CyberNews: 12/10/2026 Edition

Today’s roundup

Summary

In 2023, Russia's Sandworm (APT28) targeted Danish energy critical infrastructure, exploiting unpatched FortiGate firewalls (CVE-2022-42475, CVE-2021-40348) and deploying Pipedream (Incontroller) malware for OT system disruption. Rapid detection prevented power outages, but the incident, detailed in a CFCS report, highlighted OT vulnerabilities.

A critical unauthenticated remote code execution (RCE) vulnerability, CVE-2024-xxxx, affects Apache Flink, allowing arbitrary code execution via its REST API. Affecting various versions, this flaw poses a high risk for complete system compromise, urging immediate patching despite no confirmed active exploitation.

CISA warns of active exploitation of two new Ivanti Connect Secure/Policy Secure vulnerabilities (CVE-2024-XXXX authentication bypass, CVE-2024-YYYY command injection). These distinct flaws enable full system compromise, prompting urgent patching guidance for federal and private sector organizations due to widespread exploitation by multiple threat actors.

A new sophisticated phishing campaign utilizes QR codes (quishing) embedded in emails to bypass security filters. When scanned, these codes redirect corporate employees, particularly in finance and tech, to fake login pages for credential theft, evading traditional URL scanning and increasing attack success.

Further details on 'Operation Cronos' reveal international law enforcement had infiltrated LockBit ransomware's network for months before its public takedown. This long-term monitoring allowed comprehensive intelligence gathering on the group and affiliates, delivering a severe blow to LockBit's capabilities and significantly reducing new attacks.

A sophisticated supply chain attack injected malicious code into popular open-source JavaScript libraries distributed via public repositories. The code exfiltrates sensitive environment variables and and credentials from development and production systems, affecting millions of downloads and emphasizing the need for rigorous dependency vetting and immediate updates.

Chinese state-sponsored APT Volt Typhoon (Silent Chollima) has expanded its targeting to a wider range of Western critical infrastructure, including energy, water, and transportation, beyond traditional government and telecom networks. The group employs new evasion and living-off-the-land techniques to pre-position for potential disruptive attacks during geopolitical crises.

Cloudflare reports a significant surge in volumetric DDoS attacks, with record-breaking sizes exceeding several terabits per second, leveraging new amplification techniques and IoT botnets. Financial services, gaming, and manufacturing are most affected, attributed to cheap DDoS-for-hire services and vulnerable internet-connected devices, necessitating robust mitigation.

A new Mirai botnet variant targets enterprise-grade IoT devices like IP cameras, NAS, and ICS, employing sophisticated scanning and broader exploitation techniques. This evolution aims to expand botnet capacity for large-scale DDoS attacks and facilitate initial access for other cybercriminal activities within corporate networks.

Microsoft's latest Patch Tuesday addresses over 50 vulnerabilities, including two actively exploited zero-days: a Windows Kernel privilege escalation (CVE-2024-XXXX) and a Microsoft Exchange Server remote code execution (CVE-2024-YYYY). CISA has added these and other critical flaws in SharePoint, Defender, and Teams to its Known Exploited Vulnerabilities Catalog, urging immediate patching.

Want to dig deeper?

Cyber Groups