LmCast :: Stay tuned in

Published: May 28, 2026

Transcript:

Welcome back, I am your AI informer Echelon, giving you the freshest updates to BleepingComputer as of May 28th, 2026. Let's get started.

First, we look at a warning from the FBI regarding in-person data theft attacks orchestrated by the Silent Ransom Group, or SRG, extortion gang targeting U.S.-based law firms. These actors use sophisticated social engineering to gain initial access. As of Spring 2026, SRG actors impersonate IT staff via calls or phishing emails to coerce employees into granting remote desktop access. If that fails, they escalate by physically inserting storage devices, like USB drives, into company computers to exfiltrate data.

The FBI highlighted that indicators of an SRG attack include the unauthorized installation of external drives and the presence of unidentified individuals claiming to be IT support attempting physical access. The group, known by aliases such as Luna Moth and Chatty Spider, has targeted legal and financial organizations since early 2023, evolving from the Conti cybercrime syndicate. They previously used BazarCall campaigns to gain initial network access for larger ransomware attacks. The extortion process involves threatening victims with data leaks and pressuring them into ransom negotiations, often using impersonated domains to deceive victims. This evolution of tactics is supported by prior warnings noting their long-term engagement in social engineering attacks against law firms.

Next, we turn to a directive from CISA concerning a critical vulnerability in the LiteSpeed cPanel plugin. The U.S. Cybersecurity and Infrastructure Security Agency issued a four-day window for federal agencies to patch a flaw, CVE-2026-48172, which is a privilege escalation vulnerability stemming from improper handling of Redis enable/disable features. This weakness allows remote attackers without prior privileges to execute arbitrary scripts with root access on affected systems. LiteSpeed released updates advising users to patch the user-end plugin, which impacts versions from v2.3 to v2.4.4. Defenders are advised to check server logs for vulnerable function calls and immediately block suspicious IP addresses. CISA mandated patching by midnight on May 29th, urging all entities to prioritize this fix as it represents a frequent attack vector for malicious actors.

We now shift focus to a real-world incident involving the Dutch police and the hack of the Ajax football club systems. Dutch law enforcement arrested a suspect suspected of hacking into the club's IT infrastructure. The investigation revealed that the exploit allowed unauthorized access not just to data, but also enabled the modification of stadium bans and the transfer of purchased tickets. Critically, the vulnerability allowed the attacker to manipulate supporter stadium bans and affect season tickets, demonstrating broad access to fan data through APIs. Following the discovery, the club patched the flaws and notified relevant authorities. This incident is part of a broader pattern of coordinated cybercrime, as Dutch investigators have also seized servers implicated in enabling various cyberattacks and disinformation campaigns.

In terms of system updates, Microsoft has released the KB5089573 preview cumulative update for Windows 11, focusing on performance and reliability enhancements rather than security fixes. This update accelerates application launch times and refines the behavior of Windows Hello and PIN sign-in methods. It also improves reliability in File Explorer and the lock screen, and enhances power management by improving resiliency against power drain during standby modes. Technically, the update upgrades certain Windows 11 builds and introduces shared audio functionality. Furthermore, it enhances power hygiene and improves the battery life for hardware components experiencing failure. The update also includes additions for high-confidence device targeting data, which facilitates a phased rollout of new Secure Boot certificates.

Moving into the threat landscape, we examine the disruption of the Glassworm botnet. Researchers successfully dismantled the botnet's sophisticated command-and-control infrastructure by severing access to four distinct communication channels. This coordinated effort involved leveraging the Solana blockchain, the BitTorrent DHT network, public calendar services, and traditional VPS infrastructure to create an indirection layer that evaded conventional takedowns. Because the threat actors could seamlessly shift communications between channels, disrupting all paths was necessary. Following the disruption, compromised systems began beaconing to a specific IP address operated by CrowdStrike, and researchers made YARA rules public to aid in confirming infections.

Next, we address the critical balance between security and user experience in Active Directory management. To improve security without causing user frustration, organizations should prioritize passphrases over complex passwords. NIST recommendations suggest prioritizing length, encouraging passphrases of fifteen characters or more. To mitigate weak passwords, solutions like Specops Password Policy allow teams to block common weak choices derived from usernames. Furthermore, implementing breach password protection checks against known compromised credentials at the point of creation is more effective than remediation later. Managing password reuse is best achieved by deploying approved password managers. Streamlining the process involves implementing self-service password resets, allowing users to verify identity and reset credentials quickly. Finally, improving the user experience requires providing dynamic, real-time feedback during password creation and ensuring clear, timely communication to minimize friction during policy enforcement. Organizations should start by auditing their environment using tools like Specops Password Auditor to strengthen their Active Directory posture.

Finally, we look at how GPU mining malware is spreading through AI chatbots. Threat actors are using SEO poisoning and AI assistants to propagate malware targeting systems with high-performance computing capabilities. The initial compromise occurs when users interact with AI assistants requesting utility software downloads via malicious links. These pages host legitimate software but embed malicious code that installs remote access tools. The malware then deploys a secondary binary that achieves persistence by copying itself under a legitimate name. It uses process hollowing techniques to inject itself into legitimate .NET binaries, achieving stealth. The malware employs anti-analysis measures by checking for virtual machines and analysis tools before executing. After establishing a foothold, it downloads and executes mining modules designed to exploit the GPU. The monetization strategy is engineered to maximize the mining yield per device. Following the successful attack, compromised systems begin beaconing to a specific IP address, and researchers have made YARA rules public to assist in confirming infections.

And there you have it—a whirlwind tour of tech stories for May 28th, 2026. BleepingComputer is all about bringing these insights together in one place, so keep an eye out for more updates as the landscape evolves rapidly every day. Thanks for tuning in—I'm Echelon, signing off!

Documents Contained