Massive Canvas Breach, 'Mini Shai-Hulud' Supply Chain Worm, and Microsoft's Largest Patch Tuesday of the Year

New analysis of the Cl0p ransomware breach at South Staffordshire Water includes additional MITRE ATT&CK techniques. Beyond initial spearphishing, the attackers likely used persistence mechanisms like Registry Run Keys or Scheduled Tasks, harvested credentials via LSASS Memory, and employed lateral tool transfer for movement. The final stages involved exfiltration over alternative protocols and data encryption for impact, providing a more comprehensive technical overview of the attack chain.

Instructure has announced an agreement with ShinyHunters following the Canvas LMS breach. The company claims the deal includes the deletion of 3.65 TB of data belonging to 275 million users. While Instructure did not disclose if a ransom was paid, the agreement has sparked debate among cybersecurity experts regarding the precedent set by negotiating with threat actors and the unverifiable nature of data destruction claims. The incident continues to highlight systemic risks in the education sector.