Security Tips

WithSecure published a comprehensive disclosure today on a previously undocumented Russia-linked threat actor they have been tracking since January 2026 under the name GREYVIBE. The disclosure landed in dual-source coverage at BleepingComputer and The Hacker News with the substantive technical detail and the indicator-of-compromise pack hosted on GitHub. The group is conducting persistent cyberespionage operations against Ukrainian military, government, civilian, and corporat

The Hacker News reported yesterday on a tradecraft expansion by Kimsuky, the North Korean state-sponsored espionage actor we already track in our adversaries index under the synonyms Velvet Chollima, Black Banshee, Thallium, and Operation Stolen Pencil. The expansion has three named components. A new malware family called HTTPSpy is now the primary tool against South Korean military and corporate targets. A backdoor called HelloDoor has been added to the persistence stack. An

This week the two largest perimeter vendors in enterprise security each shipped a vulnerability that turns their own product into the breach. Fortinet patched CVE-2026-35616, a pre-authentication API access bypass in FortiClient EMS scoring a 9.1 critical, which the discoverers at Defused Cyber observed under active zero-day exploitation since early April 2026 — roughly two months before the public advisory. Palo Alto Networks updated their advisory for CVE-2026-0257, a Globa

Sixteen days ago we published a post titled "Your Lovable App Is a Spreadsheet. Mine Has Crons." The thesis was that the AI development economy in 2026 has produced an enormous population of demos that the demo authors believe are products, that the production loop — telemetry, regressions, runbooks, paying customers who would notice if the cron missed at three in the morning — does not exist inside a Lovable preview pane, and that the hackathon-class output is going to land

This morning HoneyLabs published a back-end mapping of a botnet that has been quietly earning rent for almost five years. They never named the malware family. They never had to. Their methodology was the point. They pulled next-stage URLs out of dropper binaries, clustered the delivering nodes by JA4 and JA4H and HASSH fingerprints, and walked the chain back from the noise at the perimeter to the eight staging servers that actually run the campaign. The data shape is one thou

Akira posted two victims to its leak site today. GS Yuasa Lithium Power is the Japanese global battery and lithium-ion manufacturer whose batteries powered the original Boeing 787 Dreamliner installations and now power major automotive electrification programs at Honda and Mitsubishi, industrial backup-power systems, and renewable-energy storage deployments across multiple continents. Alpine Aerotech is a Canadian aerospace MRO provider specializing in helicopter dynamic comp

ShinyHunters posted Carnival Cruise to the Trinity of Chaos leak site this afternoon with a claim of approximately six million customer records. Carnival is the fourth major-vertical victim the Coinbase Cartel confederation has posted in an eight-day window. The four are Canvas Instructure on May 22 with three-and-a-half terabytes of education-sector data, DentaQuest on May 23 with a small initial-claim of seven-hundred-forty-four user records that is almost certainly underst

TridentLocker posted the World Trade Center Health Program to its leak site today. The program enrolls approximately 130,000 first responders and survivors of the 9/11 attacks under the Zadroga Act and provides federally-administered medical monitoring and treatment for exposure-related illnesses — respiratory disease, cancers documented to be related to WTC dust exposure, mental health diagnoses tied to post-traumatic stress from the events themselves. The dataset is the kin

Six CISA Known Exploited Vulnerabilities catalog additions in May 2026 had a DugganUSA blog post or indexed IOC dated at least two weeks before the federal mandate landed. The earliest lead was fifty-seven days. The shortest positive lead was fourteen days. The median across the six positive-lead receipts was thirty-one and a half days. The mean was thirty-five point eight. The defensible public claim is that DugganUSA detected May 2026 KEV vulnerabilities an average of thirt

We named the Coinbase Cartel on May 21. On that date we indexed an IOC in our threat-intelligence corpus naming the operator constellation as the confederation of ShinyHunters, Scattered Spider, and LAPSUS$ acting in overlapping cells with specialized tradecraft. The framing was derived from observation of the alliance's payment-routing infrastructure across mixers and exchanges, which is where the Coinbase reference in the name comes from. Independently, Resecurity has been

A malicious npm package named mouse5212-super-formatter was disclosed by researchers two days ago and is still available for download from npm at the time of writing. The campaign codename, assigned by the research team that named it, is Malware-Slop. The package presents itself as an archive deployment sync utility. The actual capability is more pointed. It authenticates to GitHub using an environment token or a hardcoded fallback, programmatically creates a target repositor

This morning at eight UTC, CISA added two new entries to the Known Exploited Vulnerabilities catalog. CVE-2026-45321 covers the TanStack npm supply-chain compromise. CVE-2026-48027 covers the Nx Console extension compromise. Both entries describe the vulnerability as the act of publishing malicious versions under a trusted identity, not as a code-level flaw in the affected products. That framing is novel and worth dwelling on. The federal regulator has now formally classified

An operator emailed our inbox this morning claiming the IP address 35.237.4.214 is a Discord embed proxy and demanding we stop reporting it. The email is paraphrased here without identification because the technical pattern is the interesting thing, not the operator. Their claim does not survive contact with the facts. The threat-intelligence community has been writing about this specific abuse pattern for two years, and today's email is the closing artifact for a clean publi

Noscope researchers disclosed CVE-2026-27771 yesterday. Gitea is the leading self-hosted alternative to GitHub. Approximately thirty thousand Gitea deployments across more than thirty countries shipped a container-registry authorization bypass that let unauthenticated remote attackers pull private container images from any vulnerable instance without an account, password, or any credential. The bug shipped roughly four years ago. The detection window has been the entire regis

Three hours ago, the ShinyHunters leak site added DentaQuest LLC to its victim list. DentaQuest is a major US dental and vision insurance provider; the claimed exfil per public dark-web monitoring is seven-hundred-forty-four users plus one third-party employee credential. DentaQuest has acknowledged the cybersecurity incident on its website. Class-action plaintiffs' counsel is already investigating. The threatened-leak deadline was yesterday — the tranche has not surfaced pub

On Monday May 25, 2026, the Play ransomware crew posted MyPillow Inc. on its name-and-shame leak site with a Friday deadline. The leak-site notice claims private and personal confidential data, client documents, budget, payroll, IDs, taxes, and finance information. The volume claim is left vague — no gigabytes figure, no sample tranche posted yet. Mike Lindell told Straight Arrow News nobody has asked them for a ransom, that the company does not have any data breaches, and th

On May 20, 2026, we indexed an IOC in our threat-intelligence corpus named defender-attack-surface-campaign-2026-05-20. The body of that IOC names BlueHammer, RedSun, UnDefend, CVE-2026-41091, and CVE-2026-45498 — a five-CVE family of Microsoft Defender vulnerabilities, three of which CISA promoted to the Known Exploited Vulnerabilities catalog that same day. Eight days later, today, the broader news cycle caught up. BleepingComputer, Malwarebytes, Dark Reading, and SecurityW

Instructure, the parent company of the Canvas learning-management system, announced it had reached an agreement with ShinyHunters to recover the 3.65 terabytes of student and faculty data stolen during the late-April through mid-May extortion campaign. The terms of the agreement are not publicly disclosed. Unconfirmed reporting puts the payment at approximately ten million dollars. Instructure states it received cryptographic shred logs as proof of data destruction and that n

CISA added CVE-2026-31431 to the Known Exploited Vulnerabilities catalog today. The KEV entry confirms what oss-security, Microsoft, Sysdig, Unit 42, CERT-EU, and Xint Code have been documenting since April 29: there is a deterministic seven-hundred-thirty-two-byte path from any unprivileged user on a modern Linux box to root, and the path runs through the kernel cryptographic socket family that almost no workload actually needs to use. We wrote the mechanism up on May 14. Th

GitHub confirmed over Memorial Day weekend that the repository breach it had been investigating was linked to the TanStack npm supply-chain attack. Two days later, the same vendor shipped a two-factor approval gate on npm publish — the kind of control that exists because the prior control failed. This is the receipt arc we have been writing since April 29, when the variant first landed in our index. The headline today is GitHub. The headline two weeks ago was OpenAI. The head