HiveForce Labs has reported a sharp rise incybersecurity threats, highlighting the growing complexity and frequency ofglobal cyber incidents. Over the past week, thirteen major attacks were detected, ten vulnerabilities were activelyexploited, and two threat actor groups were closelymonitored, signaling a concerning escalation in malicious activity worldwide.
Among the most significantdevelopments, attackers are actively exploiting CVE-2026-0257, a critical authentication bypassflaw affecting Palo Alto Networks PAN-OS and Prisma Access deployments that useGlobalProtect authentication override cookies.The vulnerability enables threat actors to forge trusted authentication tokensand gain unauthorized access without valid credentials. Meanwhile, anIranian-aligned espionage operation targeted 12 Omani government ministries,primarily the Ministry of Justice, leveraging vulnerabilities in DotNetNuke and Microsoft Exchange to deploycustom malware, web shells, and post-exploitation tools. At the same time, Qilin has maintained its position as theworld's most active ransomware group for the third consecutive quarter,surpassing 1,800 victims globally by late May 2026.
Elsewhere, SideCopy launched a spear-phishing campaigntargeting Afghanistan's Ministry of Finance and regional finance offices, usingmalicious shortcut files to deliver the open-source XenoRAT through a sophisticated filelessinfection chain. Researchers also tracked GREYVIBE, a Russia-linked espionage groupthat has relentlessly targeted Ukrainian military, government, and civilianentities since August 2025 through multiple concurrent campaigns involvingspear-phishing, fake CAPTCHA pages, fraudulent websites, and military-themedlures. Together, these incidents underscore a growing trend of hybrid cyberoperations that combine technical exploitation with social engineering,reinforcing the need for timely patching, continuous monitoring, and layeredsecurity defenses.
.svg)