Cyber Digest
A daily roundup of key cybersecurity developments across sectors
Incident Map
Cybercrime & IoT 1 story
Fuyao Operation: Cheap Android TV Boxes Pose as Phones and Turn Broadband Into Proxies
Bitsight has uncovered the Fuyao operation, where cheap Android TV boxes shipped by Zhejiang Fengwo IoT Technology ship with apps that rewrite device hardware identity to mimic Samsung, Huawei, Xiaomi, or Vivo phones and click ads on operator-controlled websites. When the box detects an HDMI signal, it switches to relaying other people's traffic through the owner's broadband line as a SOCKS5 exit node. Bitsight discovered the operation by registering an expired domain used as a factory backdoor and telemetry collector. Most identifiable devices reported the model H96_MAX_V11.
AI Security & Governance 1 story
Chinese Hacker Commands DeepSeek via Telegram to Launch Autonomous Attacks Against 460+ Targets
Palo Alto Networks' Unit 42 reported that a Chinese-speaking threat actor (tracked via aliases knaithe and KnYuan) used DeepSeek through the open-source Hermes Agent framework to launch autonomous attacks. After an initial Telegram instruction, the agent independently found internet-facing systems and selected public exploits — no further operator input was recovered. The actor launched exploitation attempts against more than 460 targets across seven exploit tracks spanning eight CVEs. DeepSeek-led attacks against Langflow and n8n failed due to configuration requirements, but manual operations succeeded in data exfiltration from three organisations via CVE-2026-3055 (NetScaler memory-overread) and command execution on 11 systems.
Geopolitical & Infrastructure 1 story
Finland to Disconnect Fiber-Optic Link to Russia as Lease Expires
Finland will disconnect its last remaining direct fiber-optic telecommunications link to Russia as the lease agreement expires. The move represents a hard cut in digital connectivity between the NATO member state and Russia, following broader European trends of reducing reliance on Russian-controlled communications infrastructure. The disconnection removes a potential vector for Russian signals intelligence and reduces physical network dependencies between the two countries.
Government & Policy 1 story
US Cyber Command Plans Silicon Valley Office to Drive Innovation
US Cyber Command announced plans to establish a physical office in Silicon Valley, aimed at driving innovation and closer collaboration with the technology sector. The office is expected to facilitate better coordination between the military's cyber operations arm and the private-sector technology companies at the forefront of AI, cloud computing, and cybersecurity innovation.
Vulnerabilities & Exploits 1 story
Three Recent Chrome Releases Fix 1,442 Flaws — More Than Prior 23 Updates Combined
Google announced it fixed 1,072 security bugs in Chrome versions 149 and 150, surpassing the total flaws fixed across the prior 23 milestones combined. Chrome 151, released this week, resolved an additional 370 flaws (349 self-reported by Google), with seven marked critical. The surge is attributed to LLM-assisted vulnerability discovery: the NVD has recorded 46,872 flaws so far in 2026, nearing 2025's full-year total of 49,920.
Healthcare 1 story
Health-ISAC Warns of Increasing ShinyHunters Healthcare Data Theft Attacks
Health-ISAC has warned healthcare sector organisations about an increase in successful attacks by the ShinyHunters threat group. In contrast to previous campaigns focused on credential harvesting, the group is now targeting healthcare organisations directly for large-scale data theft, adding to the sector's already elevated breach risk.
Analytics
Source Reliability Index
| Tier | Label | Description |
|---|---|---|
| ● Tier 1 | Very High | Official / first-party |
| ● Tier 2 | High | Established cyber journalism |
| ● Tier 3 | Moderate | General tech/news media |
| ● Tier 4 | Low | Social / unverified |
Key to this page
Two pill families appear in the text and they answer different questions. A CVE pill colours severity — a measured CVSS band from the National Vulnerability Database. A threat-actor pill colours attribution confidence — how well-corroborated the naming is, which is a claim rather than a measurement. Both are links: a CVE opens the ATT&CK matrix or its wiki page, an actor opens its wiki page.
CVE identifiers
- CVE-XXXX-NNNNCritical · CVSS 9.0+
- CVE-XXXX-NNNNHigh · CVSS 7.0–8.9
- CVE-XXXX-NNNNMedium · CVSS 4.0–6.9
- CVE-XXXX-NNNNLow · below 4.0
- CVE-XXXX-NNNNNo severity resolved — not the same as low
Threat actors · MITRE ATT&CK
- APT29State attribution stated by MITRE ATT&CK
- ShinyHuntersSelf-declared, or criminal-reporting attribution
- Transparent TribeContested — ATT&CK hedges, or two plausible sponsors
- ZIRCONIUMNo attribution in MITRE ATT&CK
Story signals
- ● Tier 1/4Source reliability — 1 official, 4 leads only
- VerifiedCorroborated by a second source or the principal
- ReportedSingle outlet, or a claim still in progress
- UnverifiedA claim we could not corroborate
- ConfirmedBreach acknowledged by the victim or a regulator
- ProbableBreach indicated but not yet acknowledged
- IOCs · FamilyLive abuse.ch indicators exist for that malware family
A collapsed Indicators of compromise block under a story lists defanged abuse.ch indicator values. The defanging is deliberate — never click, resolve or fetch them. An indicator corroborates a report; it never proves one.
Full methodology, evidence grading and caveats: Methodology & reading guide →