THREATNOIR
Subscribe
Back to Weekly Roundups
2026-W21 Classification: PUBLIC

WEEKLY INTELLIGENCE BRIEFING

2026-05-18 to 2026-05-24 52 articles

Articles scanned
52
Top IOCs
15
Download STIX LinkedIn X
The week AI rewrote attack timelines

Tagline

The week AI rewrote attack timelines

Executive Summary

The week in one line

Vulnerability exploitation overtook credential theft as the primary breach vector while supply chain attacks accelerated.

What happened

AI is compressing exploit timelines from months to hours while simultaneously fueling massive supply chain campaigns. TeamPCP and other groups are leveraging developer tool compromises to steal code at unprecedented scale.

  • NGINX heap buffer overflow CVE-2026-42945 actively exploited within days of disclosure
  • Shai-Hulud malware compromised 600+ npm packages targeting developer credentials
  • GitHub breached via poisoned VS Code extension, 3,800 repositories stolen by TeamPCP
  • Microsoft patched two exploited Defender zero-days added to CISA KEV catalog
  • Uruguay national ID database with 5.8M citizen records allegedly leaked online

Why it matters for defenders and leaders

The threat landscape has fundamentally shifted as AI accelerates both attack development and the creation of vulnerable code. Traditional patch windows are collapsing while supply chain attacks target the core development infrastructure organizations depend on.

  • Critical vulnerabilities are being weaponized faster than organizations can patch
  • Developer environments have become high-value targets for stealing intellectual property
  • Government databases worldwide are being systematically breached and monetized
  • Ransomware groups are retaliating against cybersecurity firms that advise against payment

What to do this week

  • Patch NGINX, Microsoft Defender, and Drupal immediately across all environments
  • Implement supply chain security scanning for all package dependencies and CI/CD workflows
  • Review BitLocker configurations and enable TPM+PIN mode where possible
  • Audit developer tool access and extensions in VS Code and similar platforms
  • Segment critical systems from internet exposure and implement network monitoring
TLDR
  • 🔥 Supply chain attacks surge as AI accelerates both attack and defense capabilities
  • 🏦 Critical infrastructure faces elevated risks from NGINX RCE and power grid vulnerabilities
  • 🔓 BitLocker bypass and Microsoft Defender zero-days expose Windows security gaps
  • 💰 Ransomware groups target cybersecurity firms in retaliation campaigns
  • 🌍 Government databases in Uruguay and South Africa leak millions of citizen records
  • ⚡ Vulnerability exploitation overtakes credential theft as top breach vector for first time

Intelligence Breakdown

8 modules
Vulnerabilities & Exploits
VULNERABILITIES-AND-EXPLOITS
2026-W21

Critical NGINX heap buffer overflow actively exploited. CVE-2026-42945 in ngx_http_rewrite_module enables RCE and is being exploited in the wild just days after patch release, affecting 5.7M internet-exposed servers.

Microsoft patches two exploited Defender zero-days. CVE-2026-41091 allows privilege escalation while CVE-2026-45498 causes DoS; both added to CISA KEV catalog.

BitLocker bypass vulnerability acknowledged by Microsoft. YellowKey (CVE-2026-45585) allows attackers to access protected drives via crafted FsTx files on USB or EFI partitions.

Drupal SQL injection flaw under active attack. CVE-2026-9082 in PostgreSQL database abstraction API enables unauthenticated attackers to execute arbitrary SQL commands.

Key Takeaway

Patch NGINX, Microsoft Defender, Drupal, and implement TPM+PIN for BitLocker immediately.

Supply Chain Attacks
SUPPLY-CHAIN-ATTACKS
2026-W21

Shai-Hulud malware compromises 600+ npm packages. Campaign targets @antv ecosystem to steal GitHub, npm, cloud, and CI/CD credentials via Session P2P network.

GitHub breach via malicious VS Code extension. TeamPCP compromised 3,800 internal repositories through poisoned Nx Console extension, demanding $50,000 for stolen code.

Megalodon attack hits 5,561 GitHub repositories. Automated campaign injected malicious CI/CD workflows to steal cloud credentials within six hours.

Malicious postinstall hooks found in 700+ repositories. Coordinated campaign targeted Packagist and Node.js packages to download Linux binary from attacker infrastructure.

Key Takeaway

Implement supply chain security scanning and review all CI/CD workflows for unauthorized modifications.

Ransomware & Breaches
RANSOMWARE-AND-BREACHES
2026-W21

7-Eleven confirms ShinyHunters breach. Attackers stole 600K+ records from Salesforce environment and leaked 9.4GB archive after ransom refusal.

WisERP customer records auctioned on dark web. 1.5 million U.S. ERP customer records allegedly breached and advertised for sale.

ShinyHunters targets cybersecurity firm. Retaliation attack against firm that advises ransomware victims not to pay.

RetoSwap loses $2.7M to protocol flaw. 7,000 XMR drained due to Haveno protocol vulnerability exploitation.

Key Takeaway

Segment Salesforce environments and prepare incident response plans for extortion scenarios.

APT & Nation-State
APT-AND-NATION-STATE
2026-W21

TeamPCP and LAPSUS$ collaborate on GitHub data. Joint sale offering of GitHub internal repositories demonstrates threat actor coordination.

RondoDox botnet exploits 2018 ASUS flaw. CVE-2018-5999 exploitation hijacks over 1 million routers for DDoS attacks despite 8-year-old vulnerability.

Banana RAT targets Brazilian banks. SHADOW-WATER-063 uses WhatsApp distribution and QR code replacement for real-time financial fraud.

Key Takeaway

Patch legacy network devices and implement behavioral monitoring for financial applications.

Critical Infrastructure
CRITICAL-INFRASTRUCTURE
2026-W21

ABB EV charger vulnerabilities disclosed. Three buffer overflow flaws in Terra AC Wallbox enable remote firmware alteration via Bluetooth.

Hitachi Energy grid system OpenSSL flaw. GMS600 versions 1.3.0-1.3.1 vulnerable to timing attack enabling TLS decryption.

ABB automation runtime session hijacking. B&R Automation Runtime <6.4 allows unauthenticated session hijacking and XSS.

Key Takeaway

Update industrial control systems immediately and segregate OT networks from internet exposure.

Data Breaches
DATA-BREACHES
2026-W21

Uruguay national ID database leaked. 5.8 million citizen records including national ID numbers allegedly released by LaPampaLeaks.

South African Revenue Service claimed by Nullsec. SARS allegedly breached with data exfiltration claimed by threat actor.

Chilean Fire Department VIPER platform breached. Emergency response system allegedly compromised with internal records exposed.

Key Takeaway

Implement data loss prevention controls and encrypt sensitive government databases.

References
REFERENCES
2026-W21