Global 'Operation Endgame' Dismantles Major Malware Networks; Five Eyes Warns AI is Accelerating Cyber Threats

New intelligence on the 'FortiBleed' campaign indicates a significantly larger scale than previously understood. Over 86,644 Fortinet devices, including FortiGate firewalls and SSL VPN gateways, have been compromised across 194 countries since February 2026. Threat actors, believed to be Russian-speaking, are employing an automated feedback loop: after gaining initial access via weak credentials, they use the compromised device as a listening post to harvest additional credentials from VPN traffic. These newly acquired credentials are then fed back into the campaign, expanding its reach exponentially. Victims span all sectors, with telecommunications being heavily targeted. This update underscores the urgent need for organizations to implement phishing-resistant MFA and restrict management interface access.

Further analysis of the ShapedPlugin supply chain attack reveals critical new information. The malicious updates, now assigned CVE-2026-10735 and CVE-2026-49777, specifically targeted 'Pro' versions of plugins. The backdoor creates a hidden administrator account (e.g., 'wp_support_sys'), steals database credentials from wp-config.php, and exfiltrates plaintext 2FA secrets to a C2 server at cdn-stats-api[.]com (IP 194.76.217.28). This sophisticated payload grants attackers persistent and complete control, making remediation more complex than initially understood.

A new Integris report indicates that 60% of U.S. manufacturers experienced a significant email-based security breach and 49% a mobile device breach in the past year. This highlights a critical gap between rapid smart factory technology adoption and cybersecurity maturity. The report also notes a significant commercial impact, with 83% of consumers concerned about security risks and 25% changing purchasing habits due to these concerns. This data provides real-world breach statistics and consumer impact, complementing the existing article's focus on AI-driven risks in the manufacturing sector.

The U.S. National Association of Insurance Commissioners (NAIC) has confirmed a breach by the ShinyHunters group, leveraging the critical Oracle PeopleSoft zero-day (CVE-2026-35273). The vulnerability's CVSS score is now confirmed at 9.8. Exploitation was active from May 27 to June 9, 2026, two weeks before Oracle's patch on June 10. The NAIC stated no PII was compromised, but public financial data was accessed. The FBI is investigating the broader campaign, which targeted over 100 organizations, expanding beyond the previously reported education sector to include regulatory bodies.

The global 'Operation Endgame' has significantly expanded its scope beyond SocGholish, now also disrupting the infrastructure of Amadey and StealC malware networks. This broader action involved the takedown of 326 servers and 142 domains, a substantial increase from previously reported figures. Law enforcement also seized over EUR 41 million in criminal crypto assets and recovered 27 million stolen credentials. The operation now includes agencies from six countries, with private sector partners like Microsoft playing a key role, notably using the RICO Act to dismantle Amadey and StealC infrastructure. This represents a much larger blow to the cybercrime ecosystem.

Further analysis of the WhatsApp VBScript campaign reveals that the initial VBScript acts as a dropper, creating hidden directories and downloading more heavily obfuscated scripts from a remote server. These obfuscated scripts sometimes contain fake Chinese-language comments, likely an attempt to appear benign to analysts. This multi-stage process precedes the installation of legitimate Remote Monitoring and Management (RMM) tools, adding a layer of sophistication to the attack chain.