The Signal
Must Know
Identity · Krebs On Security
What happened
Qilin has operated since September 2022 and is described as the most active ransomware-as-a-service group, with at least 365 organizations claimed as victims over the preceding three months. [4]
Qilin recruits affiliates by offering them at least 80% of extortion proceeds and uses double extortion: stealing sensitive data, encrypting systems, and threatening to publish the stolen files. [4]
Why it matters
The reported identity trail describes an evolution from fraud and online arbitrage in 2018–2019 to organizing more complex cybercrime activity, including malware, botnets, and payment infrastructure, in 2020–2023. [4]
AI & Agents · Securityaffairs
What happened
ESET reported a previously undocumented toolset called Cereal on government Microsoft Exchange servers in Kazakhstan and Romania, attributing it with high confidence to the Russia-linked Turla APT group. [1]
Cereal’s modular .NET components largely arrive encrypted, unpack in memory, and leave few files on disk; only the initial loader is saved as a regular .NET file. [1]
Why it matters
The CerealNeuron backdoor uses the victim’s internet-facing Exchange server as its operator-accessible control point, receiving commands through web paths resembling Outlook Web Access, Autodiscover, and ActiveSync traffic rather than contacting an attacker-controlled server. [1]
Identity · Securityaffairs
What happened
Remus Stealer is marketed as a $1,000-per-month Enterprise feature that allegedly provides persistent access to compromised Gmail inboxes, including after password changes, browser closure and session revocation; its effectiveness remains unverified. [2]
Hudson Rock reports that the feature can provide a searchable mailbox within a stolen-device dashboard and allow an already acquired mailbox to be shared with other operators. [2]
Why it matters
If the persistence claims are true, attackers could read password-reset links and verification codes in Gmail and use them to access other accounts linked to the mailbox. [2]
AI & Agents · Arstechnica Security
What happened
Research from security firm Claroc reports that Grok Build shared-app links exposed proprietary business information and other sensitive secrets from thousands of users, including SpaceXSI. [3]
Although Grok Build randomizes shared-app URLs, a platform design decision reportedly allows anyone to enumerate thousands of live projects. [3]
Why it matters
Reportedly exposed information includes internal business plans, advertising proposals, medical examination results, cruise-line galley checklists, and employee names and identification numbers. [3]
Also Worth Knowing
Cloud · Fortinet Blog
What happened
FortiManager, FortiAnalyzer, FortiManager Cloud, and FortiAnalyzer Cloud have code-injection and classic buffer-overflow vulnerabilities that may allow a remote authenticated attacker to execute unauthorized code or commands through crafted HTTP requests. [5]
Vulnerability · Helpnetsecurity
What happened
According to iVerify’s 2026 Advanced Mobile Threat Report, criminals are using leaked exploit kits to compromise vulnerable iPhones, including phones used by employees for work. [6]
AI & Agents · Schneier Blog
What happened
The U.S. Attorney’s Office for the Southern District of New York said three men were arrested for allegedly using AI to alter and impersonate executives’ and attorneys’ voices and images to induce employees to send large payments. [7]