Threat Actors
The FBI's May 26 FLASH alert warns that Silent Ransom Group — also tracked as Luna Moth, Chatty Spider, and UNC3753 — is now sending operatives in person to US law firms, posing as IT support and inserting USB drives to steal client data for extortion.
Nation-State Cyber Threats
Israeli firm Gambit Security says the 'Ababil of Minab' hacktivist persona that claimed the March 2026 LA Metro breach is, on its forensic evidence, a front for Iran's Ministry of Intelligence and Security. At least 700 GB was stolen, and attackers reached a rail-yard control display.
Cybersecurity 101
A complete guide to the Cyber Kill Chain — the seven stages of a cyberattack, how defenders use the model to break an attack, and how it compares to MITRE ATT&CK.
Policy & Government
India's CERT-In issued guidelines on May 26, 2026 requiring organizations to patch critical internet-exposed vulnerabilities within 12 hours, "where feasible." The cited reason is explicit: AI-driven exploitation has compressed the patch window past what conventional SLAs can survive.
Vulnerabilities
Google's Threat Intelligence Group caught attackers exploiting CVE-2026-5426, a hardcoded ASP.NET machineKey in Digital Knowledge's KnowledgeDeliver LMS, to forge ViewState payloads, drop the Godzilla web shell, and stage Cobalt Strike Beacon. The patch alone is not enough.
Nation-State Cyber Threats
Nimbus Manticore — the Iran-nexus APT The CyberSignal covered as Screening Serpens — has returned with a new backdoor codenamed MiniFast that Check Point Research assesses was developed with AI assistance, and a target set that now spans aviation, aerospace, defense, software, and telecom.
Vulnerabilities
Microsoft patched CVE-2026-45659, a CVSS 8.8 deserialization RCE in SharePoint Server. The 'authenticated' precondition is barely a precondition — any account with Site Member, the lowest SharePoint role, can trigger it. Patch this week.
Data Breaches
Lithuania's Prosecutor General's Office says more than 600,000 records were pulled from the Centre of Registers using valid Migration Department login credentials issued queries from abroad. The registry itself was not breached — an authorized third party's login was.
Cybersecurity 101
A complete guide to DDoS attacks — how distributed denial-of-service attacks work, the main types, why attackers launch them, and how to defend against them.
Data Breaches
Three breach disclosures landed in one cycle — Radiology Associates of Richmond (266,183 people), DocketWise (143,480), and a vendor breach at the Oncology Institute. None is a novel attack. Together they map 2026's two structural failures: repeat victimization and third-party risk.
Nation-State Cyber Threats
Fox-IT disclosed RemotePE, a RAT the North Korea-linked Lazarus Group runs entirely in memory and never writes to disk. It is the final stage of a multi-stage chain, deployed only after the noisier RATs are deliberately cleaned up.
Supply Chain Attack
Socket disclosed TrapDoor, a coordinated attack that planted more than 34 malicious packages across npm, PyPI, and Crates.io at once. Its novel move: poisoned .cursorrules and CLAUDE.md files designed to trick a developer's AI coding assistant.