The week in breach news Jun 10, 2026

Google and the FBI have warned U.S. law firms about a ransomware gang that has escalated its tactics by, in some cases, sending fake IT workers directly to victims’ offices.

On June 5, Google’s Mandiant and Google Threat Intelligence Group published a report detailing attacks by the Silent Ransom Group between January and May that targeted dozens of organizations. According to the report, the group used physical, in-person access to facilitate attacks, including planting insiders, bribing employees and gaining entry to office buildings to support cyber operations.

Just last month, the FBI warned that the Silent Ransom Group was targeting law firms through phishing and social engineering campaigns while impersonating IT support staff. In some incidents, attackers reportedly sent fake IT personnel to victims’ offices, where they connected to employee devices and used USB drives or remote access tools to steal contracts, Social Security numbers, financial records and tax information.

A fast-moving supply-chain attack linked to the “Miasma” worm struck Microsoft’s developer ecosystem on June 5, spreading through code repositories associated with Azure cloud tools.

GitHub disabled 73 repositories across four Microsoft GitHub organizations after a malicious commit was pushed to the Azure/durabletask repository using a previously compromised contributor account. The attack inserted configuration files designed to execute a credential-stealing payload when developers opened the repository using tools such as Claude Code, Gemini CLI, Cursor or Visual Studio Code. The campaign specifically targeted the trust relationships and automation capabilities that are increasingly embedded in modern software development workflows.

The incident appears to be the latest evolution of the Miasma campaign, a supply-chain operation based on self-replicating malware linked to the TeamPCP threat actor.

Credential security platform Dashlane disclosed that attackers have obtained at least a dozen encrypted vaults used by customers to store passwords and other sensitive credentials.

According to the company, attackers successfully brute-forced its two-factor authentication system, gaining access to approximately 20 customer accounts. By bypassing the authentication mechanism, the threat actors were able to download copies of certain customers’ encrypted vaults. Dashlane said it has notified the affected customers whose encrypted vaults were accessed and downloaded by the attackers.

Dashlane later confirmed that its investigation into the incident is complete and determined that the attackers targeted API endpoints used for device registration. According to the company, the threat actors used a brute-force attack to send a large volume of automated requests to those endpoints, enabling them to gain access to a limited number of customer accounts.

The Incransom ransomware group listed Colina Financial Advisors Limited (CFAL) as a victim on its data leak site on June 3.

Colina Financial Advisors Limited, based in the Bahamas, is an independent wealth management and investment advisory firm and the investment arm of Colina Holdings Ltd. The attack is believed to have occurred on June 1 and reportedly involved the exfiltration of approximately 500 GB of highly confidential data. The exposed information is said to include client personally identifiable information, financial profiles and asset data, proprietary business intelligence, system data, estate and legal planning documents and regulatory compliance records.

The exposure of sensitive client financial profiles and estate planning documents creates a significant risk of targeted fraud, social engineering and other malicious activity aimed at the firm’s clients.

Residents in Connecticut, Massachusetts and New Hampshire had their personal information exposed following phishing and social engineering attacks targeting Eversource Energy.

Eversource Energy, formerly known as Northeast Utilities, said phishing and social engineering attacks led to the compromise of two employee accounts in April. Through these accounts, threat actors gained access to the personal information of more than 3,000 customers. The company said it has notified utility regulators in all three states, as well as state and federal law enforcement agencies, but has not disclosed additional details about the incident.

The information exposed in the breach varies by customer and may include names, mailing and service addresses, account information, phone numbers, email addresses, Social Security numbers, driver’s license numbers and financial account information.