Year: 2026 - RH-ISAC Blog

Somewhere in your organization this week, someone saved themselves a few hours by pasting company data into an AI tool nobody reviewed. They didn’t file a ticket, and they don’t think they did anything wrong.  It’s tempting to treat that as a policy violation. It’s more useful to treat it as information. Every unsanctioned AI…

Executive Summary A joint law enforcement advisory conducted by the National Police Agency of Japan (NPA),  National Cybersecurity Office of Japan (NCO), US Federal Bureau of Investigation (FBI), US Department of Defense Cyber Crime Center (DC3), Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC), Germany Federal Intelligence Service (BND), and Germany Federal Office for…

Executive Summary An Infoblox cybersecurity report, published on 15 September 2026, has revealed that online casinos are being used to disguise and deploy malicious threats targeting governments across Asia. Infoblox researchers discovered that a computer script known as PeckBirdy is being embedded into Chinese-language casino websites to avoid detection by targets and security software. These…

Executive Summary Microsoft Security Research published in a report  on 9 September 2026 tracking active cloud-based intrusions spanning multiple accounts in which unusual sign-ins were followed by threat actor-added authentication methods, high-volume Microsoft Graph activity, SharePoint and OneDrive downloads, and email collection through REST APIs. The activity begins with identity-focused social engineering and impersonation infrastructure,…

Executive Summary Arctic Wolf is tracking a widespread data theft and extortion threat cluster designated as PREY-0058, also known as Cordial Spider and the previously-mentioned UNC667, above. This activity, detailed in a GitHub blog post published on 4 September 2026, targets Microsoft 365 and other SaaS services through IT help-desk vishing, adversary-in-the-middle token theft, and residential-proxy sign-ins. Analysis of…

Executive Summary A dark web marketplace is selling 153,000,000 American and Canadian driver’s licenses, reportedly siphoned from idscan[.]net, according to multiple social media posts. The illicit marketplace, dubbed Nexus, sells scans of IDs on over 170 million people in North America. This platform specializes in in-person identity verification and serves businesses such as major retail and shipping entities, marijuana…

Executive Summary On 28 August 2026, Microsoft Threat intelligence reported details of what they have dubbed a TerminalFix campaign, a variant of ClickFix, targeting organizations across multiple industries. The campaign uses compromised websites to display a fake Cloudflare CAPTCHA verification overlay that tricks users into copying and executing a malicious PowerShell command. The PowerShell command masquerades…

Executive Summary Manchester Airports Group has disclosed on 27 August 2026 that an unauthorized third party accessed customer data belonging to approximately 8.7 million people across three of England’s busiest airports: Manchester, London Stansted, and East Midlands. The incident involved data related to parking lot, lounge and fast-track bookings and in-airport Wi-Fi sign-ups, and the hackers obtained email…

Executive Summary Researchers from Lab539 on 12 August 2026 observed a widespread campaign utilizing compromised WordPress sites to deliver a ClickFix verification flow that prompts users to execute a malicious PowerShell command. The injected JavaScript employs an EtherHiding mechanism, retrieving AES-encrypted code from an Ethereum smart contract on the Sepolia network rather than hardcoding the payload…

A Single Incident Ripples Across Industries In late July, a major global logistics and shipping provider was hit by a cyberattack that disrupted warehouse operations across Europe. The company, which operates more than 1,700 facilities in 170 countries, notified affected customers in early August that several European warehouses were unable to ship stored goods. Some…