Stryker Reports Cyberattack Impact, Windows Zero-Day and China Supercomputer Breach Claim
Summary
SecurityWeek’s roundup covers a macOS crypto stealer, a Windows Defender zero-day, reported breaches at Jones Day and DocketWise, Stryker’s cyberattack impact, and a disputed claim of massive data theft from a Chinese supercomputing center.
Key points
- NotnullOSX, a newly detected macOS stealer, reportedly targets cryptocurrency holders with more than $10,000 and spreads through fake Google documents and malicious DMG files.
- The Silent Ransom Group reportedly accessed records belonging to 10 Jones Day clients and leaked documents after the law firm rejected a $13 million ransom demand.
- A researcher released BlueHammer, a Windows Defender race-condition exploit that can grant SYSTEM privileges; Microsoft had not released a patch or assigned a CVE.
- FlamingChina claims it accessed the National Supercomputing Center in Tianjin through a compromised VPN and stole more than 10 petabytes of data. Some reviewers called posted samples authentic, while others questioned the claims.
- DocketWise confirmed an incident involving unauthorized access to credentials for a third-party repository containing personal information on 116,000 people.
- Stryker said a March cyber incident disrupted operations and will materially affect first-quarter financial results; global manufacturing and distribution systems have been restored, while the investigation continues.
Article Details
- Event Type
- Weekly roundup of cybersecurity incidents, vulnerability disclosures, and industry developments.
- Impact
- Reported incidents included a breach affecting 10 Jones Day clients, a DocketWise incident exposing personal information of 116,000 people, and a Stryker cyberattack that disrupted operations and is expected to affect first-quarter financial results. A newly detected macOS stealer reportedly targets cryptocurrency wallets. A Windows zero-day exploit was disclosed that reportedly enables SYSTEM privilege escalation; Microsoft has not released a patch or assigned a CVE. A hacker claimed to have extracted more than 10 petabytes from China's National Supercomputing Center in Tianjin, but the claim is disputed. Other developments included a spyware operator's conviction, a pause in new Internet Bug Bounty submissions, and changes to Cloudflare's post-quantum security timeline.
People
Bryan FlemingFounder of pcTattletale; sentenced to time served and a $5,000 fine for producing software that enabled secret surveillance of victims.Jerome PowellFed Chair who met with major US bank leaders to discuss possible cyber risks associated with Anthropic's Mythos model.Scott BessentTreasury Secretary who met with major US bank leaders to discuss possible cyber risks associated with Anthropic's Mythos model.
Threat Actors
FlamingChinaA hacker using this alias claims to have accessed the National Supercomputing Center in Tianjin through a compromised VPN and extracted over 10 petabytes of data. Some experts reportedly considered samples authentic, while others questioned the claims.Silent Ransom GroupReportedly used social engineering to access Jones Day client records and leaked sensitive documents and internal negotiation logs after the firm refused a $13 million ransom demand.
Malware
Vendors
Products
Microsoft Defender Antimalware PlatformA researcher has released a Windows zero-day exploit dubbed BlueHammer that leverages a race condition in Microsoft Defender to grant attackers full SYSTEM privileges.Microsoft WindowsResearcher leaks Windows zero-day following dispute with MicrosoftMythosFed officials discuss Anthropic’s Mythos AI with major US bankspcTattletaleBryan Fleming, the founder of the surveillance tool pcTattletale, was sentenced to time served and a $5,000 fine for producing software that allowed users to secretly monitor victims.
Countries
ChinaHacker claims massive breach of China supercomputing centerSpainThe malware, first detected on March 30, 2026 in Vietnam, Taiwan, and Spain, spreads through fake Google documents and malicious DMG files, tricking users into handing over Full Disk Access, which gives it a free passTaiwanThe malware, first detected on March 30, 2026 in Vietnam, Taiwan, and Spain, spreads through fake Google documents and malicious DMG files, tricking users into handing over Full Disk Access, which gives it a free passUnited StatesFed officials discuss Anthropic’s Mythos AI with major US banksVietnamThe malware, first detected on March 30, 2026 in Vietnam, Taiwan, and Spain, spreads through fake Google documents and malicious DMG files, tricking users into handing over Full Disk Access, which gives it a free pass
Industries
CryptocurrencyNew Mac stealer targets cryptocurrency walletsCybersecuritySecurityWeek’s weekly cybersecurity news roundup offers a concise overview of important developments that may not receive full standalone coverage but remain relevant to the broader threat landscape.DefenseSamples posted on Telegram in February 2026 include documents marked ‘secret’, as well as technical files, simulations, and renderings of defense equipment, such as bombs and missiles.Food and retailThis collaborative effort follows a significant breach at Asahi last September that disrupted shipments and exposed vulnerabilities in interconnected food and retail networks.SupercomputingHacker claims massive breach of China supercomputing center