Netcrook
25 Junio 2026
A Supplier Leak With Two Giant Names Attached: What the Tata Electronics Case Reveals
A reported extortion incident inside a manufacturing supply chain shows how stolen documents, not just encrypted files, can become the real prize for attackers.
One Ticket, Many Doors: The AD360 Flaw That Put SSO Under the Microscope
A critical ManageEngine vulnerability shows how a predictable login artifact can turn a convenience feature into a cross-product security risk.
India Draws a Regulatory Line Around Banking AI
The central bank’s proposed AI rules signal a harder line on machine learning in credit institutions, with compliance now circling risk control rather than experimentation.
GLM-5.2 and the Quiet Power Shift Behind Open-Weight AI
China’s GLM-5.2 release spotlights open-weight AI, deployment control, and the enterprise governance questions that follow.
One Ticket, Many Doors: The ManageEngine Identity Flaw That Could Turn Trust Into Impersonation
CVE-2026-11374 shows how a predictable SSO artifact inside an integrated identity suite can become a serious account-takeover risk.
SharkLoader Turns Trusted Windows Paths into a Quiet Launchpad
A newly named loader linked to the StrikeShark cluster shows how public-facing application exposure, DLL side-loading, and in-memory staging can turn a routine foothold into a much harder problem.
macOS Malware Finds a Quiet Door in LaunchAgents and a Loud One in AI Triage
A Rust-based implant tied to a DPRK-linked macOS cluster pairs ordinary startup persistence with a Python stealer stage and prompt-injection text aimed at analysts.
When Recovery Becomes a Shortcut: The UEFI Password Problem Hidden in WinRE
A reported bypass in the Windows recovery path shows how a pre-boot security control can weaken when firmware and recovery logic share the same trust assumptions.
SharkLoader Turns a Diplomatic Intrusion Into a Broader Beacon Problem
A newly named loader family linked to StrikeShark shows how a small foothold can become a wider intrusion chain when the real goal is to stage Cobalt Strike Beacon.
Nova Claim, Empty Trail: The Extortion Post That Hints at Risk Without Proving Breach
A ransomware listing tied to lpgroup offers a familiar warning signal, but the missing victim URL and unverified hash leave analysts with a claim, not confirmed compromise.
Leak-Site Theater: What a Nova Victim Entry Can and Cannot Prove
A claimed victim page for LP Group highlights how ransomware crews use samples, screenshots, and naming tactics to turn uncertain access into public pressure.