https://spidercivi.github.io/HACK-PROJECT/en/Daily Threat Intelligenceenhttps://spidercivi.github.io/HACK-PROJECT/en/a/adfs-privilege-escalation-en.htmlhttps://spidercivi.github.io/HACK-PROJECT/en/a/adfs-privilege-escalation-en.htmlFri, 24 Jul 2026 08:00:00 +0100Microsoft Active Directory Federation Services — the component that provides single sign-on between an organisation and external services — has an insufficient-granularity access-control flaw: CVE-2026-56155. It lets an already-authenticated attacker elevate privileges locally. The NVD score is 7.8, so it is not the "one click and you are in" kind of flaw; but CISA added it to the Known Exploited Vulnerabilities catalogue, and it sits on the server that decides who is who. It is worth explaining why it matters even at 7.8.https://spidercivi.github.io/HACK-PROJECT/en/a/akira-raas-2026-en.htmlhttps://spidercivi.github.io/HACK-PROJECT/en/a/akira-raas-2026-en.htmlFri, 24 Jul 2026 08:00:00 +0100Akira is not new: it has operated since March 2023 under the ransomware-as-a-service model and is one of the most prolific groups around. The joint advisory from CISA, the FBI and the Dutch NCSC, updated in November 2025, cites more than 342 organisations hit and roughly 244 million dollars in proceeds. In July 2026 its leak site added new names. The thread that holds the story together is mundane and, for that reason, instructive: Akira almost always enters through poorly protected remote access, not through technical magic.https://spidercivi.github.io/HACK-PROJECT/en/a/qilin-danone-en.htmlhttps://spidercivi.github.io/HACK-PROJECT/en/a/qilin-danone-en.htmlWed, 22 Jul 2026 08:00:00 +0100The Qilin ransomware group listed Danone on its leak site, claiming it stole roughly 221 GB of data and publishing more than 90,000 files. The claim, dated 17 July 2026, is not currently confirmed by the company: as always with leak sites, the assertion should be treated as a claim until verified. The case is still a chance to look at Qilin's double-extortion model — one of 2026's most active groups — with what the sources actually say and the uncertainties in plain view.https://spidercivi.github.io/HACK-PROJECT/en/a/ransomware-raas-difesa-en.htmlhttps://spidercivi.github.io/HACK-PROJECT/en/a/ransomware-raas-difesa-en.htmlMon, 20 Jul 2026 08:00:00 +0100Ransomware today is a service industry, not a lone wolf: operators who rent the malware, affiliates who strike, brokers who sell the initial access. This explainer is not the attack of the day: it lines up what official sources say — CISA with #StopRansomware, Europol with the No More Ransom project, ENISA with its Threat Landscape — on how that chain breaks. The takeaway is less spectacular than a ransom and more useful: you hit the model's economics, not the single group.https://spidercivi.github.io/HACK-PROJECT/en/a/knxlock-bcu-key-en.htmlhttps://spidercivi.github.io/HACK-PROJECT/en/a/knxlock-bcu-key-en.htmlFri, 17 Jul 2026 08:00:00 +0100On 15 July 2026 CISA added to the KEV catalog a 2023 CVE describing a 2021 attack. There is no malicious code: the attackers purge a building's KNX devices, then set the BCU key — the password the protocol provides as a protective feature. Vendors replied that no reset exists. No ransom ever arrived.https://spidercivi.github.io/HACK-PROJECT/en/a/fortibleed-inc-lynx-en.htmlhttps://spidercivi.github.io/HACK-PROJECT/en/a/fortibleed-inc-lynx-en.htmlThu, 16 Jul 2026 08:00:00 +0100Roughly half of all internet-facing Fortinet firewalls have their admin credentials in the hands of an access broker. There is no CVE to patch: there are exported config files, SHA-256 hashes cracked offline, and perfectly legitimate logins. In July, SOCRadar tied the operation to the INC and Lynx ransomware brands.https://spidercivi.github.io/HACK-PROJECT/en/a/interlock-clickfix-en.htmlhttps://spidercivi.github.io/HACK-PROJECT/en/a/interlock-clickfix-en.htmlWed, 15 Jul 2026 08:00:00 +0100Interlock flipped the ransomware script: no phishing, no breached VPN. The victim visits a legitimate compromised site, sees a fake CAPTCHA, and pastes the command that infects them. Anatomy of an attack chain in which the user is the exploit.https://spidercivi.github.io/HACK-PROJECT/en/a/kimsuky-quishing-en.htmlhttps://spidercivi.github.io/HACK-PROJECT/en/a/kimsuky-quishing-en.htmlWed, 15 Jul 2026 08:00:00 +0100Kimsuky stopped fighting corporate email filters. It simply changed channel: a QR code forces the victim onto a personal phone, outside the IT perimeter. And it steals the session token rather than the password — so MFA falls without raising a single alert.https://spidercivi.github.io/HACK-PROJECT/en/a/miasma-redhat-npm-en.htmlhttps://spidercivi.github.io/HACK-PROJECT/en/a/miasma-redhat-npm-en.htmlWed, 15 Jul 2026 08:00:00 +0100Thirty-two Red Hat npm packages were published with malicious payloads — carrying valid SLSA provenance attestations. The technology built to guarantee build integrity certified the malware, because SLSA attests where a package was built, not whether the build's input was legitimate.https://spidercivi.github.io/HACK-PROJECT/en/a/sharepoint-cve-2026-45659-en.htmlhttps://spidercivi.github.io/HACK-PROJECT/en/a/sharepoint-cve-2026-45659-en.htmlWed, 15 Jul 2026 08:00:00 +0100Microsoft rated it "Exploitation Less Likely". Five weeks later CISA put it in the KEV catalog with a three-day remediation window. A lesson in what vendor exploitability predictions are actually worth.