QuantumLock Hits LogiTrans, Zero-Day in Apex-Office, EU Cyber-AI Act

LogiTrans Global Paralyzed by $45M QuantumLock Ransomware Attack, Global Supply Chains Disrupted

New 'QuantumLock' Ransomware Group Cripples LogiTrans Global, Demands $45 Million

Global logistics firm LogiTrans Global has been hit by a devastating ransomware attack attributed to a new group named QuantumLock. The attack, which began on June 30, 2026, has encrypted critical systems, causing a worldwide halt in operations, including shipment tracking and fleet management. The attackers gained initial access via a compromised VPN, exploited a known vulnerability (CVE-2026-23456) for privilege escalation, and exfiltrated 5 TB of sensitive data before deploying the ransomware. A $45 million ransom is being demanded, with the threat of leaking stolen data. The incident has caused severe disruption to the global supply chain, and LogiTrans has engaged Mandiant and the FBI to manage the crisis.

July 1, 2026

6 min read

ransomwaredouble extortionlogisticssupply chainvpn security +1 more

LogiTrans Global Paralyzed by $45M QuantumLock Ransomware Attack, Global Supply Chains Disrupted

Actively Exploited 'ShiftScribe' Zero-Day in Apex-Office Suite Puts Millions at Risk

CRITICAL

State-Sponsored Hackers Exploit 'ShiftScribe' Zero-Day (CVE-2026-35801) in Apex-Office Suite

A critical remote code execution (RCE) zero-day vulnerability, named 'ShiftScribe' and tracked as CVE-2026-35801, has been discovered in the popular Apex-Office Suite, affecting over 100 million users. The flaw, with a CVSS score of 9.6, is being actively exploited by the state-sponsored threat actor 'Gilded Moth' (APT42) in targeted attacks against government and defense organizations. The attack involves spear-phishing emails with malicious documents that trigger the vulnerability, allowing attackers to deploy a custom backdoor called 'Inkwell'. CISA has added the CVE to its KEV catalog and issued an emergency directive, while Apex Software rushes to develop a patch.

July 1, 2026

5 min read

zero-dayrceaptespionagespear-phishing +2 more

Actively Exploited 'ShiftScribe' Zero-Day in Apex-Office Suite Puts Millions at Risk

HealthNet Insurance Breach Exposes Sensitive Health Data of 11 Million Patients via Misconfigured AWS S3 Bucket

HIGH

Misconfigured AWS S3 Bucket Leads to Massive HealthNet Insurance Data Breach Affecting 11 Million

HealthNet Insurance, a major US health provider, has disclosed a data breach that exposed the personal and medical information of 11 million individuals. The breach, discovered on June 15, 2026, originated from a misconfigured Amazon Web Services (AWS) S3 bucket that contained access keys to other sensitive databases. Attackers gained access around March 3, 2026, and were able to exfiltrate a vast amount of data, including Social Security numbers, medical claims history, and diagnosis codes. The incident has triggered class-action lawsuits and regulatory investigation by the Department of Health and Human Services (HHS).

July 1, 2026

5 min read

data breachcloud securityawss3 bucketmisconfiguration +3 more

HealthNet Insurance Breach Exposes Sensitive Health Data of 11 Million Patients via Misconfigured AWS S3 Bucket

'SandViper' APT Hits Global Energy Sector with New 'DuneStalker' Espionage Malware

HIGH

New 'SandViper' APT Group Targets Global Energy Sector with 'DuneStalker' Backdoor

A new report from Dragos Inc. details a sophisticated cyber-espionage campaign targeting the global energy sector by a previously unknown threat actor named 'SandViper'. The campaign, active since late 2025, focuses on oil and gas companies in the Middle East and Europe. SandViper uses a novel modular backdoor called 'DuneStalker' to infiltrate networks and steal sensitive operational technology (OT) data, including geological surveys and production metrics. The initial access is gained through spear-phishing and watering hole attacks. While not definitively attributed, the TTPs show similarities to Russian and Iranian APT groups.

July 1, 2026

5 min read

aptespionageenergy sectorot securityics +2 more

'SandViper' APT Hits Global Energy Sector with New 'DuneStalker' Espionage Malware

CodeStream CI/CD Utility Compromised in Supply Chain Attack, Developer Secrets Stolen

CRITICAL

Supply Chain Attack Hits 'CodeStream' CI/CD Tool; Malicious Version Steals Dev Secrets

The popular open-source CI/CD utility 'CodeStream' has been the target of a sophisticated supply chain attack. An unknown threat actor compromised the project's package registry, publishing a malicious version (3.4.1) on June 29, 2026. The tainted version, downloaded over 50,000 times, was designed to scan and exfiltrate sensitive credentials, API keys, and tokens from developer environments for services like AWS, GitHub, and Artifactory. The CodeStream team has released a clean version (3.4.2) and is urging all users to upgrade immediately, rotate all credentials, and audit their systems for compromise.

July 1, 2026

5 min read

supply chain attackci/cddevsecopsopen sourcecredential theft +1 more

CodeStream CI/CD Utility Compromised in Supply Chain Attack, Developer Secrets Stolen

Microsoft Releases Emergency Patch for Actively Exploited Exchange Server RCE Flaw (CVE-2026-17747)

CRITICAL

Microsoft Issues Out-of-Band Patch for Critical, Actively Exploited Exchange RCE Vulnerability

Microsoft has released an emergency, out-of-band security update for a critical remote code execution (RCE) vulnerability in Microsoft Exchange Server 2016 and 2019. Tracked as CVE-2026-17747 with a CVSS score of 9.8, the flaw allows an unauthenticated attacker to gain code execution by sending a specially crafted email to a vulnerable server. The vulnerability is being actively exploited in limited, targeted attacks. In response, CISA has added it to its KEV catalog and issued an emergency directive, mandating federal agencies to patch their servers within 48 hours. All organizations running on-premises Exchange are urged to apply the update immediately.

July 1, 2026

5 min read

microsoft exchangezero-dayrcepatch managementcisa +2 more

Microsoft Releases Emergency Patch for Actively Exploited Exchange Server RCE Flaw (CVE-2026-17747)

'FinReact' Phishing Campaign Uses AI-Generated Lures and 'GhostScript' Loader to Target Banks

HIGH

AI-Powered 'FinReact' Phishing Campaign Targets Financial Sector with Evasive JavaScript Loader

A highly sophisticated phishing campaign named 'FinReact' is targeting the financial services industry. Researchers at Proofpoint report that the campaign uses generative AI to create convincing, context-aware email lures that bypass traditional security. The attack chain involves a password-protected ZIP file containing a malicious LNK file, which downloads a novel JavaScript loader called 'GhostScript'. This loader performs anti-sandbox checks before deploying information-stealing malware like Vidar and IcedID. The campaign is attributed to a skilled, financially motivated threat actor.

July 1, 2026

6 min read

phishingaisocial engineeringmalwareinfostealer +3 more

'FinReact' Phishing Campaign Uses AI-Generated Lures and 'GhostScript' Loader to Target Banks

DataHaven Cloud Storage Outage Caused by Security Breach Targeting Customer Data

HIGH

Cloud Provider DataHaven Admits Global Outage Was Caused by Security Breach

Enterprise cloud storage provider DataHaven has confirmed that a multi-hour global outage on June 30, 2026, was the result of a security breach. Attackers gained access to an internal Kubernetes cluster via a zero-day vulnerability in a proprietary management API. They then attempted to issue commands to delete customer data. DataHaven's automated safety protocols detected the malicious activity and initiated a global lockdown of the control plane to prevent data loss. While this action was successful in protecting data, it inadvertently caused a cascading service-wide failure, highlighting the systemic risks in centralized cloud services.

July 1, 2026

5 min read

cloud securityoutagedata breachkubernetesapi security +2 more

DataHaven Cloud Storage Outage Caused by Security Breach Targeting Customer Data

EU Unveils 'CYBER-AI Act' with Strict Security Mandates and Heavy Fines for High-Risk AI

INFORMATIONAL

EU Announces 'CYBER-AI Act', Imposing Strict Cybersecurity Rules on AI Systems

The European Commission has introduced the 'Cybersecurity of Artificial Intelligence Act' (CYBER-AI Act), a new regulation that imposes stringent cybersecurity requirements on high-risk AI systems. Working alongside the existing AI Act, this legislation mandates secure-by-design principles, threat modeling, penetration testing, and vulnerability management for AI developers and deployers. Key requirements include maintaining a Software Bill of Materials (SBOM) and reporting significant incidents to ENISA within 24 hours. Non-compliance can result in massive fines of up to €30 million or 6% of global turnover.

July 1, 2026

5 min read

airegulationpolicycomplianceeu +2 more

EU Unveils 'CYBER-AI Act' with Strict Security Mandates and Heavy Fines for High-Risk AI

'Synapse' Wiper Malware Disguised as Ransomware, Designed for Maximum Destruction

CRITICAL

Kaspersky Analyzes 'Synapse,' a New Wiper Malware Masquerading as Ransomware

Kaspersky researchers have published a detailed analysis of 'Synapse,' a new and highly destructive malware strain. Initially mistaken for ransomware, Synapse is a pure wiper designed to cause irreversible data loss. It uses deception by dropping a fake ransom note and encrypting a few non-essential files, while its main component destroys the Master Boot Record (MBR) and overwrites file headers with junk data. The attack vector in the analyzed case was a compromised software update. The wiper shows code overlaps with malware attributed to the 'Sandworm' APT group, suggesting a possible link to the sophisticated state-sponsored actor.

July 1, 2026

6 min read

wipermalwaresandwormaptdata destruction +2 more

'Synapse' Wiper Malware Disguised as Ransomware, Designed for Maximum Destruction

One Year Later: Omni Hotels Details $50M Recovery and Security Overhaul After Devastating Ransomware Attack

INFORMATIONAL

Omni Hotels Shares Lessons Learned One Year After $50M Ransomware Attack

Omni Hotels & Resorts has published a detailed report outlining its recovery and security transformation one year after a catastrophic ransomware attack in 2025. The incident, attributed to the BlackSuit gang, cost the company over $50 million and led to a complete overhaul of its cybersecurity infrastructure. The hotel chain invested $35 million in a new security stack based on zero-trust principles, including network micro-segmentation, advanced EDR, and phishing-resistant MFA. The report serves as a case study in incident response, recovery, and the importance of board-level engagement in cybersecurity.

July 1, 2026

4 min read

incident responseransomwarecase studyzero trustresilience +1 more

One Year Later: Omni Hotels Details $50M Recovery and Security Overhaul After Devastating Ransomware Attack

AI-Powered Disinformation is Top Threat to 2028 Elections, Mandiant Warns

INFORMATIONAL

Mandiant Report: AI-Driven Disinformation Poses Greatest Threat to 2028 U.S. Elections

A new report from Mandiant (part of Google Cloud) identifies AI-powered disinformation and influence operations as the most significant cyber threat to the 2028 U.S. election cycle. The report warns of a future filled with hyper-realistic deepfakes and AI-driven social media manipulation designed to sow discord and influence voters. Researchers highlight the democratization of these tools, with 'Disinformation-as-a-Service' (DaaS) platforms emerging on the dark web. Mandiant urges a collaborative effort between tech platforms, government, and the public to develop new countermeasures.

July 1, 2026

5 min read

aidisinformationinfluence operationselection securitydeepfake +2 more

AI-Powered Disinformation is Top Threat to 2028 Elections, Mandiant Warns

Phantom Squatting: Attackers Weaponize AI-Hallucinated Domains in Novel Supply Chain Attacks

HIGH

Unit 42 Uncovers 'Phantom Squatting': A New Supply Chain Threat Vector Exploiting LLM-Hallucinated Domains

Cybersecurity researchers from Unit 42 have identified a new and active software supply chain attack vector dubbed 'Phantom Squatting.' The threat involves adversaries exploiting the tendency of Large Language Models (LLMs) to 'hallucinate,' or invent, non-existent web domains for legitimate brands. Attackers are preemptively registering these phantom domains to intercept traffic, deploy malware, and execute phishing campaigns. A notable case involved the 'Montana Empire' phishing kit being deployed on a domain that researchers had predicted would be a hallucination target 23 days prior. The study analyzed over 2.1 million URLs generated by LLMs, uncovering 13,229 malicious URLs and identifying approximately 250,000 unregistered phantom domains, representing a massive and exploitable attack surface. This method effectively creates a 'zero-reputation bypass,' as the malicious infrastructure is brand new and appears authoritative to developers and automated systems that trust the LLM's output.

July 1, 2026

19 min read

Phantom SquattingLLMAI SecuritySupply Chain AttackHallucination +3 more

Phantom Squatting: Attackers Weaponize AI-Hallucinated Domains in Novel Supply Chain Attacks

QuantumLock Hits LogiTrans, Zero-Day in Apex-Office, EU Cyber-AI Act