2026-08-08

Google’s top hacker hunter explains why hacking groups get codenames

Google modified its naming conventions for tracking hacking groups. The article features an interview with a leading hacker-tracking expert to explain the rationale behind assigning codenames to threat actors.

Why it matters: Security practitioners rely on standardized naming to correlate threat intelligence across vendors and internal sources; understanding Google's approach helps teams align terminology and attribution in their own threat tracking.

Hackers breach TrueConf to trojanize client installers with backdoors

The Head Mare hacktivist group exploited unpatched vulnerabilities in TrueConf video conferencing servers to replace legitimate client installers with trojaned versions containing backdoors. This supply chain attack compromised the distribution mechanism, allowing attackers to deliver malicious software to users downloading the application.

Why it matters: Organizations using TrueConf face direct risk if they downloaded compromised installers; practitioners should verify installer integrity, check for evidence of backdoor installation, and apply available patches to TrueConf servers immediately.

Critical One-Click Vulnerability in Atlassian’s Rovo AI Exposed Enterprise Data

Researchers at Varonis identified a one-click vulnerability in Atlassian’s Rovo artificial intelligence (AI) tool, dubbed RovoBlast, that could allow attackers to exfiltrate data from Confluence, Jira, and SharePoint. The flaw exposes enterprise information through a single user interaction. Atlassian users are urged to review their configurations and apply mitigations.

Why it matters: Enterprises using Atlassian Rovo AI with Confluence, Jira, or SharePoint face potential data theft via a one-click attack and should assess exposure immediately.

Flock’s Plans for Rideshare Dashcams and Coaching Police, Revealed

Flock Safety plans to expand its police dashcam and coaching services, while separate developments include a court ruling on cell tower data collection, water utility intrusions across multiple states, a phishing breach at a missile parts supplier, and a ransomware group leader sentenced to 16 years in prison.

Why it matters: Law enforcement procurement teams should assess Flock's expanded product roadmap; water utility operators face ongoing threats with compromises spreading geographically; defense supply chain participants need heightened email security; and the sentencing reinforces prosecution of ransomware operators.

Sensitive Info Goes Into ‘No Reply’ Emails Constantly. This Guy Sees It All

Two security researchers purchased inexpensive domains such as noreply.net and deleteduser.com, then configured email services to receive messages sent to those addresses. Hundreds of organizations have unknowingly transmitted confidential corporate data to these researcher-controlled mailboxes, revealing widespread misconfigurations in email handling.

Why it matters: Organizations using non-existent or generic email addresses in automated systems risk exposing sensitive data to anyone who registers those domains; security teams should audit email configurations and validate recipient addresses before deployment.

Atlassian Rovo Can Be Tricked Into Sending Jira and Confluence Data to Attackers

Attackers can embed malicious instructions in files that Atlassian's Rovo assistant processes, causing it to extract accessible Jira or Confluence data from a signed‑in user. Two security firms discovered the issue independently, and while one exploitation path has been patched, the other remains open.

Why it matters: Atlassian Rovo users risk having Jira or Confluence data accessed by attackers via malicious file uploads; they should verify that the disclosed exploitation path is patched and audit Rovo permissions and file‑input controls.

New CSS Attacks Can Break Webmail Defenses to Steal Passwords and Tokens

Researchers demonstrated new CSS-based attacks that allow malicious email content to break out of message boundaries and interfere with webmail interface elements across multiple providers including Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail. These techniques can capture credentials, hijack tokens, and manipulate legitimate user actions within the webmail application.

Why it matters: Email users at any organization relying on these webmail platforms face credential theft and account takeover through specially crafted emails; security teams should assess whether their email security tools catch such CSS manipulation and consider user awareness training about unusual email behavior.

N-able Issues N-central Hotfix 2 as Attackers Reach Managed Systems and Persist

N-able released N-central Hotfix 2 to address ongoing active exploitation of a recently disclosed vulnerability in its Remote Monitoring and Management platform. The company stated it is monitoring threat actors adapting their attack methods and expanding protections in response to the evolving threat landscape.

Why it matters: Organizations running N-central as their RMM solution face persistent attacker activity with the potential for compromise of managed systems; immediate patching is critical given active exploitation.

Progress Kemp LoadMaster Flaw Hits CISA KEV After 792 Reported Exploit Attempts

CISA added a critical command injection vulnerability (CVE-2026-8037, CVSS 9.6) in Progress Kemp LoadMaster to its Known Exploited Vulnerabilities catalog after observing active exploitation attempts in the wild. The flaw enables arbitrary code execution on affected load balancers.

Why it matters: Organizations running Kemp LoadMaster instances face immediate risk from active exploitation; patching or disabling affected versions should be prioritized.

Friday Squid Blogging: Arctic Bobtail Squid Video

US cloud ‘kill switch’ is as dangerous as ransomware, European businesses fear

European businesses surveyed by Proton express significant concern about a hypothetical US government kill switch that could shut off access to cloud services. With many operations dependent on a small number of US-based providers, firms fear the disruption would be as damaging as a ransomware attack. The survey covered 1,500 companies across the UK, France, and Germany.

Why it matters: European enterprises relying on US cloud platforms face geopolitical and operational risk; practitioners should assess vendor concentration and develop contingency plans for potential service disruptions.

Inside the Modern SOC: The Identity Front Door

Identity-based attacks account for 90% of incidents, and modern attackers increasingly exploit identity systems as their primary attack vector. Security operations center leaders must develop targeted responses to address this dominant threat category.

Why it matters: SOC leaders and security teams need to prioritize identity defense and detection strategies since the vast majority of successful breaches start with compromised or abused identities rather than network perimeter attacks.

New York State Department of Financial Services Secures Cybersecurity Settlement with Order Express, Inc.

New York State Department of Financial Services (NYDFS) announced a $250,000 settlement with Order Express, Inc., a licensed money transmitter, for violations of cybersecurity regulations (23 NYCRR Part 500). NYDFS investigators found deficiencies in the company's cybersecurity program.

Why it matters: Money transmitter operators and financial services firms subject to NYDFS oversight must maintain compliant cybersecurity programs or face significant penalties; review your 23 NYCRR Part 500 controls to ensure no similar gaps.