Meet The Gentlemen, a notorious ransomware group with a sprawling affiliate program that's left 478 victims in its wake, exploiting modern vulnerabilities with alarming speed and flexibility. Led by a single Russian-language operator, LARVA-368, this cybercrime powerhouse has been wreaking havoc since March 2025.
A massive data breach at VRChat has exposed the sensitive information of over 2.4 million users, leaving them vulnerable to potential cyber threats. This alarming incident highlights the importance of online security and data protection.
Europol has dismantled a massive cryptocurrency laundering operation, known as AudiA6, that handled over $380 million in illicit funds for ransomware actors and cybercriminals. The service promised anonymity, but actually took a 3-10% cut to clean and return tainted assets in just an hour.
Cyber attackers are now disguising malware as legitimate AI learning guides and developer tools, tricking professionals into opening malicious files that look like trusted educational content. They've been distributing booby-trapped archives labeled as AI study guides and developer tools, such as fake AI-ready PostgreSQL and agentic coding guides.
Identity crimes are no longer standalone incidents, but rather gateways to multiple, simultaneous frauds that can wreak havoc on victims' lives. A staggering 25.6% of victims now face two or more concurrent events, a 23.5% surge from the previous year.
A recent data breach at VRChat has compromised 2.4 million user accounts, exposing sensitive info like usernames, email addresses, and login histories, which could be used to target users with malicious attacks. Fortunately, passwords, payment details, and government IDs appear to be safe, but users are still advised to be cautious.
A staggering 3.3 billion identity records are now circulating on illicit markets, thanks to a whopping 11.1 million devices infected with infostealers last year - a digital threat landscape that's more vulnerable than ever. This alarming trend highlights the urgent need for robust protection against AI agents' vulnerability to phishing risks.
Coupang has been slapped with a whopping $409 million fine for a massive data breach that exposed the personal info of 37.55 million people, due to a lax safety management system and negligence in key security measures. The hefty penalty is part of a landmark enforcement action by South Korea's Personal Information Protection Commission.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
In a major blow to cybercrime, Interpol has dismantled the notorious SniperDz Phishing-as-a-Service platform, a significant player in the global phishing landscape. This success is a testament to the power of cross-border collaboration, with 13 countries joining forces to bring down the operation.
The notorious 15-year-old APT group, OceanLotus, is now setting its sights on Vietnam's investors with a cunning new backdoor attack called SPECTRALVIPER, showcasing their relentless adaptability and aggressive tactics. This latest move has left experts wondering if it's a temporary shift or a long-term strategy.
Ransomware attacks have taken a sinister turn, with a growing number of hackers ditching decryption keys and instead using stolen data to extort their victims. In fact, a recent report found that a whopping 87% of ransomware claims now involve data theft, with encryption becoming a thing of the past.
The FBI and Justice Department have shut down 13 fake websites pretending to be legitimate consulting firms, targeting US security clearance holders with lucrative job offers that aimed to extract sensitive information for the Chinese government. These seized domains were part of a sophisticated intelligence collection campaign that began in November 2023.
Despite a court order blocking it from doing so, NSO Group continues to target WhatsApp users, defying the ruling and putting users at risk. The company is fighting to overturn the order, claiming it will suffer harm if it's forced to comply.
Meet The Gentlemen, a notorious ransomware gang that's rapidly growing in power thanks to its unusually generous 90/10 affiliate revenue split, outshining the industry standard 80/20 and attracting top talent from rival groups. This bold move has catapulted them to become the second most active ransomware group, with over 332 reported victims since mid-2025.
Researchers have uncovered a concerning pattern of targeted GPS disruptions, with at least 75 brief outages detected across northern Europe between 2019 and 2026, all triggered by high-powered radio energy bursts. These 10-second jamming events, occurring at a frequency used by GPS and European navigation satellites, coincided with navigation antenna failures from Romania to Greenland.
Beware of "agentjacking" attacks that exploit AI coding agents' implicit trust, allowing hackers to trick them into executing malicious code on developers' machines. This new class of attack starts with a simple exploit of publicly available credentials, putting even the most secure systems at risk.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deployment
The University of Nottingham has confirmed a major data breach, with a notorious cybercriminal group gaining access to a massive 454,600 student records, affecting both current students and alumni. The university is working closely with authorities and experts to investigate the incident and mitigate its impact.
Within 24 hours of Ivanti releasing a patch for a high-severity vulnerability in its Sentry software, attackers began exploiting it in real-world attacks, with a large number of exploitation attempts detected. The flaw, tracked as CVE-2026-10520, allows hackers to execute code with root privileges on vulnerable mobile gateways.
A botnet once dismantled by US law enforcement has made a stunning comeback, with over 1,500 compromised routers and IoT devices now under the control of China-nexus actors, who are using it to fuel influence campaigns and recruitment scams. This resurgence poses a significant threat, with the same group of actors still active and causing chaos.
OpenAI has uncovered a sneaky Chinese influence operation that used ChatGPT to spread disinformation, posing as American voices to manipulate online debates. The operation, tracked by OpenAI's threat intelligence team, appears to be a classic case of foreign meddling.
A single, unauthenticated request is all it takes to exploit a high-severity flaw in Langflow, a popular AI development platform, allowing attackers to write arbitrary files to its filesystem. This is made possible by a path traversal vulnerability, CVE-2026-5027, which can be easily triggered due to Langflow's default unauthenticated auto-login feature.
The Miasma worm's source code leak is a game-changer, putting the entire open-source ecosystem at risk after already infiltrating 73 Microsoft repositories on GitHub. This credential-stealing attack framework operates autonomously, spreading rapidly by infecting developer machines and compromising legitimate repositories.
ShinyHunters, a notorious extortion group, has launched a massive data theft campaign targeting Oracle PeopleSoft servers, compromising over 300 instances across 100+ organizations, with a significant impact on the education sector. The attackers have brazenly claimed responsibility, boasting of their exploits in a chilling conversation with BleepingComputer.
A disgruntled bug hunter, known as Nightmare Eclipse, has revealed a new zero-day vulnerability called RoguePlanet, which can give attackers SYSTEM-level control over fully patched Windows 10 and 11 systems. The exploit, fueled by a grudge against Microsoft, targets a weakness in Windows Defender.