Cyber Security News

Hacking Editorial Brief — July 6, 2026

Russian APT28 Compromises UK Government Email Systems Through Credential Theft

Russian state-sponsored threat group APT28 successfully infiltrated UK Foreign Office and government email systems using stolen credentials obtained through brute-force attacks and DNS hijacking. Multiple sources confirm the compromised login details, affecting British diplomatic personnel and government officials, are now being sold on darknet markets for over £40,000. The breach represents a significant intelligence collection operation targeting UK diplomatic communications. The attack demonstrates APT28's continued focus on credential-based access to government networks, bypassing traditional perimeter defenses by targeting authentication systems directly.

North Korea Accounts for Two-Thirds of H1 2026 Cryptocurrency Theft

North Korea-linked hacking groups stole $643 million in cryptocurrency during the first half of 2026, representing approximately two-thirds of all crypto theft globally during that period, according to TRM Labs analysis. The firm documented 207 cryptocurrency hacking incidents in H1 2026, the highest number recorded for any six-month period in their data. The concentration of theft among DPRK-affiliated groups indicates continued state-directed operations targeting cryptocurrency platforms to fund regime activities. The scale and frequency of attacks suggest North Korean threat actors have refined their targeting of crypto infrastructure and improved operational tempo compared to previous periods.

Critical Vulnerabilities See Active Exploitation

CISA added SharePoint Server remote code execution vulnerability CVE-2026-45659 to its Known Exploited Vulnerabilities catalog following confirmed active exploitation in the wild. Separately, researchers disclosed CVE-2026-46242, dubbed "Bad Epoll," a Linux kernel race-condition use-after-free flaw allowing unprivileged users to escalate to root on Linux systems and Android devices. In Japan, KDDI confirmed a breach exposing approximately 14 million email credentials belonging to its ISP customers and five partner providers.

Sources: UNN · Korea JoongAng Daily · The Hacker News · Cybersec Brief · This Week in Security