AI, Supply Chain Attacks, and New Backdoors Dominate Cybersecurity News

A sophisticated phishing campaign is targeting the hospitality industry by leveraging legitimate services like Calendly and Google's URL redirection to bypass email security. Emails sent via Calendly's notification system pass authentication checks, leading to links that use Google redirects to obscure the final malicious payload. This payload is a Node.js-based implant designed to establish persistent access. This 'authentication laundering' technique highlights the evolving methods attackers use to evade detection, with specific IOCs identified including C2 IP 178.16.54.27 and domain sec-safe-dc.info.

Further analysis of the Cisco SD-WAN zero-day exploitation (CVE-2026-20245) confirms that threat actors likely gained initial access by chaining two previously undisclosed authentication bypass flaws, CVE-2026-20127 and CVE-2026-20182. This multi-staged attack allowed them to establish a foothold before exploiting CVE-2026-20245 for root privilege escalation. The main vulnerability has a CVSS score of 7.8 (High). This clarifies the initial entry point of the sophisticated campaign targeting communications service providers.

This update provides further analysis of the Black Kite report, highlighting the strategic shift by ransomware groups to compromise third-party suppliers and IT service providers as a primary vector for supply chain attacks. New hunting hints include monitoring VPN logs, `psexec.exe` usage, and unusual RDP/SMB traffic. Additional mitigation advice emphasizes implementing the principle of least privilege. The report reinforces the 55.1% surge in European ransomware attacks and the continued prominence of the Qilin group, offering a slightly different perspective on the same core findings.

The persistent supply chain attack, involving Miasma and Mini Shai-Hulud, has expanded its targeting to include the Go programming language ecosystem. A new malware family, Hades, has been identified. Attackers recently hijacked the 'semantic-release-action' GitHub Action on June 24, 2026, by force-pushing a malicious commit, leading to widespread credential theft and propagation. New techniques include a dead drop resolver using specific strings like 'firedalazer' for dynamic payload updates and AES-128-GCM for exfiltration, indicating increased sophistication and broader reach.

New expert insights from Infosecurity Europe 2026 confirm AI's role in fundamentally reshaping the cybercrime economy, particularly ransomware. Former FBI officials highlight AI's ability to lower the barrier for novice attackers while enhancing advanced threats, leading to automated, scalable, and highly targeted campaigns. CISOs are urged to adopt continuous visibility, risk-based management for IT/OT, Zero Trust, and proactive threat hunting to counter AI-driven attacks that are now outpacing traditional, perimeter-focused defenses. The article details how AI enhances social engineering, vulnerability discovery, exploit generation, and malware sophistication.