Cyber Security News

Hacking Editorial Brief — June 20, 2026

Ransomware Groups Intensify Operations with Multi-Target Campaign

Multiple ransomware operations launched coordinated attacks on June 19, with LockBit, TheGentlemen, Akira, and Qilin claiming responsibility for breaches across manufacturing, logistics, and software sectors. Victims include DaikyoNishikawa Corporation, Al Khaja Holding, and Apptricity, indicating continued targeting of enterprises with operational technology dependencies and supply chain positions. Separately, TheGentlemen ransomware-as-a-service group deployed a new EDR evasion framework called GentleKiller, capable of terminating 400 distinct security processes across endpoint protection platforms. The framework represents a significant evolution in pre-encryption tactics, allowing operators to systematically disable defensive controls before payload deployment. This operational tempo and tooling advancement demonstrates persistent ransomware group activity despite ongoing law enforcement pressure.

Law Enforcement Operation Cleans 14,971 Compromised WordPress Sites

Operation Endgame successfully disrupted SocGholish distribution infrastructure by cleaning nearly 15,000 compromised WordPress installations previously serving the malware framework. The majority of affected sites were located in the United States, followed by Germany and France. The cleanup effort directly impacts SocGholish's primary delivery mechanism, which relies on legitimate but compromised websites to serve fake browser update prompts that install malware. Concurrently, active exploitation is underway against an information disclosure vulnerability in the Gravity SMTP WordPress plugin, with Wordfence reporting blocked attack attempts in the wild. The vulnerability allows unauthorized access to sensitive configuration data. Additionally, the Texas Parks and Wildlife Department disclosed a breach at its license system vendor exposing personal data including driver's license and passport information for over three million individuals.

Sources: Bleeping Computer · The Hacker News · The Hacker News · Bleeping Computer