ThreatsDay: 296K IoT Botnet, 100+ Water Systems Targeted, SharePoint RCE Chain + 27 New Stories
- ID
- 18738
- Status
- summarized
- Published
- 27 Aug 2026, 11:12 PM
- Fetched
- 28 Aug 2026, 2:57 AM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/threatsday-296k-iot-botnet-100-water.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 5.0
- Created
- 28 Aug 2026, 2:58 AM
- Tags
- Audience
- developersvibe_coders
What happened
A weekly cybersecurity roundup covering a 296K-device IoT botnet, 100+ water systems targeted, and a SharePoint RCE chain. The most detailed incident is a failed extortion attack on ReliaQuest on August 22, 2026, where attackers registered a lookalike domain, stood up a fake SSO page behind a CDN, called employees impersonating security staff by name, and got one employee to enter their password and approve an MFA push notification—granting brief view-only session access before being contained.
Why it matters
The ReliaQuest incident lays out a concrete, repeatable attack pattern your SaaS or internal tools should defend against: lookalike domains registered and burned within the hour, fake SSO pages behind CDNs, and MFA push fatigue abuse. If you ship SSO or MFA, consider number-matching MFA, conditional access policies that block unfamiliar IPs/CDNs, and domain monitoring for lookalike registrations. The SharePoint RCE chain is relevant only if you run SharePoint infrastructure.
Discussion angle
The MFA push fatigue attack vector is cheap to execute and hard to fully block—discuss whether number-matching MFA or phishing-resistant auth (FIDO2/WebAuthn) is now table stakes for any SaaS handling sensitive data, and what the tradeoff looks like for small teams shipping fast.