A recent cybersecurity campaign attributed to APT28, also known as Fancy Bear, has been uncovered by Trend Micro. The attackers are using a new malware called PRISMEX to target Ukraine and its allies. They exploit recently disclosed vulnerabilities, specifically CVE-2026-21509 and CVE-2026-21513, to bypass security measures and gain unauthorized access. This type of espionage can significantly affect national security and the stability of the region, as sensitive information could be compromised. The targeting of Ukraine, in particular, raises alarms given the ongoing conflict in the area, indicating that the stakes are high for both military and political intelligence.
A hack-for-hire group has been targeting journalists and officials in the Middle East and North Africa (MENA) region since 2023, according to research from Access Now and Lookout. The campaign is described as sophisticated, employing various tactics to spy on its targets. Journalists, who often report on sensitive political issues, are particularly vulnerable, as are officials who may be involved in decision-making processes. This type of espionage raises serious concerns about press freedom and the safety of those working in journalism, as it can lead to self-censorship and a chilling effect on reporting. The ongoing nature of this campaign suggests that the threat is not only persistent but evolving, making it crucial for individuals and organizations in the region to be vigilant about their cybersecurity practices.
ChipSoft, a Dutch healthcare software provider, has been hit by a ransomware attack that has disrupted its online services. The attack forced the company to take its website and digital services offline, affecting both patients and healthcare providers who rely on their systems for medical information and services. This incident raises concerns about the security of healthcare IT systems, especially as they handle sensitive patient data. The downtime could lead to delays in patient care and disrupt operations for healthcare professionals. As ransomware attacks continue to pose a significant threat to the healthcare sector, this incident serves as a reminder of the vulnerabilities present in digital health infrastructure.
A recently patched vulnerability in the EngageLab SDK, a third-party software development kit used in many Android applications, has potentially exposed the private data of around 50 million users, including 30 million cryptocurrency wallet holders. The flaw allowed apps on the same device to bypass Android's security measures, enabling unauthorized access to sensitive information. This incident raises significant concerns about the security of users' cryptocurrency assets, as the compromised data could have led to theft or fraud. Developers using the EngageLab SDK are urged to update their applications to protect users from potential attacks. The vulnerability was identified and addressed, but users should remain vigilant about app permissions and security practices.
The cybersecurity community is closely observing whether Iranian hackers will adhere to a ceasefire that does not specifically mention them. Historically, ceasefires in geopolitical conflicts have not significantly impacted the frequency of cyberattacks. Experts suggest that despite a temporary halt in physical hostilities, cyber operations often continue unabated. This raises concerns for organizations and governments that might be targeted by Iranian cyber actors, as they may not feel bound by such agreements. The situation underscores the ongoing risk that cyber threats pose, irrespective of diplomatic efforts.
Hackers have compromised the update system for the Smart Slider 3 Pro plugin, which is used in WordPress and Joomla websites. These attackers managed to distribute a malicious version of the plugin that contains multiple backdoors, allowing them to access and control affected sites. This incident puts users of both platforms at risk, as the malicious code can lead to data breaches and unauthorized actions on their websites. Website administrators should be particularly vigilant, as the compromised update could have far-reaching consequences if not addressed promptly. Users are strongly advised to check their installations and update to the latest secure versions to mitigate any potential damage.
The FBI has taken significant action against the Russian hacking group APT28, which is linked to the GRU, the Russian military intelligence agency. This operation targeted routers that APT28 had compromised, allowing them to access a range of networks. According to Brett Leatherman, the FBI's cyber chief, this group's ability to propagate attacks from routers made their threat particularly concerning. By disrupting this access, the FBI aims to protect various organizations from potential espionage and data breaches. This incident underscores the persistent risk posed by state-sponsored cyber actors and highlights the importance of securing network infrastructure to prevent similar intrusions in the future.
Sensitive documents from the Los Angeles Police Department have reportedly been leaked online by a group known as World Leaks. The breach has exposed around 7.7 terabytes of data, which includes over 337,000 files. This incident raises serious concerns about the security of law enforcement data and the potential implications for public safety and privacy. With such a large volume of sensitive information now accessible, there is a heightened risk of misuse or further exploitation. The LAPD and other authorities will need to take immediate action to assess the extent of the breach and protect against future incidents.
On April 7, 2026, ChipSoft, a healthcare software vendor based in the Netherlands, suffered a ransomware attack that has been confirmed by Z-CERT, the country's computer emergency response team for the healthcare sector. This incident raises serious concerns about the security of healthcare data, as ransomware attacks can disrupt medical services and compromise sensitive patient information. The attack's timing is particularly alarming given the essential role that healthcare software plays in patient care and operations. Authorities are likely working to assess the full impact of the breach and to assist affected healthcare providers in managing the fallout. This incident underscores the ongoing vulnerabilities in the healthcare sector regarding cybersecurity threats.
The Masjesu botnet, also referred to as XorBot, has emerged as a stealthy DDoS-for-hire service that primarily targets Internet of Things (IoT) devices. Unlike many other botnets, Masjesu avoids high-profile targets, such as Department of Defense IP addresses, opting instead for less conspicuous victims. This botnet employs XOR encryption to maintain low visibility and ensure its persistence within compromised systems. As the use of IoT devices continues to rise, the potential for such botnets to disrupt services and cause damage increases, making it crucial for users and organizations to secure their devices against such threats. The activity of Masjesu raises concerns about the growing sophistication of DDoS services that are accessible for hire, which can have widespread implications for network stability and security.
Bitcoin Depot recently reported a significant cyber-attack that resulted in the theft of over 50 Bitcoin, valued at approximately $3.66 million. The breach occurred when hackers gained access to the company's internal systems, allowing them to siphon off the cryptocurrency. This incident raises concerns about the security measures in place for cryptocurrency exchanges and wallet services, as they can be prime targets for cybercriminals looking to exploit vulnerabilities. The theft not only affects Bitcoin Depot but also poses risks to users and investors in the cryptocurrency space, highlighting the ongoing challenges of securing digital assets. Companies operating in this sector need to reassess their security protocols to prevent similar incidents in the future.
Hackread – Cybersecurity News, Data Breaches, AI and More
LayerX researchers have found a way to exploit the Claude Code system by manipulating the CLAUDE.md file. This method allows attackers to bypass the platform's safety features, enabling them to execute SQL injection attacks. Such vulnerabilities can lead to unauthorized access to databases, potentially exposing sensitive information. This issue affects users of Claude Code, which is used in various applications for coding assistance. Companies relying on this technology should be aware of the risks and implement necessary precautions to protect their systems from possible exploitation.
Researchers at RSAC discovered a way to bypass Apple Intelligence's AI guardrails using techniques called Neural Exect and Unicode manipulation. This vulnerability could allow attackers to exploit the AI's systems, potentially leading to unauthorized access or misuse of the technology. The implications of this breach are significant, as it raises concerns about the security and reliability of AI systems used by Apple and possibly other tech companies. Users and developers relying on Apple Intelligence need to be aware of this vulnerability to ensure their systems are secure. The researchers' findings emphasize the importance of ongoing scrutiny and improvement of AI security measures.
Edge devices, which connect various networks and serve as points of entry, are increasingly becoming targets for cyber attackers. These devices can be exploited to gain unauthorized access to systems, allowing attackers to persist within networks and pivot to steal sensitive identity information. This trend raises concerns for organizations relying on edge computing, as vulnerabilities in these devices can lead to significant data breaches. Ensuring the security of edge devices is crucial, as they play a pivotal role in the overall security posture of an organization. Companies need to prioritize safeguarding these devices to protect against modern cyber threats.
A hack-for-hire campaign has been uncovered, believed to be linked to an actor with possible connections to the Indian government. This campaign has primarily targeted journalists, activists, and officials across the Middle East and North Africa (MENA) region. Notably, two Egyptian journalists known for their criticisms of the government were among the individuals affected. The findings, reported by Access Now, Lookout, and SMEX, raise significant concerns about the safety and privacy of those who report on sensitive issues in these regions. The implications of such targeted attacks extend beyond individual safety, potentially stifling freedom of expression and press in the affected areas.