Hackers Stole 350 GB of European Commission Data

The European Commission lost 350 GB of data from AWS, and the attacker claims they still have access to its email server. Amazon says nothing went wrong on their end so the problem was in configuration, not the cloud itself.

The European Commission confirmed a serious cybersecurity incident in which attackers breached its cloud infrastructure on Amazon Web Services and exfiltrated more than 350 GB of data.

The breach was discovered on March 24 and specifically affected the cloud environment hosting the Commission’s public web presence on the Europa.eu platform. European Commission spokesperson Nika Blažević stated that the Commission detected a cyberattack that affected part of its cloud infrastructure and that immediate steps were taken to contain the attack.

An unidentified attacker who claimed responsibility told reporters they had stolen over 350 GB of data and provided several screenshots as proof. According to their claims, they still have access to an email server. Unlike typical ransomware operators, the hacker stated they have no intention of monetizing the data through ransom demands, but instead plan to leak it publicly.

Amazon emphasized in its statement that it detected no security event and that its services operated without any issues. This suggests the attackers gained access through compromised credentials or misconfigured permissions, rather than by exploiting a vulnerability in the cloud platform itself.

The incident comes at a time of increasing pressure on cloud security for European institutions. As early as January 30, 2026, the Commission had already discovered traces of a cyberattack on its central mobile device management infrastructure. We covered this incident in a previous edition of Security Sunday.

Do You Know If Your Systems Are Secure?

Every week we bring real-world examples of attacks and vulnerabilities that can hit anyone. If you’re not sure whether your infrastructure is resilient, we’re happy to help you find out. At SysNetShield we offer vulnerability scanning, penetration testing, Red Teaming, and phishing campaign simulations.

Reach out to us at team@sysnetshield.com — the first consultation is free.

Critical TP-Link Router Vulnerability Allows Attackers to Take Control Without a Password

TP-Link this week released urgent firmware security updates for its Archer NX router series. The most severe of the patched flaws, tracked as CVE-2025–15517, allows attackers to completely bypass authentication. Specifically, it involves missing access verification for certain CGI endpoints on the HTTP server that are normally only accessible to authenticated users.

In addition to the main authentication flaw, TP-Link patched three more vulnerabilities. CVE-2025–15605 removes a hardcoded cryptographic key that was used to encrypt router configuration files. An attacker with device access could use this key to decrypt, modify, and re-encrypt configuration files, giving them the ability to manipulate network settings and effectively mask their presence.

TP-Link strongly recommended all users of affected models to update their firmware immediately, adding that it bears no responsibility for the consequences of inaction.

APT28 Exploited an MSHTML Zero-Day Before the February Patch

Researchers at Akamai discovered that the Russian cyberespionage group APT28, also known as Fancy Bear, had been exploiting vulnerability CVE-2026–21513 in the Windows MSHTML component as a zero-day before Microsoft released a fix as part of the February Patch Tuesday security updates.

The vulnerability, rated CVSS 8.8 out of 10, stems from insufficient validation of the target URL address in the ieframe.dll library, which handles hyperlink navigation. This allows attacker-controlled input to reach code paths that invoke the ShellExecuteExW function, enabling execution of local or remote commands.

The exploit uses specially crafted Windows Shortcut (LNK) files with an HTML file embedded directly after the standard LNK structure. The technique involves nested iframe elements and DOM context manipulation, bypassing Mark-of-the-Web (MotW) and Internet Explorer Enhanced Security Configuration protections. The result is execution of malicious code outside the browser sandbox.

The first malicious artifact linked to this campaign was uploaded to VirusTotal on January 30, 2026 and is connected to APT28 infrastructure. Researchers warn that the vulnerable code can be triggered by any component using MSHTML, meaning other delivery vectors beyond LNK files should also be expected.

TeamPCP Continues Their Attack: After Trivy, They Hit LiteLLM

The TeamPCP group, which we covered in the previous Security Sunday in connection with the compromise of the Trivy security scanner, has significantly escalated their campaign. On March 24, 2026, the attackers published malicious versions of the popular Python package LiteLLM on PyPI, the central repository for Python packages.

LiteLLM is a library used for unified access to various AI models and is downloaded approximately 3.4 million times per day. The attackers obtained the maintainer’s PyPI credentials through the earlier Trivy compromise that occurred within LiteLLM’s CI/CD pipeline. They then published versions 1.82.7 and 1.82.8 containing malicious code.

The insidiousness of the attack lies in its mechanism. The malicious package contained a file called litellm_init.pth, which abuses the Python .pth mechanism to execute arbitrary code on every interpreter initialization — even without an explicit import of LiteLLM. The malware collected credentials, encrypted them, and exfiltrated them to the domain models.litellm[.]cloud, which is not an official project domain.

The malicious versions were available on PyPI for approximately three hours before being pulled. Despite the short exposure window, the impact could be significant given the massive download volume.