> Security Affairs newsletter Round 573 by Pierluigi Paganini – INTERNATIONAL EDITION

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. Hidden VMs: how hackers leverage QEMU to stealthily steal data and spread malwareNexcorium Mirai variant exploits TBK DVR flaw to launch DDoS attacksMicrosoft Defender under attack as three zero-days, two of them still unpatched, enable elevated accessKyrgyzstan-based crypto exchange Grinex shuts down after $13.7M cyber heist, blames Western IntelligenceDraftKings hacker sentenced to prison, ordered to pay $1.4 MillionOperation PowerOFF: 53 DDoS domains seized and 3 Million criminal accounts uncoveredU.S. CISA adds a flaw in Apache ActiveMQ to its Known Exploited Vulnerabilities catalogCisco fixed four critical flaws in Identity Services and WebexCookeville Regional Medical Center hospital data breach impacts 337,917 peopleAI platform n8n abused for stealthy phishing and malware deliveryFrom clinics to government: UAC-0247 expands cyber campaign across UkraineSweden reports cyberattack attempt on heating plant amid rising energy threatsCVE-2026-33032: severe nginx-ui bug grants unauthenticated server accessU.S. CISA adds Microsoft SharePoint Server, and Microsoft Office Excel flaws to its Known Exploited Vulnerabilities catalogMirax malware campaign hits 220K accounts, enables full remote controlPHP Composer flaws enable remote command execution via Perforce VCSMicrosoft Patch Tuesday for April 2026 fixed actively exploited SharePoint zero-dayPersonal data of 1 million gym members compromised in Basic-Fit security incidentUS, UK and Canada disrupt $45M crypto theft in Operation AtlanticShinyHunters claim the hack of Rockstar Games breach and started leaking dataAttackers target unpatched ShowDoc servers via CVE-2025-0520U.S. CISA adds Adobe, Fortinet, Microsoft Exchange Server, and Microsoft Windows flaws to its Known Exploited Vulnerabilities catalogFake Claude AI installer abuses DLL sideloading to deploy PlugXHackers access Booking.com user data, company secures systemsiPhone forensics expose Signal messages after app removal in U.S. caseCitizen Lab: Webloc tracked 500M devices for global law enforcementIran-linked group Handala claims to have breached three major UAE organizationsCPUID watering hole attack spreads STX RAT malwareAdobe fixes actively exploited Acrobat Reader flaw CVE-2026-34621Hackers claim control over Venice San Marco anti-flood pumps International Press – Newsletter Cybercrime GTA-maker Rockstar Games hacked again but downplays impact   TRM Labs Supports Operation Atlantic: USD 12 Million Frozen and 20,000 Victims Identified in International Crackdown on Crypto Scammers  Crypto-exchange Kraken extorted by hackers after insider breach Telegram Is Still Hosting a Sanctioned $21 Billion Crypto Scammer Black Market   Two U.S. Nationals Sentenced for Facilitating Fraudulent Remote Worker Scheme that Generated $5 Million in Revenue for the Democratic People’s Republic of Korea’s WMD Programs   Europol-supported global operation targets over 75 000 users engaged in DDoS attacks   Defendant Sentenced To Prison For Hacking Betting Website   Sanctioned Russia-linked crypto exchange Grinex halts operations following alleged hack by “Western Special Services” Ransomware attack continues to disrupt healthcare in London nearly two years later    Inside an Underground Guide: How Threat Actors Vet Stolen Credit Card Shops      Cyberscammers are bypassing banks’ security with illicit tools sold on Telegram   Malware Fake Claude site installs malware that gives attackers access to your computer   JanelaRAT: a financial threat targeting users in Latin America   Mirax extraction pipeline for StreamTV-like droppers     PowMix botnet targets Czech workforce   QEMU abused to evade detection and enable ransomware delivery Hacking New Booking.com data breach forces reservation PIN resets ShowDoc RCE Flaw CVE-2025-0520 Actively Exploited on Unpatched Servers Unrestricted Cloud Metadata Exfiltration via Header Injection Chain   Composer 2.9.6: Perforce Driver Command Injection Vulnerabilities (CVE-2026-40261, CVE-2026-40176)   MCPwn: A CVSS 9.8 One-Line MCP Bug That Hands Over Your Nginx to Anyone on the Network – Actively Exploited in the Wild Hackers are abusing unpatched Windows security flaws to hack into organizations   CVE-2026-39987 update: How attackers weaponized marimo to deploy a blockchain botnet via HuggingFace   The n8n n8mare: How threat actors are misusing AI workflow automation   A Deep Dive Into Attempted Exploitation of CVE-2023-33538 Intelligence and Information Warfare A conflict of attrition: Iran’s bet on asymmetric warfare  Uncovering Webloc An Analysis of Penlink’s Ad-based Geolocation Surveillance Tech   Sweden blames pro-Russian group for cyberattack last year on its energy infrastructure   Hospitals, local governments, and FPV operators are in the focus of the UAC-0247 cyber threat cluster   Inside ZionSiphon: Darktrace’s Analysis of OT Malware Targeting Israeli Water Systems Cybersecurity When deleting Signal is not enough: the FBI, iPhone notifications, and what forensics can reveal   Operation Atlantic: Protecting Victims Against Crypto Fraud   Understanding the dark web European regulators sidelined on Anthropic superhacking model   Europe’s Largest Gym Chain Says Data Breach Impacts 1 Million Members The April 2026 Security Update Review   AI Is Finding Bugs That Hackers Can Exploit. Get Ready for Bugmageddon  Bringing Rust to the Pixel Baseband NIST Updates NVD Operations to Address Record CVE Growth   Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)