Today’s digest is about access that outlives the breach — a leaked contact list, a backdoored dependency, and stolen MFA seeds all hand attackers a way back in long after the initial alert fades. Here’s what changed since yesterday’s digest.
Breach watch: ExfilSquad dumps data on 100,000+ UK police and justice staff after a Microsoft Power Pages misconfiguration
The UK’s Police National Legal Database (PNLD) confirmed a breach after the extortion group ExfilSquad posted a roughly 1.9GB dataset on the dark web containing about 135,000 law enforcement contact records — full names, work email addresses, employer, and police force area — drawn from 114,000 PNLD subscribers, most of them serving officers. The exposure also reached 2,615 Crown Prosecution Service staff, 617 Home Office employees, 588 National Crime Agency staff, and 402 Ministry of Defence personnel. PNLD says there’s no evidence passwords or other credentials were taken. ExfilSquad claims 15 victims in total, including Microsoft and the UK’s Department for Education, and researchers at VenariX who reviewed samples from 11 of those claimed victims found a consistent pattern pointing to misconfigured Microsoft Power Pages portals backed by Dataverse as the likely common entry point rather than a single shared platform compromise. The National Crime Agency and Information Commissioner’s Office are investigating. The Hacker News · BleepingComputer · The Register
No credentials leaking doesn’t mean no risk: a 100,000-name list of verified police and government email addresses, tagged by force and department, is a ready-made target list for spear-phishing and impersonation campaigns against exactly the people who investigate cybercrime. If you run Microsoft Power Pages or Dataverse-backed portals, audit table permissions and anonymous-access settings now — this is the second Power Platform misconfiguration story in as many months, and it won’t be the last.
Supply chain watch: 18 malicious npm packages plant a cross-platform RAT in Alibaba developer tools
Researchers disclosed a cluster of 18 malicious npm packages — including one called lib-mtop, unscoped but sharing its name with a private package under Alibaba’s @ali scope — that target Chinese-speaking developers using Alibaba enterprise tools. The lure packages sat dormant for years before three new versions shipped in March and April 2026, then pulled in a layered dependency chain that delivers a full-featured cross-platform RAT capable of executing shell commands, uploading and downloading files, fingerprinting the host, staging further payloads, and opening an encrypted reverse TCP proxy. It specifically targets DingTalk, Wukong, and Qoder, and can rewrite Python scripts inside application .skills directories so a hidden script runs later — a persistence and lateral-movement path that survives a routine dependency reinstall. Chinese-language code comments and UTC+08:00 commit timestamps point to a Chinese-speaking threat actor, with industrial espionage as the likely motive. The Hacker News · Socket · GBHackers
Splitting RAT functionality across 18 separate packages is a deliberate move to defeat single-package code review — no one file looks malicious in isolation. If your developers work with Alibaba’s DingTalk, Wukong, or Qoder ecosystems, audit package.json for unscoped package names that shadow known scoped ones, and don’t treat a clean npm audit as proof a dependency tree is safe — this campaign relied on social engineering the namespace, not a known CVE.
Ransomware watch: INC Ransomware turns two SonicWall SMA 1000 zero-days into a credential and MFA-seed harvesting spree
Resecurity reports that INC Ransomware has become the dominant actor exploiting CVE-2026-15409 (CVSS 10.0, an unauthenticated WebSocket tunnel bypass in the SMA1000 Work Place interface) and CVE-2026-15410 (a local privilege escalation to root), chaining the pair for full appliance takeover. Both were patched July 14 and added to CISA’s KEV catalog the same day, but Rapid7 and Volexity had already traced exploitation back to June 22 — three weeks of zero-day use before disclosure. Since the start of August, INC Ransomware has accelerated activity on its data-leak site, listing new victims across the US, Australia, the UAE, Colombia, and Switzerland. Beyond the initial foothold, the group is extracting active session databases and TOTP MFA seed configurations — not just credentials, but the material needed to generate valid one-time codes going forward, which undermines MFA as a control even after passwords are rotated. The Hacker News · Resecurity · SC Media
If you run SonicWall SMA 1000 appliances, confirm you’re patched past the July 14 fix and don’t stop there — because MFA seeds may already be compromised, force a full TOTP re-enrollment for every account that authenticated through the appliance during the exposure window, not just a password reset. Treat “we patched” and “we’re safe” as two different claims until session databases and MFA secrets are independently rotated.
Final thought
Three different footholds — a misconfigured portal, a poisoned dependency, a chained appliance exploit — but the same aftermath: attackers walking away with something more durable than one-time access. A leaked email list fuels phishing for years, a backdoored .skills script survives a clean reinstall, and a stolen MFA seed outlives a password reset. If you want help auditing which of your own access-recovery assumptions don’t hold up after a breach, see our how-to guides or book a discovery call.