FortiBleed Campaign Linked to INC, Lynx Ransomware Attacks

Source: SecurityWeek

Researchers linked the FortiBleed credential-harvesting campaign to INC and Lynx ransomware activity. SOCRadar reported scanning against thousands of FortiGate portals, hundreds of successful administrative compromises, and at least 12 ransomware deployments, showing how stolen edge-device credentials can quickly become enterprise-wide extortion access.

Link to article

China-Linked Group Targets Southeast Asia Critical Systems

Source: Dark Reading

A China-linked threat group tracked as CL-STA-1062 has expanded from Taiwanese web-hosting targets into Southeast Asian critical infrastructure. Researchers said the group compromised electricity, water, government, and military-related organizations and deployed a new backdoor called TinyRCT for persistence, command execution, and possible intelligence collection.

Link to article

Unpatched Argo CD Repo-Server Flaw Could Let Attackers Take Over Kubernetes Clusters

Source: The Hacker News

Researchers warned that Argo CD's repo-server component has an unpatched flaw that may allow unauthenticated command execution when the internal service is reachable. Because Argo CD builds Kubernetes deployment manifests, exploitation could enable cluster takeover, making segmentation and internal service access controls especially urgent.

Link to article

Hackers target Microsoft 365 accounts with 81 million login attempts

Source: BleepingComputer

A large password-spraying campaign generated more than 81 million login attempts against Microsoft 365 accounts over two weeks. Attackers used valid username-password pairs from prior breaches and attempted Azure CLI authentication through ROPC, exposing gaps in conditional access policies and MFA enforcement.

Link to article

Aflac Japan: Hack Detected Last Week Affects Nearly 4.4M

Source: Data Breach Today

Aflac's Japanese subsidiary disclosed that a June hacking incident affected nearly 4.4 million customers and agents. The exposed information may include policy details, personal data, and bank account information, with certain services suspended while the insurer investigates the cause, scope, and remediation steps.

Link to article