[SPONSOREDNUBIVANCE]
Know a small business winging it on security?
No IT department, no security budget, real exposure. Nubivance builds right-sized security foundations for small companies. Send them this.
Send it alongMalware & Ransomware
Hackers Exploit New Microsoft SharePoint Vulnerability in Attacks
Hackers are already exploiting a newly discovered critical flaw in Microsoft SharePoint, with over 8,500 servers exposed online and vulnerable to attacks. This authentication bypass vulnerability, known as CVE-2026-55040, allows hackers to disclose files, modify data, and wreak havoc on your system.
Russian Hackers Breach Polish Power Plant via Private APN
In a chilling cyberattack, Russian hackers infiltrated a Polish power plant by breaching a wind farm's VPN and firewall, then exploited a cellular router to gain control of the plant's systems. The attackers forced a combined heat and power plant into a controlled shutdown, overriding its operations with a password-protected lock.
VMware vCenter Vulnerability Exploited for Persistent Remote Access
Hackers are quickly exploiting a high-severity vulnerability in VMware vCenter, using it to gain persistent remote access to affected systems, with evidence of attacks emerging just days after patches were released. This alarming timeline suggests that publicly disclosing vulnerabilities can sometimes inadvertently hand attackers a roadmap for exploitation.
Malicious LiteLLM Releases Expose Over 2,100 Organizations to Credential Theft
Over 2,100 organizations are at risk of credential theft due to malicious LiteLLM releases that harvested sensitive data, including environment variables, SSH keys, and cloud credentials, and sent it to an attacker-controlled domain. These compromised packages were live on PyPI for about 40 minutes on March 24, leaving a trail of potential exposure.
Aeternum Botnet Exploits Blockchain for Decentralized Command Structure
Meet Aeternum, a sneaky botnet loader that's exploiting the Polygon blockchain's smart contracts to operate with a decentralized command structure, making it a formidable and harder-to-stop threat. This innovative approach allows Aeternum to shift parts of its malware operations onto a decentralized infrastructure, giving it a unique advantage.
Kimwolf Botnet Evolves to Evade Takedowns and DDoS Defenses
The Kimwolf Botnet has upgraded its tactics, now using the Ethereum Name Service to evade detection and launching sophisticated HTTP/2 floods that mimic real Chrome traffic, making it harder to distinguish from legitimate visitors. This new approach allows infected devices to blend in with normal web traffic, bypassing traditional DDoS defenses.
DeadLock Ransomware Leverages Blockchain to Evade Takedown
DeadLock Ransomware is taking a disturbingly clever approach to evade shutdown by leveraging the Polygon blockchain to conceal its operational addresses, making it a formidable foe for cybersecurity efforts. By cleverly using decentralized building blocks, the group has already amassed a shocking 80 victims, mostly in Europe.
Lazarus Group Exploits Microsoft Zero-Day in Global Defense Sector Attacks
North Korea's notorious Lazarus Group has been exploiting a Microsoft zero-day vulnerability, CVE-2026-68820, since early June, targeting the global defense sector with alarming precision. This high-severity flaw, patched in August, allowed attackers to execute code with SYSTEM-level privileges, putting countless systems at risk.
Sandworm Hackers Exploit VPN Client in IT Pro Targeting Scam
Beware of fake job interviews! Cyber attackers, linked to the notorious Sandworm group, are targeting IT pros with bogus job offers, tricking them into installing a malicious VPN client to gain access to sensitive info.
Kimwolf Botnet Evolves to Evade DDoS Detection
The Kimwolf botnet has levelled up its game with a new upgrade, v7, which uses HTTP/2 floods to mimic real browser traffic, making it super tricky to detect as a DDoS attack. This sneaky move lets the botnet build complete browser fingerprints, blurring the line between legit and malicious traffic.
Microsoft Patches Zero-Day Windows Driver Flaw Under Active Attack
Microsoft just patched a high-severity Windows driver flaw, known as CVE-2026-68820, that was already being exploited by hackers in the wild. This zero-day vulnerability, with a CVSS score of 7.0, could be triggered by a race condition, allowing attackers to gain a foothold in targeted systems.
CAV3RN Espionage Framework Evolves With Google Apps Script C2 Relay
Meet the sneaky CAV3RN Espionage Framework, which just got a clever upgrade - it can now use Google Apps Script as a relay to secretly communicate with its controllers, all while hiding in plain sight within DNS traffic. This clever tactic lets the malware decide on a per-transaction basis whether to connect directly to its masters or take a detour through Google's services.
Head Mare APT Exploits Unpatched TrueConf Servers to Deliver PhantomCore Malware
In a sneaky move, the Head Mare group exploited unpatched TrueConf servers to spread PhantomCore malware, using a chain of vulnerabilities to swap out legitimate client installers with infected ones. This allowed them to secretly deliver a backdoor to unsuspecting meeting participants.
Kimwolf Botnet Evolves with Enhanced DDoS Capabilities
Meet Kimwolf v7, a highly evolved botnet that's taken DDoS capabilities to the next level with its cutting-edge command-and-control resolution via Ethereum's blockchain naming system, ENS. First discovered in February 2026, this malware has been quietly building its arsenal since August 2024, targeting a range of devices from Linux IoT gadgets to Android TV boxes.
Cisco Warns of Active Exploitation of VPN Flaw in ASA, FTD Software
Cisco warns that a high-severity VPN flaw, CVE-2026-20349, is being actively exploited, allowing attackers to send crafted HTTP requests that can cause affected devices to reload and disrupt operations. This denial-of-service vulnerability can be triggered remotely without authentication, making it a critical threat.
Sandworm-linked hackers exploit fake job interviews to deploy command-running VPN malware
Hackers linked to the notorious Sandworm group are using fake job interviews to trick IT workers into installing VPN malware that can run commands on their devices. They pose as recruiters from legitimate IT companies, making contact with potential victims after reviewing their resumes on job search websites.
[SPONSOREDNUBIVANCE]
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverage
DeadLock Ransomware Exploits Polygon Smart Contracts
DeadLock Ransomware takes a sophisticated approach by leveraging the Session messaging network and blockchain-backed services to streamline its extortion process, making it harder for victims to recover. Its operators use a clever combination of decentralized chat and a self-contained HTML app to communicate with victims and demand payment in Bitcoin or Monero.
Researchers Expose AI-Assisted SharePoint Exploit Chain Enabling Unauthenticated RCE
In just 24 days, security researchers uncovered a shocking exploit chain that lets hackers impersonate any SharePoint user and run code on the server - no login required. This chain combines a clever JWT bypass with a second flaw, putting countless systems at risk.
DDoS Attacks Surge Amid Global Conflicts, Sports Events
DDoS attacks skyrocketed in Q2, with a 519 percent surge in network-layer attacks over 1 Tbps, and the media and publishing sector bore the brunt, accounting for 14.2 percent of all attacks launched in 2026. This sector was hit with nearly four times as many attacks as the second most-targeted sector, and a whopping six times more in Q2 alone.
Malware Packages Exploit Ethereum for C2 Communications
Malicious actors have cleverly exploited Ethereum to spread malware, with six suspicious npm packages found querying an attacker-controlled wallet to fetch additional malicious payloads. This sneaky tactic was uncovered by Sonatype Research Labs on August 10, revealing a new level of sophistication in cyber attacks.
DDoS Attacks Over 1 Tbps Surge Fivefold in Q2
DDoS attacks exceeding 1 Tbps skyrocketed by 519% in Q2, with Cloudflare mitigating over 800 of these massive attacks - a dramatic surge from just 130 in Q1. This sharp escalation highlights the rapidly growing threat of large-scale DDoS attacks.
Ransomware gangs exploit Microsoft SharePoint flaw
Ransomware gangs are actively exploiting a high-severity Microsoft SharePoint flaw, known as CVE-2026-45659, that allows them to execute arbitrary code on unpatched servers, and it's crucial to patch up ASAP to avoid falling victim. Microsoft has already released security updates for affected SharePoint versions, so make sure to get those installed pronto!
US Local Governments Targeted in Wave of Cyber Attacks
Local governments are under siege, with a growing wave of cyber attacks crippling their operations - just like Suisun City, which was forced to declare a state of emergency after a malicious software attack shut down its entire IT network. The attacks are leaving communities vulnerable, with city services and internal operations grinding to a halt.
Gunra Ransomware Targets Infrastructure with Fortinet, Schneider Electric Exploits
Gunra ransomware is on the loose, exploiting vulnerabilities in critical infrastructure from Fortinet and Schneider Electric to wreak havoc on organizations worldwide. This malicious campaign uses double-extortion tactics, combining data theft with file encryption to maximize damage.