US authorities dismantled a GRU-linked operation that compromised vulnerable TP-Link and MikroTik home/SMB routers to perform DNS hijacking and adversary-in-the-middle attacks. The APT28 operation was used to steal credentials and surveil targets by silently redirecting traffic through attacker-controlled infrastructure.
Source: SecurityWeek
Iran-linked actors targeting US critical infrastructure OT and PLCs
US agencies warned of ongoing activity by Iranian-affiliated APTs attempting to access and disrupt operational technology environments, including Rockwell Automation/Allen‑Bradley PLCs, across energy, water, transportation, and government sectors. The alert ties the activity to rising geopolitical tensions and urges immediate hardening of internet-exposed devices and segmentation between IT and OT.
Source: Help Net Security
BlueHammer Windows zero‑day exploit leaked; works on fully patched systems
A functional proof-of-concept for an unpatched Windows local privilege escalation dubbed “BlueHammer” was released, with researchers fixing bugs to make it reliable on current Windows 10/11 and Server builds. It’s unclear when Microsoft will issue a fix, raising near-term risk of weaponization and requiring heightened EDR monitoring for suspicious privilege-escalation chains.
Source: Help Net Security
Researcher flags Adobe Reader zero‑day exploited for months
A well-known security researcher found a PDF sample apparently exploiting an unpatched Adobe Reader vulnerability that may have been used in the wild for months. Organizations should enforce Protected View, limit risky PDF features (e.g., JavaScript), and monitor for abnormal Reader child-process behavior while awaiting vendor guidance.
Source: SecurityWeek
Systemic Node.js issue on Windows enables local code execution across apps
ZDI detailed a long-standing Node.js module resolution behavior on Windows that searches C:\node_modules, allowing low-privileged users to plant malicious packages for execution by apps with missing/optional dependencies. Case studies include a now-fixed npm CLI issue (CVE‑2026‑0775) and an unpatched Discord desktop vulnerability (CVE‑2026‑0776), underscoring the need to audit dependency trees, avoid C:\node_modules lookups, and harden installer/runtime paths.
Source: Zero Day Initiative
Attackers abuse GitHub/Jira notification systems to bypass email defenses
Cisco Talos warns phishers are sending lures via SaaS platforms’ own notification infrastructure, which passes SPF, DKIM, and DMARC—evading common email security checks. Defenders should tighten allowlists, add URI and content inspection for SaaS-originated mail, and push in-app verification for high-risk requests.
Source: Help Net Security
Chaos botnet shifts from routers to misconfigured Linux cloud servers
Darktrace observed a new Chaos malware variant actively compromising misconfigured Linux cloud instances, expanding beyond the botnet’s historic focus on routers and edge devices. The capability jump highlights the urgency of hardening cloud services, closing exposed management interfaces, and continuously validating IaC and security group baselines.
Source: Help Net Security
You May Also Be Interested In...
Docker fixes AuthZ bypass bug that created containers with excessive privileges
Social engineering attacks on open source developers are escalating
Critical Ninja Forms vulnerability allows remote code execution