Organization

CyberScoop

1 mentions in 7 days · 4 in 30 days · 5 total · first seen Aug 12, 2026 · last 6d ago

Timeline5 articles

Lawmakers call on Treasury to sanction hackers-for-hire

Bipartisan US lawmakers asked Treasury to sanction three India-based hack-for-hire firms accused of long-running espionage against Americans.

Sens. Ron Wyden and Sheldon Whitehouse and Rep. Pat Harrigan urged Treasury to add Sunkissed Organic Farms (formerly Appin), BellTroX, and CyberRoot to the Entity List. The letter says the mercenary groups conducted targeted espionage against US citizens, businesses, and lawyers for over fifteen years, allegedly including work for Qatar's government such as targeting opponents of Qatar's World Cup bid and Kristi Rogers, wife of Senate candidate Mike Rogers. Adding the firms to the Entity List would restrict their access to American software, cybersecurity tools, and cloud infrastructure. The lawmakers also accuse the groups of lawfare campaigns to censor investigative reporting on their hacking activities.

CyberScoopupdated Sep 10, 17:19 UTC · 5d agofirst Sep 9, 18:43 UTC · 6d agoThreat actor in the wild 3 sources

CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

CIA deputy director says cyber operations built the intelligence picture enabling US forces to capture Nicolás Maduro in Operation Absolute Resolve.

CIA Deputy Director Michael Ellis said at the Billington Cybersecurity Conference that cyber operations built the intelligence picture that let US special operations forces locate and apprehend Nicolás Maduro within four minutes of landing during Operation Absolute Resolve. He cited the elevation of the Center for Cyber Intelligence to a full mission center as key to aligning resources around the cyber mission. The agency also created a Directorate of Mission Systems and cut its technology acquisition cycle from two to three years to a six-month target, completing more than 400 purchases within that period. Ellis said AI brings unprecedented speed and scale to cyber operations and analysis.

CyberScoopSep 8, 19:49 UTC · 7d agoPolicy & legal 2 sources

Three 10.0 security flaws fixed across Ubiquiti’s UniFi line

Ubiquiti patches 22 UniFi vulnerabilities, 21 rated critical including three CVSS 10.0 flaws enabling unauthorized access.

Ubiquiti disclosed and patched 22 vulnerabilities, 21 rated critical and three assigned the maximum CVSS 10.0 score: CVE-2026-77537, CVE-2026-77550, and CVE-2026-77554. All three involve improper access control that could let attackers gain privileges, while other flaws permit authentication bypass or arbitrary command execution. All but one of the 22 affect the UniFi product line. The company did not confirm whether any were exploited before patching.

CyberScoopAug 26, 18:47 UTC · 20d agoVulnerability CVE-2026-77537 CVE-2026-77550 CVE-2026-77554

The long tail of Clop’s PTC hack is just beginning to emerge

Clop mass-exploited CVE-2026-12569 in PTC Windchill and FlexPLM in early June, claiming data theft from dozens of large organizations.

Clop began sending extortion emails in mid-July after exploiting CVE-2026-12569 in PTC Windchill and FlexPLM, likely as a zero-day in early June before PTC's June 17 disclosure and patch. Confirmed victims include Toast and Zebra, while GE, Philips and Shell are among claimed victims. CISA added the flaw, which allows unauthenticated remote code execution, to its KEV catalog on June 25. ReliaQuest said the group used a custom Windchill-specific web shell for credential theft and large-scale exfiltration, echoing its past MOVEit and Oracle E-Business Suite mass-exploitation campaigns.

CyberScoopAug 19, 14:30 UTC · 27d agoThreat actor in the wildCVE-2026-125691

Researchers observe first ‘near-autonomous’ AI attack on government target in Taiwan

Dream researchers observed the first near-autonomous AI attack on a government target, with suspected Chinese hackers stealing 2,500+ Taiwan records.

Israeli firm Dream reported that suspected Chinese hackers used open-source AI models to run a near-autonomous cyberattack against Taiwan's government, extracting over 2,500 personnel records. The framework, built on Hermes and OpenClaw, adapted mid-operation without human intervention, ran autonomous 'Learning Cycles' researching applicable vulnerabilities, and expanded to supply chain vendors, a nuclear safety agency, a government email system, and seven-plus energy companies. Attackers bypassed safety guardrails by framing the work as authorized penetration testing. Dream discovered the operation via a 160MB online archive of nearly 1,400 files.

CyberScoopAug 12, 17:05 UTC · Aug 12, 2026Threat actor in the wild

Related CVEsby mentions

CVE-2026-125699.341%
Unauthenticated RCE in PTC Windchill and FlexPLM
PTC Windchill and FlexPLM contain an improper input validation flaw (CWE-20) with an associated deserialization of untrusted data weakness (CWE-502) that allows an unauthenticated, remote attacker to execute arbitrary code by sending a malicious request over the network. An attacker who can reach a vulnerable Windchill or FlexPLM server can run arbitrary code on it, potentially gaining a foothold for lateral movement; CISA notes the flaw is being used in ransomware campaigns. All organizations running PTC Windchill or FlexPLM are affected, and the available data does not specify affected version ranges. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2026-06-25 with known ransomware use, and EPSS assigns a 40.6% probability of exploitation within 30 days (99th percentile). No CVSS score or public proof-of-concept is available yet, but the KEV listing confirms exploitation in the wild.
· PTC Windchill · PTC FlexPLM KEV ransomwaremoderate
CVE-2026-7755410.0<1%
Unauthenticated Command Injection in Ubiquiti UniFi Talk Application
Ubiquiti's UniFi Talk Application contains an improper input validation flaw (CWE-20) that can be leveraged for command injection on the host device. The bug is triggered when untrusted input reaches the application over the network; per the CVSS vector, an attacker needs network reachability but no credentials, privileges, or user interaction (AV:N/AC:L/PR:N/UI:N). Successful exploitation yields command execution on the underlying Talk host with high impact to confidentiality, integrity, and availability and a scope change, earning the maximum CVSS 3.1 score of 10.0. Any organization running the UniFi Talk Application is affected; this is one of three 10.0-rated flaws patched across Ubiquiti's UniFi line, although the available data does not list specific affected or fixed versions. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known, and EPSS currently estimates a 1% probability of exploitation within 30 days.
· Ubiquiti UniFi Talk Applicationmoderate
CVE-2026-7755010.0<1%
Authentication Bypass via CRLF Injection in Ubiquiti UniFi OS
CVE-2026-77550 is an Improper Neutralization of CRLF (carriage return/line feed) sequences (CWE-93) in certain devices running Ubiquiti's UniFi OS, rated CVSS 10.0 with network reachability, no privileges, and no user interaction required. An attacker who can reach the vulnerable UniFi OS device or instance over the network sends crafted input containing CR/LF sequences, which disrupts authentication processing and lets the attacker bypass login entirely. Successful exploitation yields complete administrative control of the console or instance, with high impact on confidentiality, integrity, and availability, and the scope change in the CVSS vector indicates impact can extend beyond the vulnerable component to protected resources behind it. Any organization running an affected UniFi OS device is exposed, with the greatest risk for consoles or instances reachable from untrusted networks. As of this analysis there is no known public proof-of-concept, the flaw is not in CISA's KEV, and EPSS puts near-term exploitation probability at about 0.5% (40th percentile); it is one of three 10.0-severity UniFi issues reported as fixed in recent updates.
· Ubiquiti UniFi OS (certain devices/instances)mass
CVE-2026-7753710.0<1%
Command Injection in Ubiquiti UniFi Protect Application
CVE-2026-77537 is an Improper Input Validation flaw (CWE-20) in Ubiquiti's UniFi Protect Application that allows a command injection against the host device. It is triggered by attacker-controlled input submitted over the network to the Protect application, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C) indicates no authentication, user interaction, or special conditions are required. A successful exploit yields code execution on the console hosting Protect, with critical confidentiality, integrity, and availability impact across the scope-changed host environment. Any organization or user running UniFi Protect — typically on a UniFi OS console that hosts the surveillance application — is potentially affected. There is no evidence of exploitation in the wild and no known public proof-of-concept; EPSS assigns a 0.9% probability of exploitation within 30 days, and vendor advisories report that fixes have shipped across the UniFi line.
· Ubiquiti UniFi Protect Applicationlarge

Appears with

organization CISA 2 threat actor China-linked threat actor 1 organization Anthropic 1 threat actor Clop 1 threat actor CyberRoot 1 threat actor Sunkissed Organic Farms 1 threat actor CIA Center for Cyber Intelligence 1 organization Billington Cybersecurity Conference 1 organization CIA 1 threat actor BellTroX 1 organization Citizen Lab 1 organization Financial Times 1 organization Ransom-ISAC 1 organization Recorded Future 1 organization ReliaQuest 1 threat actor Appin 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.