Top stories.
- Tata Electronics and Bajaj Auto continue recovery from cyberattacks.
- Threat actors target critical infrastructure across Southeast Asia.
- CISA warns of actively exploited PTC vulnerability.
- Polish police disrupt SIM-swapping gang.
Tata Electronics and Bajaj Auto continue recovery from cyberattacks.
Mumbai-headquartered Tata Electronics, a key supplier to Apple, Tesla, and leading chip manufacturers, has tightened internal security controls following a data breach that came to light earlier this week, Reuters reports. The World Leaks ransomware group leaked more than 200,000 files allegedly stolen from the company, including what appear to be internal design papers from Apple and Tesla. The authenticity of this data has not been independently verified, and Tata hasn't commented on the contents of the leak. Reuters says the company has since restricted remote access to sensitive internal tools, and Apple's security team is working with Tata on near- and long-term security measures.
Another Indian manufacturing giant, Bajaj Auto, has resumed operations after sustaining a ransomware attack this week, ET Auto reports. The company says its manufacturing, sales, and service activities are now operating normally.
Threat actors target critical infrastructure across Southeast Asia.
Palo Alto Networks' Unit 42 is tracking a cluster of threat activity carried out by Chinese-speaking actors targeting critical infrastructure across Southeast Asia. The threat actors, tracked by Unit 42 as "CL-STA-1062," have been active since at least March 2022. The attackers have previously been observed targeting web hosting infrastructure in Taiwan, and Unit 42 says the latest campaign "highlights a broader long-term strategy in the Asia-Pacific region." The recent attacks focused on energy and government organizations.
The attackers deployed a newly documented Trojan dubbed "TinyRCT," a lightweight backdoor written in C# that enables attackers to "execute arbitrary system commands, exfiltrate files, capture screenshots, and remotely manage the infected host."
CISA warns of actively exploited PTC vulnerability.
The US Cybersecurity and Infrastructure Security Agency's (CISA's) Known Exploited Vulnerabilities (KEV) Catalog has listed a critical vulnerability affecting PTC's product lifecycle management tools Windchill and FlexPLM, SecurityWeek reports. The vulnerability (CVE-2026-12569) is an improper input validation flaw that can lead to remote code execution.
The agency also added a high-severity server-side request forgery (SSRF) vulnerability (CVE-2026-20230) in Cisco Unified Communications Manager that was observed being exploited this past weekend. Cisco released fixes for this flaw on June 3rd.
CISA has ordered Federal agencies to apply patches for both vulnerabilities by Sunday, June 28th.
Polish police disrupt SIM-swapping gang.
Polish police have arrested four alleged members of a cybercriminal gang known for targeting telecom vendors to conduct SIM-swapping attacks, BleepingComputer reports. The operation was led by the Polish Cybercrime Bureau (CBZC), supported by the US FBI and Homeland Security Investigations (HSI).
The suspects are accused of using SIM-swapping attacks to gain access to victims' cryptocurrency accounts. CBZC stated, "It is estimated that the total value of the funds laundered in this manner exceeds several tens of millions of Polish złoty" (at least US$5 million). The defendants are each facing up to 25 years in prison for charges related to money laundering, participation in an organized criminal gang, and hacking IT systems to commit theft.
