A Day In Cybercrime: May 28, 2026

A Day In Cybercrime with DERP delivers daily cybercrime and threat intelligence overviews, covering news, package manager malware, ransomware claims, C2 observations, and infrastructure.

News

CISA gives feds 4 days to patch actively exploited cPanel plugin flaw

Bleeping Computer (opens in new tab) | today at 6:30 AM Eastern

CISA ordered federal agencies to patch an actively exploited privilege escalation vulnerability in the LiteSpeed cPanel plugin within four days. Tracked as CVE-2026-48172, the flaw involves mishandling of Redis enable/disable features. Operators should prioritize patching this plugin on any exposed cPanel servers.

GPU mining malware spreads via SEO poisoning, AI chatbots

Bleeping Computer (opens in new tab) | May 27 at 6:30 PM Eastern

A cryptojacking campaign uses SEO poisoning to distribute GPU mining malware through fake download pages for utilities like CrystalDiskInfo and HWMonitor. The attacker deploys ScreenConnect for persistent access, which can later be used to install additional malware. Defenders should monitor for unauthorized ScreenConnect installations on high-performance systems.

JINX-0164 Targets Cryptocurrency Firms with Fake Recruiter Lures and macOS Malware

The Hacker News (opens in new tab) | today at 4:30 AM Eastern

A previously undocumented threat actor tracked as JINX-0164 targets cryptocurrency firms using fake recruiter lures and custom macOS malware. The campaign has been active since mid-2025 and includes supply chain attacks via compromised CI/CD infrastructure. Security teams in crypto organizations should review recruitment communication channels and CI/CD pipeline access.

Report 'phone hack' to police or I will do it for you, Labour chair tells Farage

The Guardian (opens in new tab) | May 27 at 5:30 PM Eastern

Labour chair Anna Turley gave Nigel Farage 24 hours to report his phone hacking claims to police, citing public and national interest. The claims involve alleged Russian hacking. This story is developing and may have broader implications for cyber threat attribution.

Iran's Internet is partially restored, Cloudflare Radar data shows

Cloudflare (opens in new tab) | May 27 at 2:30 PM Eastern

Iran's internet access is partially restored after nearly three months of disruption, according to Cloudflare Radar data. The restoration follows an announcement by Iran's vice president. Organizations with operations in Iran should monitor connectivity changes and adjust risk assessments accordingly.

Package Manager Malware

OSV reported 179 MAL advisories across repositories: PyPI: 16, npm: 163.

That covers 179 packages across 2 repositories.

14 promoted hosts were present in the OSV data.

npm dominates with 163 of 179 total MAL advisories, while PyPI accounts for 16. The 14 promoted hosts include C2, exfiltration, and infrastructure endpoints, indicating active abuse of package registries for multi-stage attacks.

Ransomware Claims

42 ransomware claims posted across 12 groups, 19 countries, and 11 sectors in the past 24 hours.

Dragonforce accounts for nearly half of all claims with 20 of 42, concentrating activity in a single group. The remaining 22 claims are spread across 11 other groups, with Qilin and 0day syndicate as secondary actors.

Countries hit: US (10), GB (5), MX (2), CA (2), NL (2), DE (2), BR (1), GH (1), ES (1), RU (1).

Targeted sectors: Business Services (9), Consumer Services (6), Technology (4), Manufacturing (4), Agriculture and Food Production (3), Healthcare (2), Transportation/Logistics (2), Construction (2), Energy (2), Education (1).

C2 Observations

422 C2 observations landed across 49 malware families, with 393 unique hosts and 24 shared hosts.

Clearfake dominates with 132 of 422 C2 observations, more than four times the next family. The 24 shared hosts indicate infrastructure reuse across multiple malware families, complicating attribution.

Shared Hosts

24 C2 hosts serve multiple malware families, with one host handling four families including AsyncRAT and Stealc. This reuse suggests shared infrastructure providers or multi-tool operators.

Quad9 DNS Activity

Quad9 blocked 25 C2 hosts in the last 24 hours, with the top blocked host oraxdata.monster generating 947 events. Clearfake-related domains appear frequently in the top blocked list, consistent with its C2 dominance.

Top 10 New Quad9 C2 Blocks (24hour)

Top 10 All C2 DB Quad9 C2 Blocks (24hour)

Infrastructure

Download-host infrastructure covered 414 hosts across 32 countries, 106 providers, and 5 infrastructure types.

US hosts account for 266 of 414 C2 hosts, with Cloudflare as the top provider at 210 hosts. Hosting infrastructure dominates at 378 hosts, while ISP and business types are minimal.

Latest From Derp

• PoisonX WindowsTelemetry: BYOVD-Assisted RAT With a Plugin Loader
• CrystalX: unpacking a Go RAT through three encrypted layers
• Vidar v1.5 in Go: same family, new language, heavy sandbox checks