Cyber — daily report — 2026-09-21
The reporting period is dominated by attacks on critical and electoral infrastructure: Romania records the most serious cyber incident in its history (ANCPI/Cadastral ransomware, with ransomware attacks up by more than 150% in 2025), while Russia reports over 3,000 DDoS waves against its electoral infrastructure. On t…
Cyber — daily report — 2026-09-19
The reporting period is dominated by actively exploited critical vulnerabilities: a Cisco ISE zero-day (CVE-2026-76460, CVSS 10.0) with a CERT-RO alert and a critical Zimbra Collaboration Suite vulnerability, both under active exploitation. North Korean social engineering campaigns based on fake job interviews have in…
Cyber — daily report — 2026-09-18
In the last 24–36 hours there have been significant increases in AI-based attacks, including the Android malware "RatHat", and new supply-chain incidents (Brevo). Meanwhile, Chinese APT groups (Salt Typhoon, FamousSparrow) are intensifying espionage operations in Latin America, while CISA is discontinuing its weekly v…
Cyber — daily report — 2026-09-17
The reporting period is dominated by the appearance of the first documented data breach incident carried out by an autonomous AI agent, reported in Spain, as well as the active exploitation of zero-days on Google Pixel phones and the Issabel framework. At the same time, Iranian state actors and banking malware operati…
Cyber — daily report — 2026-09-16
The reporting period is dominated by the Iranian "CHOSEN BRICK" espionage campaign, officially confirmed by the intelligence services of the US, UK and the Netherlands, which targets dissidents and journalists through malware controlled via Telegram. A likely North Korean APT group used an undocumented Linux toolkit a…
Cyber — daily report — 2026-09-15
The reporting period is dominated by the active exploitation of the maximum-severity GitLab vulnerability (CVE-2026-85706, CVSS 10.0), confirmed by CISA, with major risk to software supply chains. The Russian group Sandworm has relaunched the Cyclops Blink botnet by chaining Cisco vulnerabilities, while the Chinese ac…
Cyber — daily report — 2026-09-14
Perioada raportată este dominată de breșa Revolut, în care date sensibile ale clienților (documente de identitate, selfie-uri de verificare, extrase de cont) au fost divulgate în urma unui e-mail fraudulos care imita o solicitare oficială guvernamentală. În România, atacul asupra ANCPI/Cadastru generează efecte instit…
Cyber — daily report — 2026-09-13
The threat landscape over the last 24-36 hours is dominated by active exploitation of vulnerabilities in JFrog Artifactory, GitLab, and Check Point VPN, with CISA adding five actively exploited flaws to the KEV catalog. A second major vector is the abuse of AI both by attackers (swarms of OpenAI agents, phishing gener…
Cyber — daily report — 2026-09-11
The reporting period is dominated by the active exploitation of Cisco FMC vulnerabilities by ransomware groups and state-sponsored actors, as well as a massive campaign based on AI agents that compromised 395 organizations through vulnerable PaperCut servers. On the data front, IDScan confirmed a breach involving 153…
Cyber — daily report — 2026-09-10
The threat landscape over the last 24 hours is dominated by the active exploitation of a maximum-severity vulnerability in Cisco Secure FMC (CVE-2026-20079) and by an unprecedented exploit kit (BlueMoon) used by at least four China-linked espionage groups against Chrome and Windows. In Romania, the cyberattack on the…
Cyber — daily report — 2026-09-09
Microsoft released a record 974 CVEs, two of which are zero-days already being actively exploited, while fraud networks such as DoppelCart and multi-hop Google phishing campaigns continue to compromise sensitive data at scale.
Cyber — daily report — 2026-09-08
The reporting period is dominated by the active exploitation of a zero-day in Adobe Commerce/Magento ("StyleSmuggler"), used to install backdoors on online stores, and by a massive phishing-as-a-service attack (BigBear 2.0) that bypassed MFA at 258 organizations. There was also a theft of approximately 320 million USD…
Cyber — daily report — 2026-09-07
The reporting period is dominated by a major ransomware attack on the Berlin administration — the Rhysida group published sensitive data on the dark web after the refusal to pay a ransom of over EUR 2 million. At the same time, hackers extracted approximately 4,000 BTC (~USD 320 million) from the Liquid Federation wal…
Cyber — daily report — 2026-09-06
The reporting period is dominated by the active exploitation of zero-day vulnerabilities: a zero-day in Magento/Adobe Commerce used to plant backdoors in online stores, and a sandbox RCE actively exploited across all versions of Chromium. The Berlin crisis, where the Rhysida group published sensitive data from the loc…
Cyber — daily report — 2026-09-05
The reporting period is dominated by active exploitation: a critical authentication bypass in Citrix NetScaler (CVE-2026-19490) and a Chromium sandbox RCE are being exploited in the wild. A CrowdStrike Falcon zero-day (FalconFlank) allows privilege escalation to SYSTEM on fully updated Windows. In parallel, large-scal…
Cyber — daily report — 2026-09-03
The reporting period is dominated by the active exploitation of zero-days in edge devices: SonicWall SMA 1000 (two chained zero-days, unauthenticated RCE) and JFrog Artifactory (authentication bypass for admin token generation). A landmark incident reported by Unit 42 shows that front-line AI agents executed a complet…
Cyber — daily report — 2026-09-02
In ultimele 24-36 de ore, peisajul amenintarilor cibernetice este dominat de exploatarea agresiva a unor vulnerabilitati critice in platforme AI si DevOps, precum Langflow si JFrog Artifactory. De asemenea, un nou serviciu de furt de identitate pe dark web expune peste 153 de milioane de permise de conducere, iar atac…
Cyber — daily report — 2026-09-01
In the last 24 hours, we have observed an intensification of attacks on critical infrastructure and supply chains, with major incidents in the healthcare and financial sectors. The 'TerminalFix' campaign represents an emerging threat, using PowerShell to implant reverse tunnels in corporate networks. Attacks on crypto…
Cyber — daily report — 2026-08-31
In the last 24-36 hours, the cyber threat landscape has been dominated by targeted attacks against critical infrastructure and individual users. A hacker group is blackmailing Berlin's city hall with a massive ransom, and an attack on Manchester airports has exposed the personal data of thousands of travelers. Additio…
Cyber — daily report — 2026-08-30
In the last 24-36 hours, the cyber threat landscape is dominated by attacks on government infrastructure and software supply chains. A major attack on Berlin's administrative network led to the theft of 6TB of data, with hackers demanding a ransom of 2 million euros. At the same time, critical vulnerabilities have bee…