Weekly Threat Intelligence Digest — Apr 20 to Apr 27, 2026

Weekly threat intelligence digest from 453 items (41 critical, 152 high).

LIVETHREAT WEEKLY THREAT DIGEST April 20 – April 27, 2026 This week’s data reinforced a growing shift: attackers are bypassing traditional perimeters and striking through trusted third‑party relationships rather than exploiting direct vulnerabilities. High‑impact breaches – from the $290 M KelpDAO DeFi heist to the Vercel and Anthropic AI model exposures – all leveraged compromised API providers, cloud admin accounts, or supply‑chain components. Ransomware gangs are weaponizing MSP and managed‑service access, while zero‑day exploits in AI sandboxes and Microsoft Entra further amplify privilege‑escalation risk across the vendor ecosystem. The common denominator is privileged access that cascades downstream. 👉 Access, not a flaw, is the primary risk driver for today’s supply‑chain attacks. 🚨 EXECUTIVE RISK SNAPSHOT * Supply‑chain entry points dominate → API providers, cloud hosting platforms and MSPs were the initial footholds in 12 of the 29 breaches. * Privilege amplifies impact → Hijacked admin or service‑principal accounts enabled multi‑tenant data exfiltration (e.g., 2.1 M Amtrak records, 130 K TikTok‑downloader victims) and ransomware spread across hundreds of downstream customers. * Blind spots persist → OT converters, serial‑to‑IP devices and undocumented fourth‑party services remain largely absent from most TPRM inventories, creating invisible attack surface. 🔍 WHAT CHANGED THIS WEEK * AI‑driven supply‑chain exploits surged – Claude Mythos, Cohere Terrarium and SGLang flaws gave attackers remote code execution inside model‑hosting pipelines. * Nation‑state actors are exploiting cloud admin misconfigurations (LayerZero, Entra Agent ID) to hijack cross‑chain verification and Azure AD tenants, extending impact to every SaaS relying on those identities. * Ransomware‑as‑a‑service now incorporates botnets (SystemBC) and post‑quantum encryption, raising the speed and scale of encryption across compromised vendor environments. * Vulnerability fatigue is evident – Microsoft’s critical ASP.NET Core and Defender flaws remain partially unpatched, while 1,300 SharePoint servers stay exposed despite a recent patch. 🎯 WHERE YOU ARE MOST LIKELY EXPOSED * Vendors that expose API layers or verification services – e.g., LayerZero, Anthropic, Cohere, SGLang – because a single compromised endpoint can corrupt data across multiple customers. * Cloud hosting platforms hosting CI/CD pipelines – Vercel, Context.ai, AWS/GCP integrations – where stolen OAuth tokens or AI tool access gave attackers source‑code and deployment secrets. * Managed Service Providers and MSPs that hold privileged admin credentials for client environments – highlighted by the ADT Okta breach and Gentlemen ransomware botnet usage. #Cybersecurity #TPRM #VendorRisk #SupplyChainSecurity #ThreatIntel #LiveThreat #VerisqAI

Daily breach, advisory, and vulnerability briefs publish every weekday.