Loading story…
Sakata Seed disclosed a cyber incident affecting its U.S. subsidiary, saying the company is investigating the intrusion and has so far assessed the business impact as limited. The disclosure indicates the incident was significant enough to warrant public reporting, but operations were not described as broadly disrupted.
A separate historical reference noted Microsoft had previously said it had already patched several vulnerabilities tied to the Shadow Brokers leak of alleged NSA-linked exploits, underscoring how vendors and enterprises continue to face pressure from both newly disclosed intrusions and the downstream risk posed by exposed offensive tooling. In Sakata Seed's case, the immediate reported development is a contained cyber incident at its U.S. unit with limited operational effect.
See attribution, scope, and your downstream exposure.
2 events from the most recent confirmed update back to the earliest known activity.
Sakata Seed reported a cyber incident affecting its U.S. subsidiary and said the business impact was limited. The disclosure was made in a company announcement covered on 2026-02-13.
After the Shadow Brokers released alleged NSA-linked exploit tools, Microsoft said on 2017-04-14 that many of the vulnerabilities referenced had already been addressed in earlier security updates. The statement indicated customers running supported and updated systems were protected against several of the disclosed exploits.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple weekly threat roundups and research posts reported a mix of active exploitation, new malware tradecraft, and breach claims. Ukraine’s CERT reported **APT28** rapidly weaponized a Microsoft Office zero-day (**CVE-2026-21509**) within roughly a day of Microsoft’s disclosure, using spearphishing emails with malicious DOC lures to deliver **Covenant** backdoors against Ukrainian government targets and EU-related entities. Separately, researchers described **ShadowHS**, a stealthy **fileless Linux** post-exploitation framework that runs in-memory (e.g., via `memfd`-style execution), uses encrypted multi-stage loading (AES-256-CBC), fingerprints defensive tooling (including major EDR agents), and retains operator-driven capabilities such as credential theft, lateral movement, and covert tunneling for exfiltration. Other reporting highlighted incident and exposure claims and defensive takeaways. Check Point described a **supply-chain compromise** affecting *eScan* (MicroWorld Technologies) in which malicious updates were pushed through the legitimate updater, prompting an emergency shutdown of global update services; it also noted **Crunchbase** confirmed a breach affecting **2M+ records** claimed by **ShinyHunters**, and cited extortion/leak claims involving **Qilin** (Tulsa International Airport) and **WorldLeaks** (Nike). Google’s legal/technical disruption of the **IPIDEA** residential proxy network was also cited as reducing available proxy nodes by millions and cutting off C2 domains used to route attacker traffic. Additional coverage described a phishing chain using a fake DHL invoice to abuse a signed Java utility via **DLL sideloading** (malicious `jli.dll`) and **process hollowing** into `AddInProcess32.exe` to run **Phantom Stealer**; detection-engineering updates emphasized new rules for Windows defense-evasion (e.g., tampering with Credential Guard/HVCI, disabling AMSI and the vulnerable driver blocklist) and expanded Kubernetes and Linux post-exploitation detections.
Jun 29, 2026
The **FBI confirmed it detected and remediated “suspicious activities” on its networks** and said it is using “all technical capabilities” to respond, but provided no additional details on scope, impact, or attribution. Reporting citing an anonymous source indicated the activity may have affected a **digital system used to manage and conduct surveillance**, including workflows tied to **foreign intelligence surveillance warrants, wiretaps, and pen registers** (used to trace communications metadata such as IP addresses and dialed numbers). Public reporting did not establish who was responsible or when the activity occurred, and it was **unclear whether the incident is connected** to prior compromises of U.S. lawful-intercept and surveillance-related infrastructure (including earlier reporting about **Salt Typhoon** activity targeting U.S. wiretapping systems). The incident follows a pattern of repeated targeting of U.S. government networks; the FBI has previously disclosed other intrusions and security events affecting parts of its environment, underscoring ongoing operational risk to sensitive investigative and surveillance support systems even when public details remain limited.
Jun 29, 2026
Sakura Internet disclosed that attackers accessed its sales management system, potentially exposing customer contract and membership information tied to as many as **1,360,563** member accounts. The intrusion was uncovered during an investigation into a separate breach affecting the **Sakura Rental Server** service, where **583 accounts** experienced unauthorized logins and malware was found on Sakura systems. The company said the exact number of affected accounts is still under investigation and that it has not confirmed any data exfiltration. Sakura said passwords in the affected system were stored in hashed form and that the compromised environment did **not** contain credit card data. The company also stated the incident was **not ransomware-related**, no ransom demand was received, and no operational disruption was reported. Sakura invalidated abused credentials, removed detected malware, and notified affected customers and relevant authorities as the investigation continues.
Aug 21, 2026