River Bank Hit by June Ransomware Attack, Hackers Deleted Stolen Data

💥 BREACHES & INCIDENTS

• River Bank Hit by June Ransomware Attack, Hackers Deleted Stolen Data River Bank was hit by ransomware in June and hackers deleted stolen data after exfiltration.
  • Applies to River Financial Corporation, holding company of River Bank & Trust
  • Ransomware deployed across parts of the bank's server environment on June 16, 2026
  • Hackers accessed network portions and exfiltrated certain data
  • Investigation ongoing with third-party forensic firm; unclear if personal data was stolen
  • Bank engaged with hackers to have stolen data deleted, likely after ransom payment 📎 Coverage: securityweek.com · 👁 via SecurityWeek

🕵️ RESEARCH & DEEP DIVES

• Octagon Android RAT hides as Bahrain BH Alert app and survives reboots A new Android RAT called Octagon disguises as Bahrain's BH Alert app and persists through device reboots.

  • Targets Android users, primarily in Bahrain, by impersonating the official BH Alert emergency app
  • Delivers malware via phishing pages and APK downloads outside official app stores
  • Uses layered architecture with encrypted payloads and watchdog services to survive reboots
  • Steals device unlock credentials, SMS, banking info, and displays phishing overlays
  • Abuses Accessibility Service and VPN permissions to capture input and intercept traffic 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News

• Samsung bans smart TV apps that share users’ internet connections with strangers Samsung has banned smart TV apps that share users' internet connections via residential proxy networks.

  • Applies to Samsung smart TV apps available on Samsung's app store
  • Apps contain residential proxy (resproxy) code that shares users' internet connections with outsiders
  • Some apps, including a Samsung-endorsed Pac-Man game, turn TVs into exit nodes for proxy traffic
  • Resproxy code activates after user consent and can run continuously, risking hijacking and botnet use
  • Samsung is removing existing apps with this functionality and banning new registrations with proxy features 📎 Coverage: techcrunch.com · 👁 via @zackwhittaker@mastodon.social

📌 UNDER-REPORTED

• Kaspersky reports ransomware and insider threats at Brazilian educational institutions Brazilian educational institutions faced ransomware and insider attacks exploiting valid accounts and exposed apps.
  • Applies to Brazilian public and private educational institutions, mainly in São Paulo, Rio de Janeiro, and Pernambuco
  • Ransomware families DragonForce and LockBit 3 were prevalent, with LockBit builder leaked in 2022
  • Attackers used valid privileged accounts, exploited public-facing applications, and insider threats for initial access
  • Tools like AnyDesk, PsExec, AV-killer malware, and Potato variants were used for remote access, lateral movement, and privilege escalation
  • 60% of incidents were medium severity; 40% were high severity, mostly ransomware targeting private institutions 📎 Coverage: securelist.com · 📄 Original: securelist.com · 👁 via Securelist (Kaspersky)

🔓 CVEs & KEV

• CVE-2026-2346 — CVSS 9.8 — IDOR in Menulux Software's Mobile AppAuthorization bypass through User-Contro...
• CVE-2026-18598 — CVSS 8.8 — GL.iNet GL-MT3000 Logread Lua RPC plugin logread logread.get_system_log comma...
• CVE-2026-18599 — CVSS 8.0 — GL.iNet GL-MT3000 Logread Lua RPC Plugin logread logread.set_config command i...
• CVE-2026-56609 — CVSS 4.8 — HCL iControl is affected by multiple security vulnerabilities(CVE-2026-56608 ...
• CVE-2026-56608 — CVSS 3.7 — HCL iControl is affected by multiple security vulnerabilities(CVE-2026-56608 ...
• CVE-2026-18574 — CVSS — — Authentication Bypass in Check Point Security Management ServerAn authenticat...