A suspected Chinese-speaking actor tracked as Red Heron chained two WordPress vulnerabilities to compromise 49 organisations across 29 countries. The worst-affected victim, a western government, lost more than 18,000 records containing plaintext passwords and law enforcement PII. Red Heron also exploited a previously undocumented pre-authentication RCE in ZyXEL GS1900 switches, exfiltrating configurations and root credentials from nearly 1,000 devices across 48 countries. The two campaigns show how the same operator can move between internet-facing software and network infrastructure while using relatively narrow weaknesses to reach much larger datasets.

PAYLOAD used a different route to disruption, abusing Windows Active Directory Group Policy Objects to impose domain-wide changes at a Middle Eastern manufacturer without deploying a ransomware binary to Windows endpoints. The approach removes the usual ransomware executable from the attack chain and places more of the disruption inside legitimate administrative infrastructure. Elsewhere, ShinyHunters seized Cl0p's dark-web leak site and issued an eight-figure demand, turning the extortion model back on another criminal operation.

North Korea's Contagious Interview campaign has now been linked to more than 30,000 infected devices across 100 countries and the theft of credentials from more than 7,000 cryptocurrency wallets. Its targeting of Rust Project contributors and crates.io maintainers adds a potential software-supply-chain dimension to a campaign already operating at considerable scale.

The ShinyHunters extortion group seized control of Cl0p ransomware's dark web leak site, defacing it with an eight-figure extortion demand over the weekend. The message named alleged Cl0p operators and demanded proceeds from the gang's recent Oracle E-Business Suite campaign, threatening to publish data on Cl0p's victims and payments. Cl0p later restored a message on the site asking ShinyHunters to make contact through another platform.

Securonix identified a Windows backdoor dubbed TASK#STOMP that begins with a VBScript creating four scheduled tasks and a Startup-folder launcher for persistence. The malware backdates files, runs hidden PowerShell modules that compile C# code to bypass TLS certificate checks, and communicates with two failover command-and-control servers. Decoded payloads confirm automated document theft, real-time file monitoring, Wi-Fi password and clipboard theft, screenshot capture, and arbitrary remote command execution.

The Rust Project warned that attackers linked to the Contagious Interview group are posing as recruiters to compromise crates.io maintainers and developers. Targets are lured into fake job interviews and persuaded to install malware or run malicious commands, with international authorities reporting over 30,000 infected devices and stolen credentials from more than 7,000 cryptocurrency wallets since December 2025. The group shares infrastructure with North Korea's IT worker operation, which uses stolen identities to secure remote employment.

Kaspersky investigated an April 2026 attack on a Middle East manufacturer where actors gained domain admin access and created a malicious Group Policy Object to disrupt Windows systems. The GPO delivered ransom notes, changed desktop wallpapers, disabled the local administrator account, and appeared across endpoints only after a one-day dormancy period and subsequent reboot. No ransomware binary was deployed on Windows machines, though data exfiltration from file servers was observed and a separate PAYLOAD variant targeted Linux-based ESXi servers.

A suspected Chinese-speaking threat actor exploited a WordPress vulnerability chain (CVE-2026-63030 and CVE-2026-60137) to compromise at least 49 organisations across 29 countries, with the most severe breach yielding over 18,000 sensitive records including plaintext passwords and PII linked to law enforcement and government agencies. The actor also exploited a novel pre-authentication remote code execution flaw in ZyXEL GS1900 switches (CVE-2026-7273), exfiltrating configurations and hashed root credentials from 996 devices across 48 countries. GreyNoise linked the activity to the "Red Heron" actor based on shared command-and-control infrastructure and tooling, and suspects the attacker used a large language model to generate custom exploit scripts.