Threat Intelligence

Flat white line-art of an industrial electronics-manufacturing plant beside a single document record card — Tata Electronics cyberattack disclosure.

Data Breaches

Tata Electronics Confirms Cyberattack After Reported Data Leak

An Indian industrial-sector confirmation — sector-advisory work for the week. Tata Electronics says a recent incident hit some of its systems while an extortion group leaks data it claims to have stolen, putting manufacturing and supply-chain risk back in focus.

Flat white line-art of a three-node build pipeline with a branch-and-merge fork feeding a repository box — Cordyceps CI/CD GitHub repository disclosure.

Supply Chain Attack

Researchers Disclose "Cordyceps" CI/CD Flaws Affecting 300+ GitHub Repositories

Supply-chain audit work for organizations using GitHub-hosted CI/CD: a research firm found a recurring pull-request handling and workflow-permission pattern that left 300-plus repositories open to attacker-controlled code execution.

Flat white line-art of a timeline bar with a marked gap, a router node, and a magnifier — Mandiant Cisco SD-WAN CVE-2026-20245.

Vulnerabilities

Mandiant Publishes Analysis of Cisco SD-WAN Zero-Day Exploitation Window

A two-month exposure window prior to the vendor advisory — defenders' SD-WAN posture review continues as Mandiant's analysis of the root-access zero-day lands.

Flat white line-art of two malware boxes wired into a central hub with a power-disconnect switch — Operation Endgame Amadey and StealC disruption.

Cybercrime

Microsoft and Europol Disrupt Amadey and StealC Infrastructure in Operation Endgame Phase

Operation Endgame's latest phase takes out Amadey and StealC's shared infrastructure, with Europol and Microsoft reporting 326 servers actioned, 142 domains seized, and roughly 27 million stolen credentials recovered.

Flat white line-art of a gavel — Scattered Spider TfL guilty pleas.

Cybercrime

Scattered Spider Members Jubair and Flowers Plead Guilty on Day One of TfL Trial

Another individual-conviction milestone in the Scattered Spider law-enforcement track: two alleged members admitted unauthorised access to Transport for London's network on the opening day of their trial, with sentencing set for July.

Flat white line-art of a central server stack with a power-off symbol beside a few small site tiles — Operation Endgame SocGholish disruption.

Cybercrime

Authorities Disrupt SocGholish Servers in Operation Endgame Action

Operation Endgame's multi-month coordinated action takes down another major distribution backbone, seizing more than a hundred servers and remediating nearly 15,000 compromised WordPress sites worldwide.

Ransomware

Researchers Publish Findings on INC Ransomware-as-a-Service Activity: 830+ Victims

Another RaaS profile lands on defenders' desks — detection-engineering review for the week.

Flat white line-art of a row of package boxes with one flagged tile beside a contributor key card — Mastra npm contributor-account compromise.

Supply Chain Attack

145 Mastra npm Packages Compromised via Hijacked Contributor Account

Another contributor-account compromise hits the JavaScript ecosystem — defenders using Mastra packages have inventory and rotation work this week.

Flat white line-art of a large shield with a small keyhole notch beside a wrench mid-turn — Microsoft RoguePlanet Defender zero-day confirmation.

Vulnerabilities

Microsoft Confirms RoguePlanet Defender Zero-Day, Patch in Development

Microsoft has confirmed the publicly disclosed Defender issue tracked as CVE-2026-50656 and says a fix is in development. Defenders should follow the published mitigation guidance pending the patch.

Flat white line-art of a firewall appliance, a credential card and a shield — FortiBleed Fortinet credential-harvesting disclosure.

Vulnerabilities

Researchers Disclose Mass Credential-Harvesting Campaign Hitting Fortinet Devices (“FortiBleed”)

A large-scale credential-harvesting campaign across Fortinet deployments — sector-wide patch verification and credential rotation are the defender priority.

Flat white line-art of a large magnifier over a document beside a simple alert card — North Korean-linked NarwhalRAT research disclosure.

Nation-State Cyber Threats

Researchers Detail a North Korean-Linked Campaign Using the NarwhalRAT Family

Another published-research disclosure for defenders to review for indicator relevance: researchers at Genians named NarwhalRAT, a remote access trojan they attribute to a North Korean-linked cluster, and published indicators worth checking against your own telemetry.

Flat white line-art of a medical research flask, a server database, and a shield — GTIG China-nexus research-sector advisory.

Nation-State Cyber Threats

Google Threat Intel Details a China-Nexus Cluster Targeting Medical, Military, and AI Research

GTIG's published research resets sector advisory work for research organizations across North America, putting REDCap servers and Google Workspace administrative rules at the top of the review list.

See all