Threats & incidents
-
CERT EU flags surge in stolen AI service access
CERT EU says cybercrime markets are increasingly trading stolen access to premium AI services while attackers also hijack cloud servers to run unauthorised AI workloads.
-
Warlock expands SharePoint attacks into essential services
Researchers have linked continuing Warlock ransomware activity to SharePoint intrusions affecting a water utility, telecom provider, regional government body, and university.
-
DTU breach puts data on 200,000 users at risk
Denmark’s Technical University says attackers accessed its identity and access management system and downloaded data that may relate to as many as 200,000 current and former users.
-
NetScaler zero-days left persistent access
Unit 42 has detailed pre-disclosure NetScaler exploitation involving web shells and persistence, adding new technical evidence to an incident already affecting exposed European infrastructure.
-
Cisco SD-WAN flaw exploited for admin access
Cisco says attackers are exploiting a critical authentication bypass in Catalyst SD-WAN Manager that can provide unauthenticated access with administrator privileges.
-
DIVD breach exposes chained Zammad flaws
Dutch vulnerability institute DIVD says two previously unknown Zammad vulnerabilities were involved in its own compromise, including code execution and local privilege escalation.
-
European police seize KillSec infrastructure
European law enforcement has seized KillSec servers and its leak site in an operation targeting a ransomware group linked to around 1,000 suspected attacks worldwide.
-
Phishing turns legitimate RMM into persistence
Microsoft says attackers disguised legitimate MSP360 software as business files, then used it to install ScreenConnect and create redundant remote access to compromised systems.
-
Malicious GPTs feed ClickFix malware chain
Huntress says attackers are using custom ChatGPT instances to send victims into a ClickFix social-engineering chain that ultimately deploys remote-access malware.
-
Zimbra flaw enabled deep mail-server compromise
Microsoft has documented exploitation of an unauthenticated Zimbra command-injection flaw that led to web shells, root access, credential collection, persistence, and attempted mailbox-data exfiltration.