Loading story…
The Civil Service Employees Association (CSEA), a New York labor union representing state and local government workers, reported a data breach in which attackers accessed its systems between May 3 and May 31 and stole personal information affecting more than 47,000 members. Disclosed data may include names, Social Security numbers, and other personal details; CSEA said it took impacted systems offline, reset passwords, and implemented additional security controls, and it reported no confirmed misuse of the data at the time of notification.
Separately, MITRE released the Embedded Systems Threat Matrix (ESTM) 3.0, a framework aligned to MITRE ATT&CK that catalogs tactics and techniques targeting hardware and firmware in embedded environments (e.g., healthcare, energy, industrial controls, robotics, transportation) and is designed to support threat modeling and attack-path analysis, including alignment with the EMB3D Threat Model. A third item is a Palo Alto Networks Unit 42 post marking the Cyber Threat Alliance (CTA) anniversary and promoting industry collaboration; it is not tied to the CSEA incident or the MITRE framework and contains no specific vulnerability or incident details.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
MITRE announced the Embedded Systems Threat Matrix, a framework based on ATT&CK to classify tactics and techniques targeting hardware and firmware environments across sectors such as healthcare, energy, industrial controls, robotics, and transportation.
After discovering the compromise, CSEA took affected systems offline, reset passwords, deployed additional security controls, and engaged outside cybersecurity and privacy firms to investigate and support notifications.
CSEA reported that the unauthorized access in its environment lasted through May 31, marking the end of the known intrusion window.
The Civil Service Employees Association said attackers were present in its systems starting on May 3, during a breach that ultimately exposed member information.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two security-news roundups highlighted a broad set of **unrelated cyber incidents** rather than a single cohesive event. *Security Magazine* summarized seven January 2026 breach/exposure headlines and cited the Identity Theft Resource Center’s 2025 Data Breach Report, which reported **2025 as the highest year on record for breach counts** while **victim notices fell 79% year-over-year**, suggesting a shift away from 2024-style “mega-breaches” toward more frequent, targeted theft of high-value data. Among the incidents called out were the alleged theft and public release of roughly **860 GB of Target internal source code and developer documentation** (posted to *Gitea*), a breach of **BreachForums** that exposed metadata for about **324,000** associated individuals (e.g., usernames, emails, registration dates, IP addresses), and an **ICE data leak** involving an uploaded database that reportedly exposed sensitive information on personnel (including roughly **2,000 agents** and **150 supervisors**). Separately, *The Cyber Express* weekly roundup described a **cyberattack disrupting Spain’s Ministry of Science, Innovation, and Universities**, forcing a partial IT shutdown and temporary closure of its electronic headquarters, and also covered AI/policy items (e.g., OpenAI controlled access for cyber defense models), reinforcing that the reporting was a multi-topic digest rather than a single incident narrative.
Jul 12, 2026
The provided items do not describe a single cohesive cybersecurity event; they cover **separate incidents and research**. Dark Reading reported an **Iran-linked credential theft and surveillance effort** targeting people of interest abroad (including Iranian expats and regional targets) using **spear-phishing and social engineering**, including lures delivered via **WhatsApp** and phishing infrastructure that was rapidly stood up and taken down as campaigns shifted targets. Separately, Dark Reading covered allegations that the **Chronus Group** leaked **2.3TB** of data purportedly sourced from **25+ Mexican government institutions**, claiming exposure affecting **36 million** people; Mexico’s **ATDT** disputed that it represented a new breach, stating it appeared to be **aggregated data from prior incidents** and that impacted systems were largely **obsolete, third-party administered** state-level platforms. In parallel, Red Asgard published new technical findings on the **Lazarus-linked “Contagious Interview”** activity targeting **developers/freelancers** via fake recruiting, reporting recovery of **241,764 plaintext credentials** from unauthenticated endpoints, identification of an **AnyDesk-based RAT** with persistent remote access and hardcoded attacker credentials, and additional detection content (e.g., **YARA** and **Snort** rules).
Jun 29, 2026
A weekly threat-intelligence roundup highlighted **Microsoft’s January Patch Tuesday** release addressing **112 vulnerabilities** across Windows and *Microsoft Edge*, spanning multiple classes including elevation of privilege, remote code execution, and information disclosure. The same briefing reported active interest in **CVE-2025-64155**, a **critical FortiSIEM** vulnerability, with observed exploitation activity against honeypot environments following an out-of-band alert from Kroll Threat Intelligence—an indicator of likely broader scanning and attempted exploitation. The update also covered multiple threat developments: Check Point research described **VOIDLINK**, a Linux-focused malware framework (implants/rootkits/loaders) designed for long-term access, including in cloud environments; **North Korean-linked KTA082 (Kimsuky/APT43)** was reported using **QR-code phishing (“quishing”)** to target government, education, and think tanks; and **Iran-linked KTA060 (MuddyWater)** was associated with development of the **RUSTYWATER RAT**. Separately, detection-engineering updates noted new and refined rules for **OAuth/Entra ID consent phishing** patterns (including *ConsentFix*-style authorization flows), correlations between Entra ID risk events and privileged actions (e.g., PIM elevation/device-code auth), Windows persistence/defense-evasion behaviors (e.g., scheduled tasks by unsigned executables, Chrome security feature tampering), and updated YARA/behavioral detections for malware families (e.g., **Agent Tesla**, **MintsLoader**) and **Cobalt Strike** TTPs; the briefing also referenced a leak of a database purportedly containing ~**324,000 BreachForums** user records posted to `shinyhunte[.]rs`.
Jun 29, 2026