2026-04-08: Russian military intelligence exploited 18,000 routers worldwide to steal Microsoft credentials

Show Notes - 2026-04-08

Stories Covered

• Today:
• Anthropic's Claude Mythos Finds Thousands of Zero-Day Flaws Across Major Systems [Critical Alerts]
• Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure (CVE-2021-22681) [Critical Alerts]
• Russian State-Linked APT28 Exploits SOHO Routers in Global DNS Hijacking Campaign (CVE-2023-50224) [Critical Alerts]
• BlueHammer: Zero-Day Windows Exploit Released by Researcher After Microsoft MSRC Dispute [Critical Alerts]
• Max Severity Flowise RCE Vulnerability Actively Exploited (CVE-2025-59528, CVE-2025-8943, CVE-2025-26319) [Critical Alerts]
• Storm-1175 Deploys Medusa Ransomware at High Velocity [Ransomware & Extortion]
• NightSpire Ransomware IOCs and Affiliate Model Analysis [Ransomware & Extortion]
• Hundreds of Organizations Compromised Daily in Microsoft Device Code Phishing Attacks [Business & Infrastructure Threats]
• FBI: Americans Lost $21 Billion to Cybercrime in 2025 [Business & Infrastructure Threats]
• LucidRook Malware Targets Taiwanese Organizations via Spear-Phishing [Business & Infrastructure Threats]
• Over 1,000 Exposed ComfyUI Instances Targeted in Cryptomining Botnet Campaign [Business & Infrastructure Threats]
• Microsoft Rolls Out Fix for Broken Windows Start Menu Search [Windows / AD Security]
• Cracks in the Bedrock: Escaping the AWS AgentCore Sandbox [General Security News]
• Financial Cyberthreats in 2025: Infostealers and Dark Web Economy [General Security News]
• Webshell Scanning Activity from Microsoft Azure IP Addresses [General Security News]
• Hackers Exploit Critical Flaw in Ninja Forms WordPress Plugin (CVE-2026-0740) [Vulnerability Disclosures]
• Docker CVE-2026-34040 Bypasses Authorization and Gains Host Access [Vulnerability Disclosures]
• Mitsubishi Electric GENESIS64 and ICONICS Suite Products (CVE-2025-14815, CVE-2025-14816) [Vulnerability Disclosures]
• Snowflake Customers Hit in Data Theft Attacks After SaaS Integrator Breach [Vulnerability Disclosures]

CVEs Referenced

CVE-2021-22681, CVE-2023-50224, CVE-2024-41110, CVE-2025-14815, CVE-2025-14816, CVE-2025-26319, CVE-2025-59528, CVE-2025-8943, CVE-2026-0740, CVE-2026-34040

Indicators of Compromise

IP Addresses: 77.110.96.200, 20.48.232.178, 20.215.65.23, 51.12.84.116, 51.103.130.249

Read the full brief