TONResolver RAT Abuses TON Blockchain to Target Japan's Hotel Industry

Mass npm Supply Chain Attack: 20 Leo Platform Packages Compromised

Vào ngày 24/6/2026, tin tặc đã phát tán phiên bản độc hại của 20 package npm thuộc hệ sinh thái Leo Platform chỉ trong vòng chưa đầy 3 giây, sử dụng toolkit 'Phantom Gyp' tương tự chiến dịch Miasma trước đó. Phần mềm độc hại đánh cắp bí mật từ GitHub Actions, kho lưu trữ đa đám mây (AWS, GCP, Azure), registry package, HashiCorp Vault, Kubernetes và trình quản lý mật khẩu, sau đó exfiltrate qua token GitHub của nạn nhân để tránh bị phát hiện. Nó còn hoạt động như một worm trong chuỗi cung ứng, tự động phát tán phiên bản độc hại các package mà nạn nhân có quyền publish bằng cách vượt qua xác thực 2FA.

Lập trình viên nên đọc bài này để hiểu cách một cuộc tấn công supply chain mới sử dụng các kỹ thuật phức tạp—như obfuscation và evasion Bun—để tránh phát hiện và khai thác quyền truy cập vào các hệ thống quan trọng từ các gói npm phổ biến, từ đó cảnh báo về rủi ro khi sử dụng các thư viện công cộng mà không kiểm tra nguồn gốc và bảo mật.

From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira

A detailed forensic analysis of a multi-stage ransomware intrusion that began with SEO poisoning on Bing, luring users to a trojanized ManageEngine OpManager installer. The BumbleBee loader was deployed via DLL side-loading, followed by an AdaptixC2 beacon for persistent C2. Over five days, threat actors performed extensive credential harvesting (NTDS.dit, Veeam, LSASS), lateral movement via RDP and reverse SSH tunnels, and exfiltrated over 75GB of data via FileZilla/SFTP to a server in Ukraine. The intrusion concluded with Akira ransomware deployment across root and child domains, with Volume Shadow Copies deleted via WMI. A parallel Swisscom intrusion tied to the same campaign is also documented, including BYOVD attacks and Cloudflare tunnel persistence.

New SharkLoader Malware Deploys Cobalt Strike in StrikeShark Cyberattacks

Kaspersky has identified a new cyberattack campaign called StrikeShark that uses a previously undocumented malware loader, SharkLoader, to deploy Cobalt Strike Beacon on compromised systems. Targets include government and diplomatic organizations across Asia, the Middle East, and Latin America, as well as software development companies globally. Attackers gained initial access by exploiting known vulnerabilities in Microsoft Exchange, Openfire, GeoServer, and other public-facing applications using publicly available proof-of-concept exploits. Post-compromise activity includes DLL side-loading, web shell deployment, in-memory Beacon execution, Active Directory enumeration, and credential theft targeting LSASS and NTDS. The campaign is attributed with moderate confidence to a Chinese-speaking threat actor. No confirmed data exfiltration has been observed, but the targeting pattern suggests cyber espionage objectives. CISOs are advised to patch exposed systems, hunt for SharkLoader and Cobalt Strike behavioral indicators, and review identity exposure after any suspected compromise.

Critical SimpleHelp flaw exploited to deploy new stealer malware

Hackers are actively exploiting CVE-2026-48558, a critical authentication bypass vulnerability in SimpleHelp RMM, to deploy two previously undocumented malware families: TaskWeaver (a JavaScript-based loader) and Djinn Stealer (a cross-platform infostealer). The attack chain begins with unauthenticated creation of privileged technician accounts on OIDC-enabled SimpleHelp servers. Djinn Stealer specifically targets developer credentials including cloud provider keys, Git/GitHub tokens, SSH keys, Docker credentials, package registry auth, AI coding assistant configs (Claude, Gemini, Codex, Cline), MCP configuration files, and cryptocurrency wallets. Stolen data is packed into a TAR archive, GZIP-compressed, and AES-256-GCM encrypted before exfiltration. Blackpoint's MDR team investigated the incident and warns that stealing MCP tokens could grant attackers the same downstream access developers extended to their AI agents. Admins are urged to update SimpleHelp immediately and rotate all credentials.

US seizes hundreds of FIFA World Cup illegal streaming domains

The U.S. Justice Department seized nearly 400 web domains used to illegally stream 2026 FIFA World Cup matches, as part of Operation Offsides — a coordinated global effort involving international law enforcement and private sector partners including FIFA, NBCUniversal, and Warner Bros. Authorities targeted servers and domains across multiple countries including Peru, Bulgaria, Croatia, Romania, Poland, and Colombia. Officials also warned that illegal streaming sites expose viewers to malware and data theft risks. The action follows a related shutdown of 44 domains tied to the PirloTV sports piracy network, which generated over 950 million visits annually.

Why Most People Give Up on Understanding Blockchain

A beginner-friendly explainer of blockchain fundamentals that addresses why most people disengage from learning the technology. Covers the core concepts of Distributed Ledger Technology, the difference between centralized and distributed systems, peer-to-peer architecture, consensus mechanisms (Proof of Work and Proof of Stake), immutability, and the role of cryptography in enabling trustless coordination. Uses Bitcoin as a concrete example throughout.

The Gentlemen RaaS: rapid growth and a new ransomware variant

Kaspersky researchers provide a detailed technical analysis of The Gentlemen, a rapidly growing ransomware-as-a-service (RaaS) group that ranked among the top 10 ransomware actors in the first half of 2026. The group uses a Go-based ransomware with a custom obfuscator, a Go-based backdoor using Yamux for C2 communication, and a newly discovered C-based ransomware variant still in development. Their TTPs include exploiting internet-facing VPNs and firewalls, BYOVD attacks using multiple vulnerable drivers to kill EDR/AV products, lateral movement via GPO deployment and PsExec, network sniffing with netsh, and Active Directory reconnaissance with SharpADWS. The Go ransomware uses Curve25519 + XChaCha20 encryption while the new C variant uses AES256-GCM + RSA via OpenSSL. Targets span manufacturing, IT, healthcare, finance, and logistics across Brazil, China, Indonesia, Taiwan, and Thailand. Full IOCs including hashes, C2 IPs, and vulnerable driver hashes are provided.