Find what you’re looking for
Browse everything
6,844 results in Threat Reports
State Surveillance Exploits WhatsApp and Signal Device Linking Features
German law enforcement has been exploiting device linking features in encrypted messaging apps WhatsApp and Signal to conduct surveillance operations. The technique involves connecting a police-controlled computer to a suspect's messaging account through either physical access to their device or intercepting verification codes via state-sanctioned phishing attacks and SMS interception. Once connected, all messages are delivered to the law enforcement device without breaking encryption, effectively bypassing the security protections these apps provide. This surveillance method has raised significant concerns about digital privacy and the potential for abuse of legitimate messaging features by state actors. This incident highlights the growing sophistication of state-sponsored surveillance techniques that exploit legitimate application features rather than traditional cryptographic attacks. As governments worldwide expand digital surveillance capabilities and encrypted communications become more prevalent, understanding these attack vectors is crucial for both individual privacy protection and organizational security planning.
Citrix NetScaler Zero-Day Crisis: When Vendor Silence Puts Organizations at Risk
In September 2024, Citrix NetScaler appliances became targets of active zero-day exploitation involving CVE-2026-88771 and CVE-2026-88772, both rated 9.5 on the CVSS scale. Attackers exploited a command injection vulnerability affecting all NetScaler devices in default configurations, achieving remote code execution. The incident was particularly notable for Citrix's delayed disclosure, leaving customers without official warnings for over 36 hours while exploitation was actively occurring. Security professionals, insurance providers, and researchers issued unofficial warnings through back channels before Citrix finally published patches and advisories. With over 50,000 publicly exposed NetScaler instances potentially vulnerable, the incident highlighted critical gaps in vendor communication during active exploitation scenarios. This incident underscores the growing trend of attackers targeting network infrastructure appliances as initial access vectors, particularly in an era where traditional perimeter security models are increasingly inadequate. The delayed vendor response demonstrates the urgent need for organizations to implement zero-trust architectures and real-time threat detection capabilities rather than relying solely on vendor patches and advisories.
Kiteworks Sets New Standard with Proactive System Shutdown Following Federal Threat Intelligence
In December 2024, Kiteworks, a secure file transfer provider, issued an unprecedented advisory telling customers to take production systems offline following credible threat intelligence from federal authorities about an imminent cyberattack. The company proactively shut down customer environments over the weekend while working with federal intelligence agencies and security partners including Mandiant. During the shutdown, Kiteworks discovered and patched a critical vulnerability in their Advanced Forms product affecting approximately 50 organizations, with no evidence of exploitation. The company resumed normal operations after continuous monitoring showed no malicious activity. This incident highlights the growing trend of proactive threat response and public-private intelligence sharing in cybersecurity. As supply chain attacks continue to target file transfer and collaboration platforms, the willingness of vendors to prioritize security over operational convenience signals a maturation in industry threat response practices.
Emergency Patching: Citrix NetScaler Zero-Days Demand Immediate Action
In September 2026, CISA issued emergency directives ordering federal agencies to patch two critical Citrix NetScaler zero-day vulnerabilities (CVE-2026-88771 and CVE-2026-88772) by Wednesday after confirming active exploitation. The vulnerabilities allow unauthenticated remote code execution on NetScaler ADC and Gateway appliances, affecting thousands of internet-exposed instances. Threat actors were observed placing shellcode directly into memory on vulnerable systems, prompting national cybersecurity agencies to advise organizations to immediately shut down unpatched NetScaler deployments. This incident highlights the persistent targeting of network infrastructure appliances that serve as critical trust boundaries in enterprise environments. The rapid exploitation of these zero-days demonstrates the increasing sophistication of threat actors who can weaponize vulnerabilities within hours of discovery, making traditional patch cycles inadequate for defending against modern attack timelines.
Military Insider Threat: How Zero Trust Could Have Stopped a $1M+ Extortion Campaign
Former U.S. Army soldier Cameron John Wagenius, operating under aliases 'kiberphant0m' and 'cyb3rph4nt0m', was sentenced to 70 months in prison for orchestrating a sophisticated extortion campaign targeting at least 10 U.S. technology and telecommunications companies between April 2023 and December 2024. Wagenius and his conspirators used SSH brute force tools to steal login credentials, accessed sensitive customer data from telecom giants including AT&T and Verizon, and demanded ransom payments totaling over $1 million while threatening to leak stolen information on cybercrime forums like BreachForums and XSS.is. The operation resulted in $294,978 in documented damages and successful data sales that enabled additional SIM-swapping frauds. This case highlights the growing trend of insider threats leveraging privileged access and sophisticated tooling to execute large-scale extortion campaigns. As organizations face increasing pressure from regulatory frameworks requiring enhanced data protection and zero-trust architectures, incidents like this demonstrate the critical need for comprehensive egress monitoring, anomaly detection, and robust access controls to prevent data exfiltration by malicious insiders.
Bitget Resumes Operations After $387.5M North Korean Crypto Heist
In September 2026, cryptocurrency exchange Bitget suffered a major security breach attributed to North Korean state-sponsored hackers who stole $387.5 million from the platform's hot and warm wallets. The attackers compromised a critical backend system within Bitget's wallet infrastructure, enabling them to spoof transaction data and trigger unauthorized fund transfers across multiple blockchain networks including Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC, and Base. Bitget temporarily suspended all withdrawals as a security measure before gradually resuming services starting with Bitcoin withdrawals. This incident highlights the continuing evolution of North Korean cyber operations targeting cryptocurrency exchanges, representing part of an estimated $6 billion in crypto assets stolen since 2017. The breach demonstrates sophisticated techniques for compromising wallet infrastructure and the ongoing threat to digital asset platforms from nation-state actors seeking to circumvent international sanctions.
Shadow AI Security Crisis: How 80,000+ Organizations Lost Control of AI Credentials
In August 2026, a massive credential theft campaign targeting AI platforms exposed over 80,000 organizations worldwide, with infostealers harvesting login credentials and session tokens from employees' personal devices. The attack primarily targeted ChatGPT users but also affected Claude, Hugging Face, Replit, and other AI services, with stolen credentials being sold on underground markets for unauthorized access and billing fraud. SOCRadar's research revealed that 68% of affected organizations were billion-dollar enterprises across 36 countries, with attackers gaining access to conversation histories containing sensitive corporate data, API keys, and OAuth tokens with standing permissions to other enterprise systems. This incident highlights the critical security risks of shadow AI adoption as organizations increasingly rely on AI assistants for business operations. The theft demonstrates how unmanaged AI tool usage creates new attack vectors for data exfiltration and unauthorized access to corporate resources, making AI platforms as critical as identity providers in enterprise security strategies.
Critical Citrix NetScaler Vulnerabilities Under Active Attack: What Security Teams Need to Know
CISA added two critical Citrix NetScaler ADC and Gateway vulnerabilities (CVE-2026-88771 and CVE-2026-88772) to its Known Exploited Vulnerabilities catalog following reports of active global exploitation. CVE-2026-88771 (CVSS 9.5) allows unauthenticated remote code execution through improper input validation in a Perl script, while CVE-2026-88772 (CVSS 9.5) enables RCE via memory buffer operations when DTLS is enabled. Attackers are exploiting these flaws to achieve root-level access on vulnerable NetScaler appliances, potentially compromising enterprise network infrastructure and VPN gateways. This incident highlights the continued targeting of network appliances as critical attack vectors, particularly as organizations expand their hybrid cloud deployments and remote access infrastructure. The pre-authentication nature of these exploits makes them especially dangerous for threat actors seeking initial network footholds.
JadePuffer's AI-Powered Ransomware: The Future of Automated Cloud Attacks
In June 2026, the JadePuffer ransomware operator (tracked by Microsoft as Storm-3168) conducted sophisticated AI-driven attacks against Azure cloud tenants using compromised service principals. The threat actor employed autonomous AI agents to automate the entire attack chain, including reconnaissance, credential theft, lateral movement, and destructive operations targeting over 100 storage accounts, Key Vaults, Function Apps, and Virtual Machines. The destructive phase lasted only seven minutes, with attackers systematically removing backup protections and attempting to make recovery more difficult to support potential ransomware extortion. This incident represents a critical evolution in ransomware tactics, demonstrating how threat actors are weaponizing AI agents to accelerate and scale cloud-native attacks. The emergence of agentic AI in cybercrime signals a new era of automated, intelligent threats that can operate at machine speed against cloud infrastructure.
How 16,000+ Misconfigured Supabase Databases Exposed Critical Data in 2026
In September 2026, cybersecurity researchers at UpGuard discovered over 16,000 misconfigured Supabase databases exposing sensitive data including personally identifiable information, passwords, and authentication tokens. The exposures affected diverse organizations globally, from a U.S. valet service with 100,000+ customer records to a Canadian immigration service with nearly 5,000 user records including 884 plaintext passwords. Researchers attributed these widespread misconfigurations to poor application security settings, missing row-level security policies, and the increasing use of AI-assisted development tools that create databases without proper security awareness from developers. This incident highlights the growing security risks associated with AI-powered development platforms and cloud database misconfigurations. As AI-assisted coding becomes more prevalent, accounting for over 60% of new Supabase databases, the potential for systematic security oversights increases dramatically, making comprehensive cloud security posture management and zero-trust architectures more critical than ever.
ShinyHunters Investigation: Dutch Police Arrest Highlights Persistent Cybercrime Threats
Dutch police arrested 24-year-old Amsterdam resident Pepijn van der Stap in September 2026 as part of an ongoing investigation into the ShinyHunters cybercriminal group. Van der Stap, previously known online as 'Umbreon,' was already on probation from a 2023 conviction for hacking and extorting over a dozen companies worldwide. Authorities are examining potential connections between his 'Umbreon' identity and recent ShinyHunters campaigns, including alleged FBI breaches and attacks on the Clop ransomware gang's infrastructure. The arrest involved a tactical police unit search of his Amsterdam residence and seizure of electronic devices. This incident highlights the persistent threat of repeat cybercriminals and the challenges law enforcement faces in dismantling organized hacking groups like ShinyHunters, which continue high-profile data breaches and extortion campaigns despite increased scrutiny and arrests of suspected members.
Times Car Breach Exposes 6.6 Million Accounts: Automotive Industry Under Siege
Times Car, Japan's major vehicle rental and mobility service, confirmed a cyberattack in September 2026 that compromised 6.6 million user accounts. The breach, discovered on September 25, exposed personal information including names, addresses, driver's license data, and identity verification documents of current and former members. While passwords were stored in encrypted form and credit card information remained unaffected, the incident represents one of Japan's largest automotive sector data breaches. Times Car blocked unauthorized access on September 26 and initiated forensic investigation with external experts while maintaining normal service operations. This incident highlights the escalating threat to mobility and automotive platforms as digital transformation accelerates across transportation sectors, with attackers increasingly targeting customer databases containing sensitive identity verification documents and location data.