Notepad++ Supply Chain Attack by Chinese APT; Russian Group Exploits Office Zero-Day
Summary
A sophisticated supply chain attack targeting the popular Notepad++ editor, attributed to the Chinese APT group Lotus Blossom, has been uncovered, selectively deploying malware to users in Southeast Asia. Concurrently, the Russian-backed APT28 is actively exploiting a new Microsoft Office zero-day vulnerability (CVE-2026-21509) to target entities in Eastern Europe. Ransomware remains a dominant threat, with the Qilin group claiming an attack on Tulsa International Airport and other groups targeting US law firms and manufacturing. These events highlight a landscape of escalating state-sponsored espionage and persistent criminal activity targeting critical infrastructure and corporate entities.
Today New Articles
Notepad++ Update Mechanism Hijacked in 6-Month Supply Chain Attack by Chinese APT
The maintainers of the widely-used Notepad++ text editor have disclosed a major supply chain attack that compromised their update infrastructure for six months in 2025. The attack, attributed to the Chinese espionage group Lotus Blossom (Billbug), involved hij...
Qilin Ransomware Claims Breach of Tulsa International Airport, Leaks Data
The Russian-affiliated Qilin ransomware group has claimed responsibility for a cyberattack against Tulsa International Airport. The group has listed the airport on its data leak site, alleging the theft of sensitive data including financial records and employe...
Sophisticated Phishing Attack Uses PDF Lures and Cloud Services to Steal Dropbox Credentials
A new, multi-stage phishing campaign is using procurement-themed emails with benign-looking PDF attachments to bypass email security filters. The attack chain redirects victims through a legitimate cloud service, Vercel Blob, before presenting a convincing fak...
Canada Computers Discloses Data Breach Affecting Guest Checkout Customers
Canada Computers Inc., a major Canadian electronics retailer, has announced a data breach that exposed the personal and credit card information of customers. The incident affected individuals who used the 'guest' checkout feature on the company's website betwe...
Play Ransomware Hits US Instrument Manufacturer Deatak in Data Breach
The Play ransomware group has claimed another victim in the manufacturing sector, listing U.S.-based instrument maker Deatak on its data breach forum. The attackers allege they have compromised and exfiltrated a wide range of private and confidential data, inc...
INC Ransomware Group Breaches Two U.S. Law Firms, Leaks Sensitive Client Data
The INC ransomware group is actively targeting the U.S. legal sector, claiming responsibility for attacks on at least two law firms: Hawk Law Group and Eisenberg Lowrance Lundell Lofgren. The group alleges it has stolen highly sensitive client information, inc...
Ransomware Attack Cripples City of New Britain, CT, Forcing Manual Operations
A ransomware attack has caused significant and ongoing disruption to the municipal network systems of New Britain, Connecticut. The attack, which began last week and was later confirmed as ransomware, has impacted the city's entire internet server. As a result...
FCC Warns Telecoms of 4x Increase in Ransomware, Urges Better Security
The U.S. Federal Communications Commission (FCC) has issued a formal alert to the telecommunications industry regarding the escalating threat of ransomware. Citing data that shows a fourfold increase in attacks on the sector between 2022 and 2025, the FCC's Pu...
Article Updates
Health-ISAC Report: AI-Enabled Attacks Named Top Threat to Healthcare Sector in 2026
Update:The Health-ISAC report now includes specific 2025 statistics, showing a 55% increase in cyber incidents across all sectors and a 21% rise in healthcare. Ransomware was identified as the top threat in 2025, causing significant disruptions. While AI-enabled atta...
Microsoft Patches Actively Exploited Office Zero-Day (CVE-2026-21509) Under Targeted Attack
Update:New intelligence reveals Russian state-sponsored threat group APT28 (aka Fancy Bear) is behind 'Operation Neusploit,' actively exploiting CVE-2026-21509. The campaign targets government-related entities in Ukraine, Slovakia, and Romania using malicious RTF doc...
Open VSX Marketplace Hit by Supply Chain Attack Spreading "GlassWorm" Malware
Update:Further analysis of the Open VSX supply chain attack reveals a more detailed attack flow, including the likely method of credential compromise (T1552.001 - Credentials in Files) and the loader's function for ingress tool transfer (T1105). The report also incor...