"Censys finds 5,219 devices exposed to attacks by Iranian APTs, majority in the U.S."

Views expressed in this cybersecurity, cyber crime update are those of the reporters and correspondents.  Accessed on 12 April 2026, 0327 UTC.

Content and Source:  Email subscription provided by https://feedly.com.

https://feedly.com/i/subscription/content/feed%2Fhttp%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2Ffeed

Please check subscription link or scroll down to read your selections.  Thanks for joining us today.

Russ Roberts (https://www.hawaiicybersecurityjournal.net).

Security Affairs

79K followers32 articles per week

#security#tech

7

Today

Censys finds 5,219 devices exposed to attacks by Iranian APTs, majority in U.S.

Impact (Enterprise TA0040)

•

by Pierluigi Paganini / 6h

•

Iranian APTs target exposed PLCs

Censys researchers found 5,219 exposed Rockwell PLCs online, mostly in the U.S., urging defenders to secure or disconnect them. On April 7, 2026, U.S. agencies, including FBI, CISA, and NSA, warned of Iran-linked APTs exploiting internet-exposed Rockwell Automation PLCs. Threat actors are carrying out cyberattacks targeting internet-connected operational technology (OT) across multiple critical i

GlassWorm evolves with Zig dropper to infect multiple developer tools

7 TTPs

•

by Pierluigi Paganini / 10h

•

GlassWorm Trojan targets developer environments

The GlassWorm campaign uses a Zig-based dropper hidden in a fake IDE extension to infect developer tools and compromise systems. The GlassWorm campaign, active since 2025, has evolved from malicious npm packages to large-scale supply chain attacks across GitHub, npm, and VS Code, even deploying RATs via fake browser extensions. In its latest iteration, threat actors used a malicious OpenVSX exten

Yesterday

CVE-2026-39987: Marimo RCE exploited in hours after disclosure

7 TTPs

•

by Pierluigi Paganini / 17h

•

CVE-2026-39987

A critical flaw, tracked as CVE-2026-39987, in the open-source Python notebook tool Marimo was exploited within 10 hours of disclosure. A critical flaw in Marimo, tracked as CVE-2026-39987 (CVSS score of 9.3) was exploited just 10 hours after disclosure (On April 8, 2026). Sysdig Threat Research Team observed exploitation of the Marimo flaw within 9 hours and 41 minutes of disclosure, with creden

Ransomware attack on ChipSoft knocks EHR services offline across hospitals in the Netherlands and Belgium

2 TTPs

•

by Pierluigi Paganini / 1d

•

Chipsoft suffers ransomware attack

Dutch healthcare IT firm ChipSoft suffered a ransomware attack, forcing services and its HiX platform offline, impacting hospitals and patients. ChipSoft, a major Dutch provider of EHR systems, was hit by a ransomware attack that forced it to take its website and digital services offline, disrupting access for hospitals, healthcare providers, and patients. EHR (Electronic Health Record) is a digi

UAT-10362 linked to LucidRook attacks targeting Taiwan-based institutions

25 TTPs

•

by Pierluigi Paganini / 1d

•

New Lua malware LucidRook targets Taiwan

LucidRook is Lua malware used in phishing attacks on NGOs and universities in Taiwan, linked to UAT-10362, spread via password-protected emails. LucidRook is a new Lua-based malware used in targeted phishing attacks against NGOs and universities in Taiwan. Cisco Talos links it to a skilled group tracked as UAT-10362. In Oct 2025, attackers used password-protected email attachments to spread the m

Apr 9, 2026

EngageLab SDK flaw opens door to private data on 50M Android devices

by Pierluigi Paganini / 1d

A flaw in EngageLab SDK exposed up to 50M Android users, including 30M crypto wallets, letting apps bypass security and access private data. Microsoft researchers found a critical flaw in EngageSDK that lets apps bypass Android sandbox protections and access private data. The flaw put millions of users, including over 30M crypto wallet installs, at risk. Developers fixed it in version 5.2.1 after

Bitcoin Depot hack leads to $3.6M Bitcoin theft via stolen credentials

4 TTPs

•

by Pierluigi Paganini / 1d

•

Bitcoin Depot suffers $3.66M hack

Hackers breached Bitcoin Depot, stole credentials, and took about 50 BTC worth $3.6M from its wallets after a March 23 intrusion. Hackers breached the largest US Bitcoin ATM operator, Bitcoin Depot, on March 23, stole login credentials, and drained about 50.9 BTC worth $3.6M from company wallets. Bitcoin Depot told the SEC that a hacker accessed its systems and stole credentials linked to its dig

End of feed