A Day In Cybercrime: May 26, 2026

A Day In Cybercrime with DERP delivers a daily cybercrime and threat intelligence overview covering news, package manager malware, ransomware claims, C2 observations, and infrastructure.

News

Weekly Recap: Linux Flaws, Defender 0-Days, Router Botnets, and Supply Chain Chaos

The Hacker News (opens in new tab) | May 25 at 10:38 AM Eastern

A weekly recap highlights Linux flaws, Microsoft Defender zero-days, router botnets, and supply chain issues. Operators should prioritize patching known exploited vulnerabilities in internet-facing systems.

Microsoft Patches SharePoint RCE Flaw CVE-2026-45659 Across Server Versions

The Hacker News (opens in new tab) | today at 8:38 AM Eastern

Microsoft patched CVE-2026-45659, an 8.8 CVSS SharePoint RCE flaw exploitable by any authenticated attacker. Organizations running SharePoint should apply the update immediately.

CISA orders feds to patch actively exploited Drupal vulnerability

Bleeping Computer (opens in new tab) | today at 5:38 AM Eastern

CISA ordered federal agencies to patch CVE-2026-9082, an actively exploited Drupal SQL injection vulnerability. The flaw requires no authentication and targets Drupal's database abstraction API.

Iranian Hackers Deploy MiniFast and MiniJunk V2 via Phishing and SEO Poisoning

The Hacker News (opens in new tab) | today at 3:38 AM Eastern

Iranian state-sponsored group Nimbus Manticore deployed MiniFast and MiniJunk V2 backdoors via phishing and SEO poisoning. Defenders should monitor for AppDomain hijacking and AI-assisted malware delivery.

KnowledgeDeliver LMS Flaw Exploited to Deploy Godzilla and Cobalt Strike

The Hacker News (opens in new tab) | today at 1:38 AM Eastern

A hard-coded ASP.NET machine key vulnerability (CVE-2026-5426) in KnowledgeDeliver LMS was exploited to deploy Godzilla and Cobalt Strike. Organizations using this LMS should verify they are on patched versions.

Package Manager Malware

OSV reported 59 MAL advisories across repositories: npm: 59.

That covers 59 packages across 1 repositories.

Ransomware Claims

21 ransomware claims posted across 9 groups, 9 countries, and 9 sectors in the past 24 hours.

Play dominated with 6 claims, followed by Safepay at 4 and Spacebears at 3, while the remaining 6 groups each posted 2 or fewer claims.

Countries hit: US (8), DE (2), NL (2), JP (2), CH (1), IE (1), IT (1), EG (1), CA (1).

Targeted sectors: Consumer Services (3), Business Services (3), Technology (2), Agriculture and Food Production (2), Transportation/Logistics (2), Manufacturing (1), Hospitality and Tourism (1), Telecommunication (1), Healthcare (1).

C2 Observations

400 C2 observations landed across 47 malware families, with 380 unique hosts and 16 shared hosts.

Clearfake accounted for 130 of 400 C2 observations, with Asyncrat, Purerat, and Vidar rounding out the top four. 16 shared hosts were observed.

Shared Hosts

16 hosts were shared by multiple C2 families, indicating infrastructure reuse across campaigns, often on Cloudflare or Hetzner.

Quad9 DNS Activity

Quad9 blocked 25 C2 hosts, with Asyncrat and Clearfake domains generating the most events, primarily from Germany, the US, and Russia.

Top 10 New Quad9 C2 Blocks (24hour)

Top 10 All C2 DB Quad9 C2 Blocks (24hour)

Infrastructure

Download-host infrastructure covered 408 hosts across 34 countries, 116 providers, and 4 infrastructure types.

US hosted 263 of 408 C2 hosts, with Cloudflare accounting for 204. Germany and Russia followed with 40 and 19 hosts respectively.

Latest From Derp

• PoisonX WindowsTelemetry: BYOVD-Assisted RAT With a Plugin Loader
• CrystalX: unpacking a Go RAT through three encrypted layers
• Vidar v1.5 in Go: same family, new language, heavy sandbox checks