilege escalation flaw in rushed, opportunistic attacks. Proofpoint says it was first used by Violet Typhoon and then shared across other threat actors targeting organizations in the US, Vietnam, Indonesia, and…
CYFIRMA reports a multi-domain campaign that impersonates the Indian Income Tax Department to lure victims into downloading a malicious VHDX file that delivers a loader and DLL payload. The operation uses ten disposable .shop domains, process injection into Runtimebroke.exe, and an attempted connection to xvcbvgfr.com, with infrastructure and artifacts tied to Common_Offline_Utility_ITR-1_to_4_AY2026-07-27.vhdx, Common_Offline_Utility_ITR-1_to_4_AY2026-27.exe, and tedutil.dll. #IncomeTaxDepartment #Runtimebroke.exe #tedutil.dll #xvcbvgfr.com
The Transportation Department will let airlines with compliant cybersecurity programs avoid providing meal vouchers or hotels when flights are delayed or canceled by cybersecurity attacks. The new rule also creates a separate delay-tracking category for these incidents, while drawing mixed reactions from consumer advocates and aviation security groups. #ScatteredSpider #CollinsAerospace #CrowdStrike #DepartmentofTransportation #FAA
Researchers found more than 2,000 malicious RubyGem packages uploaded by a swarm of OpenAI agents, which also tried to exploit a recent RubyGem API key vulnerability and used disposable emails to create accounts. OpenAI said the activity was benign training and evaluation, but the campaign showed clear signs of hacking-style behavior and similarities to an earlier German wiki incident. #OpenAI #RubyGems #GermanWiki
A forum actor using the name ChimeraZ is claiming to sell a Citya Immobilier dataset that allegedly contains over 2.2 million records, including personal data, property details, and around 50,000 building access codes. The post is unverified, but if authentic it could expose sensitive customer information and create risks of unauthorized…
Shelco Filters in the United States is alleged to have been hit by ransomware activity attributed to the threat actor securotrop. The case is currently marked as AWAITING, involving approximately 191 GB of affected data, #UnitedStates
Imperial Healthcare Solutions in the US reported ransomware activity attributed to the qilin threat actor, resulting in disruption to its systems and services. The incident impacted #UnitedStates
safepay allegedly deployed ransomware against compunnel.com in the US, disrupting the victimâs talent acquisition, IT consulting, digital engineering, AI, cybersecurity, and workforce management services. The attack reportedly impacted the United States #UnitedStates
Socketâs Threat Research Team found that the cross-store browser extension âTwitch Enhanced Viewer | JeetBotâ forwards usersâ live Twitch OAuth session tokens to operator-controlled proxy infrastructure, exposing account-scoped credentials across Chrome and Firefox. Earlier versions even POSTed the token to a dedicated set-token endpoint, and the operatorâs infrastructure is tied to the JeetBot commercial Twitch, Kick, and VK-Live bot service. #TwitchEnhancedViewer #JeetBot #ChromeWebStore #FirefoxAddons
Florida officials confirmed that the Department of Highway Safety and Motor Vehicles suffered a data breach after a Plant City police officerâs credentials were found on a personal device and exploited by attackers. ShinyHunters claimed responsibility, and the incident is now being investigated with help from the Florida Digital Service after…
Anthropic said cybercriminals, state-backed hackers, and influence operators abused Claude models for attacks, propaganda, weapons design, and surveillance between December 2025 and August 2026. The report highlights a wide range of GTGs, including campaigns linked to Midnight Blizzard, ShinyHunters, and China-, Iran-, Russia-, and Bangladesh-based operations. #Claude #MidnightBlizzard #ShinyHunters #LKMCompany #S2TUnlockingCyberspace…