CyberNews: 10/10/2026 Edition

Today’s roundup

Summary

The Clop ransomware group exploited a zero-day in Fortra GoAnywhere MFT for widespread data theft before a patch was available. Over 130 organizations across various sectors were affected globally, underscoring the need for immediate patching and security audits of MFT solutions.

Rhysida ransomware targeted the U.S. healthcare sector in Q3 2023, using TTPs like Cobalt Strike and rclone for exfiltration. Victims faced double extortion, highlighting severe risks to patient data.

The MOVEit Transfer vulnerability led to data breaches at multiple U.S. government agencies, including DoE, HHS, and DoD, by the Clop group. This exposed millions of individuals, emphasizing supply chain risks and the need for robust patching.

A Chinese APT exploited a Barracuda ESG zero-day (CVE-2023-2868), deploying malware for persistent access and data exfiltration. Barracuda advised replacement of compromised appliances.

Critical Ivanti Connect Secure VPN flaws (CVE-2023-46805, CVE-2024-21887) are actively exploited, deploying malware like MIGRAZIONE and THINSPOOL. Patches and forensic analysis are urgently required.

A critical remote code execution flaw (CVE-2023-46604) in Apache ActiveMQ is actively exploited on Windows, Linux, and macOS. This enables arbitrary command execution, posing a significant risk for ransomware.

A sophisticated phishing campaign bypasses Microsoft 365 MFA using Open Redirects and Azure AD application consent phishing. Attackers leverage legitimate URLs, highlighting evolving tactics.

A highly sophisticated supply chain backdoor was found in XZ Utils (versions 5.6.0/5.6.1) for Linux. This could enable remote code execution via SSH, posing a severe threat to global software infrastructure.

Russian APTs exploited a Microsoft Outlook zero-day (CVE-2023-23397) since 2022, targeting critical sectors. This flaw allows privilege escalation and NTLM credential theft via malicious calendar invites.

Want to dig deeper?

Malware Families