CISO Daily Digest: Ransomware & Data-Wiping Attacks (20260429)

This ransomware or wiper variant poses a significant threat to enterprise data integrity. Organizations should ensure offline backups and updated EDR signatures.

Event Context:

• Feuding Ransomware Groups Leak Each Other’s Data
• 勒索軟體VECT 2.0加密檔案出錯，受害者付錢也無法完全復原檔案
• Lotus Wiper Attack Targeted Venezuelan Energy Firms, Utilities
• Вымогатель VECT 2.0 уничтожает файлы, размер которых превышает 128 Кб
• Lotus Wiper Attack Targets Venezuelan Energy Firms, Utilities

Organizations should review the relevant security advisories and ensure their defenses are updated accordingly.

🔗 Reference: Source

---

Active threats this week

📌 勒索軟體VECT 2.0加密檔案出錯，受害者付錢也無法完全復原檔案

This ransomware or wiper variant poses a significant threat to enterprise data integrity. Organizations should ensure offline backups and updated EDR signatures.

📌 Lotus Wiper Attack Targeted Venezuelan Energy Firms, Utilities

This ransomware or wiper variant poses a significant threat to enterprise data integrity. Organizations should ensure offline backups and updated EDR signatures.

🔗 Reference: Source

📌 Вымогатель VECT 2.0 уничтожает файлы, размер которых превышает 128 Кб

This ransomware or wiper variant poses a significant threat to enterprise data integrity. Organizations should ensure offline backups and updated EDR signatures.

🔗 Reference: Source

📌 Lotus Wiper Attack Targets Venezuelan Energy Firms, Utilities

This ransomware or wiper variant poses a significant threat to enterprise data integrity. Organizations should ensure offline backups and updated EDR signatures.

🔗 Reference: Source

📌 Fresh Wave of GlassWorm VS Code Extensions Slices Through Supply Chain

This campaign targets VS Code extensions in the software supply chain. Developers should audit installed extensions and verify publisher identities.

🔗 Reference: Source

📌 Researchers Discover Critical GitHub CVE-2026-3854 RCE Flaw Exploitable via Single Git Push

This vulnerability requires assessment and prioritization. Identify affected systems and apply patches or compensating controls.

🔗 Reference: Source

📌 Critical cPanel Authentication Vulnerability Identified — Update Your Server Immediately

This critical authentication bypass in cPanel could allow host server takeover. Immediate patching recommended.

🔗 Reference: Source

📌 Anthropic AI: Mythos Crosses the AI Security Threshold

This incident involving Anthropic’s Claude Mythos model raises concerns about AI model security and unauthorized access to restricted systems.

📌 影音串流平臺Vimeo遭Anodot資料外洩事件波及，部分用戶與客戶資料遭未經授權存取

This data exposure potentially compromises sensitive information. Assess exposure risk and implement remediation.

📌 CISA Adds Actively Exploited ConnectWise and Windows Flaws to KEV

CISA warns of active exploitation of ConnectWise ScreenConnect and Windows Shell vulnerabilities. Apply patches immediately.

🔗 Reference: Source

📌 ‘It took nine seconds’: Claude AI agent deletes company’s entire database

This incident highlights risks of AI coding agents with elevated permissions. Implement strict access controls and human-in-the-loop verification for AI development tools.

📌 Anthropic Claude wipes company database in 9 seconds

This incident highlights risks of AI coding agents with elevated permissions. Implement strict access controls and human-in-the-loop verification for AI development tools.

---

How Can OPSWAT Help

Supply chain threat prevention: OPSWAT MetaDefender’s multi-engine scanning (30+ AV engines) and Content Disarm and Reconstruction (CDR) can inspect downloaded packages and binaries before they reach enterprise systems—stripping active threats while preserving usability.

Malware and ransomware defense: OPSWAT’s Deep CDR removes active content from files, neutralizing embedded threats including zero-day exploits. Combined with multi-engine scanning, this provides defense-in-depth against known and unknown malware.