From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira

Mass npm Supply Chain Attack: 20 Leo Platform Packages Compromised

Vào ngày 24/6/2026, tin tặc đã phát tán phiên bản độc hại của 20 package npm thuộc hệ sinh thái Leo Platform chỉ trong vòng chưa đầy 3 giây, sử dụng toolkit 'Phantom Gyp' tương tự chiến dịch Miasma trước đó. Phần mềm độc hại đánh cắp bí mật từ GitHub Actions, kho lưu trữ đa đám mây (AWS, GCP, Azure), registry package, HashiCorp Vault, Kubernetes và trình quản lý mật khẩu, sau đó exfiltrate qua token GitHub của nạn nhân để tránh bị phát hiện. Nó còn hoạt động như một worm trong chuỗi cung ứng, tự động phát tán phiên bản độc hại các package mà nạn nhân có quyền publish bằng cách vượt qua xác thực 2FA.

Lập trình viên nên đọc bài này để hiểu cách một cuộc tấn công supply chain mới sử dụng các kỹ thuật phức tạp—như obfuscation và evasion Bun—để tránh phát hiện và khai thác quyền truy cập vào các hệ thống quan trọng từ các gói npm phổ biến, từ đó cảnh báo về rủi ro khi sử dụng các thư viện công cộng mà không kiểm tra nguồn gốc và bảo mật.

Brand on the Line: CISOs to Watch in Retail and Consumer Brands

A profile of five CISOs leading cybersecurity programs at major retail and consumer brands including Levi Strauss, Topgolf Callaway, Burlington Stores, Family Dollar, and New Balance. Each leader brings cross-sector experience spanning healthcare, financial services, and hospitality. Key themes include protecting payment card data, loyalty program records, e-commerce platforms, and supply chain data. The piece frames retail security as fundamentally a consumer trust problem, where breaches damage brand relationships beyond just regulatory exposure.

The Gentlemen RaaS: rapid growth and a new ransomware variant

Kaspersky researchers provide a detailed technical analysis of The Gentlemen, a rapidly growing ransomware-as-a-service (RaaS) group that ranked among the top 10 ransomware actors in the first half of 2026. The group uses a Go-based ransomware with a custom obfuscator, a Go-based backdoor using Yamux for C2 communication, and a newly discovered C-based ransomware variant still in development. Their TTPs include exploiting internet-facing VPNs and firewalls, BYOVD attacks using multiple vulnerable drivers to kill EDR/AV products, lateral movement via GPO deployment and PsExec, network sniffing with netsh, and Active Directory reconnaissance with SharpADWS. The Go ransomware uses Curve25519 + XChaCha20 encryption while the new C variant uses AES256-GCM + RSA via OpenSSL. Targets span manufacturing, IT, healthcare, finance, and logistics across Brazil, China, Indonesia, Taiwan, and Thailand. Full IOCs including hashes, C2 IPs, and vulnerable driver hashes are provided.

New SharkLoader Malware Deploys Cobalt Strike in StrikeShark Cyberattacks

Kaspersky has identified a new cyberattack campaign called StrikeShark that uses a previously undocumented malware loader, SharkLoader, to deploy Cobalt Strike Beacon on compromised systems. Targets include government and diplomatic organizations across Asia, the Middle East, and Latin America, as well as software development companies globally. Attackers gained initial access by exploiting known vulnerabilities in Microsoft Exchange, Openfire, GeoServer, and other public-facing applications using publicly available proof-of-concept exploits. Post-compromise activity includes DLL side-loading, web shell deployment, in-memory Beacon execution, Active Directory enumeration, and credential theft targeting LSASS and NTDS. The campaign is attributed with moderate confidence to a Chinese-speaking threat actor. No confirmed data exfiltration has been observed, but the targeting pattern suggests cyber espionage objectives. CISOs are advised to patch exposed systems, hunt for SharkLoader and Cobalt Strike behavioral indicators, and review identity exposure after any suspected compromise.

Critical SimpleHelp flaw exploited to deploy new stealer malware

Hackers are actively exploiting CVE-2026-48558, a critical authentication bypass vulnerability in SimpleHelp RMM, to deploy two previously undocumented malware families: TaskWeaver (a JavaScript-based loader) and Djinn Stealer (a cross-platform infostealer). The attack chain begins with unauthenticated creation of privileged technician accounts on OIDC-enabled SimpleHelp servers. Djinn Stealer specifically targets developer credentials including cloud provider keys, Git/GitHub tokens, SSH keys, Docker credentials, package registry auth, AI coding assistant configs (Claude, Gemini, Codex, Cline), MCP configuration files, and cryptocurrency wallets. Stolen data is packed into a TAR archive, GZIP-compressed, and AES-256-GCM encrypted before exfiltration. Blackpoint's MDR team investigated the incident and warns that stealing MCP tokens could grant attackers the same downstream access developers extended to their AI agents. Admins are urged to update SimpleHelp immediately and rotate all credentials.

US seizes hundreds of FIFA World Cup illegal streaming domains

The U.S. Justice Department seized nearly 400 web domains used to illegally stream 2026 FIFA World Cup matches, as part of Operation Offsides — a coordinated global effort involving international law enforcement and private sector partners including FIFA, NBCUniversal, and Warner Bros. Authorities targeted servers and domains across multiple countries including Peru, Bulgaria, Croatia, Romania, Poland, and Colombia. Officials also warned that illegal streaming sites expose viewers to malware and data theft risks. The action follows a related shutdown of 44 domains tied to the PirloTV sports piracy network, which generated over 950 million visits annually.

The OSCP Is a Mental Game

A first-person account of passing the OSCP certification after 3 months of preparation, emphasizing the mental resilience required over technical skill. Covers prep strategy using PEN-200, Proving Grounds, and AD-focused labs, key tools like netexec, BloodHound, mimikatz, and ligolo-ng, and a detailed walkthrough of the 24-hour exam experience including rabbit holes, strategic breaks, and a last-minute breakthrough that swung 50 points in 30 minutes.