Author: Staff Writer

Summary Points Exploitation of CVE-2025-67038 in Lantronix EDS5000 Series devices allows attackers to inject arbitrary OS commands with root privileges through unsanitized user input, risking complete device compromise. Active exploitation of CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910 in Ubiquiti UniFi OS enables remote command injection, file access, and unauthorized system modifications, potentially leading to full system control. Success in exploiting these vulnerabilities can facilitate lateral movement within networks, resulting in widespread network compromise, data access, and disruption of critical services. Threat, Attack Techniques, and Targets CISA issued a warning about a critical security flaw in Lantronix EDS5000 Series devices. The flaw is…

Quick Takeaways Europol-led Operation Endgame successfully dismantled key infrastructure of StealC, Amadey, and SocGholish malware, targeting their global cybercrime supply chain. The operation resulted in the takedown of 326 servers and 142 domains, freezing €41 million in crypto assets, and recovering 27 million stolen credentials. Key malware, including StealC (credential-stealer) and SocGholish (linked to Evil Corp), were neutralized, disrupting large-scale credential theft and ransomware deployment efforts. Over two weeks, coordinated international law enforcement efforts involved multiple countries and private partners, marking the largest operation against ransomware enablers to date. The Core Issue Law enforcement agencies from multiple countries, including the…

Essential Insights GHOST STADIUM is running a highly sophisticated phishing campaign with over 300 domains, including pixel-perfect clones of the FIFA website, aiming to steal login credentials and financial information. The campaign’s domains are often typosquatting or maliciously registered shortly before deployment, suggesting targeted infrastructure for credential theft and fraud. Potential financial losses from premium ticket fraud alone could reach up to $474 million, highlighting the severe threat to event organizers and attendees. Threat Overview, Techniques, and Targets The GHOST STADIUM group is a Chinese-speaking, financially motivated threat actor. They are using a complex phishing campaign targeting FIFA 2026 fans…

Summary Points Europol and partners disrupted the command-and-control infrastructure of Amadey loader/botnet and StealC info stealer, both of which operate as modular Malware-as-a-Service targeting Windows machines globally. Amadey uses plain HTTP communication with hardcoded C2 servers and obfuscated configs, while StealC employs a sophisticated, encrypted JSON-over-HTTP protocol, both stealing credentials, wallets, and sensitive data across numerous browsers and applications. The operations’ disruption leveraged detailed threat intelligence—including C2 mapping, IoCs, and infection telemetry—highlighting the importance of public-private collaboration in dismantling cross-border cybercrime networks. Threat, Techniques, and Targets On June 24, 2026, Europol and the Microsoft Digital Crimes Unit led a coordinated…

Essential Insights Microsoft and law enforcement collaborated to simultaneously takedown two interconnected cybercrime tools, Amadey and StealC, disrupting over 140,000 infected devices globally. The operation targeted over 200 command-and-control servers using the RICO Act, treating both tools as part of a single criminal conspiracy, aided by AI insights from Microsoft’s Copilot. Amadey, a malware loader dating back to 2018, is used primarily by Russian threat groups, while StealC, an infostealer sold as malware-as-a-service, is linked to Russia and often used in organized cyber attacks. The coordinated disruption highlights the importance of attacking multiple components of cybercrime operations simultaneously to reduce…

Essential Insights Operation Endgame successfully disrupted the StealC infostealer ecosystem, seizing over 25 million credentials and disabling key infrastructure. StealC exploited vulnerabilities in its PHP-based C2 panel, enabling data exfiltration through encrypted HTTP requests and directory traversal bugs. The malware leveraged secondary payloads like ransomware and RATs, often delivered through complex multi-stage loaders, amplifying threat scope and damage. Threat, Attack Techniques, and Targets The threat involves the StealC malware, a popular information stealer sold as a service since January 2023. It targets individuals and organizations that store sensitive data on their devices. The malware is Linux-based and uses a command…

Fast Facts Unpatched on-premises SharePoint servers are prime targets for sophisticated threat actors like Storm-2603, exploiting known vulnerabilities (CVE-2025-49706, CVE-2025-49704, CVE-2025-11371) to gain initial access and probe systems. Attackers establish long-term persistent access by deploying tools like Velociraptor, creating backdoors, elevating privileges, and using vulnerable drivers (e.g., NSecKrnl.sys) to disable security defenses. Multiple threat actors can operate simultaneously within the same environment, masking each other and creating complex attack chains that are difficult for defenders to unravel without correlated, multidisciplinary data analysis. Organizations must urgently patch vulnerable systems, enforce strict identity controls, monitor for suspicious activity, and develop robust incident…

Essential Insights A critical Cisco Unified CM vulnerability (CVE-2026-20230) is actively exploited, allowing remote, unauthenticated attackers to conduct SSRF and escalate privileges to root; patches were issued on June 3. The exploit involves improper input validation, enabling attackers to send crafted HTTP requests that could lead to malicious file writes and system compromise. Exploitation was first observed by Defused over the weekend, using an unvetted PoC, with no prior reported exploitation or indication of widespread breach. Patches are available in software updates (14SU6 for Cisco Unified CM 14, 15SU5 for Cisco Unified CM 15), and disabling the WebDialer service is…

Fast Facts The threat actor exploited a zero-day vulnerability (CVE-2026-20245) in Cisco SD-WAN to escalate privileges from a compromised account to root-level access, using malicious CSV uploads. Unauthorized peering connections enabled initial access, with attackers manipulating default credentials and using stolen certificates to establish persistent control over SD-WAN infrastructure. The attacker employed anti-forensic techniques to delete and restore configuration files, making detection difficult while exfiltrating sensitive network data via compromised accounts. Threat, Attack Techniques, and Targets In early 2026, a threat actor targeted SD-WAN infrastructure at a service provider. They gained initial access through unauthorized peering connections. These connections likely…

Summary Points Privileged access is central to most cyberattacks, with attackers exploiting privileged credentials to escalate their privileges, move laterally through networks, and achieve domain dominance, often over a prolonged dwell time. Modern threats now involve non-human identities such as service accounts, API keys, and AI agents, which vastly outnumber human users, frequently carry privileged access, and are poorly secured, creating numerous attack vectors. Traditional PAM approaches focusing solely on password vaults are insufficient; effective protections require capabilities such as credential management, just-in-time access, session monitoring, and comprehensive visibility across all identity types and workloads. Implementing a complete PAM program—covering…