FlagThis — Daily Cybersecurity Intelligence Briefing

Rhysida and Interlock ransomware operations have shifted to a modular supply chain model, leveraging Initial Access Brokers (IABs) and specialized crypter services to target VMware ESXi hypervisors. By employing the "GentleKiller" framework—an EDR-terminating toolset targeting over 400 security processes across 48 products—affiliates (including Storm-2697) disable guest-level defenses before deploying Go-based, self-propagating encryptors. This strategy enables the mass encryption of multiple virtual machines simultaneously at the virtualization layer, utilizing per-file ephemeral key encryption to maximize operational paralysis and extortion leverage.

The IRGC-linked threat actor CyberAv3ngers is executing a targeted campaign against critical infrastructure, specifically exploiting internet-facing Unitronics Vision PLCs, Federal Signal, and Genmark siren controllers. By leveraging weak or default credentials and unauthorized access to Human-Machine Interfaces (HMIs), the group manipulates emergency alert protocols and public warning systems. This shift from technical sabotage to "cyber-psychological warfare" aims to trigger mass public panic and erode societal trust in civil safety mechanisms. The campaign serves as a non-kinetic extension of regional geopolitical tensions, requiring urgent hardening of OT network segmentation and credential management to prevent mass societal destabilization.

Luxembourg state workstations were targeted by a coordinated cyber-espionage campaign timed with the nation's National Day. Attackers utilized spear-phishing emails to deploy Socgholish (FakeUpdates) as an initial access broker, which subsequently loaded Amadey for persistence and StealC for credential exfiltration. The infection chain focused on harvesting administrative credentials and government metadata from public sector infrastructure. The campaign was neutralized through a global disruption operation led by Europol in collaboration with GovCERT.lu, CIRCL, and CERT-EU, resulting in the dismantling of the Amadey and StealC command-and-control (C2) infrastructure.

The Dragonforce ransomware group has executed a sophisticated intrusion against Aptora, a major U.S.-based civil engineering firm, by employing a "Living off Trusted Services" (LOTS) technique. The attackers deployed 'Backdoor.Turn', a custom Go-based Remote Access Trojan (RAT), which utilizes the Microsoft Teams relay infrastructure for Command-and-Control (C2). By routing malicious traffic through legitimate Microsoft SaaS endpoints, the group successfully masked C2 communications as standard HTTPS/TLS telemetry and messaging. This method allows the threat actor to bypass traditional network security monitoring and EDR solutions, facilitating long-term persistence and increasing the risk of large-scale data exfiltration and subsequent ransomware deployment.

The convergence of frontier AI model capabilities and the rapid deployment of autonomous AI agents has triggered a structural collapse in traditional cybersecurity risk models. The Five Eyes intelligence alliance reports a critical compression of threat timelines, shifting advanced vulnerability weaponization and phishing from years to months. Concurrently, enterprises are expanding the attack surface through AI agents that lack robust non-human identity frameworks. Current OAuth 2.1 and JWT implementations exhibit structural gaps that fail to effectively authenticate or isolate autonomous agent identities, creating an "identity vacuum." This enables high-sophistication, AI-driven exploits to meet a vulnerable infrastructure at a significantly reduced financial barrier for Cybercrime-as-a-Service (CaaS) operators.

UNC3753, also identified as the Silent Ransom Group, is conducting a sophisticated hybrid extortion campaign targeting United States law firms. The threat actor bypasses traditional digital perimeters by combining voice phishing (vishing) with physical social engineering to gain onsite access to office premises. Once physical access is achieved, the actors deploy Remote Monitoring and Management (RMM) tools to establish persistent command-and-control (C2) capabilities. This facilitates the targeted exfiltration of sensitive legal documentation and attorney-client privileged data, which is subsequently leveraged for financial extortion. This campaign represents a critical risk to data confidentiality, physical security protocols, and professional privilege.

Researchers from CISPA have identified critical, zero-click vulnerabilities in proximity-based file-transfer protocols, specifically Apple AirDrop and Google/Samsung Quick Share. Utilizing the custom "AIRFUZZ" protocol-aware fuzzer, the study uncovered systemic flaws in how privileged daemons process unauthenticated, complex serialized content such as Binary Plists, CPIO archives, and Protocol Buffers. Exploitation vectors include Swift-based Denial of Service (DoS), XML recursion, and memory corruption via Heap Use-After-Free (UAF). Most significantly, the research demonstrated a complete bypass of Device-to-Device (D2D) encryption in Samsung Quick Share. These vulnerabilities affect over 5 billion devices globally. All affected vendors—Apple, Google, and Samsung—have released patches to remediate these flaws.

Northern Technologies International Corporation (NTIC) has confirmed a data breach resulting in the exfiltration of sensitive Personally Identifiable Information (PII) by the Chaos Ransomware group. The attack involved unauthorized data egress from NTIC environments, compromising Social Security Numbers (SSNs), financial records, and contact information. Technical indicators point to the use of Chaos Ransomware encryption methodologies and communication with identified Command and Control (C2) infrastructure. The incident is being evaluated for potential links to wider coordinated attacks on technology-sector and cloud infrastructure vulnerabilities within the Indian regional landscape, carrying significant regulatory implications under GDPR, CCPA, and regional data laws.

An international law enforcement operation, spearheaded by the U.S. Department of Justice and Canadian authorities, has dismantled the Kimwolf IoT botnet and its associated DDoS-for-hire ecosystem. The botnet, operated by Jacob Butler (alias 'Dort'), utilized the AISURU malware strain to weaponize millions of vulnerable, internet-exposed IoT devices. The infrastructure facilitated massive volumetric attacks, reaching unprecedented peaks of 31.4 Tbps, and was managed through 45 seized web-based command platforms. By seizing the Command and Control (C2) infrastructure and over 25,000 attack command logs, this operation effectively neutralized a major segment of the global 'booter' market and mitigated systemic threats to global internet stability.

GitLab released patch 18.10.3 to address a cluster of critical vulnerabilities, including CVE-2026-1606 and CVE-2026-3074, affecting both Community (CE) and Enterprise (EE) editions. These flaws enable Remote Code Execution (RCE) and significant information disclosure, primarily via code injection vectors within the GitLab Snippets feature and unauthenticated API endpoints. Successful exploitation allows attackers to achieve full system takeover, exfiltrate sensitive source code, and access stored credentials. This marks a shift from historical unauthenticated RCEs to more complex injection flaws requiring immediate version upgrades and rigorous auditing of snippet usage patterns to prevent unauthorized system access.

Gaslight (macOS.Gaslight) is a Rust-based backdoor attributed to North Korean (DPRK) state-sponsored actors, designed for browser credential harvesting from Chrome, Brave, Firefox, and Safari on macOS. The implant utilizes the Telegram Bot API for command-and-control (C2) communications. Its primary innovation is the integration of 38 adversarial prompt injection strings embedded within the binary. These strings are engineered to deceive Large Language Models (LLMs) used by SOC analysts during triage, inducing AI refusals or hallucinated benign classifications to bypass automated analysis and extend attacker dwell time. Detection was initially facilitated by an Apple XProtect update.

CVE-2026-20971 is a critical vulnerability in the Samsung Knox security framework that facilitates a hypervisor-level bypass by exploiting a race condition within the kernel's process integrity validation mechanism. By leveraging this race condition primitive, an attacker can circumvent the Real-time Kernel Protection (RKP) provided by the Knox hypervisor. This flaw enables a transition from a kernel-level exploit to a complete hypervisor breach, resulting in Local Privilege Escalation (LPE) to a high-privilege or system context. Such an exploit effectively neutralizes Samsung's hardware-backed defense-in-depth strategy, allowing for the deployment of persistent rootkits capable of evading real-time integrity monitoring on enterprise-managed mobile devices.

Between May and June 2026, threat actor TeamPCP executed a multi-stage supply chain attack transitioning from the Shai Hulud cluster to the Miasma Worm. Shai Hulud utilized dependency confusion and SLSA provenance spoofing to compromise CI/CD pipelines and exfiltrate AWS Redshift data. The subsequent Miasma Worm evolved into an "environment-triggered" threat, hijacking AI agent configuration files (e.g., .claude/settings.json, .cursor/rules/setup.mdc) to achieve zero-click execution upon workspace opening. This campaign compromised 176 npm packages and 37 PyPI wheels, culminating in a June 5 breach of Microsoft that disabled 73 GitHub repositories and disrupted Azure Functions deployment actions globally.

A critical integer overflow vulnerability in the Android Framework, identified as CVE-2025-48595, is being actively exploited in the wild to achieve unauthorized privilege escalation. Threat actors utilize this flaw to deploy "Landfall," a sophisticated commercial-grade spyware suite designed for clandestine surveillance and data exfiltration. By leveraging this zero-day alongside CVE-2025-48593, attackers can bypass security boundaries to gain system-level access and complete device control. This exploitation allows for the interception of sensitive personal and enterprise data, bypassing traditional network-level security controls. Google addressed these vulnerabilities in the June 2026 Android Security Bulletin.