[ DAILY DIGEST ] 2026-04-19 Sun

Full Daily Digest

5 articles · 7.80 avg score

Daily Overview

Date: 2026-04-19. Article count: 5. Average score: 7.80. Top categories: Incidents (4), Events (1). Recurring terms: CVE-2024-3721, Data Exfiltration, DDoS botnet, Grinex, Nexcorium.

Per-Article Analysis

Incidents Microsoft Security Blog Score 7.8

Cross‑tenant helpdesk impersonation to data exfiltration: A human-operated intrusion playbook

Incidents: Threat actors are exploiting cross-tenant Microsoft Teams communications to impersonate IT or helpdesk personnel, socially engineering users into granting remote desktop access.

Deep Analysis and Expert Commentary

Threat actors are exploiting cross-tenant Microsoft Teams communications to impersonate IT or helpdesk personnel, socially engineering users into granting remote desktop access. Once inside, attackers leverage trusted tools like Quick Assist and vendor-signed applications to execute malicious code, enabling lateral movement via protocols such as WinRM. This technique allows them to pivot to high-v

Original Article Brief Intro

Microsoft Security Blog · 2026-04-18 · Incidents: Threat actors are exploiting cross-tenant Microsoft Teams communications to impersonate IT or helpdesk personnel, socially engineering users into granting remote desktop access.

Related Terms and Notes

Malware Families
  • Data Exfiltration
  • Rclone — A command-line program to manage files on cloud storage, often abused for data exfiltration.
  • WinRM — Windows Remote Management, a protocol used for remote administration of Windows systems.
Techniques / TTPs
  • Lateral Movement
Context Notes
  • Microsoft Teams
  • Social Engineering
  • WinRM
Read Original Source ↗
Incidents SecurityWeek Score 7.8

Tycoon 2FA Loses Phishing Kit Crown Amid Surge in Attacks

Incidents: Tycoon 2FA, once the dominant phishing-as-a-service (PhaaS) platform, has lost its top position following a coordinated law enforcement takedown in early March.

Deep Analysis and Expert Commentary

Tycoon 2FA, once the dominant phishing-as-a-service (PhaaS) platform, has lost its top position following a coordinated law enforcement takedown in early March. Despite the seizure of 330 active domains, the platform's underlying ecosystem persisted, with threat actors migrating to alternatives like Mamba 2FA, EvilProxy, and Sneaky 2FA. Barracuda Networks reports that the overall volume of phishin

Original Article Brief Intro

SecurityWeek · 2026-04-18 · Incidents: Tycoon 2FA, once the dominant phishing-as-a-service (PhaaS) platform, has lost its top position following a coordinated law enforcement takedown in early March.

Related Terms and Notes

Techniques / TTPs
  • MFA bypass — Techniques used to circumvent multi-factor authentication, often involving phishing or session hijacking.
  • PhaaS — Phishing-as-a-Service: A model where threat actors rent or purchase phishing tools and infrastructure to launch attacks.
  • phishing-as-a-service
Context Notes
  • Barracuda Networks
  • MFA bypass
  • threat actors
  • Tycoon 2FA
Read Original Source ↗
Events The Hacker News Score 7.8

[Webinar] Eliminate Ghost Identities Before They Expose Your Enterprise Data

Events: Unmanaged non-human identities—service accounts, API keys, and AI agent connections—are now the primary attack vector in cloud breaches, accounting for 68% of incidents in 2024.

Deep Analysis and Expert Commentary

Unmanaged non-human identities—service accounts, API keys, and AI agent connections—are now the primary attack vector in cloud breaches, accounting for 68% of incidents in 2024. These 'ghost identities' persist long after projects end or employees leave, often retaining excessive privileges and remaining completely unmonitored. Attackers exploit these overlooked credentials for lateral movement, w

Original Article Brief Intro

The Hacker News · 2026-04-18 · Events: Unmanaged non-human identities—service accounts, API keys, and AI agent connections—are now the primary attack vector in cloud breaches, accounting for 68% of incidents in 2024.

Related Terms and Notes

Techniques / TTPs
  • Ghost Identities — Dormant or unmanaged non-human credentials (service accounts, API tokens) that retain access privileges
Context Notes
  • API Keys
  • Cloud Breaches
  • IAM — Identity and Access Management systems designed primarily for human user authentication and authorization
  • Non-Human Identities
  • Service Accounts
Read Original Source ↗
Incidents The Hacker News Score 7.8

$13.74M Hack Shuts Down Sanctioned Grinex Exchange After Intelligence Claims

Incidents: Grinex, a sanctioned cryptocurrency exchange linked to Russia, has suspended operations following a $13.74 million hack attributed to Western intelligence agencies.

Deep Analysis and Expert Commentary

Grinex, a sanctioned cryptocurrency exchange linked to Russia, has suspended operations following a $13.74 million hack attributed to Western intelligence agencies. The attack, characterized by advanced techniques and state-level resources, targeted the exchange's infrastructure, stealing over 1 billion rubles. Grinex, a rebrand of the sanctioned Garantex, has been a conduit for illicit transactio

Original Article Brief Intro

The Hacker News · 2026-04-18 · Incidents: Grinex, a sanctioned cryptocurrency exchange linked to Russia, has suspended operations following a $13.74 million hack attributed to Western intelligence agencies.

Related Terms and Notes

Malware Families
  • Grinex — A cryptocurrency exchange sanctioned for laundering funds linked to ransomware and darknet markets.
Context Notes
  • blockchain laundering
  • cyber attack
  • Garantex — A predecessor to Grinex, sanctioned by the U.S. Treasury for processing illicit transactions.
  • Grinex
  • sanctions evasion
Read Original Source ↗
Incidents The Hacker News Score 7.8

Mirai Variant Nexcorium Exploits CVE-2024-3721 to Hijack TBK DVRs for DDoS Botnet

Incidents: A new Mirai variant dubbed Nexcorium is exploiting CVE-2024-3721, a medium-severity command injection flaw in TBK DVR-4104 and DVR-4216 devices, to hijack systems for DDoS botnets.

Deep Analysis and Expert Commentary

A new Mirai variant dubbed Nexcorium is exploiting CVE-2024-3721, a medium-severity command injection flaw in TBK DVR-4104 and DVR-4216 devices, to hijack systems for DDoS botnets. This campaign, documented by Fortinet and Palo Alto Networks, underscores the persistent targeting of IoT devices due to weak security and unpatched vulnerabilities. Nexcorium shares architectural similarities with Mira

Original Article Brief Intro

The Hacker News · 2026-04-18 · Incidents: A new Mirai variant dubbed Nexcorium is exploiting CVE-2024-3721, a medium-severity command injection flaw in TBK DVR-4104 and DVR-4216 devices, to hijack systems for DDoS botnets.

Related Terms and Notes

CVE IDs
  • CVE-2024-3721 — Command injection vulnerability in TBK DVR devices (CVSS 6.3), exploited to deploy Nexcorium malware.
Malware Families
  • DDoS botnet
  • Nexcorium — Mirai-based botnet with DDoS modules, XOR-encoded configurations, and cross-device exploitation capabilities.
Context Notes
  • Mirai variant
  • Nexcorium
  • TBK DVR
Read Original Source ↗