Authorities Disrupt First VPN Cybercriminal Service
Law enforcement is increasingly targeting the “infrastructure layer” of cybercrime, rather than ransomware operators themselves.
All topics
Law enforcement is increasingly targeting the “infrastructure layer” of cybercrime, rather than ransomware operators themselves.
The company said it is still working through the intrusion but does not believe any customer repositories or data was affected at this point.
As of May 2026, over 6,502 ATG services running on 6,057 unique hosts were found to be reachable on the public internet across more than 65 countries.
An "unauthorized party” obtained a token with access to the Grafana Labs GitHub environment and downloaded Grafana’s codebase.
Researchers have linked the compromise to the "Mini Shai-Hulud" campaign, which has been ongoing for several weeks and is associated with TeamPCP.
The vulnerability (CVE-2026-6973) exists in Ivanti Endpoint Manager Mobile (EPMM) is being exploited by threat actors.