ShinyHunters FBI hack exposes members of secretive hacking unit

💥 BREACHES & INCIDENTS

• ShinyHunters hack of FBI data exposes members of secretive FBI hacking unit
  Stolen FBI employee data from the ShinyHunters hack includes members of the FBI's secretive Remote Operations Unit.

  • Applies to FBI employees, including members of the Remote Operations Unit (ROU), the FBI's device-hacking team.
  • ShinyHunters shared a list of 5,000 alleged FBI officials with 404 Media; three entries specifically mention remote operations units.
  • Stolen data includes addresses, phone numbers, job titles/teams, and in some cases spouses' names and phone numbers; some titles relate to investigating China or Russia.
  • The breach may involve the FBIJobs.gov portal or a third-party provider; the point of breach remains undetermined.
  • The ROU developed the NIT hacking tool used on a dark web child abuse site and has shifted focus to national security tools, per a 2020 OIG report.
  Sources 📄 Source: oig.justice.gov · 📎 Coverage: 404media.co · 👁 via 404 Media

• US arrests Oxygen Forensics CEO for hiding company's Russian ownership in government sales
  The US has arrested the CEO of Oxygen Forensics for allegedly hiding the company's Russian ownership when selling software to the US government.

  • Oxygen Forensics sells forensic software to the US government
  • The CEO, a Russian national, was arrested on charges of concealing Russian ownership
  • The DOJ complaint alleges the ownership was hidden during sales to the US government
  Sources 📎 Coverage: justice.gov · 👁 via @campuscodi@mastodon.social

🔓 CVEs & KEV

• CVE-2026-6928 — IBM Concert — CVSS 9.8 — Multiple Vulnerabilities in IBM Concert SoftwareIBM Concert 1.0.0 through 3.0...

• CVE-2026-93352 — plank laravel-mediable — CVSS 9.3 — Laravel-Mediable 7.0.0 before 7.0.2 RCE via .pht File UploadLaravel-Mediable 7.0.0...

• CVE-2026-86583 — carazo Import and export users and customers — CVSS 8.8 — Import and export users and customers through 2.4.17 - Authenticated (Subscriber+)...

• CVE-2026-19125 — lynn999 EthPress – Web3 Login — CVSS 8.1 — EthPress through 2.3.5 - Unauthenticated Authentication BypassThe EthPress – Web3 ...

• CVE-2026-6935 — IBM Concert — CVSS 7.8 — Multiple Vulnerabilities in IBM Concert SoftwareIBM Concert 1.0.0 through 3.0...

• CVE-2026-6794 — IBM Concert — CVSS 7.8 — Multiple Vulnerabilities in IBM Concert SoftwareIBM Concert 1.0.0 through 3.0...

• CVE-2026-49972 — plank laravel-mediable — CVSS 7.7 — Laravel-Mediable 7.0.0 before 7.0.2 RCE via .pht File UploadLaravel-Mediable 7.0.0...

• CVE-2026-75887 — Red Hat OpenShift Container Platform 4 — CVSS 7.5 — Openshift/console: openshift/console: unauthenticated path traversal in i18n ...

• CVE-2026-75886 — Red Hat OpenShift Container Platform 4 — CVSS 7.2 — Openshift/console: openshift/console: unauthenticated reverse proxy to in-clu...

🕵️ RESEARCH & DEEP DIVES

• GitLab Incoming Email Addresses Act as Privileged Tokens Usable for Supply Chain Attacks
  Aikido Security researchers found that GitLab's automatically assigned incoming email addresses contain non-expiring tokens granting broad access that attackers can abuse for supply chain attacks.

  • Applies to all GitLab users; each user is assigned a private incoming email address for creating issues, containing a non-expiring glimt- token valid across all their public and private projects.
  • The token allows more than issue creation: attackers can send merge requests, push code to main branches, and trigger CI/CD jobs — GitLab's UI previously claimed the address "cannot be used to access any other data."
  • Attackers can modify the project path slug and ID in an exposed address to reach private projects, and email-based merge requests bypass IP address restrictions.
  • A short internet search found a dozen exposed addresses in ReadMe and support files, some belonging to popular open source projects.
  • Aikido reported the issue via HackerOne in May; GitLab closed it as intended behavior but later updated its UI and documentation after a follow-up report.
  Sources 📎 Coverage: darkreading.com · 👁 via Dark Reading

• CARBONATO botnet built on Hermes AI agent targets exposed Docker daemons
  ThreatDown uncovered CARBONATO, a botnet built around the Hermes AI agent that compromises unauthenticated Docker daemons and is controlled via Telegram.

  • Targets servers running Docker daemons exposed without authentication on port 2375.
  • Implant installs the open-source Hermes Agent framework unchanged and overwrites its SOUL.md persona file with a 39-line malicious prompt.
  • Uses a privileged container to run commands on the host, establishes persistence, and scans neighboring networks every five minutes to spread like a worm.
  • Operators send tasks via Telegram; the prompt prioritizes stealing AI API keys from 14 named providers, plus SSH credentials, tokens, and databases.
  • Operation leaked via its own misconfigured Docker registry (59 repositories, 4.3 GB); clues suggest operators are based in Costa Rica.
  Sources 📎 Coverage: threatdown.com · 👁 via @campuscodi@mastodon.social

• Process Parameter Poisoning Combined With Evasion Stack Slips Past EDR Defenses
  Flashpoint validated a Windows 'process parameter poisoning' technique that evades EDR detection by injecting code without monitored APIs.

  • Applies to Windows environments protected by EDR/XDR products; no public malware use observed yet.
  • Technique hides malicious payloads in process initialization structures, avoiding APIs like VirtualAllocEx(), WriteProcessMemory(), and MapViewOfFile2() that EDRs monitor.
  • Attacker with existing code execution creates a 'sacrificial process' and abuses startup parameters Windows transfers into it; original researchers bypassed four market-leading EDRs with no alerts.
  • Flashpoint's Rust POC evaded an open source EDR, and adding DLL unhooking plus blocking non-Microsoft DLLs bypassed the XDR component entirely.
  • Flashpoint expects use mainly by dedicated red teams or sophisticated threat actors.
  Sources 📎 Coverage: darkreading.com · 👁 via Dark Reading

• Google removes Chrome extensions that enrolled browsers into Mellowtel web-scraping botnet
  Google has removed Chrome extensions that turned user browsers into nodes of the Mellowtel web-scraping proxy botnet.

  • Affects Chrome users who installed the affected extensions from the Chrome Web Store.
  • The extensions enrolled user browsers into the Mellowtel proxy network used for web scraping.
  • Security firm Spur reported Mellowtel proxy nodes fell from 90,000 to 18,000 after Google's removal action.
  Sources 📎 Coverage: spur.us · 👁 via @campuscodi@mastodon.social

📋 ADVISORIES

• 📄 Source for IBM DataStage on Cloud Pak for Data 5.4.0.0 hit by seven vulnerabilities — ibm.com