Loading story…
Recent cybersecurity news covers a wide range of topics, including the evolving threat landscape, regulatory changes, and the persistent risks associated with misconfigurations and legacy systems. Notable highlights include urgent warnings from CISA and other agencies about the Akira ransomware's new, faster variant targeting critical infrastructure, and the release of the updated OWASP Top 10 Web Application Risks for 2025, which now includes "software supply chain failures" as a key concern. Additionally, Microsoft Exchange servers face heightened risk due to the end of support for Exchange 2016 and 2019, with CISA and NSA urging organizations to follow best practices to mitigate imminent threats. In Brazil, banking Trojans such as Coyote and Maverick are actively targeting users, particularly through WhatsApp, resulting in hundreds of organizations being affected.
On the regulatory front, the UK has introduced a new Cyber Security and Resilience Bill to strengthen protections for critical sectors, mandating rapid incident reporting and imposing significant penalties for non-compliance. Kenya has launched the "Code Nation" initiative to train over a million tech workers, including cybersecurity specialists, as part of its digital transformation. Meanwhile, industry commentary highlights the growing risks of misconfigurations in platforms like Salesforce, the challenges posed by non-human and AI identities, and the ongoing debate over privacy and surveillance in the EU. These developments underscore the complexity and interconnectedness of today's cybersecurity environment, with organizations urged to stay vigilant and adapt to rapidly changing threats and regulations.
See the reporting duties and controls this puts on the clock.
4 events from the most recent confirmed update back to the earliest known activity.
CISA advised organizations to strengthen and refresh their protections against Akira ransomware as concern over the threat continued. The guidance was presented as a current defensive response to active ransomware risk.
Security reporting described Coyote and Maverick banking trojans as actively operating at scale in Brazil, indicating an ongoing escalation in regional banking malware activity. The coverage pointed to these malware families as a significant current threat to Brazilian users and institutions.
CISA warned that organizations remained at risk because Cisco fixes had been applied incompletely, while a China-linked threat group was actively exploiting the affected systems. The alert emphasized that partial remediation was insufficient.
CISA issued an alert urging organizations to act immediately to secure on-premises Microsoft Exchange environments, warning they were under imminent threat. The warning highlighted the need for urgent defensive action by administrators.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See what this changes for your reporting obligations and which controls it puts on the clock.
4 references tracked. Mallory keeps watching after this page renders.
tenable.com
Open sourcethehackernews.com
Open sourcedarkreading.com
Open sourcedarkreading.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple outlets published **weekly cybersecurity roundups** summarizing a mix of vulnerability disclosures, ransomware/breach reporting, and policy developments rather than a single discrete incident. TechTarget highlighted a surge in reported vulnerabilities (citing **48,000+ new CVEs in 2025**) and called out several high-impact issues, including a **critical ServiceNow weakness** tied to weak authentication in the legacy *Virtual Agent* chatbot that became more dangerous when paired with agentic AI (*Now Assist*), potentially enabling impersonation and **admin-level access** into connected enterprise systems. Other roundup coverage aggregated unrelated security events across sectors. Sherpa Intelligence’s “Five for Friday” compiled items including ransomware claims (e.g., **Everest** targeting Nissan; **Nightspire** claiming an attack on a Hyatt Place property) and breach reporting (e.g., a **Korean Air** employee-data breach attributed to **Clop**). The Cyber Express weekly roundup similarly mixed disparate topics (platform policy changes around AI abuse, senior government appointments, and national-level connectivity disruptions), reinforcing that the common thread is **curation of multiple stories** rather than new primary reporting on one specific cyber event.
Jun 29, 2026
Multiple weekly cybersecurity roundups and newsletters highlighted a mix of policy, threat, and vulnerability developments rather than a single discrete incident. UK government messaging featured prominently, including a campaign urging businesses to “lock the door” against cyber criminals and publication of longitudinal survey results indicating most organizations continue to experience cyber incidents (with reported rates in the 70–80% range across businesses and charities). Separately, commentary from European security circles emphasized growing calls for **offensive cyber capabilities** (“strike back”) amid concerns about Russian aggression and sabotage activity across Europe, including references to cyber operations targeting critical infrastructure. Threat reporting in the same period emphasized escalating **nation-state and proxy activity** against critical infrastructure and the defense industrial base, citing research that espionage groups (including those linked to China, Russia, and North Korea) have compromised organizations by exploiting **zero-day vulnerabilities in edge devices** (e.g., VPNs and gateways). Additional reporting pointed to newly identified OT-focused threat groups (e.g., **Sylvanite**, **Azurite**, **Pyroxene**) and a broad set of emerging technical risks and product/security changes, including discussion of an **OpenSSL RCE** risk, **Foxit 0-days**, and analysis of **LockBit 5.0** ransomware techniques (e.g., ETW tampering, process hollowing, log clearing) alongside Android platform security changes (e.g., deprecating cleartext traffic defaults and adding HPKE support).
Jun 29, 2026
Multiple organizations worldwide experienced significant cybersecurity incidents, including ransomware attacks, data breaches, and exploitation of zero-day vulnerabilities. Notable events include a ransomware attack on LG's battery subsidiary by the Akira group, a confirmed breach at Logitech linked to the Clop ransomware group, and a data breach at DoorDash affecting user information. The UK National Health Service (NHS) was compromised via an Oracle EBS zero-day, and Princeton University suffered a data breach impacting alumni, donors, faculty, students, and parents. Additional incidents involved the hacking of Somalia's e-visa system, resulting in the theft of over 35,000 applicants' data, and the disruption of Russian port operator Port Alliance due to a cyberattack. These incidents highlight the ongoing threat posed by ransomware groups, zero-day exploits, and targeted attacks on critical infrastructure and service providers. Security news roundups and technical digests reported on these incidents alongside broader threat intelligence developments. Updates included new and refined detection rules for cloud environments (AWS, Azure), Linux, and Windows, as well as coverage of phishing campaigns, credential theft, and the abuse of legitimate tools for persistence and lateral movement. The cybersecurity community also discussed the impact of AI on security, the proliferation of rogue npm packages, and the need for improved detection engineering to address evolving threats. These developments underscore the importance of timely patching, robust detection capabilities, and cross-sector collaboration to mitigate the impact of increasingly sophisticated cyberattacks.
Jun 29, 2026