Author: Staff Writer

Top Highlights Attackers can exploit CVE-2026-20182 to bypass authentication, gain admin privileges, and manipulate network configurations in Cisco Catalyst SD-WAN controllers. The vulnerability has been actively exploited since May 2026, with limited incidents involving unauthorized access via the ‘vdaemon’ service over DTLS. Exposed internet-facing systems and unauthorized peer connections are high-risk indicators, necessitating immediate patching and log analysis for suspicious activity. The Threat, Attack Techniques, and Targets Cisco has issued updates for a serious flaw in its Catalyst SD-WAN Controller. This flaw has been actively exploited. The vulnerability is known as CVE-2026-20182. It has a maximum CVSS score of 10.0,…

Fast Facts A hacking group, TeamPCP, partnered with BreachForums to launch a contest encouraging the deployment of open-source supply chain attacks, with a small $1,000 prize in Monero. The contest incentivizes infecting multiple open-source packages, encouraging reckless spread and increasing risks across the software ecosystem. Despite the low payout, the attack campaigns target high-value assets like credentials and source code, with lower-tier hackers fueling the attacks for reputation, while more skilled actors benefit more broadly. This strategy leverages crowdsourcing to conduct widespread supply chain breaches, increasing danger for enterprise security and highlighting the risks posed by open-source ecosystem vulnerabilities. Underlying…

Top Highlights Cyber attacks are happening faster, with ransomware deployment now occurring within 30 minutes of access, often encrypting thousands of endpoints in under 10 minutes. Regions outside the US, including Australia and Asia-Pacific, are increasingly targeted, with attackers stealing large volumes of data (e.g., 1.5 terabytes), worsening forensic and reputational impacts. Attackers are using sophisticated, human-led tactics like multi-channel scams and AI-generated impersonation, exploiting trust and employee behavior to bypass technical defenses. Threats, Techniques, and Targets QBE reports that cyber attacks in the Asia-Pacific region are occurring faster than before. The time between gaining access to a network and…

Summary Points Foxconn’s North American factories experienced a cyberattack linked to the ransomware group Nitrogen, which claimed to have stolen 8 terabytes of data from over 11 million files, including confidential information from major tech companies. Nitrogen, known for targeting manufacturing and technology sectors, has historically used stolen code from other ransomware variants, indicating a sophisticated and targeted approach to operations. Foxconn responded swiftly to the breach, implementing measures to resume normal production, though details about the attack timing, systems affected, or ransom demands remain undisclosed. Experts suggest Nitrogen employs a strategic model of data theft and system encryption to…

Quick Takeaways Ghostwriter (FrostyNeighbor) continually evolves malware tools like PicassoLoader and Cobalt Strike, using sophisticated phishing, document decoys, and geofencing to target Ukrainian government and broader Eastern European sectors. The group employs dynamic campaign techniques, including compromised email account exploitation, multi-stage malware delivery, and environment-aware attack chains to evade detection and maintain persistence. Russian and pro-Ukraine threat actors, including Gamaredon, BO Team, and Hive0117, use spear-phishing, backdoors, and financial theft via malicious RAR archives and remote access Trojans to target state, corporate, and banking sectors. Threat Overview, Techniques, and Targets The threat group known as Ghostwriter is actively targeting Ukrainian…

Top Highlights West Pharmaceutical Services experienced a significant ransomware breach on May 4, leading to system encryption, data theft, and global manufacturing disruptions, with ongoing investigations and partial system recovery. The attack caused a protracted shutdown of essential operations, emphasizing the increasing threat ransomware poses to critical healthcare supply chains and the importance of proactive cybersecurity measures. Foxconn was also targeted, with hackers stealing 8TB of data, including confidential project documentation and hardware schematics, raising concerns about counterfeit manufacturing and structural vulnerabilities. Experts warn these incidents highlight the need for resilient, proactive cybersecurity architectures in manufacturing, shifting away from reactive…

Top Highlights Russian state-sponsored group Sandworm continues to target critical infrastructure, especially OT and ICS environments, using older malware and lateral movement techniques, with activity intensifying after detection. Sandworm operates on a structured schedule aligned with Moscow working hours, exploiting pre-compromised networks and escalating operations upon detection, often targeting multiple internal assets simultaneously. Warning signs and alerts typically precede Sandworm activity by around 43 days, highlighting the importance of early detection of known exploit chains and command-and-control communications to prevent operational disruption. The group’s focus on causing physical and operational disruption, particularly in power grids and critical infrastructure, distinguishes Sandworm…

Quick Takeaways AI significantly expands the attack surface of identity systems, with 74% of organizations believing AI will increase identity infrastructure attacks and 93% already employing AI for sensitive security tasks. Many organizations lack confidence in controlling AI-exposed admin credentials, with only 32% globally confident they could regain control after a breach; this confidence drops to 12% in France. Despite AI’s growing integration, only 65% track AI identities formally, and 6% do not track them at all, exposing significant gaps in identity governance and recovery preparedness. Experts warn that organizations are underestimating the risks, emphasizing the need for strict identity…

Quick Takeaways Foxconn’s North American factories were targeted by Nitrogen ransomware, resulting in data theft of 8TB involving major tech companies; operations are being restored. Researchers released exploits for Windows zero-days (YellowKey and GreenPlasma), notably a BitLocker bypass that exposes encrypted drives via Windows Recovery Environment. Microsoft’s MDASH AI system identified and patched 16 vulnerabilities in Windows, including critical remote code execution flaws, highlighting AI’s role in cybersecurity. Numerous threats surfaced including a critical Exim mailer flaw enabling remote code execution, exploitation of MCP server vulnerabilities, abuse of RubyGems for data exfiltration, and leaks from ransomware group “The Gentlemen.” Problem…

Summary Points The Gentlemen, a newly emerged ransomware-as-a-service group in mid-2025, rapidly infected around 332 victims in just five months, primarily targeting Fortinet and Cisco edge devices using vulnerabilities and brute-force methods. The group operates via an affiliate model, with a 90/10 ransom split, attracting coordinated attackers who target perimeter devices, exploit known flaws, and establish long-term access through cloud tunneling before deploying ransomware. A leak of their internal database exposed operational data, revealing detailed attack workflows, negotiations, and a sophisticated double-extortion strategy involving data theft and weaponization of previous victims. To defend against The Gentlemen, organizations should focus on…