A Huntress SOC investigation uncovered an Akira ransomware affiliate using an unusual attack chain: the threat actor accessed a hypervisor, spun up a new virtual machine (bypassing installed security tooling), disabled Microsoft Defender, archived target data with WinRAR, and exfiltrated it via Easyupload.io — a file-sharing site now owned by the rebranded LimeWire platform. The VHDX image of the VM provided forensic analysts a clear timeline of attacker activity, including Active Directory enumeration, lateral movement to file servers, and rapid ransomware deployment. The incident highlights how RaaS affiliates adapt TTPs, including creating new VMs to evade endpoint security stacks, and underscores the need to monitor for new endpoint creation within environments.
Nguồn: https://www.huntress.com/blog/akira-ransomware-limewire-data-exfiltration. 8sync News chỉ tóm tắt và dẫn link; bản quyền nội dung thuộc tác giả và nguồn gốc.
Ransomware attacks in Europe surged 55% in the first four months of 2026 compared to the same period in 2025, with France seeing a 119% increase and Italy 92%. Researchers from Black Kite attribute the shift to US market oversaturation and AI-assisted target research pointing attackers toward European organizations. The number of active ransomware groups has grown from 60 in 2023 to 150 today, filling the vacuum left by law enforcement takedowns of major RaaS operations. Manufacturing and digital services sectors are primary targets, largely because attackers exploit supply chain leverage — breaching one vendor to access hundreds of downstream clients, as demonstrated by the Miljödata attack that exposed data from ~200 Swedish municipalities. Experts recommend organizations map fourth- and fifth-party vendor dependencies and rank vendors by risk proactively rather than reactively.
Mexico's 2025–2030 National Cybersecurity Plan, published by the ATDT in December 2025, outlines a six-phase roadmap to modernize the country's cyber posture. The plan addresses top threats including ransomware, financial malware, hacktivism, state-sponsored attacks, and organized crime. Key milestones include passing a General Cybersecurity Law in 2026, establishing a National Center for Cybersecurity Operations, creating a National Cyber Range by 2027, and integrating AI for cyber defense by 2028. Mexico ranks as a Tier 2 nation in the ITU Global Cybersecurity Index but lags in institutional capacity. The 2026 FIFA World Cup co-hosted by Mexico serves as an immediate stress test for its digital infrastructure. Insikt Group recommends organizations in Mexico adopt international standards like NIST CSF or ISO/IEC 27001, conduct scenario-planning exercises, leverage threat intelligence platforms, and invest in public cyber hygiene education.
India's Tata Electronics has confirmed a cybersecurity incident after ransomware group World Leaks claimed to have stolen over 630GB of data, including purported Apple and Tesla component design files and trade secrets. A 52-page document with Apple's proprietary markings allegedly detailing iPhone circuit-board quality-inspection standards and Tesla Model Y chargeport controller files were listed on a dark-web index. Tata says operations were unaffected, but Apple is investigating and a ransom demand has been received. The authenticity of the files remains unverified. The incident highlights the growing risk of supply chain attacks, where attackers target contract manufacturers to gain leverage over high-profile customers who never directly touched the breached network.
A SANS Internet Storm Center audit of 14 SonicWall firewalls patched for CVE-2024-40766 (CVSS 9.8) found that Akira and Fog ransomware operators had compromised several of them post-patch. The core finding: firmware patching alone is not remediation. Attackers pre-created accounts, harvested credentials, and enrolled their own TOTP devices before patches were applied. Key gaps found across audited devices include stale SSLVPN accounts (12/14), no credential rotation post-patch (11/14), overly permissive LDAP group mappings giving all AD users VPN access (9/14), and publicly reachable TOTP enrollment portals (7/14). Gen 6 hardware is now end-of-life with no further firmware fixes. The recommended checklist covers account auditing, credential rotation, LDAP reconfiguration, portal access restriction, upgrading to SonicOS 7.3.0+, and external log forwarding to a SIEM.
Security researchers at Zafran discovered four vulnerabilities in Dify, a popular open source AI application platform, collectively dubbed 'DifyTap.' The flaws include a tracing hijack (CVE-2026-41947, CVSS 9.1) that lets attackers silently intercept AI chat histories by registering a rogue tracing backend, a Plugin Daemon path traversal (CVE-2026-41948, CVSS 9.4) exposing internal APIs to unauthenticated requests, and two UUID-based document access bugs (CVE-2026-41949 and CVE-2026-41950, both CVSS 6.5) enabling cross-tenant file exposure. Three of the four CVEs are patched in Dify 1.14.2; a fix for CVE-2026-41948 is available on GitHub. No real-world exploitation has been observed yet. Organizations are advised to patch promptly, apply WAF rules for CVE-2026-41948, and treat AI platforms as critical enterprise systems.
Microsoft's Detection and Response Team (DART) uncovered two separate, unrelated threat actors simultaneously operating inside the same victim network after unpatched on-premises SharePoint servers were exploited. Storm-2603 deployed ransomware using tools like Cloudflare Tunnel and Velociraptor, while a second actor used DLL sideloading, custom backdoors, and attempted Active Directory credential theft. The overlapping intrusions obscured each other, complicating detection and response. DART resolved the case by correlating identity, endpoint, and cloud telemetry. The investigation expanded to a second compromised organization. Key takeaways include prioritizing patching of internet-facing systems, centralizing telemetry, and maintaining tested incident response playbooks.
An international law enforcement operation (Operation Endgame) seized 106 servers and numerous domains tied to SocGholish, a JavaScript malware framework used as an initial-access broker for ransomware groups including Evil Corp. The action also remediated nearly 15,000 compromised WordPress websites. SocGholish relies on traffic distribution systems (TDSs) to redirect users from legitimate sites to fake browser update pages, filtering out researchers and bots while targeting domain-joined enterprise systems for deeper intrusion. The FBI issued guidance urging organizations to change default JavaScript file associations, monitor endpoints for suspicious script execution, keep CMS platforms updated, and audit administrator accounts to defend against TDS-based attacks.
Klue, the market intelligence firm whose breach exposed customer data at LastPass, HackerOne, and others, says the original hacking group Icarus is now deleting the stolen data. However, a second unnamed hacker group claims to have obtained the data from Icarus and is extorting affected companies directly, demanding payment or threatening to leak everything. Icarus reportedly told Klue the second group only has data samples for a subset of customers, not the full dataset, and instructed Klue to tell customers not to pay the second group. The breach stemmed from a compromised third-party credential from 2022 that was never revoked, granting OAuth access to customers' Salesforce environments. Over a dozen companies including Gong, Jamf, HackerOne, and LastPass have confirmed they were affected.