[SPONSOREDNUBIVANCE]
Know a small business winging it on security?
No IT department, no security budget, real exposure. Nubivance builds right-sized security foundations for small companies. Send them this.
Send it alongIntelligence Briefing
Latest Analysis
Cybersecurity intelligence, threat analysis, and national security reporting.
MSPs Targeted by SCKit Malware in ScreenConnect Attacks
In a lightning-fast attack, hackers compromised 288 endpoints across 48 organizations in just 90 minutes using a new malware toolkit called SCKit, specifically designed to exploit managed service providers (MSPs) who rely on ScreenConnect. This sophisticated toolkit can turn the tables on technicians, allowing attackers to establish persistent remote access and spread between systems.
GitHub Compromises Expose Cloud Credentials in Widespread Attack
A massive attack on GitHub has compromised 4,837 accounts, leading to the theft of sensitive secrets from at least 1,835 targets, with researchers tracking a whopping 61,764 probed repositories. The attackers used stolen credentials to infiltrate and siphon off valuable data in a widespread campaign.
BrickLink Disrupted by Unusual Activity, Remains Offline
BrickLink's been taken offline due to some unusual activity, and the team is working hard to secure the platform, contain the issue, and get to the bottom of what happened. The popular Lego marketplace has been down since November 6, with a return to normal expected soon.
Global Operation Disrupts Malware Networks, Uncovers 6.4 Million Stolen Credentials
In a major win for global cybersecurity, international authorities have joined forces to dismantle a massive malware network, uncovering a staggering 6.4 million stolen credentials and crippling three major commercial malware toolkits. This landmark operation, dubbed Operation Endgame, marks a significant milestone in the fight against cybercrime, showcasing the power of cross-border collaboration in protecting people worldwide.
Australia Weighs Nuclear Submarine Options Beyond AUKUS Pillar One
Australia is considering a new path for its nuclear submarine program, with a recent inquiry suggesting that the costly AUKUS Pillar One plan for eight submarines could be scrapped in favor of a more affordable, sovereign fleet of 12 attack subs. This bold move could save taxpayers billions while still ensuring the country's maritime security.
Autonomous AI Targets Semiconductor, Defense Sectors in China-Linked Campaign
Chinese-speaking attackers have unleashed a powerful autonomous AI campaign, using an open-source framework called Cairn to launch 25 devastating operations against at least 19 organizations in the semiconductor and defense sectors. The results are alarming: over a million member records compromised and 10 successful breaches in just a month.
Groups Urge Hill Leaders to Separate Section 702 Renewal from Defense Bill
Twenty-seven civil liberties groups, led by Demand Progress, are urging Congress to keep the renewal of Section 702 separate from the National Defense Authorization Act, warning that bundling the two would undermine debate and the democratic process. They argue that attaching the renewal to a must-pass bill would be a procedural and substantive failure.
US Military Reimagines Warfare with Autonomous Robotics
The US military is revolutionizing warfare with autonomous robotics, and recent exercises at Fort Bragg and Clark Range are leading the charge, showcasing how soldiers are learning to operate alongside and against cutting-edge robotic systems. NATO's latest maritime exercise is also pushing the boundaries of coordinated autonomous operations.
Qilin Ransomware Operator Unmasked
Meet Qilin, the notorious ransomware operator that's been wreaking havoc on a massive scale, with a staggering 365 victim organizations in just three months. This cybercrime group has become the most active ransomware affiliate program worldwide, using a clever business model that rewards hackers with up to 80% of extortion payments.
Cloud Pentest Methodology Exposes Trust Boundaries
Imagine a hotel with three layers of vulnerability: the public booking website, the guest rooms and staff areas, and the underlying infrastructure - a model that helps cloud providers identify trust boundaries and prevent devastating attacks, like the one that started with CVE-2026-19478. By mapping cloud infrastructure to this model, providers can better protect themselves against single vulnerabilities that can seed an attack chain.
China's Y-15/30 Transport Spawns Multirole Ambitions
A newly surfaced diagram reveals a surprising potential for China's Y-15/30 Transport: a tanker variant that could transform this medium transport family into a multi-role powerhouse. This bold move suggests that Chinese planners are thinking big, envisioning the Y-15/30 as a versatile workhorse with a range of capabilities.
Military SATCOM Evolves Toward Interoperable, Multi-Orbit Networks
The future of military SATCOM is all about agility and control - with software-defined ground systems, operators can instantly scale resources, adapt to changing requirements, and deploy new services faster, giving them a critical edge in sovereignty and operational effectiveness. By embracing interoperable, multi-orbit networks, states can accelerate time to revenue and drive a faster return on investment.
Police Location Tool Exploits App Data
Meet Webloc, a powerful tool that helps law enforcement track smartphones by tapping into location data from everyday apps like weather, gaming, and email services, creating a searchable map of movements over time. This is made possible by leveraging billions of location data points generated by these commonly used apps.
SpaceX to Integrate Laser Comms Terminals with Missile Tracking Sats
SpaceX just landed a $9.9 million contract to explore how its cutting-edge laser communications terminals can supercharge missile-warning and tracking satellites. The innovative study aims to overcome technical hurdles and pave the way for seamless data transmission between SpaceX's tech and the Space Development Agency's satellite network.
Japan Weighs Denial Defense Strategy Amid Debate on US Nuclear-Armed Ship Port Calls
Defense Minister Koizumi Shinjiro describes "denial capabilities" as the crucial link between deterrence and response, helping to prevent attacks and protect Japan's interests. He emphasizes that this approach aligns with Japan's exclusively defense-oriented policy, reaffirming the country's commitment to not initiating attacks on its own.
OpenAI Warns Organizations to Adopt AI-Powered Security Tools
Stay ahead of security threats by embracing AI-powered tools, warns OpenAI President Greg Brockman, as companies' safety now relies heavily on the advanced models they use to defend themselves. Reorienting your security practice around frontier models is crucial to staying secure.
[SPONSOREDNUBIVANCE]
Rapid7 deployed right the first time.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deployment
Microsoft Outage Disrupts Global Access to 365 Services
Microsoft is working to resolve a global outage affecting access to its 365 services, caused by a number of servers unexpectedly going offline and straining the remaining infrastructure. The issue, which began on Thursday, has prompted the company to safely return the affected servers to service as quickly as possible.
Hackers Exploit N-able Zero-Day to Deploy Cryptocurrency Miners
Security researcher Sean Bales took an unconventional approach, releasing his findings on a zero-day exploit directly to the public, giving the vendor the reins to decide on a fix. This zero-day, known as 4EverAble2Shell, can give hackers root control of N-central servers, and has already been used to deploy cryptocurrency miners.
Apache HTTP Server Patches Flaw Exploited for Remote Code Execution
A critical flaw in Apache HTTP Server's HTTP/2 module, known as CVE-2026-119618, can be exploited by unauthenticated attackers to execute remote code on vulnerable hosts. This race-condition bug can corrupt heap memory, allowing malicious actors to gain control of affected systems.
Zero-Day Exploit Turns Windows Log File System into System Access Vector
A security researcher, known as MSNightmare, has discovered a zero-day exploit that can turn Windows' log file system into a vulnerability, allowing a local user to gain SYSTEM access - and has even released proof-of-concept code to demonstrate it. This exploit, dubbed SignDrop, targets a recently added log-authentication feature in Windows 11 and Windows Server 2025.
AI Fuels Cyber Attacks as Linux Kernel Bugs and Spyware Threats Surge
Cyber attacks are getting more sophisticated by the minute, with hackers leveraging automation, trusted tools, and sneaky tactics to launder massive amounts of money - just like the record $6.43 billion Binance breach, which was linked to a sprawling network of over 20,000 wallets and 65,000 transactions.
Developer Exploits eMudhra Leak to Block Smart TV Ads
A clever developer, Daniel Vrátil, took advantage of a massive security blunder at Indian certificate authority eMudhra to block ads on his smart TV, dodging an update that would have revoked the exploited certificate. His quick thinking was made possible by eMudhra's shockingly weak private keys, including one that was simply the number four.
ScreenConnect Flaw Exploited in MSP Attack Paths
A newly exploited flaw in ScreenConnect, CVE-2026-84869, is being used to turn legitimate support sessions into gateways for massive attacks on multiple customers, with a severity score of 9.9. Security researchers have discovered a toolkit called SCKit that weaponizes this vulnerability and built-in remote management features to spread attacks.
AI Lookalike Domains Redirect Users to Browser Malware and Search Hijackers
Beware of AI lookalike domains that can redirect you to malware and search hijackers - a new campaign uses 186 fake domains to trick users into installing malicious software. These bogus sites impersonate popular AI brands, including ChatGPT and Google Gemini, to get you to verify, install, or run something that could compromise your browser.