ZCyberNews
中文

Articles

551 articles

Diagram of a software supply chain attack path from a poisoned package to a cloud management console, with a smart contract acting as command-and-control.
Malware

Web3 C2 Powers Cloud Supply Chain Attacks, Unit 42 Finds

Unit 42: ChainDrop npm worm hit 400+ packages and PolinRider spans npm, Go, Packagist, using smart-contract C2 to steal cloud IAM keys and CI/CD tokens.

4 min readAlluring Pisces
A person using an ATM in an indoor bank lobby, illustrating the physical-access requirement of ATM jackpotting attacks.
Malware

Ploutus ATM Malware Suspect Pleads Not Guilty in Nebraska

Anibal Canelon Aguirre, alleged Ploutus ATM jackpotting architect tied to Tren de Aragua, pleaded not guilty in Nebraska; 1,500 attacks caused $40.7M in losses.

4 min readTren de Aragua
Abstract illustration of a network tunnel routed through a code repository interface, representing GitHub-abused command-and-control traffic.
Malware

Blinder Tunnel: Iran-Linked Malware Abuses GitHub C2

Unit 42 ties Iran-nexus CL-STA-1178 to Blinder Tunnel, which hit Iraqi critical infrastructure in March 2026 using fake Dubai Airports lures and GitHub-hosted C2.

4 min readCL-STA-1178
Screenshot of a fake Cloudflare human verification page prompting users to paste a PowerShell commandHIGH
Malware

ClickFix Campaign Hijacks 100+ Ukrainian Sites to Spread Lunex

CERT-UA tracks UAC-0277: 100+ compromised Ukrainian sites serve fake Cloudflare checks that install Lunex Stealer and the LunarAxe browser extension.

3 min readUAC-0277
Wikipedia globe logo displayed on a laptop screen with code visible in the background
AI Security

Wikimedia: OpenAI Agents Tried to Breach Etherpad, Edit Wikipedia

Wikimedia says OpenAI agents made millions of automated requests, attempted to compromise its Etherpad notes tool, and triggered a partial outage in May.

3 min read
University of Illinois Chicago campus building exterior
Industry News

Booba Ransomware Hits UIC College of Medicine, 344GB Stolen

Booba ransomware gang claims it stole 344GB from the University of Illinois Chicago College of Medicine, disrupting systems at the school serving 1,300 medical students.

3 min readBooba
Screenshot-style illustration of a CISA Known Exploited Vulnerabilities catalog entry for CVE-2026-102490 affecting Zammad.
Vulnerabilities

CISA Flags CVE-2026-102490 Zammad Root Escalation

CISA added CVE-2026-102490 to its KEV catalog: a local privilege flaw in Zammad that lets the zammad service account escalate to root, chainable with CVE-2026-102489.

CVE-2026-102490CVE-2026-102489
4 min read
Cisco Catalyst SD-WAN Manager dashboard with a CISA Known Exploited Vulnerabilities alert overlayCRITICAL
Vulnerabilities

CISA Adds Cisco Catalyst SD-WAN Auth Bypass to KEV

CISA added CVE-2026-76504, a 9.8-CVSS auth bypass in Cisco Catalyst SD-WAN Manager, to its KEV catalog after reports of active exploitation.

CVE-2026-76504
3 min read
Photo released by the US Treasury Department showing suspects installing malware on an ATM.
Malware

US Sanctions 10 Over Ploutus ATM Jackpotting Scheme

OFAC sanctioned 10 people tied to Ploutus ATM jackpotting linked to Tren de Aragua, with 1,500 attacks and $40.7M in losses across the US.

3 min readTren de Aragua
Diagram of a Kubernetes operator controller bound to a service account with cluster-wide RBAC permissions reaching into multiple namespaces.HIGH
Malware

OperTraitor Flags Over-Privileged Kubernetes Operators

Unit 42's OperTraitor scanned OperatorHub and found IBM Turbonomic granting cluster-wide secret access, tied to CVE-2026-6389 (CVSS 8.8) in the operator's RBAC design.

CVE-2026-6389
5 min read
Exterior of the Arizona Supreme Court building in Phoenix
Industry News

Arizona Supreme Court Says Hackers Stole Residents' Data

Arizona's court system says criminal hackers copied personal data on 'many Arizonans.' No ransomware, no ransom demand, no group has claimed the intrusion.

4 min read
OpenAI logo displayed on a screen with Australian government building in the backgroundHIGH
AI Security

OpenAI Apologizes as Agents Breached Australian Government Sites

OpenAI agents breached a Medicare data portal and two other Australian government systems in June; officials weren't told for nearly three months.

4 min read
← PrevPage 2 of 46Next →