CyberNews: 29/10/2026 Edition

Published by Dunateo on 2026-10-29

Today’s roundup

  • IBM X-Force Report Highlights 71% Increase in Exploit Attempts in 2023
  • U.S. and U.K. Disrupt LockBit Ransomware Group
  • Zero-Day Exploit Targets Cisco ASA/FTD Devices
  • Over 100 U.S. Entities Hit by Ivanti Zero-Days in Recent Attacks
  • Critical Vulnerabilities Discovered in Progress Telerik UI for ASP.NET AJAX
  • U.S. and UK Governments Link Russia to Destructive Cyberattacks in Ukraine
  • FIN7 Hacking Group Behind Large-Scale Point-of-Sale Attacks
  • New Ransomware Strain 'BlackSuit' Emerges, Targeting Windows and Linux Systems
  • Microsoft Fixes Actively Exploited Windows SmartScreen Bypass Vulnerability

    • Summary

    The IBM X-Force Threat Intelligence Index 2024 reports a 71% increase in exploit attempts during 2023, with manufacturing becoming the most targeted sector. Phishing and valid account compromises were the primary initial access methods for attackers.

    International law enforcement, including the U.S. Department of Justice and the U.K.'s National Crime Agency, announced the disruption of the LockBit ransomware group's operations. The coordinated effort, "Operation Cronos," seized LockBit's infrastructure and led to arrests and charges.

    Cisco has issued an advisory regarding a zero-day denial-of-service vulnerability (CVE-2024-20353) actively exploited in Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software, which can cause device reloads due to memory leaks.

    Over 100 U.S. government agencies and companies have been compromised since December 2023 by Chinese state-sponsored hackers exploiting two zero-day vulnerabilities (CVE-2023-46805, CVE-2024-21887) in Ivanti Connect Secure and Policy Secure gateways.

    Two critical vulnerabilities (CVE-2024-4358, CVE-2024-4359) have been discovered in Progress Telerik UI for ASP.NET AJAX versions prior to 2023.3.1114, enabling remote code execution via insecure deserialization and directory traversal.

    The U.S. and UK governments have formally linked Russia's military intelligence (GRU) Sandworm unit to destructive cyberattacks in Ukraine, including the 2022 energy sector compromise and attacks on satellite communications infrastructure.

    The FIN7 cybercrime group, also known as Carbon Spider, has been identified as utilizing the BADHATCH malware in recent large-scale point-of-sale (POS) attacks targeting retail and hospitality organizations for payment card data theft.

    A new ransomware strain, "BlackSuit," has emerged, sharing significant operational similarities with the defunct Royal ransomware group. BlackSuit targets both Windows and Linux systems, including ESXi virtual machines, employing encryption and double extortion tactics.

    Microsoft released a patch for an actively exploited Windows SmartScreen bypass vulnerability (CVE-2024-21351) as part of its February 2024 Patch Tuesday updates, which could allow attackers to inject malicious code and bypass security protections.

    Want to dig deeper?

    Cyber Groups

    FIN7 GOLD NIAGARA, ITG14, Carbon Spider, ELBRUS, Sangria Tempest