Loading story…
A threat actor using the alias "Mr. Raccoon" has allegedly breached Adobe support systems through a third-party Indian BPO contractor and claims to have stolen a large cache of sensitive data. According to unverified reports and social media posts, the actor first compromised a contractor employee with a malicious email delivering a remote access trojan, then expanded access by phishing the employee’s manager. The attacker says the intrusion exposed more than 13 million support ticket records, roughly 15,000 employee records, internal documents, Adobe’s Microsoft SharePoint environment, and submissions from Adobe’s HackerOne bug bounty program.
The reports further allege the actor abused overly permissive ticket export functionality that allowed bulk extraction of support data in a single request, raising concerns about phishing, identity theft, and exposure of unpublished vulnerability disclosures. The incident, if confirmed, would represent a significant third-party supply chain compromise affecting Adobe’s support operations. Adobe had not publicly confirmed or denied the claims at the time the reports were published.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Google Threat Intelligence Group reported that UNC6783 is targeting business process outsourcing providers to steal corporate Zendesk support tickets and access downstream victims using phishing, helpdesk manipulation, fake Okta pages, and remote access malware. GTIG assessed UNC6783 may be linked to the Raccoon persona associated with attacks on multiple BPOs, including the unconfirmed Adobe-related claim.
Google Threat Intelligence Group reported that UNC6783, potentially linked to the Raccoon persona, targeted several dozen high-value companies by exploiting BPOs, helpdesks, and support workflows. After stealing data through phishing, spoofed Okta pages, device enrollment abuse, and occasional remote access malware, the actor sent Proton Mail ransom notes as part of data-theft extortion operations.
Researchers from vx-underground said the alleged Adobe breach appeared plausible but may have been confined to the helpdesk environment rather than Adobe's full corporate network. The reporting also cited analyst suspicion that initial access may have involved a remote access trojan delivered by malicious email.
At the time the claims were reported, Adobe had not publicly confirmed or denied the alleged incident. Coverage emphasized that the breach details remained unverified pending an official response.
Unverified reports said a threat actor calling himself 'Mr. Raccoon' claimed to have compromised Adobe support operations through an Indian BPO contractor. The alleged haul included 13 million support tickets, about 15,000 employee records, access to Adobe SharePoint and HackerOne data, and internal documents.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcego.theregister.com
Open sourcescworld.com
Open sourcebleepingcomputer.com
Open sourceaustinlarsen.me
Open sourcescworld.com
Open sourcecybersecuritynews.com
Open sourcereddit.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Accenture confirmed a cybersecurity breach after a threat actor using the name **"888"** advertised roughly **35 GB** of alleged company data for sale on a cybercrime forum. The seller claimed the cache included source code, configuration files, **RSA keys**, **SSH keys**, **Azure Personal Access Tokens**, and **Azure Storage access keys**, and reportedly shared a screenshot appearing to show an Azure DevOps repository tied to an Accenture domain being cloned. Independent verification of the full dataset and its authenticity was not available at the time of reporting. Accenture said it detected irregular activity, investigated the incident, contained the affected environment, remediated the source of the breach, and restored impacted systems. The company said operations and service delivery were not affected, but it has not disclosed how the intrusion occurred, how many systems or repositories were involved, whether the exposed credentials were valid, or whether any customer data or customer environments were impacted.
Jul 11, 2026
ShinyHunters has claimed responsibility for breaching Cisco and stealing more than **3 million Salesforce records** along with internal corporate data, **GitHub repositories**, and contents from **AWS S3 buckets**, then posted a **"FINAL WARNING"** on its leak site threatening to publish the data after April 3. Reports said the alleged haul may include information tied to Cisco customers, employees, and personnel from U.S. and foreign government agencies, while screenshots shared by the group purportedly showed access to Cisco-linked AWS infrastructure and multiple connected cloud accounts. The intrusion was linked in reporting to three alleged access paths involving **Salesforce CRM**, **Salesforce Aura/Experience Cloud**, and AWS environments, and to activity tracked as **`UNC6040`** and **`UNC6395`**. Threat intelligence cited in the coverage said the attackers have used **vishing** to trick employees into approving malicious Salesforce OAuth applications, then abused stolen tokens to bypass MFA and move deeper into cloud environments; recommended defenses included auditing connected OAuth apps, revoking suspicious tokens, tightening API access controls, and monitoring for unauthorized Salesforce Data Loader activity. Cisco had not publicly addressed the March 2026 extortion claim at the time of reporting.
Jun 29, 2026
Mexican IT and cybersecurity provider **Be Prime** disclosed a cyberattack after a threat actor using the alias **`dylanmarly`** posted alleged proof of compromise on a cybercrime forum. The attacker claimed to have accessed Be Prime administrative accounts, **Cisco Meraki Vision** surveillance systems, Meraki API keys, and thousands of network devices, and to have leaked **12.6 GB** of data linked to Be Prime and some of its clients. Public reporting said the intrusion may have involved administrator accounts without multifactor authentication, though Be Prime did not confirm those specific allegations. Be Prime said it activated containment, mitigation, investigation, and remediation measures with support from **Cisco Talos**, and stated that it had found no evidence so far of disruption to its own operations or those of customers. At the same time, the company warned it could pursue legal action against parties spreading what it described as false or out-of-context claims about the incident, a response that drew criticism from researchers and journalists who argued that threatening reporters and whistleblowers could intensify scrutiny of the breach and its potential impact on client data and video surveillance exposure.
Jun 29, 2026