Daily Digest

Ransomware, Data Breaches, and New APT Tactics Dominate Cybersecurity News

August 31, 2026
8 articles (4 new, 4 updated)
24 min read

Summary

This daily summary highlights significant cybersecurity incidents and emerging threats. Updates on the Qilin ransomware attack on the ATF reveal new technical indicators, including specific commands for disabling recovery and clearing logs, and the .agenda file extension for encrypted data. McKesson disclosed a $55 million ransom demand from ShinyHunters following a vishing campaign that compromised Okta credentials, leading to the theft of sensitive employee, physician, and patient data from Salesforce and Snowflake. The Manchester Airports Group breach is now understood to involve potential phishing and valid account exploitation, with data exfiltration over C2 channels; new detection strategies include D3FEND URL Analysis and Database Activity Monitoring.

Boston Scientific operations remain impacted by a global cyberattack, confirmed to be limited to on-premise systems, with no new malicious activity observed since August 25, 2026. The inability to perform remote activations for cardiac monitors poses a direct risk to patient care. In new threats, 19 malicious Chrome and Edge extensions under the 'Superior' campaign have been identified, designed to steal cryptocurrency wallet secrets and exchange credentials. The Silver Fox Group is distributing the ValleyRAT backdoor via signed adware ('QN Wallpaper'), primarily targeting China and India through DLL sideloading. An operational security failure by a Blind Eagle APT operator exposed their malware production pipeline, including research into crypters and infrastructure services. Finally, the 'Spring Ring' campaign has been observed abusing Microsoft Teams for voice phishing (vishing) attacks, aiming to deploy remote management tools or conduct NTLM relay attacks against domain controllers.

Filter by Category

New Articles (4)

19 Malicious Chrome & Edge Extensions Caught Stealing Crypto Wallets

HIGH

Malicious Browser Extensions Steal Crypto and Credentials

A large-scale malware campaign dubbed 'Superior' has been uncovered, involving 19 malicious browser extensions for Google Chrome and Microsoft Edge. These extensions, some with tens of thousands of users, were designed to steal cryptocurrency wallet secrets, credentials for exchanges like Binance and Coinbase, and other sensitive data. The threat actors either published new extensions or pushed malicious updates to existing, trusted ones.

August 31, 2026
5 min read
MalwareBrowser ExtensionChromeEdgeCryptocurrency +2 more
19 Malicious Chrome & Edge Extensions Caught Stealing Crypto Wallets

ValleyRAT Backdoor Spread by Silver Fox Group via Signed Adware

MEDIUM

Silver Fox Spreads ValleyRAT via Signed Adware

The cybercrime group known as Silver Fox is distributing the ValleyRAT backdoor by hiding it within a legitimately signed Chinese adware application, 'QN Wallpaper'. The campaign, primarily targeting users in China and India, uses DLL sideloading to execute the malware within a trusted process, thereby evading detection by security software. The sophisticated ValleyRAT provides attackers with full control over compromised machines.

August 31, 2026
5 min read
ValleyRATSilver FoxMalwareDLL SideloadingAdware +1 more
ValleyRAT Backdoor Spread by Silver Fox Group via Signed Adware

OPSEC Fail: Infostealer Infection Exposes Blind Eagle APT Operator

MEDIUM

Infostealer Exposes Blind Eagle APT Operator's Toolkit

An embarrassing operational security (OPSEC) failure has exposed the inner workings of a cybercriminal linked to the South American APT group 'Blind Eagle'. The operator's own machine was infected with an infostealer, which exfiltrated browser history and other data. The revealed information details the actor's malware production pipeline, including research into crypters and the use of services like Firebase and HostGator for infrastructure.

August 31, 2026
4 min read
Blind EagleAPTThreat IntelligenceOPSECInfostealer +2 more
OPSEC Fail: Infostealer Infection Exposes Blind Eagle APT Operator

Spring Ring Campaign Abuses Microsoft Teams for Voice Phishing Attacks

HIGH

Spring Ring: Voice Phishing via Microsoft Teams Targets Enterprises

Between January and April 2026, a threat campaign dubbed 'Spring Ring' targeted over 150 employees across at least 10 companies by abusing Microsoft Teams. Attackers, impersonating IT support personnel from external tenants, initiated voice phishing (vishing) calls to manipulate victims. The objectives were twofold: either trick users into executing remote management tools and custom malware or, in a more advanced variant, escalate the attack to perform NTLM relay attacks against the organization's domain controllers using tools like PetitPotam. This campaign signifies a tactical evolution, blending social engineering with real-time voice interaction on trusted collaboration platforms to bypass traditional security controls and gain deep network access.

August 31, 2026
13 min read
Spring RingVishingSocial EngineeringMicrosoft TeamsNTLM Relay +3 more
Spring Ring Campaign Abuses Microsoft Teams for Voice Phishing Attacks

Updated Articles (4)

Boston Scientific Operations Crippled by Major Global Cyberattack

HIGH

Boston Scientific Cyberattack Disrupts Global Operations

Update:

Boston Scientific has provided an update on its cyberattack, confirming the incident appears limited to on-premise systems, with cloud environments unaffected. No new malicious activity has been observed since the initial detection on August 25, 2026, indicating successful containment efforts. However, the company also clarified that the inability to perform remote activations for some cardiac monitors poses a direct risk to patient care. A detailed incident timeline was also released, outlining detection, SEC filing, operational impact, and the latest containment status.

August 30, 2026
Updated: August 31, 2026
5 min read
cyberattackhealthcare securitymedical devicesupply chainoperational disruption +1 more
Boston Scientific Operations Crippled by Major Global Cyberattack

McKesson Discloses Breach After ShinyHunters Claims Patient Data Theft

HIGH

McKesson Data Breach Claimed by ShinyHunters Extortion Group

Update:

New details reveal the McKesson breach involved a $55 million ransom demand from ShinyHunters. The attackers gained initial access through a sophisticated voice-phishing (vishing) campaign, compromising employee Okta single sign-on credentials. This allowed them to infiltrate both Salesforce and Snowflake cloud environments. The stolen data now explicitly includes sensitive employee records, physician data, and doctor-patient email communications, in addition to patient information, significantly increasing the scope and potential impact of the incident.

August 29, 2026
Updated: August 31, 2026
5 min read
Data BreachShinyHuntersHealthcareSnowflakeData Exfiltration +1 more
McKesson Discloses Breach After ShinyHunters Claims Patient Data Theft

ATF Confirms Major Incident After Qilin Ransomware Breach Claim

HIGH

Qilin Ransomware Claims Breach of US ATF Agency

Update:

Further analysis of the Qilin ransomware attack on the ATF has revealed additional cyber observables and technical details. New hunting hints include the use of 'vssadmin.exe delete shadows' to prevent system recovery, 'wevtutil.exe cl' for clearing event logs, and monitoring for large outbound transfers to cloud storage for data exfiltration. The '.agenda' file extension has also been noted for encrypted files. These details provide a more comprehensive understanding of the threat actor's tactics.

August 27, 2026
Updated: August 31, 2026
5 min read
ransomwareqilinatfdojdata breach +3 more
ATF Confirms Major Incident After Qilin Ransomware Breach Claim

Manchester Airports Group Breach Exposes 8.7 Million Customers' Data

HIGH

Data of 8.7M Customers Exposed in Manchester Airports Group Breach

Update:

Further analysis of the Manchester Airports Group data breach suggests additional potential attack vectors, including phishing (T1566) and the use of valid accounts (T1078). Data collection might have involved local system access (T1005) or SQL injection (T1505.003), with exfiltration over C2 channels (T1041). New detection and response strategies include D3FEND URL Analysis (D3-UA), Database Activity Monitoring (DAM), and public breach monitoring. Mitigation recommendations now include D3FEND File Encryption (D3-FE). Customers are advised to be vigilant for targeted phishing.

August 29, 2026
Updated: August 31, 2026
4 min read
Data BreachTransportationAirportUKPII
Manchester Airports Group Breach Exposes 8.7 Million Customers' Data

📢 Share This Publication

Help others stay informed about cybersecurity threats

📅 Daily Edition

Curated and deduplicated every day from dozens of trusted sources — giving you one clean, consolidated view of what matters in cybersecurity.

🔢 Deduplication Applied

Related stories are merged into a single evolving article rather than repeated as separate entries — cutting through noise so you only read what's new.

🔗 Full Articles Linked

Every entry links to its full enriched article — complete with MITRE ATT&CK mappings, extracted IOCs, and actionable detection and mitigation guidance.