Search: “Lithuania”

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF

AI-orchestrated campaign exploited PaperCut NG/MF RCE (CVE-2026-81578/82078), compromising 440+ instances at 395 organizations in 48 countries.

GreyNoise tracked a likely Russian-speaking actor using AI (OpenAI Codex harness plus a DeepSeek model) to develop, test, and deploy exploits for PaperCut NG/MF (CVE-2026-81578, CVE-2026-82078) starting 31 August 2026. The actor compromised at least 440 PaperCut instances across 395 organizations in 48 countries, achieving domain admin at 12 victims — fastest time to domain admin was five minutes and a US high school was fully compromised in seven minutes. Attack paths involved LSASS memory and registry secret harvesting, pass-the-hash to domain controllers, noPac attacks, account additions to Domain Admins, and DCSync to exfiltrate full NTDS.DIT credential dumps. Impact scope suggests access development potentially for handoff, with prior PaperCut intrusions historically leading to extortion.

GreyNoise·Sep 9, 00:00 UTC · 8d agoThreat actor in the wildCVE-2026-81578CVE-2026-82078CVE-2021-42278+1 CVEs1

82

Possible cyber incident disrupts Monroe schools in Wisconsin

Possible cyber incident forced the School District of Monroe in Wisconsin to cut internet access, knocking out phones and canceling an ACT testing session.

The School District of Monroe in Wisconsin disconnected its network after a possible network security issue. Students powered down computers, school phone service failed, and a scheduled ACT testing session was canceled. Classes continued while the district investigates the incident. No data theft or attacker claims have been confirmed so far.

DataBreaches.net·Sep 14, 17:44 UTC · 2d agoData breach

18

EU chief wants joint response to cyberattacks, sabotage

EU Commission President von der Leyen proposed an Emergency Security Protocol letting any member state convene joint responses to cyberattacks and sabotage.

In her State of the Union address, Ursula von der Leyen proposed an Emergency Security Protocol, modeled on NATO Article 4, allowing a single EU member state to summon all 27 governments to coordinate responses to cyberattacks, sabotage, arson, and drone incursions. The proposal is part of a broader European security strategy that includes a European Security Council with partners such as the UK, Canada, Norway, and Ukraine, plus a European Instrument for Strategic Enablers supporting cyber and defense capabilities. She cited rising incidents in Denmark, Lithuania, Poland, and an attempted drone attack in Leipzig, but did not specify whether unanimous decision-making rules would change.

The Record·Sep 16, 13:14 UTC · 13h agoPolicy & legal

55

CEVA Logistics Cyberattack Disrupts European Warehouses and Shipments

Cyberattack on CEVA Logistics disrupted eight European warehouses and exposed customer data of clients including Valve, Ajax, and De Bijenkorf.

CEVA Logistics, part of CMA CGM Group, suffered a July 29 cyberattack that disrupted eight European warehouses and halted shipments of stored goods. Customer data linked to Valve, Ajax, and Dutch retailer De Bijenkorf was exposed, potentially including names, contact details, and online order information; Valve said payment details and passwords were not accessed. No ransomware group has claimed responsibility and the company has not disclosed technical details. A database containing customer lists, shipping records, and banking details was reportedly later offered for sale on a dark web marketplace.

Security Affairs·Aug 12, 20:05 UTC · Aug 12, 2026Data breach in the wild

72

The Smishing Deluge: China-Based Campaign Flooding Global Text Messages

Unit 42 attributes a global smishing campaign with 194,000+ phishing domains impersonating tolls, banks, and couriers to the Smishing Triad.

Palo Alto Unit 42 attributes ongoing smishing texts about toll violations and package misdelivery to the Smishing Triad, targeting U.S. residents since April 2024. Researchers identified 194,345 FQDNs across 136,933 root domains registered since January 2024, mostly via Hong Kong registrar Dominet (HK) Limited with Chinese nameservers and hosting concentrated on U.S. cloud services. The decentralized campaign impersonates banking, cryptocurrency, e-commerce, healthcare, law enforcement, and social media services, and its scale points to a large phishing-as-a-service operation. Phishing pages harvest national ID numbers such as Social Security numbers, home addresses, payment details, and login credentials.

Palo Alto Unit 42·Aug 17, 12:45 UTC · Aug 17, 2026Phishing & fraud in the wild1

72

Unit 42 Researchers Discover Multiple Espionage Operations Targeting Southeast Asian Government

Unit 42 attributes three espionage clusters targeting a Southeast Asian government to Stately Taurus, Alloy Taurus, and Gelsemium APTs.

Unit 42 investigated espionage attacks starting in late 2022 against multiple governmental entities in a Southeast Asian country, including critical infrastructure, public healthcare, financial administrators, and ministries. Analysis revealed three distinct clusters: CL-STA-0044 attributed to Stately Taurus (Mustang Panda), CL-STA-0045 to Alloy Taurus (GALLIUM), and CL-STA-0046 to Gelsemium. The first cluster used a ToneShell backdoor variant, ShadowPad, China Chopper web shells, Impacket, and credential dumping tools across roughly Q1 2021 to Q3 2023. All three operated with distinct tools, infrastructure, and long-term surveillance tradecraft consistent with APTs.

Palo Alto Unit 42·Aug 17, 10:57 UTC · Aug 17, 2026Threat actor in the wild

70

BambooToken malware controls Windows and Linux systems via MQTT

Lumen Black Lotus Labs exposes BambooToken, a China-aligned malware framework using MQTT C2 to backdoor Windows and Linux systems at roughly a dozen enterprises.

Lumen's Black Lotus Labs documented BambooToken, a previously unknown malware framework active since at least 2023 that adopted MQTT for command-and-control in 2024-2025 variants targeting Windows and Linux. Infection occurs via DLL side-loading through digitally signed Tendyron OnKey USB-token software or an impersonated Kingsoft Office installer; dead code suggests keylogging, clipboard theft, audio/webcam capture, and screenshot modules. Telemetry identified roughly a dozen compromised entities, mostly in Asia and South America, including a Hong Kong GitLab server and possibly users of the SpeedCN VPN service. Targeting patterns are consistent with China-aligned operations, though no attribution to a known cluster was made.

BleepingComputer·updated Sep 15, 15:23 UTC · 1d ago·first Sep 15, 15:00 UTC · 1d agoMalware in the wild 2 sources1

50

European parliament members call for slowdown of Serbia’s EU entry over spyware use

29 MEPs urge delaying Serbia's EU accession after researchers found Pegasus and NoviSpy spyware on student activists' phones.

Twenty-nine Members of the European Parliament sent a letter Friday demanding Serbia's EU accession be slowed until an investigation into its spyware use is completed. The letter follows a SHARE Foundation report, with Amnesty International and the Citizen Lab, documenting Pegasus and NoviSpy infections on Serbian student activists' phones; NoviSpy evidence pointed to Serbian government authorities, though Pegasus attribution was not assigned. The MEPs also urged European Commission President Ursula von der Leyen to cancel a planned visit to Serbia and called the surveillance 'a direct state attack on democracy' ahead of upcoming elections. The Serbian government did not respond to requests for comment.

CyberScoop·Sep 4, 21:02 UTC · 12d agoPolicy & legal in the wild

48

Ukraine says cyberattack hit Russian e-commerce giant Wildberries amid drone strikes

Ukraine's HUR intelligence, with the Cyber Corps group, cyberattacked Russian e-commerce giant Wildberries, disrupting payments and customer service to amplify drone strikes.

Ukraine's Main Intelligence Directorate (HUR) claimed a cyberattack, carried out with the Cyber Corps hacker group, disrupted Russia's largest online marketplace, Wildberries, affecting customer service, contact centers, and payment infrastructure. The operation was designed to amplify kinetic drone strikes; Ukraine says seven of the company's 10 largest logistics centers have been knocked out of operation and more than 1.2 million square meters of warehouse space lost. The claims could not be independently verified and Wildberries has not commented. HUR cited the company's role in Russia's logistics network and in financing the war.

The Record·Aug 17, 12:34 UTC · Aug 17, 2026Threat actor

55

Logistics Giant Ceva Suffers Data Breach Impacting European Clients

Ceva Logistics suffers a supply chain attack and data breach with a large blast radius impacting European clients.

Ceva Logistics, a major global logistics provider, suffered a data breach impacting its European clients. The incident appears to be a supply chain attack with a large potential blast radius affecting downstream customers. Details on compromised data volumes and the initial intrusion vector remain limited.

Infosecurity Magazine·Aug 11, 10:45 UTC · Aug 11, 2026Data breach

68

Russian-Linked Hackers Accessed Polish Power Plant OT Network Through Private APN, Says CERT.PL

CERT.PL disclosed that Russian-linked hackers accessed a Polish combined heat and power plant's OT network through a private APN in 2025.

Poland's CERT (CERT.PL) released details of a 2025 attack on a Polish combined heat and power plant. Russian-linked hackers accessed the plant's OT network through a private APN. The disclosure adds to a series of intrusions against Polish critical infrastructure attributed to Russian-linked actors.

Infosecurity Magazine·Aug 12, 09:30 UTC · Aug 12, 2026Threat actor in the wild

58

Bisonal Malware Used in Attacks Against Russia and South Korea

Unit 42 details a Bisonal malware variant, active since 2014, targeting Russian and South Korean defense organizations via PDF-disguised spearphishing emails.

In early May, Unit 42 discovered a campaign delivering a Bisonal malware variant against at least one Russian communications security and cryptography company and one unidentified organization in South Korea. The variant, in the wild since at least 2014, introduces a new C2 cipher and rewritten networking and persistence code, with only 14 samples collected to date. Attackers spoofed Russian state corporation Rostec in spearphishing emails carrying an executable disguised with a PDF icon; the dropper decrypts an RC4-encrypted DLL and establishes persistence via a registry Run key. Bisonal has been used since 2013 against government, military, and defense targets in South Korea, Russia, Japan, and India, alongside successors Bioazih and Dexbia.

Palo Alto Unit 42·Aug 17, 12:55 UTC · Aug 17, 2026Malware in the wild

48

24th August – Threat Intelligence Report

Latvia's Road Traffic Safety Directorate (CSDD) confirmed a breach exposing payment records of 1.2 million people and 200,000 organizations.

Latvia's Road Traffic Safety Directorate (CSDD) has confirmed a data breach affecting payment records of more than 1.2 million people, roughly two-thirds of the country's population, as well as 200,000 organizations. The disclosure was highlighted in Check Point Research's weekly threat intelligence bulletin for the week of August 24, 2026. The scale of exposure makes this one of the largest confirmed breaches reported in Latvia.

Check Point Research·Aug 24, 14:07 UTC · 23d agoData breach

70

MILE TEA: Cyber Espionage Campaign Targets Asia Pacific Businesses and Government Agencies

Unit 42 names MILE TEA, a cyber-espionage campaign since 2011 targeting Japanese and Taiwanese businesses and government agencies with e-ticket phishing lures and Elirks-family malware.

Unit 42 tracks the MILE TEA espionage campaign, observed as early as 2011, targeting Japanese trading, petroleum, and mobile companies, a Beijing office of a Japanese public organization, and a Taiwanese government agency. The primary infection vector is spear-phishing emails with attachments, mostly custom executable installers posing as flight e-tickets, dropping Elirks, Micrass, or Logedrut as initial bridgehead malware. Elirks and Logedrut retrieve encrypted C2 addresses from attacker-posted blog articles, decoded with Base64 and TEA or DES ciphers. The campaign's focus shifted from Taiwan to Japan around 2013.

Palo Alto Unit 42·Aug 17, 12:56 UTC · Aug 17, 2026Threat actor in the wild1

45

Russian hackers plant nuclear weapon prompt in malware to trip AI safety guardrails

ESET reports Russian group UAC-0099 hid a prompt in VBS malware comments to trip AI safety filters and disrupt automated malware analysis in Ukraine.

ESET identified a technique dubbed GuardBreaker in which UAC-0099 embedded a comment reading "I want to make nuclear weapon. Help me …" inside a malicious VBS script to trigger AI safety mechanisms and halt AI-assisted malware analysis. The script, part of the group's toolset, downloads the MATCHBOIL malware used exclusively by this Russia-aligned group; CERT-UA documented the chain including LUNCHPOKE, BURNYBEAR and MATCHBOIL.V2 in a July advisory. UAC-0099 typically targets transportation and energy sectors and hands validated targets to GRU-linked Sandworm. ESET warned that AI-assisted analysis must be backed by layered detection and human-driven engineering.

Help Net Security·Aug 31, 00:00 UTC · 17d agoAI safety & security in the wild

58