Threat Advisories

Vercel OAuth Supply Chain Compromise

Cyber Florida SOCAP Team — Wed, 16 Sep 2026 15:45:07 GMT

DragonForce Ransomware Abuses Microsoft Teams for Covert C2 Operations

Cyber Florida SOCAP Team — Wed, 16 Sep 2026 15:44:32 GMT

ShinyHunters Canvas Extortion Campaign

Cyber Florida SOCAP Team — Wed, 16 Sep 2026 15:30:21 GMT

Section 1: Executive Summary (Current Status as of May 24, 2026)

On April 30, 2026, the threat actor group ShinyHunters exploited a vulnerability in Instructure’s Free-For-Teacher account program to gain unauthorized access to Canvas, one of the most widely used learning management systems in the United States. The breach exposed sensitive information belonging to students, faculty, and staff across 8,809 institutions worldwide. ShinyHunters claimed to have stolen 275 million records and exfiltrated approximately 3.65 terabytes of data.

This incident is not ShinyHunters’ first intrusion into Instructure’s environment. In September 2025, the group breached Instructure’s Salesforce business systems through social engineering. The September 2025 Salesforce incident may have provided the actor with additional knowledge of Instructure’s environment, but no public source has confirmed that it directly enabled the April/May 2026 Canvas intrusion. Rather than negotiate following the second breach, Instructure applied security patches. ShinyHunters responded by escalating. On May 7, 2026, the group simultaneously defaced Canvas login portals across affected institutions, disrupted final examinations at multiple universities, and issued a new ransom deadline of May 12, 2026.

ShinyHunters operates under a pay-or-leak extortion model, applying pressure through countdown timers, dark web leak sites, and live production defacement as coercive instruments. Notably, no malware was deployed during this operation. There is currently no public indication of traditional malware deployment or ransomware encryption during the Canvas incident. Reported activity appears to have relied on abused account access, application-layer vulnerabilities, and platform/API functionality.

This report provides an overview of the incident, a technical analysis of the exploited attack surface and associated MITRE ATT&CK techniques, infrastructure, and related indicators of compromise, and recommended remediation and mitigation actions for affected institutions and their users.

RDP Exploitation and AI-Enhanced Token Theft

Cyber Florida SOCAP Team — Wed, 16 Sep 2026 15:25:05 GMT

Authors: Kevin Wong, Aarav Jain

GitHub Internals Breach via Poisoned VS Code Extension

Cyber Florida SOCAP Team — Wed, 16 Sep 2026 15:00:43 GMT

On May 19, 2026, GitHub announced via X (formerly Twitter) an ongoing investigation into unauthorized access to its internal repositories. In a follow-up statement hours later, GitHub confirmed it had experienced a breach and assessed that threat actors had stolen source files and other sensitive data from around 3,800 of its internal repositories.

Authors: Taylor Alvarez, Isaac Ward Published: 05/29/2026

Technical Threat Advisory | CVE-2026-45675

Cyber Florida SOCAP Team — Wed, 16 Sep 2026 14:57:33 GMT

Originally Published May 20, 2026

Chrome Zero-Days Threat Advisory

Cyber Florida SOCAP Team — Wed, 16 Sep 2026 14:49:48 GMT

Originally Published April 1, 2026

Qilin Ransomware – A Double Extortion Campaign

Cyber Florida SOCAP Team — Wed, 16 Sep 2026 14:35:24 GMT

Originally Published December 8, 2025

BRICKSTORM APT Intrusion Campaign

Cyber Florida SOCAP Team — Wed, 16 Sep 2026 14:23:02 GMT

Originally Published December 3, 2025

BIG-IP Integrity Vulnerability Threat Report

Cyber Florida SOCAP Team — Wed, 16 Sep 2026 14:14:29 GMT

I. Introduction

Application Delivery Controllers (ADCs) are essential to modern networks because they optimize, secure, and manage client-server traffic. F5’s BIG-IP, a critical Application Delivery Controller used across enterprises and government networks, plays a key role in traffic management, SSL/TLS termination, and application delivery. [1]