Posted on Identity & Governance Incidents & Breaches Security Operations Vulnerability Intelligence

BreachForums Governance Crisis and Clone Forum Impersonation Reveal Dark Web Volatility in June 2026

In June 2026, BreachForums underwent leadership upheaval involving diencracked's return, conflict with HasanBroker experienced leadership instability as former operator diencracked returned, clashed with HasanBroker, announced retirement, and signaled ownership transfer to user L, raising governance concerns. Simultaneously, clone forums attempted to sell BreachForums infrastructure for $3,000 in cryptocurrency while admitting to impersonating ShinyHunters and original staff. DarkForums and XSS forums showed domain instability, DaMaGeLiB went offline after lead operator gliderexpert disappeared, and new forums BlackForums and RAIDForums emerged, underscoring the dark web ecosystem's resilience amid persistent volatility. Read more

Posted on Cloud Security Identity & Governance Security Operations Vulnerability Intelligence

GovCERT.HK Issues High Threat Alert for Linux Kernel Privilege Escalation Flaws

GovCERT.HK has issued a High Threat Security Alert (A26-06-45) for two elevation-of-privilege vulnerabilities in the Linux kernel—DirtyClone (CVE-2026-43503) and pedit COW (CVE-2026-46331)—with public PoC exploits available, allowing local unprivileged users to gain root access on affected systems. Read more

Posted on Identity & Governance Incidents & Breaches Security Operations Vulnerability Intelligence

CISA Alert: Active Exploitation of Critical Lantronix EDS5000 Flaw Demands Immediate Patching

CISA has warned of active exploitation of CVE-2025-67038, a critical code injection vulnerability in Lantronix EDS5000 Series devices, requiring Federal Civilian Executive Branch agencies to apply patches by June 26, 2026. The flaw allows unauthenticated remote command execution with root privileges via the HTTP RPC module, posing significant risks to network integrity and device security. Read more

Posted on AI Security Identity & Governance Incidents & Breaches Security Operations

Research Digest: Explainable ML Framework Reveals Moral Condemnation as Dominant Tactic in Korean Foreign Influence Operations

A two-decade analysis of 112 million South Korean news comments identifies 23,998 accounts showing coordinated manipulation behavior, with moral condemnation of domestic political figures driving higher engagement than direct foreign narrative promotion, informing platform defense prioritization. Read more

Posted on AI Security Identity & Governance Incidents & Breaches Security Operations

Research Digest: China’s ‘Airport’ Censorship Circumvention Ecosystem Reveals New Security and Operational Risks

A study of China's underground 'airport' proxy market finds over half of 1,667 surveyed users rely on these subscription services to bypass the Great Firewall, citing performance and access to global platforms like ChatGPT. Researchers identified 3,431 active airports and tested 35, noting superior speeds via multi-hop routing but also risks including Alipay payments, frequent takedowns, client misconfiguration, and private censorship enforcement. Read more

Posted on AI Infrastructure Risk Identity & Governance Incidents & Breaches Security Operations

Converging Ransomware and Data Leak Threats Target South Korea’s Critical Sectors in June 2026

In Week 3 of June 2026, South Korea faced a multi-vector cyber threat landscape as Qilin ransomware struck a big data solution provider, Anubis ransomware targeted a semiconductor equipment parts manufacturer, and confidential defense industry documents appeared for sale on the dark web forum Spear Forums, highlighting coordinated risks to national technological and security assets. Read more

Posted on Cloud Security Identity & Governance Incidents & Breaches Security Operations

Malicious LNK Files Disguised as Privacy Consent Forms Target South Korean Users via Fileless PowerShell and Task Scheduler Abuse

AhnLab identifies a campaign distributing malicious LNK files masquerading as personal information consent forms to execute fileless PowerShell scripts, establish persistence via Windows Task Scheduler, deploy info-stealers and backdoors, and use decoy documents to evade detection, with observed TTP overlaps to Kimsuky-like activity. Read more

Posted on Cloud Security Identity & Governance Security Operations Vulnerability Intelligence

Monitoring TWCERT/CC vulnerability notes for Taiwan supply-chain exposure

A practical guide for global security, cloud, and operations teams to monitor TWCERT/CC’s Taiwan Vulnerability Notes (TVN) feed for early detection of supply-chain risks affecting Taiwan-based software, vendors, and infrastructure. Focuses on actionable workflow steps, ownership, and flexible review practices without implying timeliness or numerical thresholds. Read more

Posted on AI Infrastructure Risk Cloud Security Identity & Governance Security Operations

Maintain an ‘evidence ladder’ for East Asia cyber signals

This article provides a practical workflow for maintaining an evidence ladder to assess the strength and reliability of East Asia cyber signals over time. It outlines how to track signal evolution, determine when to upgrade from monitoring to action, and correct prior assumptions transparently without rewriting history. The guidance is designed for security, cloud, and operations teams using Nogosee’s tracker as a monitoring layer. Read more