FBI ने Stryker में 80,000 डिवाइस वाइप के बाद Handala लीक साइट जब्त की, PolyShell Magento RCE सभी स्टोर प्रभावित, Navia उल्लंघन 2.7 मिलियन, APT28 Zimbra के जरिए यूक्रेन पर हमला

FBI ने मेडिकल टेक्नोलॉजी दिग्गज Stryker में लगभग 80,000 डिवाइस वाइप करने के बाद Handala हैक्टिविस्ट समूह के इंफ्रास्ट्रक्चर को जब्त कर लिया है। नई खुलासा हुई PolyShell भेद्यता हर Magento और Adobe Commerce इंस्टॉलेशन पर अनधिकृत रिमोट कोड एक्ज़ीक्यूशन सक्षम करती है। Navia Benefit Solutions ने 2.7 मिलियन व्यक्तियों को प्रभावित करने वाले डेटा उल्लंघन की पुष्टि की। रूसी सैन्य हैकर APT28 यूक्रेनी सरकारी संस्थाओं पर सक्रिय हमलों में Zimbra दोष का शोषण कर रहे हैं।

1. विनाशकारी Stryker साइबरहमले के बाद FBI ने Handala हैक्टिविस्ट लीक साइटें जब्त कीं

The FBI has seized two websites operated by the Handala hacktivist group following a devastating cyberattack on Stryker, one of the world's largest medical technology companies. The attack resulted in the wiping of approximately 80,000 devices across Stryker's infrastructure — a scale of destruction rarely seen outside of nation-state operations.

Stryker, which manufactures surgical equipment, orthopedic implants, and medical devices used in hospitals worldwide, faced catastrophic operational disruption. The wiper attack didn't just encrypt data for ransom — it destroyed it entirely, targeting endpoints, servers, and connected systems across the organization.

Why This Matters

• Healthcare impact: Stryker's devices are used in operating rooms and hospitals globally — disruption to their operations can have downstream effects on patient care
• Scale of destruction: 80,000 devices wiped represents one of the largest destructive attacks on a single organization in 2026
• Hacktivist evolution: Handala's capabilities demonstrate that hacktivist groups are now executing attacks at nation-state scale
• FBI response: The seizure of leak sites signals aggressive US law enforcement response to destructive attacks on healthcare infrastructure

Immediate Actions

• Healthcare organizations should review their endpoint protection and backup strategies
• Verify offline backup availability — wiper attacks make backups the only recovery path
• Assess vendor dependency risk for medical technology suppliers
• Review incident response plans for destructive (non-ransomware) scenarios

2. PolyShell: हर Magento और Adobe Commerce स्टोर पर अनधिकृत RCE

A devastating vulnerability dubbed PolyShell has been disclosed affecting every Magento Open Source and Adobe Commerce version 2 installation in existence. The flaw allows completely unauthenticated attackers to achieve remote code execution on the web server, leading to full store compromise including payment data theft, customer data exfiltration, and webshell installation.

This is particularly alarming because Magento/Adobe Commerce powers a significant percentage of the world's e-commerce stores. With the vulnerability requiring no authentication and affecting all stable v2 releases, the potential for mass exploitation is enormous.

Technical Impact

• Unauthenticated RCE: No login required — any attacker can exploit this against any Magento store
• Account takeover: Admin accounts can be hijacked, giving full control over the store
• Payment skimming: Attackers can inject Magecart-style payment skimmers to steal credit card data in real time
• Universal impact: All Magento Open Source and Adobe Commerce v2 stable releases are affected

Immediate Actions

• Apply Adobe's emergency patch immediately — do not wait for your next maintenance window
• Scan your store for webshells and unauthorized admin accounts
• Review payment processing logs for signs of skimming activity
• Implement a Web Application Firewall (WAF) rule to block exploitation attempts
• If you can't patch immediately, consider taking your store offline until patched

3. Navia Benefit Solutions डेटा उल्लंघन 2.7 मिलियन व्यक्तियों को प्रभावित करता है

Navia Benefit Solutions, a company that administers employee benefit plans including FSAs, HSAs, and commuter benefits, has disclosed a data breach affecting 2.7 million individuals. The breach exposed sensitive personal information that employers entrust to Navia for benefits administration.

The scale of this breach is significant — 2.7 million people represents a large portion of Navia's customer base, and the data involved (benefits enrollment, personal identifiers, potentially health-related information) is particularly sensitive under HIPAA and state privacy regulations.

Key Details

• 2.7 million individuals affected across multiple employer clients
• Exposed data may include names, Social Security numbers, dates of birth, and benefits enrollment information
• Benefits data is especially valuable for identity theft — it confirms employment status, income ranges, and health plan choices
• Notification letters being sent to affected individuals with credit monitoring offers

If You're Affected

• Freeze your credit with all three bureaus (Equifax, Experian, TransUnion)
• Monitor benefits accounts for unauthorized changes
• Be alert for tax-related identity theft — stolen SSNs are frequently used for fraudulent tax returns
• Accept the free credit monitoring but don't rely on it as your only protection

4. रूसी APT28 यूक्रेनी सरकार पर हमलों में Zimbra भेद्यता का शोषण करता है

Russia's military intelligence hacking unit APT28 (also known as Fancy Bear, linked to the GRU) is actively exploiting a vulnerability in Zimbra Collaboration Suite (ZCS) to target Ukrainian government entities. The attack exploits insufficient sanitization of CSS content within HTML emails — when the victim opens the malicious email in a browser-based mail client, inline scripts execute automatically.

This is a particularly insidious attack vector because it requires no clicks beyond opening the email. Simply viewing the message in Zimbra's web interface triggers the exploit, making it highly effective for mass targeting of government employees.

Attack Methodology

• Delivery: Crafted HTML emails with malicious CSS that triggers JavaScript execution
• Trigger: Simply opening/viewing the email in Zimbra's web client — no attachment or link clicks needed
• Impact: Email account compromise, credential theft, access to sensitive government communications
• Attribution: Confirmed APT28/GRU operation, consistent with ongoing Russian cyber operations against Ukraine

Immediate Actions

• Patch Zimbra Collaboration Suite to the latest version immediately
• Organizations using Zimbra in conflict zones should audit for signs of compromise
• Consider implementing Content Security Policy headers to prevent inline script execution
• Enable multi-factor authentication on all email accounts
• If running Zimbra on-premises, assess whether migration to a cloud email provider would improve your security posture

5. CISA ने Stryker उल्लंघन के बाद Microsoft Intune सुरक्षित करने के लिए आपातकालीन मार्गदर्शन जारी किया

Following the devastating Stryker breach, CISA (Cybersecurity and Infrastructure Security Agency) has issued an urgent advisory warning US organizations to follow Microsoft's guidance for hardening Intune endpoint management deployments. The advisory came after investigators determined that the Handala attackers exploited weaknesses in Stryker's Microsoft Intune configuration to execute the mass device wipe.

Microsoft Intune, which manages mobile devices and PCs across enterprises, became the weapon used against Stryker. Attackers who compromised the Intune admin console were able to push destructive wipe commands to every managed endpoint simultaneously.

Key Recommendations from CISA

• Enforce MFA on all Intune admin accounts — no exceptions
• Implement conditional access policies restricting admin actions to compliant, managed devices
• Enable just-in-time admin access — no permanent admin roles
• Monitor Intune audit logs for bulk device actions (wipe, retire, reset commands)
• Segment Intune admin roles — no single account should be able to wipe all devices

6. अधिकतम गंभीरता Ubiquiti UniFi भेद्यता खाता अधिग्रहण सक्षम करती है

Ubiquiti has patched two vulnerabilities in the UniFi Network Application, including a maximum-severity flaw (CVSS 10.0) that may allow attackers to take over user accounts. UniFi is widely deployed in enterprise and SMB networks for managing access points, switches, and security gateways.

A maximum CVSS score means the vulnerability is trivially exploitable, requires no authentication, and results in full compromise. Given UniFi's widespread deployment — especially in SMBs that may lack dedicated security teams — this is a high-priority patch.

Immediate Actions

• Update the UniFi Network Application to the latest version immediately
• Audit admin accounts for any unauthorized access or changes
• Restrict access to the UniFi management interface to internal networks
• Enable MFA on all UniFi admin accounts

7. Bitrefill ने साइबरहमले का श्रेय उत्तर कोरियाई Lazarus समूह को दिया

Cryptocurrency gift card platform Bitrefill has attributed its recent cyberattack to Bluenoroff, a subgroup of North Korea's notorious Lazarus hacking operation. The attack, which occurred earlier this month, targeted the company's crypto-related infrastructure.

Lazarus/Bluenoroff continues to be one of the most prolific financially motivated threat actors globally, with a particular focus on cryptocurrency platforms. Their operations fund North Korea's weapons programs, making them both a cybersecurity and a geopolitical concern.

8. ईरान का पूर्व-स्थापित साइबर इंफ्रास्ट्रक्चर उजागर

A detailed analysis has revealed a six-month buildup of Iran-linked cyber infrastructure, including US-based shell companies, designed to weather kinetic strikes and ensure the resilience of Iran's global hacking operations. The infrastructure was positioned to enable rapid cyber retaliation capabilities in response to military escalation.

This pre-positioning strategy represents a significant evolution in nation-state cyber doctrine — rather than building offensive capabilities in response to events, Iran has created persistent, resilient infrastructure capable of launching attacks at short notice from geographically distributed points, including inside the United States.

दैनिक खतरा सारांश