#cyber-security — Public Fediverse posts

Update on Attacks by Threat Group APT-C-60 in 2026

APT-C-60 continues targeting organizations in Japan with evolved tactics observed throughout 2026. The threat group employs spear-phishing emails containing Proton Drive links or direct attachments with RAR archives. Victims extract LNK files that execute JavaScript via mshta.exe, leading to multi-stage payload delivery. The attackers abuse legitimate services including GitHub, GitLab, jsDelivr, and Codeberg as infrastructure for hosting malicious components. Git.exe is leveraged to execute scripts that deploy downloaders and loaders, ultimately delivering SpyGlace malware versions 3.1.15 through 3.1.18. The attack chain involves multiple obfuscated JavaScript files and persistence mechanisms similar to previous campaigns. By utilizing developer-oriented services and CDNs commonly allowed in corporate environments, the threat actor attempts to evade detection and blend malicious traffic with legitimate communications.

Pulse ID: 6a54e01e0597d81e8ad9f7d0
Pulse Link: https://otx.alienvault.com/pulse/6a54e01e0597d81e8ad9f7d0
Pulse Author: AlienVault
Created: 2026-07-13 12:54:54

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CDN #CyberSecurity #DNS #Email #GitHub #ICS #InfoSec #Japan #Java #JavaScript #LNK #Malware #OTX #OpenThreatExchange #Phishing #RAT #SMS #SpearPhishing #bot #AlienVault

Update on Attacks by Threat Group APT-C-60 in 2026

APT-C-60 continues targeting organizations in Japan with evolved tactics observed throughout 2026. The threat group employs spear-phishing emails containing Proton Drive links or direct attachments with RAR archives. Victims extract LNK files that execute JavaScript via mshta.exe, leading to multi-stage payload delivery. The attackers abuse legitimate services including GitHub, GitLab, jsDelivr, and Codeberg as infrastructure for hosting malicious components. Git.exe is leveraged to execute scripts that deploy downloaders and loaders, ultimately delivering SpyGlace malware versions 3.1.15 through 3.1.18. The attack chain involves multiple obfuscated JavaScript files and persistence mechanisms similar to previous campaigns. By utilizing developer-oriented services and CDNs commonly allowed in corporate environments, the threat actor attempts to evade detection and blend malicious traffic with legitimate communications.

Pulse ID: 6a54e01e0597d81e8ad9f7d0
Pulse Link: https://otx.alienvault.com/pulse/6a54e01e0597d81e8ad9f7d0
Pulse Author: AlienVault
Created: 2026-07-13 12:54:54

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CDN #CyberSecurity #DNS #Email #GitHub #ICS #InfoSec #Japan #Java #JavaScript #LNK #Malware #OTX #OpenThreatExchange #Phishing #RAT #SMS #SpearPhishing #bot #AlienVault

Threat Actors Achieve Persistence After SQL Injection

Threat actors gaining initial access through SQL injection exploited a web application vulnerability in a technology sector organization. After compromising an MSSQL instance via inadequate input validation, the attackers deployed base64-encoded PowerShell scripts to conduct reconnaissance using tasklist commands and exfiltrated results to an external server. They established persistence by enabling Remote Desktop Services, creating an administratively privileged user account named adminweb2$, and disabling Windows Defender. The attackers installed BadIIS modules for SEO fraud, deployed XMRig cryptocurrency miner with hidden file attributes, and utilized service creation tools. Multiple PowerShell scripts and batch files were downloaded throughout the attack to facilitate various malicious operations and maintain access.

Pulse ID: 6a551f28c1e094d7650c8ecd
Pulse Link: https://otx.alienvault.com/pulse/6a551f28c1e094d7650c8ecd
Pulse Author: AlienVault
Created: 2026-07-13 17:23:51

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #InfoSec #MSSQL #OTX #OpenThreatExchange #PowerShell #RAT #SQL #Vulnerability #Windows #bot #cryptocurrency #AlienVault

Threat Actors Achieve Persistence After SQL Injection

Threat actors gaining initial access through SQL injection exploited a web application vulnerability in a technology sector organization. After compromising an MSSQL instance via inadequate input validation, the attackers deployed base64-encoded PowerShell scripts to conduct reconnaissance using tasklist commands and exfiltrated results to an external server. They established persistence by enabling Remote Desktop Services, creating an administratively privileged user account named adminweb2$, and disabling Windows Defender. The attackers installed BadIIS modules for SEO fraud, deployed XMRig cryptocurrency miner with hidden file attributes, and utilized service creation tools. Multiple PowerShell scripts and batch files were downloaded throughout the attack to facilitate various malicious operations and maintain access.

Pulse ID: 6a551f28c1e094d7650c8ecd
Pulse Link: https://otx.alienvault.com/pulse/6a551f28c1e094d7650c8ecd
Pulse Author: AlienVault
Created: 2026-07-13 17:23:51

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #InfoSec #MSSQL #OTX #OpenThreatExchange #PowerShell #RAT #SQL #Vulnerability #Windows #bot #cryptocurrency #AlienVault

🟠 CVE-2026-26396 - High (7.5)

OpenBMB XAgent v1.0.0 and before is vulnerable to path traversal in the file() function in XAgent/XAgentServer/application/routers/workspace.py. The input parameter “filename” is user-controllable and is concatenated into the file path to be r...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26396/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-55773 - High (8.8)

CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Cedar-expres...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-55773/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-55771 - High (8.8)

CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 4.9.0, the EntityIdentifier.equals() has inverted null/self branches which could lead to incorrect eq...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-55771/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 EUVD-2026-43524

📊 Score: 8.8/10 (CVSS v3.1)
📦 Product: cedar-java
🏢 Vendor: cedar-policy
📅 Updated: 2026-07-13

📝 CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 4.9.0, the EntityIdentifier.equals() has inverted null/self branches which could lead to incorrect equal...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-43524

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-43524

📊 Score: 8.8/10 (CVSS v3.1)
📦 Product: cedar-java
🏢 Vendor: cedar-policy
📅 Updated: 2026-07-13

📝 CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 4.9.0, the EntityIdentifier.equals() has inverted null/self branches which could lead to incorrect equal...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-43524

#cybersecurity #infosec #euvd #cve #vulnerability

🧪 NEW BETA RELEASES 🧪

📱 iOS 26.6 beta 5 (23G5065a)
📱 iPadOS 26.6 beta 5 (23G5065a)
📱 iPadOS 27.0 beta 3 v.2 (24A5380l)
💻 macOS 26.6 beta 5 (25G5065a)
💻 macOS 27.0 beta 3 v.2 (26A5378n)
📺 tvOS 26.6 beta 5 (23L5766a)
🥽 visionOS 26.6 beta 5 (23O5765a)
⌚ watchOS 26.6 beta 5 (23U5062b)

#apple #cybersecurity #infosec #security #ios

🧪 NEW BETA RELEASES 🧪

📱 iOS 26.6 beta 5 (23G5065a)
📱 iPadOS 26.6 beta 5 (23G5065a)
📱 iPadOS 27.0 beta 3 v.2 (24A5380l)
💻 macOS 26.6 beta 5 (25G5065a)
💻 macOS 27.0 beta 3 v.2 (26A5378n)
📺 tvOS 26.6 beta 5 (23L5766a)
🥽 visionOS 26.6 beta 5 (23O5765a)
⌚ watchOS 26.6 beta 5 (23U5062b)

#apple #cybersecurity #infosec #security #ios

"Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting" by Cybersecurity and Infrastructure Security Agency (#CISA)🇺🇸 and 18 other gov't security organizations🇦🇺🇨🇦🇳🇿🇬🇧🇨🇿🇩🇰🇪🇪🇫🇮🇫🇷🇮🇹🇵🇱🇸🇪 - Recommended router configuration steps to mitigate recurring Russian network attacks on western #infrastructure. https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-194a #malware #cyberwar #cybersecurity #Internet #networking #tech

"Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting" by Cybersecurity and Infrastructure Security Agency (#CISA)🇺🇸 and 18 other gov't security organizations🇦🇺🇨🇦🇳🇿🇬🇧🇨🇿🇩🇰🇪🇪🇫🇮🇫🇷🇮🇹🇵🇱🇸🇪 - Recommended router configuration steps to mitigate recurring Russian network attacks on western #infrastructure. https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-194a #malware #cyberwar #cybersecurity #Internet #networking #tech

State of (in)security - Week 28, 2026

Week 28 of 2026 saw 17 security advisories and 26 incidents (down from 28 the prior week), with roughly 2.7 million individuals impacted. The largest breach is Moody Bible Institute's exposure of 2.3 million records via a PeopleSoft zero-day. Ransomware/malware and unauthorized access were the leading causes (7 incidents each), healthcare was the hardest-hit industry, and several actively exploited flaws were reported in products including Adobe ColdFusion, Gitea, Joomla extensions, and Langflow.

**Make sure to update your Joomla and plugins. They are under heavy attack!**
#cybersecurity #infosec #knowledge #weeklyreport
https://beyondmachines.net/event_details/state-of-in-security-week-28-2026-p-s-9-s-y/gD2P6Ple2L

State of (in)security - Week 28, 2026

Week 28 of 2026 saw 17 security advisories and 26 incidents (down from 28 the prior week), with roughly 2.7 million individuals impacted. The largest breach is Moody Bible Institute's exposure of 2.3 million records via a PeopleSoft zero-day. Ransomware/malware and unauthorized access were the leading causes (7 incidents each), healthcare was the hardest-hit industry, and several actively exploited flaws were reported in products including Adobe ColdFusion, Gitea, Joomla extensions, and Langflow.

**Make sure to update your Joomla and plugins. They are under heavy attack!**
#cybersecurity #infosec #knowledge #weeklyreport
https://beyondmachines.net/event_details/state-of-in-security-week-28-2026-p-s-9-s-y/gD2P6Ple2L

🟠 CVE-2026-49970 - High (8.8)

Laravel-Mediable before 7.0.0 contains a path traversal vulnerability in the File::sanitizePath() function that allows attackers to write uploaded files to arbitrary locations by controlling the directory argument passed to MediaUploader::toDestin...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-49970/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-49972 - High (8.8)

Laravel-Mediable before 7.0.0 contains a file upload vulnerability that allows unauthenticated attackers to achieve remote code execution by uploading a file with an embedded PHP extension disguised within a double extension such as shell.php.jpg....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-49972/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-55772 - High (8.8)

CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Record-to-En...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-55772/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 EUVD-2026-43515

📊 Score: 5.1/10 (CVSS v3.1)
📦 Product: phoenix_live_view, phoenix_live_view
🏢 Vendor: phoenixframework
📅 Updated: 2026-07-13

📝 Cross-site scripting vulnerability in phoenixframework phoenix_live_view allows an attacker to bypass URL scheme validation and execute JavaScript in a victim's browser session.

The Phoenix.LiveView.Utils.valid_destinat...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-43515

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-43515

📊 Score: 5.1/10 (CVSS v3.1)
📦 Product: phoenix_live_view, phoenix_live_view
🏢 Vendor: phoenixframework
📅 Updated: 2026-07-13

📝 Cross-site scripting vulnerability in phoenixframework phoenix_live_view allows an attacker to bypass URL scheme validation and execute JavaScript in a victim's browser session.

The Phoenix.LiveView.Utils.valid_destinat...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-43515

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-43517

📊 Score: 8.7/10 (CVSS v3.1)
📦 Product: laravel-mediable
🏢 Vendor: plank
📅 Updated: 2026-07-13

📝 Laravel-Mediable before 7.0.0 contains a path traversal vulnerability in the File::sanitizePath() function that allows attackers to write uploaded files to arbitrary locations by controlling the directory argument passed to MediaUploader::toDestinatio...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-43517

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-43517

📊 Score: 8.7/10 (CVSS v3.1)
📦 Product: laravel-mediable
🏢 Vendor: plank
📅 Updated: 2026-07-13

📝 Laravel-Mediable before 7.0.0 contains a path traversal vulnerability in the File::sanitizePath() function that allows attackers to write uploaded files to arbitrary locations by controlling the directory argument passed to MediaUploader::toDestinatio...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-43517

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-43516

📊 Score: 5.3/10 (CVSS v3.1)
📦 Product: laravel-mediable
🏢 Vendor: plank
📅 Updated: 2026-07-13

📝 Laravel-Mediable before 7.0.0 contains a server-side request forgery vulnerability that allows remote attackers to issue arbitrary HTTP requests from the server by supplying unvalidated caller-controlled URLs to endpoints backed by MediaUploader::from...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-43516

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-43518

📊 Score: 5.3/10 (CVSS v3.1)
📦 Product: laravel-mediable
🏢 Vendor: plank
📅 Updated: 2026-07-13

📝 Laravel-Mediable before 7.0.0 contains a stored cross-site scripting vulnerability that allows authenticated or anonymous users to execute arbitrary JavaScript by uploading unsanitized SVG files containing embedded scripts in onload event handlers, sc...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-43518

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-43516

📊 Score: 5.3/10 (CVSS v3.1)
📦 Product: laravel-mediable
🏢 Vendor: plank
📅 Updated: 2026-07-13

📝 Laravel-Mediable before 7.0.0 contains a server-side request forgery vulnerability that allows remote attackers to issue arbitrary HTTP requests from the server by supplying unvalidated caller-controlled URLs to endpoints backed by MediaUploader::from...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-43516

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-43518

📊 Score: 5.3/10 (CVSS v3.1)
📦 Product: laravel-mediable
🏢 Vendor: plank
📅 Updated: 2026-07-13

📝 Laravel-Mediable before 7.0.0 contains a stored cross-site scripting vulnerability that allows authenticated or anonymous users to execute arbitrary JavaScript by uploading unsanitized SVG files containing embedded scripts in onload event handlers, sc...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-43518

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-43519

📊 Score: 7.7/10 (CVSS v3.1)
📦 Product: laravel-mediable
🏢 Vendor: plank
📅 Updated: 2026-07-13

📝 Laravel-Mediable before 7.0.0 contains a file upload vulnerability that allows unauthenticated attackers to achieve remote code execution by uploading a file with an embedded PHP extension disguised within a double extension such as shell.php.jpg. The...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-43519

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-43519

📊 Score: 7.7/10 (CVSS v3.1)
📦 Product: laravel-mediable
🏢 Vendor: plank
📅 Updated: 2026-07-13

📝 Laravel-Mediable before 7.0.0 contains a file upload vulnerability that allows unauthenticated attackers to achieve remote code execution by uploading a file with an embedded PHP extension disguised within a double extension such as shell.php.jpg. The...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-43519

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-43520

📊 Score: 9.5/10 (CVSS v3.1)
📦 Product: ServiceNow AI Platform, ServiceNow AI Platform, ServiceNow AI Platform (+4 more)
🏢 Vendor: Servicenow
📅 Updated: 2026-07-13

📝 ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain ...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-43520

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-43520

📊 Score: 9.5/10 (CVSS v3.1)
📦 Product: ServiceNow AI Platform, ServiceNow AI Platform, ServiceNow AI Platform (+4 more)
🏢 Vendor: Servicenow
📅 Updated: 2026-07-13

📝 ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain ...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-43520

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-43521

📊 Score: n/a
📅 Updated: 2026-07-13

📝 Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or bundled content within the Firefox for iOS application sandbox. This vulnerability was fixed in Firefox for iOS 152.4.

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-43521

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-43521

📊 Score: n/a
📅 Updated: 2026-07-13

📝 Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or bundled content within the Firefox for iOS application sandbox. This vulnerability was fixed in Firefox for iOS 152.4.

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-43521

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-43522

📊 Score: 8.8/10 (CVSS v3.1)
📦 Product: cedar-java, cedar-java, cedar-java
🏢 Vendor: cedar-policy
📅 Updated: 2026-07-13

📝 CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling cou...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-43522

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-43522

📊 Score: 8.8/10 (CVSS v3.1)
📦 Product: cedar-java, cedar-java, cedar-java
🏢 Vendor: cedar-policy
📅 Updated: 2026-07-13

📝 CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling cou...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-43522

#cybersecurity #infosec #euvd #cve #vulnerability

AI and the next wave of scams #negativepid #digitalInvestigations #OSINT #cybersecurity #AI #tech #onlineInvestigations #robotics #cyberpsychology #cybercrime https://negativepid.blog/ai-and-the-next-wave-of-scams/?utm_source=mastodon&utm_medium=social&utm_campaign=fedica-Negative-PID-Blog

This is a pretty bad one!

New CrashStealer malware poses as Apple crash reporting tool https://www.bleepingcomputer.com/news/security/new-crashstealer-malware-poses-as-apple-crash-reporting-tool/

#Cybersecurity #Infosec #Malware #macOs

🐝🍯 Oh, the riveting saga of a #TFTP honey pot—spoiler alert: it was forbidden! 🔐🚫 Apparently, attempting to #access this tantalizing "research" is like asking a bouncer to let you into a library rave. Nice try, but you shall not pass! 😂📚
https://bruceediger.com/posts/tftp-honeypot-results/ #HoneyPot #Forbidden #LibraryRave #CyberSecurity #Research #Humor #HackerNews #ngated

TFTP Honey Pot Results

https://bruceediger.com/posts/tftp-honeypot-results/

Comments: https://news.ycombinator.com/item?id=48897329

#HackerNews #TFTP #Honey #Pot #Results #cybersecurity #honeypot #networksecurity #dataanalysis #technews

Die Ransomware-Gruppe D1R hat Bosch auf ihrer Darknet-Seite gelistet, mit einer Frist von 11 Tagen und der Drohung, gestohlene Konstruktionsdaten zu veröffentlichen. Der Einbruch erfolgte nicht bei Bosch direkt, sondern über den Softwareanbieter Synopsys. Gestohlene Daten umfassen offenbar VHDL-Hardware-Designs und Unterlagen zum CAN-Bus-Protokoll — Technologie, die in Fahrzeugen, Zügen und Flugzeugen weltweit im Einsatz ist.

#ITSicherheit #Cybersecurity #Ransomware #SupplyChain #Bosch