supply-chain China-linked hackers turning popular cybersecurity tool into ransomware launchpad, Microsoft warns China-linked hackers, believed to be part of the Storm-1175 group, are exploiting a critical vulnerability in N-central, a remote monitoring and management (RMM) tool, to deploy ransomware. This supply-chain attack is leveraging a zero-day vulnerability, allowing attackers to gain full administrative control of N-centr… The Record · Aug 10, 2026 High CVE-2026-18577CHsupply-chainransomwarezero-day
vulnerability Attackers Exploit N-able Patch Bypass Flaw on RMM Servers N-able disclosed a patch bypass vulnerability (CVE-2026-18577) that allowed attackers to gain administrative access to N-central servers, its remote monitoring and management (RMM) platform. Threat actors exploited this… Dark Reading · Aug 3, 2026 High CVE-2026-18577CVE-2026-18556patch-bypassremote-managementrmm
threat-intel Operation BlueDash Deploys Level RMM and ScreenConnect via Fake Teams Update A sophisticated phishing campaign, dubbed Operation BlueDash, is leveraging Microsoft Teams-themed lures to deliver malicious Remote Management and Monitoring (RMM) tools, primarily Level RMM and ConnectWise ScreenConnec… The Hacker News · Jul 27, 2026 High NGphishingrmmremote access
threat-intel Iran-Linked Hackers Using Modular C&C Framework in Cyberattacks An Iran-linked APT group, known as Cavern Manticore, is utilizing a sophisticated, AI-assisted modular command-and-control framework to target organizations in Israel, particularly government entities and IT providers. T… SecurityWeek · Jul 7, 2026 High ILaptcommand and controllateral movement
threat-intel 'Djinn' Stealer Targets Cloud, AI Credentials The ‘Djinn’ stealer, delivered via a SimpleHelp vulnerability (CVE-2026-48558), is targeting cloud and AI credentials, specifically focusing on developer and administrator environments. Blackpoint Cyber’s APG tracked an… Dark Reading · Jun 29, 2026 High CVE-2026-48558DKaicredentialsstealer
malware A VBScript campaign distributed through WhatsApp deploying RMM software A WhatsApp-distributed malware campaign, active as of June 2026, leverages deceptive VBScript files disguised as financial documents to trick users into executing malicious code. This code ultimately installs legitimate… Securelist · Jun 22, 2026 High MYBRINsocial engineeringvbswhatsapp
threat-intel From cause to cash: a cross-border look at hacktivist activity This Securelist article details a cross-border hacktivist campaign led by groups including 4BID, with a broadened geographic scope impacting organizations in Kazakhstan, the UAE, Syria, and Egypt. The campaign utilized t… Securelist · Jun 8, 2026 High CVE-2023-44976KZAESYproxyshellransomwarehacktivism
