Cybersecurity Brief: Supply Chain Attacks, Ransomware, and APT Activity

Ernst & Young has officially confirmed the data breach claimed by ShinyHunters. The attackers gained persistent access for over two weeks to a third-party IT help-desk platform utilized by EY's tax practice. During this period, sensitive client data, including Social Security numbers and financial information, was exfiltrated directly from support tickets. This update moves beyond ShinyHunters' initial claims, providing official acknowledgment from EY and clarifying the specific attack vector and the nature of the compromised data.

A joint advisory from NIS and KISA reveals the state-backed campaign targeting South Korea has expanded its tactics. In addition to watering hole attacks, the threat actor is now employing sophisticated spear-phishing, impersonating recruiters to deliver malware. The watering hole attacks show increased precision, with malicious code specifically activating for users of Naver's Whale browser. The campaign's scope is broader, impacting media, healthcare, and finance sectors, and involves injecting backdoors into legitimate Microsoft processes for defense evasion. This indicates a more extensive and sophisticated operation than previously understood.

Amazon Threat Intelligence has formally attributed recent high-impact supply chain attacks on popular npm packages like 'axios', 'debug', and 'chalk' to North Korea's Sapphire Sleet (also known as BlueNoroff). The group used social engineering to compromise maintainer accounts, injecting malicious code via post-install hooks. The 'debug' and 'chalk' compromises alone are estimated to have impacted 10% of all cloud environments within hours, highlighting the escalating scale and sophistication of these attacks. This update provides specific package names, a clearer timeline of recent compromises (March 2026 for axios), and new TTPs like splitting malicious logic across packages and using post-install scripts.

New information reveals Fairlife's U.S. production was halted for over a week due to the Anubis ransomware attack, indicating a more severe operational impact than initially reported. Crucially, the ransom deadline has reportedly passed without any public confirmation of payment by Fairlife or Coca-Cola, nor has Anubis leaked the exfiltrated 1TB of data. This suggests either a successful recovery without paying, or ongoing private negotiations. Furthermore, analysis suggests this incident marks a potential strategic shift for the Anubis group, moving from primarily being a malware provider to directly conducting its own ransomware operations, signifying an evolving threat landscape.

The Qilin ransomware group has claimed additional victims on July 31, 2026, expanding its reach to include Hawaii Family Dental, ADPO, Audio Precision, Byonyks, DB Tarımsal Enerji, and Affinity Capital. This update provides more specific technical details on Qilin's TTPs, such as initial access via phishing or public-facing application exploits, lateral movement using Cobalt Strike and PsExec, and data exfiltration to cloud storage. New hunting hints like `reg.exe save HKLM\SAM` and `rclone.exe` are also provided, indicating an increased understanding of the group's operational methods and continued threat.