VulnHub

A report from Qrator Labs has revealed a significant increase in a DDoS botnet, which has now ballooned to 13.5 million compromised devices over the past year. The majority of these devices are located in the United States, Brazil, and India. This surge in botnet size has enabled attackers to launch unprecedented distributed denial-of-service attacks, reaching up to 2 terabits per second. The fintech and betting industries appear to be the primary targets of these assaults. This situation raises alarms for businesses in these sectors, as the sheer scale of attacks could disrupt services and lead to substantial financial losses.

A new cybercrime platform named ATHR is making waves by using automated voice phishing, or vishing, attacks that combine AI technology with human social engineering tactics. This platform allows cybercriminals to harvest sensitive credentials from unsuspecting victims through sophisticated voice interactions. By utilizing AI voice agents, attackers can engage targets without needing continuous human involvement. This development poses a significant risk to individuals and organizations, as it makes it easier for scammers to launch large-scale attacks with minimal effort. Users should be especially cautious about unsolicited calls asking for personal information, as these AI-driven tactics can be surprisingly convincing.

Autovista has confirmed that it has suffered a ransomware attack that is disrupting its applications, which are essential for automotive companies. These applications help businesses track asset values, market trends, and overall costs associated with vehicle ownership. The attack is affecting systems in both Europe and Australia, raising concerns among its clients who rely on this data for decision-making. The implications of this attack could lead to significant operational challenges for those companies that depend on Autovista's insights. As the situation develops, it will be important for affected businesses to assess their own cybersecurity measures and prepare for potential impacts on their operations.

This week saw several notable cybersecurity incidents, including a zero-day vulnerability affecting Microsoft Defender. Attackers are exploiting this flaw to bypass security measures, putting users at risk. Additionally, SonicWall reported a brute-force attack targeting their products, which could compromise user accounts. In another concerning development, a 17-year-old remote code execution (RCE) vulnerability in Microsoft Excel remains a threat, proving that outdated software can still be a significant risk. These incidents emphasize the need for organizations to stay vigilant and ensure their systems are updated and secure.

Cookeville Regional Medical Center in Tennessee experienced a significant data breach last year when the Rhysida ransomware group infiltrated its systems and stole approximately 500GB of sensitive data. This breach has affected around 337,000 patients, raising serious concerns about the privacy and security of their personal and medical information. Such incidents not only compromise individual data but also highlight vulnerabilities within healthcare systems, which are often targeted due to their sensitive data. The implications of this breach extend beyond the immediate risk to patients; it underscores the need for healthcare organizations to strengthen their cybersecurity measures to protect against similar attacks in the future.

In 2024, a significant security issue emerged in cloud environments, with 68% of breaches linked to compromised service accounts and overlooked API keys. This isn't about phishing or weak passwords; it's primarily due to unmanaged non-human identities that organizations fail to monitor. For every employee, there are approximately 40 to 50 automated credentials like service accounts and API tokens. Many of these credentials remain active long after projects conclude or employees leave. This oversight creates vulnerabilities that attackers can exploit, leading to serious breaches. Companies must prioritize managing these non-human identities to enhance their security posture and prevent future incidents.

The National Institute of Standards and Technology (NIST) is adjusting how it manages the volume of Common Vulnerabilities and Exposures (CVE) by focusing on enriching entries that meet specific criteria. This means that not all CVEs will automatically receive additional information or context, particularly those that do not fulfill these new standards. The change aims to streamline the process and ensure that critical vulnerabilities, especially those included in the Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities (KEV) list, are prioritized for updates. This is significant for organizations that rely on NVD resources to stay informed about potential security risks. By refining the enrichment process, NIST hopes to enhance the quality of information available to cybersecurity professionals and help them better protect their systems.

Cisco has released patches for critical vulnerabilities found in its Webex and Identity Services Engine (ISE) products. These flaws could allow attackers to exploit the systems remotely, potentially impersonating users or executing unauthorized commands on the operating system. This poses a significant risk to organizations using these platforms, as it could lead to unauthorized access and data breaches. Users of Webex and ISE should prioritize applying these updates to safeguard their systems and data against potential attacks. Keeping software up to date is crucial in maintaining cybersecurity hygiene.

CERT-UA has reported a significant cyber campaign by the threat actor known as UAC-0247, targeting Ukrainian clinics and government bodies. This operation, which took place between March and April 2026, involved the use of malware designed to steal sensitive data from Chromium browsers and WhatsApp. The affected entities include municipal healthcare facilities, such as emergency hospitals and clinics, which are critical for public health. This cyber attack not only threatens the privacy of individuals seeking medical care but also poses risks to the operational integrity of essential services in Ukraine. As the conflict in Ukraine continues, the expansion of such cyber operations raises alarms about the security of public institutions and personal data in the region.

According to Halcyon, ransomware attacks targeting automotive manufacturers have surged, now making up over 40% of all cyber-attacks against the sector. This increase marks a significant rise in cyber threats faced by carmakers, as attackers increasingly exploit vulnerabilities in automotive systems. The implications are serious, as these attacks can disrupt production, compromise sensitive customer data, and potentially jeopardize vehicle safety. As the automotive industry continues to integrate more technology into their vehicles, the risk of ransomware attacks is likely to grow, prompting manufacturers to bolster their cybersecurity measures. Companies in the automotive sector need to prioritize security to protect against these escalating threats.