Krebs Investigation: Anti-DDoS Firm Huge Networks Found Enabling Botnet That Attacked Brazilian ISPs

Krebs on Security reveals Huge Networks — a Brazilian DDoS protection firm — was enabling a Mirai-based botnet attacking other Brazilian ISPs, with the CEO's own SSH keys found in the malicious attack archive.

ShinyHunters Claims 9.4M Amtrak Records via Salesforce — 2.1M Accounts Confirmed on Have I Been Pwned

ShinyHunters claims 9.4 million Amtrak records via Salesforce — 2.1 million accounts independently confirmed on Have I Been Pwned. The latest target in the group's coordinated 2026 campaign that has hit ADT, Udemy, Medtronic, Vimeo, and Cisco.

Massachusetts Fines Fidelity $1.25M for IDOR Breach That Exposed 77,000 Customers' SSNs and Financial Records

Massachusetts Secretary Galvin fined Fidelity Brokerage Services $1.25M after a three-day IDOR vulnerability allowed any authenticated user to access other customers' SSNs, credit card numbers, and medical records — plus a secondary failure to notify affected individuals.

Operation Winter SHIELD: The FBI Is Telling You Exactly What to Fix — And Why Most Organizations Still Get Breached

The FBI's Operation Winter SHIELD distills 10 proven defensive controls from real-world investigations — and its central message is blunt: most organizations are breached because they don't implement what they already know works.

NoName057(16): How Russia Gamified DDoS Attacks on Europe with Crypto Rewards

An investigation reveals how NoName057(16) turned DDoS attacks into a cryptocurrency-rewarded 'patriotic game' — with activity increasing after Europol's Operation Eastwood crackdown rather than diminishing.

Silver Fox Uses New ABCDoor Backdoor to Target Organizations in Russia and India via Tax Impersonation

Silver Fox has launched a tax-themed phishing campaign across India, Russia, Indonesia, and Japan — deploying ValleyRAT and the newly documented ABCDoor Python backdoor via fake tax authority notifications.

Inc Ransom Ransomware Breach at Sandhills Medical Exposes 169,017 Patients — Notified 12 Months Later

Sandhills Medical Foundation discloses a ransomware breach by Inc Ransom affecting 169,017 patients — nearly 12 months after the attack was detected and 10 months after stolen data was published publicly.

Novel China-Linked Group Shadow-Earth-053 Found Lurking in Critical Networks Across Poland and Asia

A previously undocumented China-linked threat group tracked as Shadow-Earth-053 has infiltrated 12+ critical networks across Poland and Asian nations — targeting defense contractors, government agencies, and transport infrastructure.

Iran-Linked Handala Leaks 2,379 US Marines' Data and Sends Chilling WhatsApp Threats

Iran-linked Handala published the names and phone numbers of 2,379 US Marines and sent direct WhatsApp threats warning of drone and missile strikes — a hybrid psychological operation attributed to Iran's MOIS.

Three Arrested After Using Stolen Session Cookies to Hijack and Sell 610,000 Roblox Accounts

Ukrainian police have arrested three individuals who systematically used stolen session cookies to access and sell more than 610,000 Roblox accounts, targeting profiles with accumulated in-game currency and rare items and reselling them through Russian criminal platforms for cryptocurrency. KYIV, UKRAINE — Ukrainian law enforcement has detained three suspects in

Vimeo Confirms Data Breach via Third-Party Vendor Anodot — ShinyHunters Attributed

Vimeo has confirmed a data breach affecting portions of its user database following a compromise at Anodot, a third-party analytics vendor. The breach has been attributed to ShinyHunters, which exploited trusted API connections between Anodot and its enterprise clients to access Vimeo's environment without directly targeting Vimeo'

Attacker Bought 31 WordPress Plugins, Hid a Backdoor for 8 Months, Then Activated It with an Ethereum C2

An attacker purchased a portfolio of 31 trusted WordPress plugins on a public marketplace, embedded a PHP backdoor in a routine-looking update, and left it dormant for eight months before activating it to distribute hidden SEO spam to thousands of websites — with the malware resolving its command-and-control server through an