Find what you’re looking for
Browse everything
6,892 results in Threat Reports
Understanding the Bucket Hijacking Threat in Cloud Storage
In July 2026, a critical cloud storage attack technique known as 'bucket hijacking' was disclosed, enabling threat actors to silently redirect an organization's active cloud data streams, including audit logs and telemetry, into attacker-controlled external storage buckets across major cloud platforms. This vulnerability exploits the global uniqueness of cloud storage bucket names, allowing attackers to register a previously deleted bucket name and reroute data streams intended for the original bucket. The attack affects major cloud providers, including Google Cloud, Amazon Web Services (AWS), and Microsoft Azure, and detection is extremely challenging once deployed. ([serisec.com](https://serisec.com/index.php/2026/06/27/new-bucket-hijacking-attack-allows-hackers-to-reroute-cloud-data-streams-to-external-storage/?utm_source=openai)) This incident underscores the escalating risks associated with cloud misconfigurations and the critical need for organizations to implement robust monitoring and configuration management practices. As cloud environments become increasingly complex, the potential for such vulnerabilities to be exploited grows, emphasizing the importance of proactive security measures to safeguard sensitive data.
Dormant GitHub Accounts: A New Vector in Supply Chain Attacks
In July 2026, Datadog Security Labs identified multiple coordinated campaigns systematically enumerating corporate GitHub organizations, repositories, and user accounts via the GitHub API. Attackers utilized automated scraping tools with custom or legitimate-sounding user agents, leveraging dormant 'ghost' accounts—created two to five years prior and left inactive—as well as compromised OAuth tokens and personal access tokens (PATs) from legitimate users. While much of the activity targeted public data, some instances involved cloning private repositories, indicating a significant escalation in threat actor capabilities. This incident underscores the evolving tactics of threat actors who exploit dormant accounts and compromised credentials to conduct reconnaissance and access sensitive information. Organizations must enhance their monitoring of API activities and implement robust access controls to mitigate such risks.
npm 12 Enhances Security by Disabling Automatic Install Scripts
In July 2026, GitHub released npm version 12, implementing significant security enhancements by disabling install scripts by default. This change prevents automatic execution of preinstall, install, and postinstall scripts during package installation, addressing a major attack vector exploited in previous supply chain attacks. Additionally, npm v12 requires explicit approval for Git and remote URL dependencies, further strengthening the ecosystem's security posture. This update is particularly relevant as supply chain attacks have become increasingly prevalent, with attackers leveraging automatic script execution to compromise systems. By requiring explicit consent for script execution and external dependencies, npm v12 aims to mitigate these risks, promoting a more secure development environment.
GigaWiper: Unveiling a Multifaceted Cyber Threat
In July 2026, Microsoft uncovered a sophisticated Windows backdoor named GigaWiper, which integrates three destructive functionalities: a raw disk wiper that overwrites physical drives and partition tables, a fake ransomware module that encrypts files without saving the decryption key, and a Windows drive wiper that overwrites system drives multiple times. Additionally, GigaWiper possesses espionage capabilities, including screen recording, hidden VNC sessions, and system manipulation, all while masquerading as legitimate services like OneDrive. The malware utilizes legitimate business services such as RabbitMQ, Redis, and MinIO for command and control, making detection challenging. The emergence of GigaWiper underscores a concerning trend in cyber threats, where attackers combine destructive and espionage functionalities within a single malware package. This evolution highlights the necessity for organizations to implement robust detection mechanisms, maintain offline backups, and stay vigilant against sophisticated attack vectors that blend legitimate services with malicious intent.
AI-Powered Attack Compromises AWS Environment in Record Time
In July 2026, a lone threat actor utilized agentic AI workflows to orchestrate a sophisticated attack on a large Amazon Web Services (AWS) environment, achieving full compromise within 72 hours. The attacker exploited weaknesses across application services, AWS resources, source code repositories, CI/CD pipelines, runtime components, and data stores, leading to financial extortion of the victim. This incident underscores the evolving threat landscape where AI accelerates the speed and scale of cyberattacks, enabling even individual actors to execute complex operations rapidly. Organizations must adapt by enhancing their detection and response capabilities to counteract AI-assisted threats effectively.
GodDamn Ransomware: A New Era of BYOVD Attacks
In July 2026, the Hyadina ransomware group launched a sophisticated attack against U.S. organizations using their newly developed 'GodDamn' ransomware. The attackers employed a Bring Your Own Vulnerable Driver (BYOVD) technique, utilizing a malicious kernel driver signed by Microsoft to disable security software and facilitate the ransomware deployment. This method allowed them to infiltrate sectors including healthcare, manufacturing, and education, leading to significant operational disruptions and data encryption. This incident underscores the evolving tactics of ransomware groups, particularly the exploitation of trusted digital certificates to bypass security measures. The use of legitimate tools for malicious purposes highlights the need for enhanced behavioral detection mechanisms and adaptive security strategies to counteract such sophisticated threats.
AI Gateway Compromise Exposes Critical Security Vulnerabilities
In July 2026, a threat actor compromised an Amazon EC2 server hosting an AI gateway connected to Amazon Bedrock services. The attacker utilized this access to deploy cryptomining software, exploiting the gateway's privileged position to potentially access AI models, manipulate workflows, and infiltrate the organization's cloud infrastructure. This incident underscores the critical vulnerabilities associated with AI gateways, which often serve as central points of access to sensitive data and services. The increasing deployment of AI gateways in enterprise environments highlights the urgent need for robust security measures. As these gateways aggregate access to multiple AI models and datasets, they become attractive targets for attackers seeking to exploit centralized points of control. Organizations must implement stringent access controls, continuous monitoring, and regular security assessments to mitigate the risks posed by such vulnerabilities.
NotPetya Attack: Lessons in Cybersecurity from a Nation-State Operation
In June 2017, the NotPetya malware attack, orchestrated by the Russian military's GRU Unit 74455 (Sandworm), exploited a compromised update mechanism in M.E.Doc, a widely used Ukrainian tax accounting software developed by Intellect Service. This supply chain attack led to the rapid propagation of the malware, causing extensive disruptions to critical infrastructure in Ukraine and resulting in global damages exceeding $10 billion. Major multinational corporations, including Maersk, Merck, and FedEx, experienced significant operational and financial impacts due to the attack. The incident underscored the vulnerabilities inherent in software supply chains and the potential for nation-state cyber operations to inflict widespread collateral damage. ([cyberbreaches.org](https://www.cyberbreaches.org/en/incidents/notpetya-2017?utm_source=openai)) The NotPetya attack serves as a stark reminder of the evolving nature of cyber warfare, where nation-state actors target civilian infrastructure to achieve strategic objectives. The incident highlights the critical importance for organizations to implement robust cybersecurity measures, particularly in securing their supply chains, to mitigate the risks posed by sophisticated cyber threats.
Fake 7-Zip Installers Compromise Devices as Residential Proxy Nodes
In early 2026, cybersecurity researchers uncovered a campaign by the threat actor 'Lurking Lizard,' which distributed trojanized 7-Zip installers via the domain '7zip[.]com.' These malicious installers covertly transformed compromised devices into nodes within a residential proxy network, allowing attackers to route illicit traffic through unsuspecting users' IP addresses. The operation, dating back to at least August 2022, involved over 230 lookalike domains and impersonated major proxy providers to expand its reach. This incident highlights the growing trend of cybercriminals exploiting legitimate software and services to build extensive proxy networks, complicating detection and mitigation efforts. The use of residential proxies enables threat actors to mask their activities, posing significant challenges for cybersecurity defenses and emphasizing the need for heightened vigilance against such deceptive tactics. ([fbi.gov](https://www.fbi.gov/investigate/cyber/alerts/2026/evading-residential-proxy-networks-protecting-your-devices-from-becoming-a-tool-for-criminals?utm_source=openai))
Critical Vulnerability in Schneider Electric Easergy MiCOM Px40 Series: CVE-2026-4832
In April 2026, Schneider Electric disclosed a vulnerability (CVE-2026-4832) in its Easergy MiCOM Px40 Series protection relays. The flaw involves hard-coded credentials within the SNMP interface, allowing unauthenticated attackers to access sensitive device information. Affected models include Easergy MiCOM P14x, P24x, P341, and others, with versions prior to specific firmware updates being vulnerable. The vulnerability has a CVSS v4.0 score of 6.9, indicating a medium severity level. This incident underscores the critical importance of securing industrial control systems against unauthorized access. The use of hard-coded credentials is a known security risk, and organizations must prioritize updating firmware and implementing network protections to mitigate such vulnerabilities.
Microsoft Patches Critical RoguePlanet Vulnerability in Defender
In June 2026, security researcher Chaotic Eclipse disclosed a critical zero-day vulnerability in Microsoft Defender, known as 'RoguePlanet' and tracked as CVE-2026-50656. This flaw, a race condition in the Microsoft Malware Protection Engine, allowed attackers to escalate privileges to SYSTEM level on fully patched Windows 10 and 11 systems. Microsoft acknowledged the vulnerability and released a security update in July 2026 to address the issue. The RoguePlanet exploit underscores the persistent challenges in securing endpoint protection software and highlights the importance of timely vulnerability disclosures and patches. Organizations are reminded to maintain up-to-date security measures and monitor for emerging threats to safeguard their systems.
GodDamn Ransomware: Exploiting PoisonX Driver in Advanced Attacks
In May 2026, a new ransomware variant named GodDamn emerged, utilizing the PoisonX kernel driver to disable endpoint security defenses. This tactic, known as a Bring Your Own Vulnerable Driver (BYOVD) attack, allows the ransomware to neutralize security software by exploiting a signed but vulnerable driver. GodDamn is assessed to be a rebranded version of the Beast ransomware, which itself evolved from the Monster ransomware first detected in March 2022. The attackers employed tools like AnyDesk for remote access and a NirSoft-based credential harvester to extract sensitive information before deploying the ransomware payload. The use of signed drivers to disable security measures represents a significant evolution in ransomware tactics, highlighting the increasing sophistication of threat actors. Organizations must be vigilant against such advanced techniques, as they can render traditional security solutions ineffective, leading to severe operational disruptions and data loss.