Threats & incidents
-
NightEagle cyberespionage expands into Russian industry
Kaspersky says NightEagle has moved beyond its previously observed Asian target set, compromising Russian manufacturing and construction organisations through stolen VPN credentials and Exchange servers.
-
North Korean WaterPlum campaign hits 30,000 devices
A multinational advisory links the WaterPlum recruitment campaign to North Korea and says it compromised at least 30,000 devices across more than 100 countries.
-
Revolut breach shifts into alleged extortion
Attackers claiming responsibility for Revolut’s customer-data breach have reportedly demanded $3 million, while the fintech says it has received no direct contact or ransom demand.
-
Cisco ISE auth bypass exploited in attacks
Cisco has patched a maximum-severity authentication bypass in Identity Services Engine that is being actively exploited and can give unauthenticated attackers access to network-control infrastructure.
-
MovieReaper spreads through compromised torrent archive
Kaspersky says attackers compromised a shared torrent-file repository, causing multiple trackers to distribute a new multi-stage malware framework to users and organisations across several European countries.
-
Brevo breach spread malicious code downstream
A stolen Cloudflare credential allowed attackers to modify Brevo-hosted content at the CDN edge and push malicious code through JavaScript components embedded on customer websites.
-
Compromised plugin vendor backdoors WordPress sites
Attackers compromised the distribution infrastructure for Admin Menu Editor Pro and pushed backdoored updates to around 230 customers, affecting at least 1,500 WordPress sites.
-
Acronis patches exploited backup plugin flaw
Acronis has patched a privilege-escalation vulnerability affecting cPanel and Plesk backup integrations after detecting limited exploitation against cPanel deployments.
-
Ransomware crews exploit VMware vCenter flaw
A critical VMware vCenter vulnerability already under active exploitation is listed by CISA as associated with known ransomware campaigns, raising the stakes around unpatched management servers.
-
Ace & Tate confirms CEVA customer data theft
Ace & Tate says customer information was accessed and copied during a breach at logistics provider CEVA, expanding an incident first disclosed as a potential exposure in August.