Morning Review in IT Security — April 4, 2026

The cybersecurity landscape continues to face intense pressure from state-sponsored actors, ransomware gangs, and supply chain attackers. Today's briefing covers critical incidents spanning European government targeting, cloud infrastructure vulnerabilities, and major data breaches affecting law enforcement and critical infrastructure sectors.

Europe's Cyber Agency Blames Hacking Gangs for Massive Data Breach and Leak

The European Union's cybersecurity agency CERT-EU has attributed a significant breach of the European Commission to the cybercrime group TeamPCP, with the notorious ShinyHunters gang subsequently responsible for leaking the stolen data publicly. The incident highlights the vulnerability of critical European infrastructure to coordinated criminal operations and the risk of sensitive governmental information being exposed through secondary distribution channels.

Source: Europe's cyber agency blames hacking gangs for massive data breach and leak | TechCrunch

Double Agents: Exposing Security Blind Spots in GCP Vertex AI

Palo Alto Networks Unit 42 has uncovered a critical vulnerability in Google Cloud Platform's Vertex AI service, demonstrating how overprivileged AI agents can be exploited to compromise entire cloud environments. The research reveals that service agents with excessive permissions can be weaponized by attackers to escalate privileges and gain unauthorized access to sensitive cloud infrastructure and data.

Source: Double Agents: Exposing Security Blind Spots in GCP Vertex AI

China-Linked TA416 Targets European Governments with PlugX and OAuth-Based Phishing

A China-aligned threat actor cluster known as TA416, which overlaps with multiple tracked groups including DarkPeony, RedDelta, and Vertigo Panda, has resumed targeting European government and diplomatic organizations since mid-2025 following a two-year hiatus from the region. The campaign employs sophisticated OAuth-based phishing techniques alongside multiple malware families including PlugX, COOLCLIENT, PUBLOAD, and TONESHELL to establish persistent access within government networks.

Source: China-Linked TA416 Targets European Governments with PlugX and OAuth-Based Phishing

North Korean Hackers Abuse GitHub to Spy on South Korean Firms

FortiGuard Labs researchers have identified a high-severity espionage campaign originating from North Korean threat actors targeting South Korean companies through abuse of GitHub and social engineering tactics. The operation leverages the trusted nature of the GitHub platform to distribute XenoRAT malware, enabling attackers to conduct surveillance and intelligence gathering against corporate targets.

Source: North Korean Hackers Abuse GitHub to Spy on South Korean Firms

United States and Canada Police Tipline Databases Breached in BlueLeaks 2.0 Incident

A massive breach affecting police tipline databases across the United States and Canada has exposed approximately 8.3 million sensitive records from P3Global and CrimeStoppers services. The threat actor iym is allegedly offering the stolen database for sale on cybercrime forums, potentially compromising law enforcement intelligence and public safety information.

Source: United States and Canada Police Tipline Databases Breach

SentinelOne's AI EDR Autonomously Stops Zero-Day Attack Amid Supply Chain Threats

Security vendor SentinelOne has demonstrated successful autonomous detection and blocking of a zero-day attack through its AI-powered endpoint detection and response platform. Concurrently, a trojanized version of the Axios library has been distributed across npm and PyPI package repositories, representing an active supply chain compromise affecting developers worldwide, while Chrome zero-day vulnerabilities continue to be exploited in the wild.

Source: SentinelOne's AI EDR autonomously stops a zero-day attack, Axios Supply Chain Attack Spreads Across npm & PyPI, and Chrome Zero-Day Actively Exploited in the Wild

Initial Access Brokers Target Critical Infrastructure Across Multiple Nations

Threat actors are actively marketing initial access credentials to critical infrastructure targets including a United States managed services provider, a U.S. government contractor's firewall, a Saudi Arabian government ministry, and an Asian point-of-sale systems provider. The sale of these access credentials on underground forums represents a significant threat to national security and critical infrastructure resilience across multiple countries.

Source: Alleged sale of initial access to critical infrastructure targets

Die Linke German Political Party Confirms Data Stolen by Qilin Ransomware

The Qilin ransomware group has successfully attacked Die Linke, Germany's left-wing political party, forcing an IT systems outage and threatening to leak sensitive political data. The incident demonstrates the willingness of ransomware operators to target high-profile political organizations and the potential for data exfiltration alongside encryption-based extortion.

Source: Die Linke German political party confirms data stolen by Qilin ransomware

Today's threat landscape reflects a coordinated assault on critical infrastructure, government institutions, and supply chain systems from multiple adversary categories. Organizations must prioritize cloud security hardening, supply chain verification, and advanced threat detection capabilities to defend against these persistent and evolving threats.