Tracking Threats, Incidents, and Vulnerabilities
Tracking Threats, Incidents, and Vulnerabilities
A large-scale Distributed Denial of Service (DDoS) attack disrupted eBay's operations for 42 to 48 hours, causing an estimated loss of $200 million per day in transactions. The pro-activist group 313 Team claimed responsibility, highlighting the significant financial and reputational damage such cyberattacks can inflict on major online platforms.
https://www.cybersecurity-insiders.com/ddos-cyber-attack-makes-ebay-lose-200m-per-day/
On April 23, 2026, CISA and the UK National Cyber Security Centre revealed FIRESTARTER, a persistent backdoor implant targeting Cisco Adaptive Security Appliance firmware via CVE-2025-20333 and CVE-2025-20362, enabling advanced persistent threat actor UAT-4356 (linked to the earlier ArcaneDoor campaign) to maintain long-term access even after patching and rebooting. The malware hooks into Cisco’s core LINA process to execute attacker shellcode triggered by specially crafted WebVPN requests, requiring a hard power cycle or full device reimaging to fully remove, highlighting a serious evolution in firmware-level threats that challenge conventional patch-and-monitor security models.
https://thecyberthrone.in/2026/04/28/firestarter-cisco-asa-backdoor/
A coalition of U.S. and international government agencies has issued a warning about a significant shift in Chinese hacker tactics, highlighting the use of large-scale covert networks composed of compromised everyday routers and Internet of Things devices to conduct cyberattacks. These networks enable malicious activities such as reconnaissance, malware delivery, and espionage while disguising attackers' origins, prompting recommendations for organizations, especially large and critical infrastructure entities, to adopt enhanced cybersecurity measures and active threat hunting.
https://cyberscoop.com/china-nexus-covert-networks-advisory/
Security researchers report a massive 10-fold growth in the size of the largest botnet, which expanded from 1.33 million to 13.5 million infected devices within a year, enabling hackers to launch unprecedented sustained DDoS attacks exceeding 2 Tbps and lasting over 40 minutes. These increasingly complex multi-vector attacks, often commanded via blockchain-based systems, pose greater challenges for mitigation as traffic now originates worldwide, rendering traditional defenses less effective.
An exposed server revealed a criminal operation exploiting the React2Shell vulnerability (CVE-2025-55182) to harvest credentials. The “Bissa scanner” operation used AI tools like Claude Code and OpenClaw to automate target scanning, credential extraction, and victim triage. The operation targeted credentials from various cloud providers, payment platforms, and databases, highlighting the risks of storing secrets in .env files.
https://thecyberexpress.com/bissa-scanner-ai-assisted-credential-factory/
According to U.K. intelligence, over 100 countries now have access to commercial spyware capable of hacking phones and computers to steal sensitive data, increasing from 80 countries in 2023. The U.K. National Cyber Security Centre warns this expanded access lowers barriers for foreign governments and hackers to target U.K. citizens, companies, and critical infrastructure, with victims now including bankers and wealthy businesspeople, and highlights ongoing threats from state-backed intrusions and leaked hacking tools.
The article discusses how AI security tools, designed to identify vulnerabilities rapidly, are overwhelming open source software maintainers with excessive, low-quality reports, creating a “volunteer DDoS” effect that hinders real security work. It highlights the need for improved governance and trust frameworks—like those developed by the OpenSSF, including SAFE-MCP, OSS-CRS, and OMS—to filter AI findings, verify model provenance, enforce scoped permissions, and maintain human review, emphasizing that existing community-driven governance structures are crucial to managing AI-driven security challenges effectively.
Europol and global law enforcement agencies have launched Operation PowerOFF, sending warning emails to over 75,000 individuals suspected of using DDoS-for-hire services that enable cyberattacks without technical skills. The operation resulted in four arrests, seizure of 53 domains, and 24 executed search warrants, targeting the disruption caused by these easily accessible cyberattacks.
Martin Alderson discusses the potential cybersecurity crisis posed by Anthropic's new AI model, Mythos, which can generate working exploits against browser sandboxes 72.4% of the time, a dramatic increase from under 1% with previous models. This threatens the foundational security of the internet and cloud computing, as sandboxes that isolate code execution may no longer be effective defenses, raising concerns about widespread device compromise and disruption.
https://martinalderson.com/posts/has-mythos-just-broken-the-deal-that-kept-the-internet-safe/
Teenage hacking gangs are reshaping cybercrime by causing chaos and seeking attention rather than financial gain, according to cyber correspondent Joe Tidy. He highlights notorious cases like Finnish hacker Julius Kivimäki, who executed devastating hacks including a traumatic breach of a digital psychotherapy chain’s patient records, illustrating how these young hackers wield power over governments, corporations, and individuals with little regard for the damage caused.
https://www.rnz.co.nz/life/books/how-teenage-hackers-hijack-the-internet
Researchers from GreyNoise analyzed 4 billion malicious sessions and found that residential proxies evaded IP reputation checks in 78% of cases, challenging the assumption that attackers can be distinguished from legitimate users based on IP origin. These proxies are short-lived, rapidly rotated, and primarily used for scanning and reconnaissance, making IP reputation less effective and suggesting a shift toward behavior-based detection methods.
Recent research shows that building a quantum computer capable of breaking 256-bit elliptic-curve cryptography (ECC) requires far fewer qubits and resources than previously estimated, potentially compromising critical encryption much sooner than expected. One study demonstrated that neutral-atom qubits could break ECC-256 in 10 days with 100 times less overhead, while Google researchers showed quantum circuits breaking ECC on Bitcoin within nine minutes using 20 times fewer resources, highlighting accelerating progress in cryptographically relevant quantum computing.
The recent LiteLLM breach, involving a popular Python library used in numerous AI projects, compromised around 400,000 systems worldwide, leading to theft of over 300GB of data from 500,000 infected devices. The hackers behind the attack, TeamPCP, have now partnered with a major dark web forum and the ransomware group Vect to distribute ransomware tools to over 300,000 forum users, creating what could become the largest cybercrime operation in history by broadly enabling affiliates to carry out ransomware attacks.
https://cybernews.com/security/litellm-hack-spawning-massive-cybercrime-alliance/
The Pay2Key ransomware group, linked to Iranian threat actors, has developed a Linux-targeted ransomware variant that actively attacks organizational servers, virtualization hosts, and cloud environments. This Linux-specific malware requires root privileges, disables key Linux security frameworks, and uses the ChaCha20 encryption algorithm to cause significant disruption to critical infrastructure, signaling a major shift in ransomware targeting strategy.
https://cybersecuritynews.com/linux-ransomware-pay2key-attacking-organizations-ervers/
A hacking tool called DarkSword, which targets iPhones running older versions of iOS, has been publicly leaked on GitHub, making it easy for criminals to exploit vulnerabilities in millions of devices that have not updated to the latest iOS 26. Security experts warn that the tool requires no special expertise to use and urge users to update their devices to protect against data theft, while Apple has released an emergency patch for unsupported devices.
