German Authorities Unmask Leaders Behind REvil and GandCrab Ransomware AttacksGerman Authorities Unmask Leaders Behind REvil and GandCrab Ransomware Attacks
In April 2026, Germany's Federal Criminal Police Office (BKA) identified Russian nationals Daniil Maksimovich Shchukin and Anatoly Sergeevitsch Kravchuk as the leaders of the GandCrab and REvil ransomware operations between 2019 and 2021. Operating under aliases such as 'UNKN' or 'UNKNOWN,' Shchukin and Kravchuk orchestrated at least 130 cyberattacks targeting German companies, resulting in over $40 million in damages and approximately $2.2 million in ransom payments. Their operations popularized the 'double extortion' tactic, demanding payment for decrypting data and additional sums to prevent public release of stolen information. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/german-authorities-identify-revil-and-gangcrab-ransomware-bosses/?utm_source=openai))
This identification underscores the persistent threat posed by sophisticated ransomware groups and highlights the importance of international cooperation in combating cybercrime. The GandCrab and REvil models have influenced current ransomware tactics, emphasizing the need for robust cybersecurity measures and proactive threat intelligence to mitigate such risks.
Critical impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
FrostArmada: Unveiling APT28's DNS Hijacking Tactics Targeting Microsoft 365
In April 2026, an international law enforcement operation, in collaboration with private companies, successfully disrupted 'FrostArmada,' a cyber espionage campaign orchestrated by the Russian state-sponsored group APT28 (also known as Fancy Bear or Forest Blizzard). The campaign involved compromising small office/home office (SOHO) routers, primarily from MikroTik and TP-Link, to alter DNS settings and redirect traffic through attacker-controlled servers. This allowed APT28 to intercept authentication traffic and steal Microsoft 365 credentials and OAuth tokens. At its peak in December 2025, FrostArmada infected 18,000 devices across 120 countries, targeting government agencies, law enforcement, IT and hosting providers, and organizations operating their own servers. The operation to neutralize the malicious infrastructure was supported by Microsoft, Lumen's Black Lotus Labs, the FBI, the U.S. Department of Justice, and the Polish government. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/authorities-disrupt-dns-hijacks-used-to-steal-microsoft-365-logins/?utm_source=openai))
This incident underscores the evolving tactics of state-sponsored threat actors in exploiting network infrastructure vulnerabilities to conduct large-scale credential theft. The use of DNS hijacking via compromised routers highlights the need for organizations to secure network devices, implement robust monitoring, and adopt zero-trust principles to mitigate such sophisticated attacks.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Flowise 2026 RCE Vulnerability Exploitation
In April 2026, security researchers identified active exploitation of a critical remote code execution (RCE) vulnerability, CVE-2025-59528, in Flowise, an open-source platform for building AI agents and large language model (LLM) workflows. This flaw, residing in the CustomMCP node, allows attackers to execute arbitrary JavaScript code without security validation, leading to potential full system compromise. Despite a patch being available since September 2025, many instances remain unpatched, exposing organizations to significant risks. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/max-severity-flowise-rce-vulnerability-now-exploited-in-attacks/?utm_source=openai))
The exploitation of this vulnerability underscores the persistent threat posed by unpatched software in widely used AI development tools. Organizations leveraging Flowise must prioritize immediate updates to mitigate potential breaches and safeguard sensitive data. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/max-severity-flowise-rce-vulnerability-now-exploited-in-attacks/?utm_source=openai))
Critical impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Snowflake Data Breach 2026: Lessons in Third-Party Integration Security
In April 2026, over a dozen companies experienced data theft attacks following a breach at a SaaS integration provider, leading to the theft of authentication tokens. The majority of these attacks targeted Snowflake, a cloud-based data platform. Snowflake detected unusual activity in a small number of customer accounts linked to a specific third-party integration and promptly initiated an investigation, securing the affected accounts and notifying impacted customers. The attacks did not involve any vulnerability or compromise of Snowflake's systems. The ShinyHunters extortion group claimed responsibility for the attacks, stating they had stolen data from dozens of companies and were demanding ransom payments to prevent the release of the stolen data. The group also attempted to steal data from Salesforce but were thwarted by AI detection mechanisms. This incident underscores the critical importance of securing third-party integrations and the growing threat posed by sophisticated cybercriminal groups like ShinyHunters.
Medium impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Critical Remote Code Execution Vulnerability in Flowise AI: CVE-2025-59528
In September 2025, a critical remote code execution (RCE) vulnerability, identified as CVE-2025-59528, was discovered in Flowise AI's version 3.0.5. This flaw resided in the CustomMCP node, which improperly executed user-supplied JavaScript code without validation, granting attackers full Node.js runtime privileges. Exploitation of this vulnerability could lead to complete system compromise, unauthorized command execution, and data exfiltration. Flowise addressed this issue by releasing version 3.0.6, which rectified the vulnerability. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2025-59528?utm_source=openai))
As of April 2026, active exploitation of CVE-2025-59528 has been observed, with over 12,000 Flowise instances exposed to potential attacks. This resurgence underscores the critical need for organizations to ensure their systems are updated to the latest secure versions to mitigate such high-severity threats. ([thehackernews.com](https://thehackernews.com/2026/04/flowise-ai-agent-builder-under-active.html?utm_source=openai))
Critical impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Critical Security Flaw in Ninja Forms Plugin Puts WordPress Sites at Risk
In early 2026, a critical vulnerability (CVE-2026-0740) was discovered in the Ninja Forms File Uploads plugin for WordPress, affecting versions up to 3.3.26. This flaw allowed unauthenticated attackers to upload arbitrary files, including malicious PHP scripts, leading to potential remote code execution and complete site takeover. The vulnerability stemmed from inadequate validation of file types and extensions during the file upload process.
The issue was reported on January 8, 2026, and a full patch was released on March 19, 2026, with version 3.3.27. Despite the availability of a fix, exploitation attempts surged, with over 3,600 attacks blocked in a single day. This incident underscores the critical importance of timely software updates and robust security practices in mitigating emerging threats.
Critical impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
FBI's 2025 Cybercrime Report: A 26% Surge to $21 Billion in Losses
In 2025, the FBI's Internet Crime Complaint Center (IC3) reported that Americans lost nearly $21 billion to cyber-enabled crimes, marking a 26% increase from the previous year. The most prevalent incidents included phishing attacks, extortion, and investment scams, with cryptocurrency-related fraud accounting for over $11 billion in losses. Notably, individuals over the age of 60 were disproportionately affected, reporting $7.7 billion in losses, a 37% rise from 2024. Additionally, the FBI highlighted the emergence of AI-driven scams, which resulted in 22,300 complaints and $893 million in losses, involving tactics such as voice cloning and deepfake videos.
This surge underscores the evolving sophistication of cybercriminals, who are increasingly leveraging advanced technologies like artificial intelligence to enhance the effectiveness of their schemes. The significant financial impact on older adults highlights the urgent need for targeted education and robust cybersecurity measures to protect vulnerable populations from these emerging threats.
Critical impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Critical Docker Authorization Bypass Vulnerability (CVE-2026-34040) Discovered
In March 2026, a high-severity vulnerability (CVE-2026-34040) was identified in Docker Engine, allowing attackers to bypass authorization plugins (AuthZ) by sending oversized HTTP request bodies. This flaw enables unauthorized users to perform privileged container operations, potentially leading to full host system compromise. The issue affects Docker Engine versions prior to 29.3.1 and is a result of an incomplete fix for a previous vulnerability (CVE-2024-41110) addressed in July 2024. ([sentinelone.com](https://www.sentinelone.com/vulnerability-database/cve-2026-34040/?utm_source=openai))
The discovery of this vulnerability underscores the persistent risks associated with authorization bypass flaws in critical infrastructure. Organizations relying on Docker for container management must promptly update to version 29.3.1 or later to mitigate this threat. ([cyera.com](https://www.cyera.com/blog/cyera-research-discovers-docker-authorization-bypass-that-silently-disables-security-policies?utm_source=openai))
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Russia Hacked Routers to Steal Microsoft Office Tokens
In April 2026, Russian state-sponsored hackers, identified as APT28 (also known as Fancy Bear or Forest Blizzard), exploited vulnerabilities in outdated MikroTik and TP-Link routers to hijack DNS settings. This allowed them to intercept Microsoft Office authentication tokens from users across more than 18,000 networks without deploying malware. The attackers targeted government agencies, law enforcement, and third-party email providers, compromising over 200 organizations and 5,000 consumer devices. ([cyberkendra.com](https://www.cyberkendra.com/2026/04/your-router-is-spying-on-you-and.html?utm_source=openai))
This incident underscores the critical need for organizations to secure network infrastructure, especially as remote work increases reliance on home and small office routers. Ensuring devices are updated and monitoring for unauthorized DNS changes are essential to prevent similar attacks.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
AI-Driven Supply Chain Attack Compromises GitHub Repositories
In March 2026, a threat actor utilized AI-assisted automation to execute over 450 exploit attempts against open-source repositories on GitHub. The campaign, identified as 'prt-scan,' specifically targeted repositories misconfigured with the 'pull_request_target' workflow trigger. While less than 10% of these attempts were successful, the attacker managed to compromise at least two NPM packages, leading to the exposure of ephemeral GitHub credentials. This incident underscores the growing trend of AI-enhanced supply chain attacks, where adversaries leverage automation to scale their operations and exploit common misconfigurations. Organizations are urged to review and secure their CI/CD pipelines to mitigate such risks.
Critical impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(medium)
UNC1069's Social Engineering Compromise of Axios: A 2026 Supply Chain Attack
In late March 2026, the popular JavaScript HTTP client library Axios, with over 100 million weekly downloads, was compromised through a sophisticated social engineering attack. The North Korean state-sponsored group UNC1069 targeted lead maintainer Jason Saayman, gaining access to his npm account. The attackers published two malicious versions of Axios (1.14.1 and 0.30.4) that included a trojanized dependency, 'plain-crypto-js@4.2.1', which executed a post-install script to deploy a cross-platform Remote Access Trojan (RAT) upon installation. The malicious packages were available for approximately two to three hours before being removed, but the potential impact was significant due to Axios's widespread use. This incident underscores the increasing industrialization of social engineering attacks targeting open-source maintainers, highlighting the need for enhanced security measures within the software supply chain. The rapid detection and removal of the compromised packages prevented a more extensive breach, but the event serves as a critical reminder of the vulnerabilities inherent in widely used open-source projects.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Forest Blizzard's 2026 SOHO Router DNS Hijacking: A Wake-Up Call for Network Security
In April 2026, the Russian state-sponsored group Forest Blizzard exploited vulnerabilities in small office/home office (SOHO) routers to perform DNS hijacking and adversary-in-the-middle (AiTM) attacks. By compromising these routers, they redirected DNS requests through attacker-controlled servers, enabling interception of sensitive communications. This campaign affected over 200 organizations and 5,000 consumer devices, primarily targeting sectors such as government, IT, telecommunications, and energy. The attackers leveraged the compromised infrastructure to collect intelligence and potentially facilitate further malicious activities.
This incident underscores the critical need for securing SOHO devices, as they can serve as entry points for sophisticated cyberattacks. Organizations must prioritize regular firmware updates, enforce strong authentication measures, and monitor network traffic for anomalies to mitigate such threats.
Critical impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
