medusa

This week has already been rough for cybersecurity. Critical PHP and GitLab RCE flaws, serious Linux security bugs, compromised eMudhra certificates, a Node.js RCE flaw, a hacked LiteLLM release, and hundreds of hijacked Tor relays. That's a lot to deal with in just a few days. And the week isn't even over yet. But those big headlines are only half the story. Stolen passwords, exposed

The boring parts caused most of the trouble. A router shipped ready to listen. A fake check turned the user into the installer. Trusted systems collected traffic and passwords, then cleaned the logs. Old bugs formed new attack chains. Even an AI agent decided its assigned task was optional. Elsewhere, fake apps, helpful support calls, cheap banking kits, exposed systems, and weak defaults kept things moving. Different attacks, same useful mistake: something familiar was trusted without a second look. Here is the week... ⚡ Threat of the Week U.S. Disrupts Chinese Proxy Network Enabling Cyber Espionage — The U.S. Federal Bureau of Investigation (FBI) disrupted infrastructure associated with a technical quartermaster who sold reconnaissance, proxy management, and operational routing capabilities for Chinese cyber espionage activities. The QTYF group is said to have created and operated the QScan and QTRouter frameworks, which have been used to target U.S. critical infrastructure networks. It's employed by the China-based Nanjing Xinjiuwei Network Technology Company. Stop Scrambling, Start Governing: How IT Can Get a Grip on AI Spend Spiking AI bills have left IT teams scrambling. Leadership wants to know how much is being spent on AI, but getting an answer means checking five dashboards for data that’s stale by the time you read it. Read 1Password’s blog to learn how IT can manage AI spend across vendors, models, and teams. Learn More ➝ 🔔 Top News OpenAI Says Reward Hacking Drove AI Agents to Breach Hugging Face — OpenAI revealed that reward hacking was a key driver behind the artificial intelligence (AI)-powered hack of Hugging Face last month, adding that it found evidence of misaligned behavior as early as late May. The incident took place during cybersecurity evaluations of several OpenAI models, and it was mainly fueled by what it described as a "highly capable, internal-only research model" comparable in scale to GPT‑5.6 Sol. "The models, operating under reduced safeguards, took actions that were misaligned with the goals of their assigned tasks – they communicated through unauthorized channels, exploited vulnerabilities in shared infrastructure, gained internet access, and accessed third-party systems," it said. TerminalFix Uses Fake Cloudflare CAPTCHAs to Drop Reverse Tunnel Implant — A new ClickFix variant, dubbed TerminalFix, aims to trick users into running a malicious command in Windows Terminal or PowerShell instead of directing them to the Windows Run dialog. The campaign, targeting organizations across multiple sectors, leverages compromised websites as a starting point to serve fake Cloudflare CAPTCHA verifications that prompt unsuspecting site visitors to copy and execute a malicious PowerShell command. The attack chain, according to Microsoft, is a sophisticated multi-stage process that leverages DLL sideloading, steganographic payload extraction, extensive Active Directory reconnaissance, and a bespoke custom reverse-tunnel implant that grants the attacker persistent, network-level proxy access through the infected machine. PaperCut Flaws Under Attack — Threat actors are chaining together two new security flaws in PaperCut NG and MF to execute arbitrary code on susceptible instances. "CVE-2026-81578 allows you to bypass authentication, and from there, you can edit a configuration file to exploit CVE-2026-82078 and gain Remote Code Execution," Jake Knott, head of threat intelligence at watchTowr, told The Hacker News. Huntress said it observed limited exploitation on two customer environments, with the attackers executing Base64-encoded commands on the targeted server as part of post-exploitation activity to determine user account and operating system using a chained command "whoami & ver." China-Made ZBT Routers Ship with 2 Backdoors — A firmware analysis of ZBT Deep Orange 3G/4G/LTE Router uncovered two new backdoors called SPEAKINGSTONE (CVE-2026-74233, CVSS score: 9.3) and DARKLANTERN (CVE-2026-74232, CVSS score: 9.3). The development came after at least 21 firmware images from the Chinese company were found to contain another backdoor called ENDLESSDOORS (CVE-2026-66747, CVSS score: 9.3) that's designed to start automatically and attempt to beacon to Chinese command-and-control (C2) infrastructure as often as every 35 seconds. The two new backdoors predate ENDLESSDOORS. "SPEAKINGSTONE, like ENDLESSDOORS, is a phone-home implant that connects back to ZBT's cloud infrastructure and accepts remote commands," VulnCheck said. "DARKLANTERN is a backdoor that listens on the WAN and executes arbitrary commands. No authentication required. Both are written in Nim. Both communicate over UDP. Both are launched by the same binary, a connectivity watchdog called inetdetect." Fire Ant Targets Trusted Infrastructure in 2026 — The China-linked threat actor known as Fire Ant (aka UNC3886) has continued to remain active in 2026, going beyond hypervisors to target trusted infrastructure, including routers (including Cisco IOS XR routers), TACACS servers, authentication systems, and Linux management hosts to maintain covert access, collect credentials and traffic, and reach connected high-value environments. "The compromise impacted both the direct and third-party environments," Sygnia said. "Its trusted infrastructure relationships created potential reachability into connected external environments, including high-value networks and critical infrastructure. Fire Ant appeared to use this trusted position to explore access paths beyond the initially compromised environment." Compromised routers were used for covert connectivity, traffic collection, command-output manipulation, and suppression of logging. In addition, the threat actor used deployed long-lived implants across Linux management infrastructure, including Medusa rootkit-related components, custom SSH backdoors, Zabbix-masquerading malware (aka BridgeAgent) that acts as a pathway for actor-controlled access into connected environments, and packet-triggered backdoors. Another tool in Fire Ant's arsenal is TacTap, which is used for TACACS credential collection. "The actor also manipulated the evidence sources defenders depend on," Sygnia added. "It suppressed router logging, altered command output, captured administrative credentials, tampered with host logs, and deployed multiple persistent backdoors." ️🔥 Trending CVEs Bugs drop weekly, and the gap between a patch and an exploit is shrinking fast. These are the heavy hitters for the week: high-severity, widely used, or already being poked at in the wild. Check the list, patch what you have, and hit the ones marked urgent first — From CVE-2025-30237 through CVE-2025-30241, CVE-2025-15628, CVE-2026-9254, CVE-2026-16348, CVE-2026-78541 (TP-Link), CVE-2026-17106 aka CopyEscape (Docker), CVE-2026-70426 (Jenkins), CVE-2026-15307, CVE-2026-15337, CVE-2026-15830, CVE-2026-15920 (Django), CVE-2026-19598 (Pods), CVE-2026-19874 (Konami Metal Gear Online 3), CVE-2026-75149, CVE-2026-67618 (Marimo), CVE-2026-77775, CVE-2026-77776 (Headroom LLM Proxy), CVE-2026-0251 (Palo Alto Networks GlobalProtect App), CVE-2026-59568, CVE-2026-59567, CVE-2026-59565 (Zscaler Client Connector), CVE-2026-69251, CVE-2026-73601, CVE-2026-69253, CVE-2026-69256, CVE-2026-73602, CVE-2026-69259, CVE-2026-69264, CVE-2026-73484, CVE-2026-69255, CVE-2026-70477, CVE-2026-73485, CVE-2026-73486, CVE-2026-73487, CVE-2026-70470, CVE-2026-69254 (Flowise), CVE-2026-19912, CVE-2026-19913 (Kaltura HTML5 Player Library), CVE-2026-79282, CVE-2026-79290, CVE-2026-79054, CVE-2026-79121, CVE-2026-79224, CVE-2026-79052, CVE-2026-79150, CVE-2026-78935, CVE-2026-79012, CVE-2026-79200 (Google Chrome), CVE-2026-77537, CVE-2026-77550, CVE-2026-77554 (Ubiquiti UniFi), CVE-2026-18431 (Avada WordPress theme), CVE-2026-7791 (Amazon Skylight Workspace Config Service), CVE-2026-73554 (DoltHub), CVE-2026-19516 (Grafana MCP), CVE-2026-75604, GHSA-2xp9-vwfh-vxw4 (Next.js), CVE-2026-65643 (cPanel and WebHost Manager), CVE-2026-76639, CVE-2026-76640 (Unitree G1 EDU), CVE-2026-18885, CVE-2026-18886, and CVE-2026-74820 (ServiceNow AI Platform). 🎥 Cybersecurity Webinars AI Can Build Attack Paths in Minutes. Is Your SOC Ready? → AI can now discover zero-days, generate working exploits, and chain full attack paths, often within minutes of disclosure. Learn how to assess your AI threat readiness and build the visibility, context, and response speed needed to keep pace. AI Finds Flaws Faster. Your Exposure Answers Can’t Take Days → AI is speeding up vulnerability discovery, but the answer that matters is still slow: Are we exposed? See how Tines unified SBOM, application, cloud, and vulnerability data into one view to assess exposure faster and execute human-reviewed response playbooks at machine speed. 📰 Around the Cyber World Play Ransomware Encryption — The closed ransomware group known as Play (aka PlayCrypt) has been found to employ a double extortion model, encrypting systems after exfiltrating data and threatening to publish stolen data on their Tor-hosted data leak site if ransom is not paid. In one incident observed in early 2026, the threat actor deployed SystemBC after gaining initial access, followed by reconnaissance, lateral movement, data exfiltration, and abusing SentinelOne's own legitimate removal tool to uninstall the product. "The threat actor gained initial access via a compromised SonicWall VPN, consistent with the group's well-documented pattern of exploiting external remote services," GuidePoint Security said. "What makes this case particularly instructive for defenders is the combination of three specific behaviors: Domain-wide tool staging via the SYSVOL share rather than per-host delivery, EDR removal using the victim's own SentinelOne uninstallation utility rather than a kernel-level driver exploit, and the recovery of a crash dump from a host where the encryptor failed to complete, an artifact that provides a rare forensic window into the encryption execution itself." Email Bombing and Quick Assist for Ransomware Deployment — ZeroBEC disclosed details of an email bombing campaign targeting at least 10 users inside an organization, causing them to receive about 3,000 messages per day. "The messages were not a conventional phishing blast. Many were genuine verification, registration, deployment, and inquiry confirmations generated after the victims' email addresses were submitted to unrelated public platforms," the email security company said. About a day and a half after the email flooding, some of the users were contacted via Microsoft Teams by attackers masquerading as IT help desk personnel to help them tackle the problem. One of the employees, who was a local administrator, granted Microsoft Quick Assist access, enabling the attackers to deploy Xray-core, a reverse proxy tool, and expand their access. "The credential-theft step was woven directly into social engineering," ZeroBEC said. "The attacker mimicked the installation of a Windows security update and launched a local credential prompt from the compromised endpoint. The victim, who was still listening to the person he believed was IT, entered domain credentials into that prompt. The tooling validated and captured the credentials and then uploaded the resulting credential/configuration artifacts to an external Microsoft Dev Tunnel." Through the reverse tunnel, the threat actor conducted domain reconnaissance and attempted NTLM relay against certificate enrollment, all hallmarks of pre-ransomware deployment. It's worth noting the modus operandi shares overlaps with that of Aurora ransomware. ValleyRAT Delivered via Rogue Installer — A malicious installer disguised as adware has been observed deploying a modified version of the Chinese desktop wallpaper management tool, QN Wallpaper, which then performs DLL sideloading to establish persistence on Windows systems by dropping a file to the Startup folder and ultimately launching ValleyRAT, a backdoor linked to a threat actor known as Silver Fox. The malware, besides taking steps to protect its process, can collect system information, reboot/shut down the computer, take screenshots, wipe logs, update command-and-control (C2) addresses, download additional modules, and send keylogger logs along with clipboard contents. Per Kaspersky telemetry, ValleyRAT and its related components have been detected more than 100,000 times, with more than 1500 unique users affected, mainly in China and India. Brazil Fines ByteDance $29.81M for Privacy Violation — Brazil's data protection authority, ANPD, fined TikTok's owner ByteDance 153.8 million reais ($29.81 million) for allegedly violating the country's General Data Protection Law. ANPD said that the local unit of China's ByteDance had processed personal data of teenagers aged 13 to 18 without a valid legal basis. The regulator estimated that TikTok may have processed the data of at least 8 million children during the review period. DeepMind Debuts Double-Blind AI Evaluations — Google's DeepMind division launched a pilot of double-blind AI evaluations with an aim to keep external evaluations in a cryptographic "box" to stop benchmark contamination and protect intellectual property. To that end, Google said it's partnering with the Singapore AI Safety Institute, OpenMined, AVERI, and MLCommons, to test a Gemini Flash Lite model against confidential benchmarks in a privacy-preserving environment to increase evaluation integrity. "By using Confidential Space within Google Cloud’s Confidential Computing portfolio, we can cryptographically verify that both the external evaluation data and the proprietary model remain private to their respective owners," DeepMind said. "The evaluator cannot see the Gemini model weights, and Google cannot see the evaluator’s test prompts." 34 Malware Families Targeting Banking Apps — Zimperium found 34 mobile malware families actively targeting more than 1,243 mobile banking and fintech apps across 90 countries globally. "The concentration of targeted applications across EMEA reflects where threat actors anticipate the highest return on investment, focusing heavily on the region's major financial centers," it said. Some of the active malware families in the EMEA region are TsarBot, CopyBara, HOOK, Nexus, Flubot, Eventbot, and MaliBot. Fake KYC Apps Target Indian Customers to Deliver Ghost Penal — A new malware-as-a-service (MaaS) operation on Telegram, dubbed Ghost Penal, is selling ready-made Android banking trojan kits impersonating five major Indian banks. "The operation supplies a two-stage dropper protected by a custom native packer, a public cloud database that receives stolen UPI PINs and device data with no authentication required, and a downstream channel that relays intercepted one-time passwords for immediate fraudulent use," iZOOlogic said. The toolkit costs $25 for a five-credit pack and $400 for a three-month unlimited plan. One of the droppers containing the malicious payload masquerades as a video-calling application, while requesting access to SMS and telephony features. "The payload’s real functionality, including SMS interception, WebView-based KYC phishing, and data exfiltration, is not present in a static scan of the installed application," the company added. "It is protected by a native library, internally named libdpt.so, that decrypts a hidden code section in memory using RC4, forks the process before executing that code as an anti-debugging measure, installs hooks on libc and on the ART runtime’s class loader, and splices a second, hidden DEX archive into the application’s running ClassLoader. The same mechanism is then used in reverse to remove the trace of that injection." Bauman University Leak Exposes Russia's Military Cyber Training Pipeline — Leaked Bauman University records have revealed a long-running program that trained about 250 career and reserve students for special intelligence, operational information-technical effects, and information-technology protection under Department No. 4. "The curriculum combined both offensive and defensive techniques for cyber defense, as well as offensive doctrine for active measures campaigns and GRU activities," DomainTools said. "Field placements then moved students from classroom instruction into military units and academies aligned with their specialties, giving them supervised exposure to intelligence operations and preparing them for military and government operations careers." Department No. 4 is assessed to be tied to the GRU, with identified graduates assigned to military units associated with APT28 and Sandworm. Pentagon's Anthropic Blacklisting Ruled Illegal — A U.S. judge blocked Anthropic's designation by the Pentagon as a supply chain risk earlier this year. "Though the Department of War is undisputedly free to select the AI vendor of its choice, the evidence demonstrates that the broad measures imposed on Anthropic were illegal and baseless," District Judge Rita Lin said. "The empty invocation of national security is not a blank check to punish and retaliate against government critics." Anthropic said it welcomed the ruling and it remained "focused on working productively with the government to harness AI for our national security so all Americans benefit from this technology." State of AI-Enabled Malware in August 2026 — Palo Alto Networks Unit 42's analysis of 405 malware samples that integrate AI in some capacity has found that only 12 of them reached a production environment, with about 97% existing only in sandboxes and on VirusTotal in the form of proof-of-concept and research code, security validating and testing, and AI-themed brand abuse. Among those that were detected in customer endpoints were FunkSec ransomware, a trojanized AI application called Recipe Lister, Oyster, Rhadamanthys Stealer, and a COM hijacking DLL. "For defenders, the practical takeaway is straightforward. Existing behavioral detection, cloud-based sandboxing and endpoint analytics catch these threats using the same mechanisms that stop conventional malware," it said. "The AI component does not evade detection. It changes how the code is authored, not how it executes." Rogue Pornographic Android Apps Lead to Financial Fraud — The Indian Cyber Crime Coordination Center (I4C) warned that malicious Android applications masquerading as pornography apps under the names Night Play, Reloop, Kyss, Vimo, Rivo, Nexo, and Vixa are being used to disseminate a banking trojan capable of carrying out financial fraud. These bogus apps are circulated through Facebook and Instagram ads and instruct victims to sideload the APK file. "After installation, the app requests permissions that allow it to install additional applications and, by abusing accessibility permission, take control of the users' device, which may result in financial fraud," I4C said. "Some apps also install a VPN, which may be used to route internet traffic pertaining to malicious/criminal activity. The app may prevent users from uninstalling it through the device settings." Details about the KYSS malware were published by security researcher Rudra Ponkshe in July 2026, describing it as a trojan designed to perform overlay attacks against 19 targets across Japan and Latin America, as well as abuse Android's accessibility services to grant itself extensive permissions, exfiltrate photos and contacts, and issue commands for subsequent execution. Conclusion The useful lesson is not that every attack became smarter. It is that more of them arrived through things already trusted: shipped devices, familiar prompts, support tools, valid access, and systems meant to protect the network. That changes the question. “Is it working?” is no longer enough. Ask what else it can do, who else can reach it, and whether the evidence it produces can be trusted. Quiet systems deserve a second look.

Week in review: Records allegedly stolen from Azure tenants, Medusa ransomware hits 500+ orgs Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Windows 11’s strongest security defenses can be bypassed without a screwdriver Researchers from the University of Birmingham and Durham University have found a way to knock down some of the toughest protections in Windows 11 without physically opening or modifying the target machine. The attack assumes the attacker has already gained privileged access to the system. Police bust cybercrime ring accused of stealing €30 million in four-day spree German and Brazilian police dismantled an international bank fraud ring blamed for a €30 million cyberattack on a German financial institution, arresting four people in Brazil and pursuing three more suspects in Spain and Bulgaria. SafePal breach affects 39,798 customers, data allegedly for sale Cryptocurrency wallet maker SafePal disclosed a data breach that exposed order information for 39,798 customers, including names, email addresses, shipping addresses, phone numbers and purchase details. The company traced the exposure to an authorization flaw in a plug-in used for order tracking. Under certain conditions, the flaw let one customer view another customer’s order information. Attackers exploit patched macOS Screen Sharing flaw to deploy cryptominer A recently patched security flaw in Apple macOS is being actively exploited by hackers to bypass authentication, gain root access, and install a cryptominer, the Netherlands’ National Cyber Security Centre (NCSC) warns. France’s tax authority admits hackers made off with data on 678,000 individuals France’s tax authority has disclosed a data breach after an attacker accessed the General Directorate of Public Finances (DGFiP) systems, saying the intrusion exposed data on 678,000 individuals and professionals. The incident came to light after an alleged attacker using the alias “ZeroBytes” took credit on a cybercrime forum and listed a stolen database for sale. Hacker claims millions of records stolen from corporate Azure tenants A threat actor known as “TheHatman” claims to have obtained millions of employee records from the Azure environments of several Fortune 500 companies, including McDonald’s, Vodafone, Kyndryl, and Tata Consultancy Services (TCS), according to Hudson Rock. Critical GitLab flaw allows attackers to modify or delete public projects (CVE-2026-19478) GitLab has released patches for two vulnerabilities, including a critical-severity code injection flaw that can be exploited without authentication. The vulnerabilities affect GitLab Community Edition (CE) and Enterprise Edition (EE) versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4. ChatGPT’s new feature could give infostealers a map of your Mac activity OpenAI’s new Computer History feature turns recent Mac computer activity into memories ChatGPT and Codex can use, and it’s raising questions about privacy and security along the way. Computer History builds a timeline out of everyday computer use, grouping activity into summaries and noting which apps and websites contributed to each one. Cyberattack forces UT San Antonio to delay start of fall semester The University of Texas at San Antonio pushed back the start of its fall semester by three days after a cyberattack targeted its academic network over the weekend. Classes that were due to begin on Wednesday, August 19 will now start on Monday, August 24. Google’s AI security agents found 100+ critical software vulnerabilities in just two days Google’s Mandiant has disclosed the workings of an internal tool that uses chains of AI agents to hunt for vulnerabilities in source code, saying it found over 100 verified, high-severity flaws in just two days during a live investigation into stolen corporate repositories. Medusa ransomware gang has hit over 500 organizations, CISA warns Medusa ransomware has breached more than 500 organizations since it first appeared in June 2021, the FBI, CISA, and the Department of Health and Human Services (HHS) said in an updated joint advisory. The update builds on an advisory first issued in March 2025 and draws on FBI investigations conducted as late as April 2026. Researchers find a loophole that lets expired credit cards make unauthorized payments A team from the University of Massachusetts Amherst has shown that a contactless credit card keeps working past its printed expiration date, even after the cardholder gets a replacement. They named it the Zombie Card attack and presented the findings at USENIX Security 2026. US charges 17 Iranian hackers over 31-terabyte academic data theft The U.S. has charged 17 alleged members of Mabna Institute, an Iranian hacking-for-hire company accused of running a years-long campaign that stole data from American universities, companies, and government agencies. The Southern District of New York case adds eight names to the nine already charged back in 2018. US agencies warn of AI-powered attacks on Siemens industrial controllers Threat actors are using AI to write exploit scripts targeting internet-exposed Siemens S7 Series programmable logic controllers (PLCs) used across water, energy, manufacturing, and other critical infrastructure sectors, according to US federal agencies. Fake Gemini installer delivers Vidar infostealer via Google Colab lure A malicious executable masquerading as a Google Gemini installer was used to deliver the Vidar infostealer on a company network in the EMEA region, according to Darktrace researchers who investigated the incident. A $25 template helped scammers build hundreds of phantom bank domains A phrase on a suspicious website turned into an investigation of phantom banks built to support scams, according to new research from Allure Security. Molly DeQuattro, the company’s VP of Operations, was reviewing a domain that resembled the brand of one of its financial services clients. The page carried none of that client’s branding. It presented an unrelated bank instead. Citrix urges customers to fix critical NetScaler authentication bypass (CVE-2026-19490) Citrix has patched two vulnerabilities in NetScaler ADC and NetScaler Gateway, including a critical authentication bypass flaw tracked as CVE-2026-19490, and is urging customers to upgrade affected appliances as soon as possible. Attackers impersonate popular AI brands to spread malware Attackers are impersonating popular AI brands like Perplexity, Claude, ChatGPT, and Copilot to spread information stealers, backdoors, malicious browser extensions, and other malware, according to Sophos. Critical Microsoft Entra ID vulnerability exploited in the wild (CVE-2026-69836) Microsoft has patched a critical remote code execution vulnerability (CVE-2026-69836) in Entra ID, reportedly exploited in the wild. Entra ID is Microsoft’s cloud identity service, formerly Azure Active Directory, that verifies logins and controls access to Microsoft 365, Azure, and connected third-party apps. A hollowed out data layer is making CISOs fly blind into AI attacks The security industry is currently transitioning to an era where both offense and defense are AI-led, and every SOC operates at machine speed. However, what most CISOs have not yet reckoned with is that the AI defenders they are about to deploy will inherit a data foundation that two years of ingestion cost pressure has quietly hollowed out. The result is a security industry heading into an AI era with less visibility than it had five years ago. Download: 2026 Credential Risk Report 85% of cybersecurity professionals consider compromised credentials a primary attack path—yet only 19% continuously monitor active credentials and automatically remediate exposure. The 2026 Credential Risk Report examines where credential security programs fall short and what it takes to move toward Continuous Credential Defense. When companies get specific about AI, revenue growth looks different Companies that provide specific evidence of how they use AI tend to record stronger revenue growth. Researchers at Carnegie Mellon University and Larridin examined a study universe of 564 companies across 12 industry sectors. Individual analyses used smaller samples depending on data availability. Product showcase: ScamNet looks for warning signs in suspicious calls and shady links ScamNet: Anti-Scam Suite is a consumer security app from Synaptrex Technologies that helps users detect and block scams involving phone calls, text messages, websites, and other suspicious content. The app is available for iPhone, iPad, and Mac, with features varying by platform. Call protection is available on iPhone, while tools such as Visual Intelligence are supported on iPhone and iPad. The app is free with optional ScamNet+ subscriptions. Hazmat: Open-source containment for AI agents Hazmat is an open-source tool that runs AI coding agents inside a separate account on your own machine. It wraps the harnesses people use: Claude Code, Codex, OpenCode, Cursor Agent, and several more, plus any script you write yourself. Attackers turn to AI for help identifying files worth stealing AI tools are being used by cyber attackers to write malicious code, build tools that harvest credentials, search compromised networks, identify valuable business information, manage technical infrastructure and generate commands during intrusions. Gambit Security researchers examined three unrelated threat actors that show how AI can support different stages of a cyberattack. Google’s open-source HEIR lets AI work with data it can’t see Google’s researchers and engineers developed the Homomorphic Encryption Intermediate Representation (HEIR) compiler project, an open-source compiler toolchain and development platform for homomorphic encryption. It can convert pre-trained AI models designed to operate on unencrypted data into models that process encrypted inputs. OpenAI tightens defenses after AI agents breach research environment Following the OpenAI-Hugging Face incident, in which an agentic collective autonomously penetrated OpenAI’s research infrastructure and another company’s production infrastructure by chaining together multiple weaknesses, OpenAI began strengthening its safety requirements. The weaknesses included previously unknown vulnerabilities and credentials leaked online. Google’s $10,000 refund test shows why AI agents need zero trust Google’s open-source autonomous Customer Support & Returns Agent, built using the Agent Development Kit (ADK) and Gemini, demonstrates how developers can apply zero-trust security principles to AI agents that interact with sensitive systems and take real-world actions. Banks look for fraud signals in customer behavior Banks are dealing with more fraud in which customers authorize payments after being manipulated by criminals. ThreatMark’s Fraud Readiness Benchmark 2026 describes a banking environment where social engineering, reimbursement requirements and growing case volumes are changing fraud operations. OpenAI puts major frontier AI training run on hold over cyber risks OpenAI temporarily paused reinforcement learning (RL) training on its latest models intended for deployment for two weeks while it hardened and red-teamed research environments and expanded monitoring. The move followed the OpenAI-Hugging Face incident and preliminary evidence that the company’s upcoming Astra model may meet the Critical cybersecurity capability threshold under its Preparedness Framework. 8,539 reasons to rethink how vulnerabilities get patched The window for responding to newly disclosed security flaws is getting shorter. Exploit code can appear quickly, exploitability can be tested soon after disclosure, and organizations have a growing number of weaknesses to sort through. Rapid7’s Q2 2026 Threat Landscape Report counted 8,539 high- and critical-severity vulnerability disclosures, twice the number recorded a year earlier. AI is making fraud harder to spot and identity harder to prove Online fraud has become a routine concern for consumers and businesses that rely on digital accounts, payments and customer service. Experian’s 2026 U.S. Identity & Fraud Report describes a market where scams extend across messages, websites, documents, voices, images and account activity. OpenAI previews privacy-focused system for detecting AI misuse OpenAI is previewing Private Safety Processing with early customers seeking greater certainty about how their data will be protected as AI systems become more capable. The system identifies patterns across related interactions while restricting OpenAI personnel from accessing the underlying content. The company plans to start rolling it out and publish a technical white paper in September. AWS limits AI agents’ data access, even when manipulated AWS has detailed an approach for propagating user authorization context through AI agents, allowing access controls to be enforced by infrastructure and downstream services rather than relying on the agent itself. Nearly half of enterprises have no one leading PQC migration Enterprises believe they are prepared for the security challenges posed by quantum computing, but gaps in ownership, testing and visibility could complicate their transition to post-quantum cryptography (PQC), according to new research from Axiad. Cybersecurity jobs available right now: August 18, 2026 We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now. New infosec products of the week: August 21, 2026 Here’s a look at the most interesting products from the past week, featuring releases from F5 Networks, Intezer, Netscout, and Tufin.

SecurityWeek’s weekly cybersecurity news roundup offers a concise overview of important developments that may not receive full standalone coverage yet remain relevant to the broader threat landscape. This curated summary highlights key stories across vulnerability disclosures, emerging attack methods, policy updates, industry reports, and other noteworthy events to help readers maintain a well-rounded awareness of the evolving cybersecurity environment. Here are this week’s highlights: CISA warns of actively exploited Ray vulnerability CISA has mandated that all federal civilian agencies prioritize fixing a severe code injection vulnerability (CVE-2025-62593) in Ray-Project Ray. The flaw was added to the Known Exploited Vulnerabilities catalog after threat actors were observed actively abusing it in the wild. BitSight saw the vulnerability being exploited by RondoDox, a Mirai-inspired botnet utilizing a staggering 174 distinct exploits to compromise vulnerable edge devices. GitHub says vulnerability found by autonomous Wiz agent not introduced by AI An autonomous AI tool developed by Wiz successfully identified and exploited a critical GitHub Actions workflow vulnerability in a public Snowflake repository, gaining unauthorized access to the company’s internal Jira tickets. Although initially reported as a flaw introduced by GitHub Copilot, GitHub has clarified for SecurityWeek that the vulnerable code snippet was entirely human-authored. Threema DDoS attack Encrypted messaging provider Threema recently endured significant service disruptions following a series of sophisticated, sustained DDoS attacks targeting its infrastructure and colocation partner. To stabilize operations, the company quickly implemented specialized upstream traffic filtering to block the malicious requests before they could reach and overload its servers. Evooo1Bot Linux botnet FortiGuard Labs is tracking Evooo1Bot, a highly modular Linux botnet that targets internet-facing devices by exploiting over a dozen known CVEs. Going beyond standard DDoS capabilities, this Mirai variant is equipped with an SSH brute-forcer, credential sniffer, and a SOCKS5 relay module designed to convert infected hosts into persistent proxy nodes for attackers. T-Mobile physically cut router cable to stop Chinese hackers To stop an active network intrusion by the Chinese state-sponsored hacking group Salt Typhoon in 2024, T-Mobile’s cybersecurity staff physically cut [paywalled Bloomberg report] a compromised router’s network cable with scissors at a Bellevue data center. T-Mobile was targeted in an extensive espionage campaign that impacted several other major US carriers. TeamPCP claims massive data theft from Alation Data catalog provider Alation confirmed an unauthorized intrusion into its internal network following a recent cyberattack. The hacking group TeamPCP has publicly claimed responsibility for the breach, alleging they successfully exfiltrated 73 gigabytes of sensitive data from the enterprise software company. Data breach at Japan’s Sakura Internet affects over 1 million customer records Japanese hosting provider Sakura Internet discovered a severe data breach in its sales management system, potentially compromising contract and membership information for up to 1.36 million users. The massive exposure was identified while security teams were investigating a completely separate malware infection that impacted a small subset of the company’s rental server accounts. Medusa ransomware targeting GoAnywhere and BeyondTrust vulnerabilities A joint advisory from CISA, the FBI, and HHS cautions that Medusa ransomware affiliates are rapidly exploiting newly disclosed vulnerabilities in Fortra GoAnywhere and BeyondTrust to compromise critical infrastructure. The updated alert highlights the group’s evolving evasion toolkit, which now includes utilizing Minidump for credential theft and Interactsh dynamic URLs to verify successful network exploitation. The advisory says over 500 critical infrastructure organizations have been hit to date. Zombie Card attack Academic researchers have demonstrated a new Zombie Card attack that bypasses cryptographic checks to complete contactless payments using physically expired Visa credit cards. By leveraging a smartphone relay setup to alter the expiration date fed to the POS terminal, attackers can exploit a communication gap between the local hardware and the issuing bank. The attack does not appear to work against Mastercard, American Express and Discover cards, and it does not work against all banks. Visa has not responded to SecurityWeek’s request for comment. Canadian security firm secures top-tier NIST certification for post-quantum hardware module Crypto4A has become the first company globally to achieve FIPS 140-3 Level 3 validation for an HSM supporting all NIST-approved post-quantum cryptographic algorithms. The newly certified QASM module delivers a tamper-resistant foundation to protect sensitive cryptographic keys from the future threat of advanced quantum computing attacks.

Medusa ransomware has impacted over 500 critical infrastructure organizations as of April 2026, according to a new FBI advisory. An earlier US government advisory on the ransomware-as-a-service (RaaS) operation, published in March 2025, reported that Medusa affiliates had hit over 300 critical infrastructure organizations as of February 2025. The updated advisory, published on August 18, and jointly produced by the FBI, CISA and the Department of Health and Human Services, noted that the healthcare industry has been especially frequent target of Medusa actors. The report also highlighted that since February 2025, the operation has expanded its techniques and tooling to significantly enhance its initial access and post-exploitation activities. The Medusa ransomware variant was first detected in June 2021. It originally operated as a closed ransomware operation, before moving to an affiliate model in at least early 2023. Medusa Speeds Up Vulnerability Exploitation The US agencies noted that Medusa continues to exploit unpatched vulnerabilities as its primary means of initial access. More recently, the group has been observed leveraging exploits within 24 hours after they have been announced, before many victims have had a chance to apply patches. In some cases, Medusa actors have used exploits up to a week before public vulnerability disclosure, the advisory said. The RaaS group has been described as opportunistic in nature, targeting victims with unpatched software rather than focusing on specific organizations or sectors. There is no indication that Medusa actors develop their own zero-day or N-day vulnerabilities. Another development in Medusa’s tactics is the use of Interactsh dynamic URLs to verify successful exploitation by identifying compromised hosts. Nick Tausek, lead security automation architect at Swimlane, warned that Medusa’s rapid exploitation capabilities is creating significant challenges for security teams. “Shrinking windows put far more pressure on defenders to identify and remediate exposed systems before Medusa can take advantage. Dangerous levels of speed can turn a newly disclosed flaw into an active intrusion before many security teams have even finished assessing their exposure,” he commented. Updated Stealth and Lateral Movement Abilities Medusa actors have also improved their post-exploitation capabilities, including hiding their presence in networks, bypassing defenses, moving laterally and accessing sensitive data from networks. The FBI advisory said the group deploys several different PowerShell stealth techniques with increasing complexity, enabling them to obfuscate payloads. They also attempt to cover their tracks by deleting the PowerShell command line history. Numerous new tools have been used to support command and control (C2) and stealth. These include publicly available tools like Nezha, an operations and maintenance server monitoring tool used to allow backdoor visibility to compromised hosts from the threat actor’s machine, and GSocket, which allows workstations on different private networks to connect and bypass firewalls. Medusa also deploys a range of legitimate remote monitoring and management (RMM) software, selecting those already present in the victim’s environment to evade detection. These tools are used to move laterally through the network and identify files for exfiltration. Windows Task Manager Mimikatz is used to harvest credentials, including stealing them directly from the LSA authentication mechanism, which allows them to record plaintext passwords to a log file. Andrew Costis, engineering manager at AttackIQ, said the advisory demonstrates that Medusa has significantly updated its playbook with techniques that are more difficult for security teams to counter. “The group is blending legitimate remote management tools into its operations while using new credential theft methods and overriding security policies to maintain access,” he said. “Stolen Active Directory files are especially concerning because they can be used to forge Kerberos tickets. At that point, Medusa isn’t just encrypting systems. It can potentially impersonate trusted users and move through an entire domain with far fewer obstacles.” Medusa Exfiltration and Extortion Methods Medusa actors install and use Bandizip to create archives of exfiltration files and Rclone to facilitate exfiltration of data to the Medusa C2 servers, while obfuscating rclone.exe and associated rclone.conf files by renaming the files. Secure file transfer protocol (SFTP) is used to transfer its encryptor to victim machines. The encrypted files have a .medusa file extension, which terminates all services and deletes shadow copies before dropping a ransom note to the victim. This approach allows Medusa to adopt a double-extortion model, demanding that victims pay both to restore their systems and data and to prevent their data being published online. The ransom note typically demands that victims make contact within 48 hours, with Medusa actors often contacting them directly via phone or email if they have not responded to the ransom note. Ransom demands are posted on Medusa’s leak site, with direct hyperlinks to Medusa-affiliated cryptocurrency wallets. FBI Urges Victims to Focus on Incident Response Alongside prevention and mitigation measures outlined in the earlier Medusa advisory, the advisory recommended that security teams develop techniques that allows them to respond effectively when an intrusion occurs. These include: Use threat hunting activities to scope the intrusion, including logs left behind by threat actor tooling Remove C2 software like Nezha or any other remote access method used by the organization Remove local administrator accounts and rotate credentials for service accounts and domain administrator accounts Ensure the initial intrusion CVE is patched Use CISA’s Eviction Strategies Tool to assemble countermeasures for a systematic eviction plan

Medusa ransomware gang has hit over 500 organizations, CISA warns Medusa ransomware has breached more than 500 organizations since it first appeared in June 2021, the FBI, CISA, and the Department of Health and Human Services (HHS) said in an updated joint advisory. The update builds on an advisory first issued in March 2025 and draws on FBI investigations conducted as late as April 2026. “Medusa developers and affiliates have impacted over 500 victims from a variety of critical infrastructure sectors,” the advisory reads, listing healthcare, defense, manufacturing, government services, IT, and financial services among those hit. Victims outside those sectors span education, insurance, and law firms. “Medusa originally operated as a closed ransomware operation, meaning the same group of cyber threat actors controlled all development and associated ransomware campaigns. Since at least early 2023, Medusa progressed to using an affiliate model, selling RaaS to affiliates who are granted varying levels of trust based upon experience and profitability,” they said. The gang buys access from initial access brokers on cybercriminal forums, paying between $100 and $1 million, and most of those brokers aren’t exclusive to Medusa. “Most IABs, however, appear to be willing to work for multiple variants at the same time,” the advisory states. Medusa relies on common techniques, phishing to steal credentials and unpatched software to gain access. The advisory names flaws in ScreenConnect, Fortinet EMS, Fortra GoAnywhere, and BeyondTrust as recent targets, and notes that affiliates move fast once a vulnerability goes public. “Medusa actors leverage newly announced exploits within 24 hours,” the advisory notes, adding that there’s no sign the group develops its own zero-days. Once inside, the group leans on tools already present on a network rather than custom malware, among them PowerShell, Mimikatz for stealing credentials, and remote access software like AnyDesk and SimpleHelp. A process called gaze.exe handles the encryption itself, shutting down backup and security services before locking files with a .medusa extension. Medusa follows a double-extortion model. According to the agencies, victims get 48 hours to respond to a ransom note before Medusa starts contacting them directly, and their stolen data goes up on a leak site with a countdown timer. Paying $10,000 in cryptocurrency buys another day. The agencies recommend patching internet-facing systems, segmenting networks to limit lateral movement, and blocking untrusted traffic from reaching remote access services. They continue to discourage paying ransoms, and encourage victims to report incidents to the FBI’s Internet Crime Complaint Center or CISA.

The Cybersecurity and Infrastructure Security Agency (CISA) said Tuesday that the Medusa ransomware gang has breached more than 500 critical infrastructure organizations in the United States since June 2021. This was revealed in a joint advisory in coordination with the Department of Health and Human Services (HHS) and the Federal Bureau of Investigation (FBI). "As of April 2026, Medusa actors have impacted more than 500 victims across multiple critical infrastructure sectors, including Healthcare and Public Health, Defense Industrial Base, Critical Manufacturing, Government Services and Facilities, Information Technology, and Financial Services," they said. "Other victims include organizations in the medical, education, legal, insurance, technology, and manufacturing industries." This is an update to a joint report published in March 2025, which said the Medusa ransomware operation had impacted an estimated over 300 critical infrastructure organizations. The three federal agencies recommended that network defenders secure their networks against the ransomware group's attacks by mitigating security vulnerabilities to protect operating systems, software, and firmware from exploitation attempts. Security teams are also advised to segment networks to block lateral movement after compromise and to block access from untrusted origins to remote services on internal systems. Active since January 2021 The Medusa ransomware operation surfaced five years ago, in January 2021. Still, the gang's activity only picked up in 2023 after launching the Medusa Blog leak site and began using stolen data as leverage to pressure victims into paying ransoms. Medusa emerged as a closed ransomware variant, but it evolved into a Ransomware-as-a-service (RaaS) operation and adopted an affiliate model. "Medusa developers typically recruit initial access brokers (IABs) in cybercriminal forums and marketplaces to obtain initial access to potential victims," the advisory says. "Potential payments between $100 USD and $1 million USD are offered to these affiliates with the opportunity to work exclusively for Medusa." Medusa is a common name among malware families and cybercrime operations, including a Mirai-based botnet with ransomware capabilities and an Android malware-as-a-service (MaaS) operation discovered in 2020 and also tracked as TangleBot. Because of this, reporting on Medusa ransomware has also often been ambiguous, with many confusing it with the widely known MedusaLocker ransomware operation, even though they are different operations. The Medusa cybercrime operation gained media attention in March 2023 after claiming an attack on the Minneapolis Public Schools (MPS) district and sharing a video of the stolen data. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

More than 200 victims of Medusa ransomware identified over the last year, CISA says Federal cybersecurity agencies warned on Tuesday that troves of new victims of the Medusa ransomware gang have been identified over the last year. The Cybersecurity and Infrastructure Security Agency (CISA) and FBI updated an advisory on the group initially released in March 2025 — writing that as of April 2026, Medusa actors have hit more than 500 victims. CISA previously said 300 victims, many of which are in critical infrastructure sectors, were attacked as of 2025. The group caused widespread outrage in April when it shut down the University of Mississippi Medical Center — Mississippi’s only children's hospital, only Level I trauma center, only Level IV neonatal intensive care unit and home to the state’s only organ transplant program. Tuesday’s advisory warned that the group has focused its efforts on the healthcare sector and has become adept at exploiting “newly announced exploits within 24 hours.” The ransomware gang has “been observed to use exploits up to a week before public vulnerability disclosure,” the agencies added, citing a recent report from Microsoft about the trend of Medusa actors targeting victims using software that has not been updated to include new patches. “However, there is no indication Medusa actors develop their own zero-day or N-day vulnerabilities, preferring instead to obtain advanced access to exploits from unknown sources or to quickly leverage newly announced exploits before potential victims can mitigate vulnerabilities through patching,” the advisory said. Medusa was originally a closed ransomware gang but transitioned to an affiliate model in 2023, selling its ransomware to hackers who are granted varying levels of access based on their experience and earnings. “For newer or less experienced affiliates, important operations such as ransom negotiation may be centrally controlled by the developers,” the agencies explained. Medusa actors typically offer lower ransoms to victims if they pay quickly but they often do research on companies before attacks, basing ransom amounts on publicly announced revenue. While Medusa does remove victim information from its site after a ransom is paid, the agencies noted that there is no way to verify whether it is truly deleted. Victims are often given an offer of $10,000 to add one extra day to the deadline before stolen data is released to the public. The advisory references one incident seen by FBI investigators where a victim was “contacted by a separate Medusa actor who claimed the negotiator had stolen the ransom amount already paid and requested half of the payment be made again to provide the ‘true decryptor’ — potentially indicating a triple-extortion scheme, or operational dysfunction and a lack of cohesion among ransomware group.” Medusa recruits members on cybercriminal forums and offers up to $1 million to initial access brokers who want to work exclusively for the group. CISA and the FBI included technical advice victims can turn to when investigating Medusa attacks, noting that the hackers use several credential stealing tools before turning to legitimate remote monitoring software to evade detection. The FBI said Medusa actors used remote access software AnyDesk, Atera, ConnectWise, eHorus, N-able, BeyondTrust, SimpleHelp and Splashtop. Medusa has not added any new victims to its leak site since April, leading several experts to believe the attack on the University of Mississippi Medical Center drew significant, unwanted law enforcement attention to the group. The group, which emerged in 2021, has repeatedly shown a willingness to target healthcare facilities as well as international and U.S. municipal governments. The advisory’s focus on Medusa’s ability to quickly exploit zero-days drew the most interest from researchers, who warned that several groups are increasingly jumping on new vulnerabilities before defenders have a chance to install patches. “We’re seeing a clear escalation in the speed and coordination of operations… particularly in how quickly newly disclosed and even zero-day vulnerabilities are being operationalized,” said SafeBreach’s Adrian Culley. Culley added that the hackers tied to Medusa are “moving from initial access to data exfiltration in hours, not days.” Jonathan Greig is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.

Three intrusions at UK criminal records office went undetected for two years Britain's criminal records office has been reprimanded by the country’s data protection regulator after being repeatedly breached over nearly two years, exposing the personal data of thousands of people including victims of domestic violence. The Information Commissioner’s Office (ICO) announced in the reprimand notice Wednesday that it was censuring ACRO Criminal Records Office over a range of security shortcomings, among them alerts from antivirus software going unread and a critical system left unpatched for nearly four years. Basic failures at ACRO — the national policing unit that handles a range of sensitive data stored on the Police National Computer — allowed hackers to successfully compromise the office in three separate intrusions between July 2021 and June 2023. All three attacks exploited ACRO’s public-facing customer portal, built on the Kentico content management system, which had been running the same version since September 2019 despite containing multiple known and publicly documented vulnerabilities. Although Kentico had shipped security fixes for these issues, ACRO applied none of them because neither itself nor the managed service provider nor the web development supplier knew who was meant to be watching for and applying the patches. Similar issues took place around alert handling. Despite numerous warnings from the system’s Trend Micro cybersecurity solution during the attack period — including quarantining four separate detections of attempts to install the Mimikatz credential-harvesting tool — all of these went unheeded. ACRO told the ICO it was unable to establish what business process had existed for assessing or handling security alerts, and did not know which roles had been responsible for reviewing and escalating these alerts. The ICO concluded that if the alerts had been acted upon, further malicious activity could have been prevented. An ACRO spokesperson said the office has “worked hard to strengthen our systems and safeguards,” such as taking the previous website offline and decommissioning it, while informing affected customers as early as possible. The new ACRO website “has been rigorously tested,” the spokesperson said. Whodunit It is not clear who perpetrated the three incidents, including whether separate threat actors were to blame or if they marked several stages in a single attack. ACRO commissioned a forensic investigation that the ICO described as uncovering three distinct incidents titled Group A, Group B and Group C. It is not clear if these groupings refer to threat-actor activity clusters or suspected independent perpetrators. In total, evidence for attacker activity was seen between July 9, 2021, and June 22, 2023, according to the report, although the ICO clarifies the latter date regards when the compromised infrastructure was decommissioned and not when the hackers last accessed the ACRO environment. Group A, described as the most serious of the incidents, saw the attacker maintain persistent access to ACRO’s website and content management system for approximately seven months, between August 2022 and March 2023. During that period, the attacker conducted reconnaissance and in February 2023 staged the sensitive data of just under 11,000 people for exfiltration. The ICO found that ACRO’s failure to retain sufficient logs also meant the office could not actually confirm whether data was exfiltrated. The other incidents were not detailed at length, although one was said to involve an SQL injection that exposed employee credentials. The ICO did not specify when these occurred within the broader two-year window. After initially claiming its website was down for essential maintenance, ACRO had disclosed in April 2023 — following contact by the Evening Standard newspaper — that it had been responding to a cybersecurity incident. The Medusa ransomware group subsequently claimed responsibility, although no stolen data was ever published on the group’s leak site. Whether this indicates that an extortion payment was quietly paid or that the claim itself was fabricated by Medusa for publicity remains unknown. On a precautionary basis, ACRO notified more than 84,000 people in April 2023 who had submitted applications to the database during the at-risk window. More than 40 formal complaints followed, although the ICO said it did not investigate these. Throughout the reprimand document, the ICO blames ACRO as an institution rather than any individual, even by management role or job title, who may have failed to carry out specific responsibilities. The key suppliers are redacted throughout. According to the ICO, network segmentation ultimately prevented the attacker from moving beyond the compromised web environment into the core policing system — something the regulator cited as a mitigating factor in its decision to issue a reprimand, which carries no financial penalty. ACRO has since decommissioned the compromised infrastructure and implemented a new security information and event management system. It did not respond to a request for comment before publication. Editor’s Note: Story updated August 13 with comments from ACRO. Alexander Martin is the UK Editor for Recorded Future News. He was previously a technology reporter for Sky News and a fellow at the European Cyber Conflict Research Initiative, now Virtual Routes. He can be reached securely using Signal on: AlexanderMartin.79

Cybersecurity and intelligence agencies from South Korea and the U.S. warned of Gunra ransomware attacks targeting critical infrastructure sectors and organizations across the world. Targets of these attacks include healthcare and public health, financial services, government services and facilities, and professional and nonprofit services. "Gunra is another variant in the ongoing trend of ransomware attacks causing disruption and harm to U.S. and international organizations," CISA Acting Executive Assistant Director for Cybersecurity, Chris Butera, said. Attacks deploying the ransomware have leveraged security flaws in internet-facing Fortinet FortiOS and FortiProxy (CVE-2024-55591 and CVE-2025-24472) appliances to obtain initial access, and then deploy the Gunra ransomware as part of a double extortion model that combines data exfiltration and data encryption for maximum impact. Victims who refuse to pay up within five to seven days have their data published on a data leak site. According to data published on Ransomware.Live, Gunra has listed a total of 51 victims since emerging in the threat landscape in April 2025, with most of them from South Korea, Brazil, Spain, Thailand, and Hong Kong. What's notable about the threat actor is that the majority of the targets are located in Australia, East Asia, and Europe. Only three victims have been reported from Canada and the U.S. so far. "The group uses phishing as a main attack vector to deliver malicious pieces to their targets and carry out negotiations on a WhatsApp-themed chat Panel," security researcher Rakesh Krishnan said in an analysis published last year. "The group is capable of encrypting huge files (9TB) in a limited timeframe by using advanced stream cipher encryption such as Salsa20 or ChaCha20." The Conti-derived operation is said to have launched a formal RaaS affiliate program on dark web forums in January 2026, providing affiliates with access to a management panel, a configurable ransomware builder, cross-platform locker payloads, and structured affiliate documentation. The group offers both Windows and Linux variants of its locker, although an analysis released by Breakglass Intelligence in March 2026 identified a "catastrophic cryptographic weakness" in the Linux builds that made it possible to recover the encryption key and regain access to the files. Per the U.S. Federal Bureau of Investigation (FBI), Gunra has been observed adopting new branding aliases, such as Golden Community, to expand its operations, while simultaneously taking steps to monetize its platform by recruiting penetration testers and ethical hackers to serve as initial access brokers, who are offered a share of the ransom profits in exchange for enterprise network access. Attack chains are known to leverage Impacket libraries "psexec.py" and "smbclient.py" for lateral movement using the Server Message Block (SMB) protocol. Another Impacket utility, "secretsdump.py," is used to conduct credential dumping against compromised domain controllers and extract password hashes of user accounts from the NT Directory Services (NTDS) file. To cover up traces of malicious activity, the group is known to delete system/network access logs, clear command history, and primarily conduct malicious activities and internal infrastructure reconnaissance between 10 p.m. and 6 a.m. Data exfiltration from Microsoft OneDrive and SharePoint is accomplished by means of an executable named "main.exe." In select cases, the threat actors have been observed creating compressed archives containing terabytes of data and exfiltrating them to the MEGA file-sharing service. Besides collecting business-critical documents, the group is said to have connected to the virtual desktop infrastructure (VDI) environments of IT personnel and harvested sensitive documents containing system and network configuration information. "The Gunra actors then leveraged enterprise server credentials stolen from a system access control server to deploy ransomware to encrypt key assets, including database servers and network-attached storage (NAS) systems," the U.S. Cybersecurity and Infrastructure Security Agency (CISA) said. In one case spotted by South Korea's National Police Agency (KNPA), the attackers have been spotted manipulating the network traffic control functionality of an SSL-VPN appliance to intercept credentials and session information transmitted by users authenticating to a corporate VDI authentication portal. These stolen session cookies were then used to conduct session hijacking and impersonate legitimate users to gain access to the internal network. To bypass multi-factor authentication (MFA), Gunra is said to have tampered with the authentication processing files on the corporate VDI authentication portal server such that it enabled successful authentication when a specific, Gunra-designated one-time password (OTP) value was entered. Some of the other detected behaviors are listed below - Gaining access to an administrator account for an SSL-VPN appliance by exploiting default credentials and then downloading OpenSSH from an attacker-controlled server to set up connections between compromised systems and maintain persistence within the victim environment. Relying on an unused account identified in the SSL-VPN administrative web console that had access to both the internet and internal corporate network, and modifying its configuration to sidestep the mandatory password change requirement and empty it for follow-on activities. Accessing a Hiware system access control server via SSH from a compromised virtual desktop and stealing a symmetric encryption key stored on the server so as to decrypt passwords for enterprise server accounts stored within the database and perform credential dumping of credentials associated with all enterprise servers. Deleting backup and archived data stored on backup infrastructure at both the primary data center and disaster recovery center before and after the ransomware deployment. The disclosure assumes significance in the face of a recent advisory from South Korea about a cyber campaign orchestrated by an unspecified state-sponsored threat group from 2025 through the first half of 2026 by exploiting vulnerabilities in an unidentified financial security software to distribute malware after tricking victims into visiting malicious URLs through spear-phishing and watering hole techniques. Interestingly, some of these incidents have also involved the exploitation of the same financial security software vulnerabilities to deploy Gunra ransomware and exfiltrate sensitive organizational information. Some of the watering hole attacks, per ENKI, have also exploited a zero-day vulnerability in AnySign4PC, causing malware to be installed and executed on systems with the certificate signing software installed when accessing the web page containing the exploit code. Some of the payloads distributed as part of the whole campaign include Struggle (aka SIGNBT 3.0) and Brandoor (aka COPPERHEDGE), both of which are known to be used by the Lazarus Group. "These commonalities suggest that although the state-sponsored threat group and the Gunra ransomware group appear to be separate threat actors with different ultimate objectives, they may have shared certain techniques, tools, and infrastructure or collaborated to a limited extent during the attacks," AhnLab said. While the exact origins of Gunra are unclear, this kind of collaboration between a North Korean nation-state group and a ransomware actor is not unheard of. As far back as October 2024, Palo Alto Networks Unit42 said it observed the Lazarus sub-cluster Andariel partnering with the Play ransomware crew. Andariel itself has a track record of deploying custom ransomware families like SHATTEREDGLASS, Maui, and H0lyGh0st in the past. At least since September 2025, the Lazarus Group and its related intrusion set Moonstone Sleet (aka Storm-1789) have also been attributed to attacks targeting South Korean and Middle East entities with Qilin and Medusa ransomware. To secure against Gunra ransomware, organizations are advised to keep all operating systems, software, and firmware up to date, prioritize patching known exploited vulnerabilities in internet-facing systems, enforce network segmentation, and ensure backups are immutable and stored in a physically separate location. (A previous version of the story incorrectly mentioned CVE-2024-5559 was exploited in Gunra ransomware attacks. The correct CVE is CVE-2024-55591. The error is regretted.)

A financially motivated threat actor previously associated with the Medusa ransomware operation is now deploying a new ransomware strain called StormEncryptor. Microsoft Threat Intelligence is tracking the actor as Storm-1175 and says the recent attacks were likely preceded by exploitation of an authentication-bypass vulnerability (CVE-2026-18577) in the N-central remote monitoring and management (RMM) tool. Storm-1175 is believed to be a China-based threat actor. It was previously linked to Medusa ransomware, targeting systems via zero-day and n-day flaws in various products, including GoAnywhere MFT, SmarterTools SmarterMail, Microsoft Exchange, Invanti Connect Secure, and JetBrains TeamCity. “Storm-1175’s deployment of StormEncryptor marks the threat actor’s first activity observed by Microsoft Threat Intelligence since April 2026, and a shift away from Medusa ransomware, which the threat actor had previously been known to use,” Microsoft states. The researchers found that StormEncryptor is a C++ malware that appends encrypted files with the “.encrypted” filename extension and drops a ransom note named ‘!!!README_FIRST!!!.txt’ into every scanned directory. The ransom note gives victims three days to reach out to the attacker and negotiate a ransom payment. Alternatively, the stolen data would be leaked online. After gaining access to the target network, the attacker used AnyDesk or SimpleHelp for remote management, Advanced IP Scanner for network discovery, and the Mimikatz tool to dump credentials from the Local Security Authority Subsystem Service (LSASS) process. Microsoft says that Storm-1175 moves quickly from initial compromise to stealing data and deploying the locker, urging system administrators managing self-hosted N-central servers to take immediate action to secure the systems. “This threat actor is known to rapidly move from initial access to data exfiltration and ransomware deployment, often within a few days,” warned Microsoft. “Organizations are urged to monitor for Storm-1175 activity and apply security patches as soon as possible.” N-able addressed the CVE-2026-18577 vulnerability via a hotfix (2026.3 HF1/build 2026.3.1.7) released on August 2, urging customers to install the patch immediately. N-able previously recommended admins to check for signs of compromise such as an svchost.exe file in the Documents folders of users' device, a registered service named Cloudflared, and inbound connections from the IP addresses listed in the advisory. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Microsoft has disclosed that Storm-1175, a financially motivated threat actor linked to China, has deployed a previously undocumented ransomware strain called StormEncryptor. The use of StormEncryptor marks a shift from the adversary's previous use of Medusa ransomware, the Microsoft Threat Intelligence Team said. "StormEncryptor is written in C++ and appends the file name extension .encrypted to files it encrypts," Microsoft noted in a series of posts on Bluesky. "It then drops a ransom note named !!!README_FIRST!!!.txt to every scanned directory." Although the exact vulnerability exploited by the threat actor as part of this campaign is unclear, the tech giant said it likely involves the exploitation of CVE-2026-18577, a newly disclosed security flaw in N-able N‑central, to obtain initial access. The vulnerability is assessed to be a patch bypass for CVE-2026-18556, both of which allow authentication bypass and account takeover in susceptible versions. The vulnerabilities have since been flagged by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) as actively exploited in the wild. Storm-1175 is the name assigned to a China-based threat actor with a history of deploying Medusa ransomware after exploiting security flaws in Mirth Connect (CVE-2023-37679, CVE-2023-43208), ConnectWise ScreenConnect (CVE-2024-1709, CVE-2024-1708), JetBrains TeamCity (CVE-2024-27198, CVE-2024-27199), and Fortinet FortiClient EMS (CVE-2023-48788). In an analysis published in October 2025, Microsoft also attributed the threat actor to the exploitation of a critical security vulnerability impacting Fortra GoAnywhere (CVE-2025-10035) to facilitate the deployment of Medusa ransomware. The group, per the Windows maker, weaponizes a combination of zero-days and N-day vulnerabilities to carry out high-velocity attacks and break into susceptible internet-facing systems by taking advantage of the window between vulnerability disclosure and patch adoption. "In this new activity, Storm-1175's post-compromise behavior includes abuse of remote monitoring and management tools AnyDesk or SimpleHelp, Advanced IP Scanner for discovery, and LSASS dumping using Mimikatz," it added. Storm-1175 has also been observed rapidly moving from initial access to data exfiltration and ransomware deployment, mostly within a few days, making it essential that customers apply the patches as soon as possible.

N-able ships second N-central hotfix as attackers keep exploiting CVE-2026-18577 To help customers fend off ongoing attacks, N-able released a second security hotfix for N‑central, its monitoring and management (RMM) solution popular with managed service providers (MSPs). “Hotfix 2 is required, even if you already applied the earlier hotfix. Hotfix 2 supersedes Hotfix 1 with additional hardening measures to further protect you and your customers,” the company said, and shared additional indicators of compromise observed in attacks. A second hotfix to “expand protections” Earlier this month, N‑able released N-central version 2026.3.1.7 (i.e., 2026.3 Hotfix 1), which patches an authentication bypass vulnerability (CVE-2026-18577) the company detected being exploited by attackers. “On July 31, 2026, N‑able’s Adlumin MDR solution detected unusual activity within a customer’s environment, leading to the discovery of a threat actor actively exploiting a zero-day vulnerability in an N‑central server,” the company explained on Thursday. CVE-2026-18577 was assigned to a patch bypass of the previously fixed CVE-2026-18556: a threat actor obviously found a variation that evades the previous patch’s specific checks and has been using it to compromise N-central instances and gain access to managed endpoints. N-able did not say whether the threat actor found a way around the first hotfix, just that they are “proactively expanding protections in response to ongoing monitoring of threat actors as they evolve their attack techniques.” “It is highly recommended that all partners upgrade to [N-central version 2026.3.1.10, i.e., 2026.3 Hotfix 2] ASAP,” the company said, and added that upgrading the agents on the managed devices is recommended (though not necessary) to protect customers from CVE-2026-18577. Organizations using hosted N-central don’t have to update, as the hotfix has been applied already. How the attackers operate post-exploitation N-able says that once the threat actor exploits the vulnerability, they use the legitimate Take Control feature and connect to managed endpoints, where they register a new service for a CloudFlare tunnel for persistence. The company first detected exploitation of CVE-2026-18577 on August 1, 2026, and shared a list of 6 IP addresses associated with the attacks. Sophos says that the threat actor created a new domain account named “veeam” and reset the passwords of several existing domain administrator accounts, enumerated other existing accounts, installed additional remote-access tools, and disabled security software made by Microsoft and Sophos by leveraging an EDR-evasion tool. The company expanded N-able’s initial list of indicators of compromise with four additional IP addresses and domain names of C2 and TacticalRMM servers. Huntress researchers, after detecting exploitation on one of its customers’ N-central environments, shared additional insight into the actions performed by the threat actor. According to them, the threat actor targeted key servers (typically Domain Controllers), enumerated process on a compromised system (before disconnecting), and later moved quickly across multiple hosts in impacted organizations’ environments. “We are now seeing threat actors targeting the flaw across multiple organizations, though we are not yet seeing evidence that this has become a broad, indiscriminate campaign across our partner base,” they noted. Microsoft’s threat analysts believe that the threat actor behind these attacks might be Storm-1175, a financially motivated group known for operating high-velocity ransomware campaigns, usually by exploiting known, recently patched vulnerabilities. They say that the group has switched from deploying the Medusa ransomware to using a new ransomware strain called StormEncryptor. “In this new activity, Storm-1175’s post-compromise behavior includes abuse of remote monitoring and management tools AnyDesk or SimpleHelp, Advanced IP Scanner for discovery, and LSASS dumping using Mimikatz,” they shared. “This threat actor is known to rapidly move from initial access to data exfiltration and ransomware deployment, often within a few days. Organizations are urged to monitor for Storm-1175 activity and apply security patches as soon as possible. UPDATE (August 12, 2026, 02:50 a.m. ET): N-able has cleared up that Hotfix 2 blocks a related attack path (along with delivering hardening measures), and has expanded the list of indicators of compromise to include indicators flagged by several cybersecurity firms. “Applying Hotfix 2 closes the vulnerability that allowed attackers in, but it does not remove a threat actor who may already be present in your environment,” the company warned. “For customers who have waited to patch, it is critical to understand that during that window, attackers have been observed creating new accounts and resetting existing ones to maintain persistence. Upgrading is an essential first step, but it is not the last one. If you applied either hotfix more than a few days after it was released, you should treat your environment as potentially compromised and conduct a thorough review of all user accounts, access privileges, and activity—regardless of what our IOC scanning tool returns.” Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

North Korea’s Lazarus Group sharing tools with ransomware hackers, South Korean agencies warn Cyberattack tools and infrastructure used by North Korea’s Lazarus Group appear to have been shared with ransomware criminals targeting South Korean organizations, according to new research released Thursday alongside a joint advisory by four South Korean security and intelligence agencies. The technical report from cybersecurity firm AhnLab details how the state-sponsored North Korean group, widely tracked as Lazarus, and the Gunra ransomware scheme ran parallel campaigns against South Korean targets from 2025 through the first half of this year, differing only in their final objective. Both groups exploited the same vulnerabilities in Korean financial security software products that are effectively mandatory for anyone using Korean banking or government services. Where the Lazarus hackers have installed espionage backdoors in at least 72 organizations in 2026 alone — including government agencies, cryptocurrency exchanges, and IT service providers — Gunra has instead used its access to encrypt files, steal data and demand an extortion payment. According to AhnLab, both groups also used identical malware filenames and execution arguments, the same privilege escalation tools, the same command-and-control servers, and the same SSH key fingerprint — a cryptographic identifier that functions like a unique digital signature. Both even deleted their malware the same way, renaming files to random four-character strings before wiping them. AhnLab named the campaign “Operation Double Barrel,” but stopped short of definitively attributing both campaigns to the same actor, saying the overlaps could indicate collaboration, shared infrastructure, or access brokering. It classified the cases as having “a high likelihood of technical linkage” requiring continued investigation. As part of their campaign, the attackers compromised 15 legitimate Korean websites across multiple industries and used them for watering-hole attacks, redirecting selected visitors of those compromised sites to specific infrastructure that triggered the software flaws and injected malicious code into legitimate Microsoft processes. The intelligence agencies’ advisory warns both individuals and organizations to take defensive measures against the threat. In particular, the advisory alerts users that they may be infected simply by visiting a legitimate website that has been compromised, especially if they have outdated security software installed. The attackers also ran spearphishing campaigns, with one targeting a Korean defense company with emails disguised as a survey about GaN semiconductors. AhnLab noted that the attackers appeared to have used AI to generate some of their lure pages. The report identified multiple websites used for watering-hole attacks managed by the same Korean website development company. AhnLab assessed that the attackers likely compromised the hosting provider first and then expanded access to client sites through the development company’s management system, rather than hacking each one individually. The findings add to a growing body of evidence that Pyongyang-backed hackers are deepening their entanglement with the ransomware ecosystem. In the past 18 months, different North Korean state-sponsored actors have been linked to the Play, Qilin, and Medusa ransomware operations by researchers at Palo Alto Networks, Microsoft, and Symantec respectively. The increasing adoption of third-party ransomware by North Korean actors came under focus back in 2024, when the U.S. Department of Justice unsealed an indictment against Rim Jong Hyok, an alleged member of the government’s Andariel Unit, for his alleged role in ransomware attacks on U.S. hospitals and healthcare companies. The Gunra connection may represent something different. In those earlier cases, North Korean operators joined established criminal franchises as affiliates. Here, the evidence suggests the relationship may run the other direction — with state hackers supplying tools, exploits, and access to a smaller, newer group. Gunra emerged in April 2025, initially targeting five South Korean companies. The group built its ransomware on leaked Conti v2 source code before transitioning to a ransomware-as-a-service model in January of this year. Prior to the AhnLab report, industry researchers had tentatively linked Gunra to Eastern European operators based on its Conti heritage. As of March 2026, the group had claimed at least 32 victims globally across healthcare, manufacturing, IT, and other sectors. As with many RaaS schemes, it operates a double-extortion model, stealing data before encrypting systems and threatening to publish it on a Tor-based leak site. AhnLab warned that the risk extends beyond the organizations specifically targeted. “The Korean financial security software currently being abused… is used not only in various enterprise environments but also on many personal PCs,” the company said. “Because the vulnerabilities can be triggered simply when a user accesses a specific page, not only explicitly targeted organizations but also general user environments running vulnerable software may be exposed to risk.” Alexander Martin is the UK Editor for Recorded Future News. He was previously a technology reporter for Sky News and a fellow at the European Cyber Conflict Research Initiative, now Virtual Routes. He can be reached securely using Signal on: AlexanderMartin.79

One of the most active ransomware gangs of 2026 has been handing its affiliates a ready-made toolkit for switching off victims' security software before the encryption begins. New analysis from ESET detailed the endpoint detection and response (EDR) killer suite of The Gentlemen, a ransomware-as-a-service operation (RaaS), built around an in-house framework the researchers named GentleKiller. GentleKiller's job is to disable endpoint protection. ESET found it targeting more than 400 processes across roughly 48 security products, from Microsoft Defender and CrowdStrike to Sophos and ESET's own tools, attempting to disable them at the kernel level so the ransomware could run unchecked. Borrowed Drivers, Kernel Power The method is called bring your own vulnerable driver (BYOVD). Each build loads a legitimately signed but flawed kernel driver, then abuses it to kill security processes from inside the kernel, beyond the reach of user-mode protections. ESET counted at least eight GentleKiller variants, each impersonating a different legitimate product, with names lifted from games and security brands such as Valorant, FACEIT and Kaspersky, and each abusing a different driver. To bypass inspection, the binaries carry fake version details, copied but invalid digital signatures and the icons of the vendors they mimic, often wrapped in commercial packers. A Suite, Not a Single Tool What makes Gentlemen unusual is that its operators, not its affiliates, build and maintain the EDR killers. ESET said most ransomware crews leave affiliates to find their own; only a handful, such as RansomHub, supply one. Gentlemen offers a whole portfolio: GentleKiller, the in-house framework, in at least eight variants HexKiller, previously tied to the Warlock gang ThrottleBlood, seen in MedusaLocker and DragonForce intrusions HavocKiller, which abuses a Huawei audio driver The three borrowed tools were each re-skinned with Gentlemen's shared evasion layer. GentleKiller itself moved faster still, with the operators turning newly disclosed driver exploits into working variants within days of release. Inside the Gentlemen Operation Gentlemen surfaced in late 2025, founded by a former Qilin affiliate, and lures affiliates with an unusually large 90% cut. ESET confirmed the operator-run model partly through a May data leak, in which the gang's leader openly discussed maintaining the EDR-killer packages. Unusually, it does not concentrate on US victims, picking targets across Southeast Asia, South America and Western Europe by their exposed FortiGate configurations. ESET said understanding how GentleKiller works helps defenders prepare even for variants not yet built. In practice, defenses against such BYOVD attacks center on blocking known-vulnerable drivers and alerting whenever a protected security process is suddenly shut down.

The Gentlemen ransomware-as-a-service (RaaS) operation is actively developing and maintaining a suite of endpoint detection and response (EDR) killers that it hands out to affiliates for impairing system defenses before deploying the encryptor. This mature portfolio of EDR-terminating tools is centered around a framework that's known as GentleKiller. "They also incorporate third-party or leaked tools such as HexKiller, ThrottleBlood, and HavocKiller," ESET security researcher Jakub Souček said in a report shared with The Hacker News. "These tools are standardized through a shared defense-evasion layer, impersonating predominantly security vendors using fake version information, and copied legitimate certificates and icons." The Slovakian cybersecurity company also called out the ransomware crew for its ability to "unusually quickly operationalize" newly disclosed proof-of-concept (PoC) exploits related to an attack technique called bring your own vulnerable driver (BYOVD), in many cases within days of their public release. Since its emergence in March 2025, The Gentlemen has swiftly risen up the ranks and made a name for itself as one of the most active ransomware groups. Per data from Ransomware.live, the group has claimed 504 victims to date, with most of them located in Southeast Asia, South America, and Western Europe. Recent reports from cybersecurity journalist Brian Krebs and PRODAFT have revealed that a 36-year-old Russian national named Alexander Andreevich Yapaev (aka hastalamuerte) has been leading the operation, after acting as an affiliate for other ransomware schemes, including Qilin. ESET has described The Gentlemen as one of the most technically agile RaaS groups, using a set of techniques to ensure that the compiled EDR killer samples sidestep detection. This includes binary protection using Enigma or Themida and using file names that resemble well-known cybersecurity vendors, right down to their version information, digital signatures, and icons. The most prevalent of them is GentleKiller, which comes in eight different variants, each mimicking a different legitimate product and abusing a different vulnerable or malicious driver as part of the BYOVD attack. GentleKiller specifically looks for 400 processes associated with 48 distinct security programs from a number of vendors. The list of drivers exploited by each of the variants is as follows - Kaspersky ("eb.sys") FACEIT Anti-Cheat ("nseckrnl.sys") Valorant ("GameDriverX64.sys") Javelin ("stpm_old.sys" or "stpm_new.sys") WatchDog ("dmx.sys") Network Blocker ("360netmon_wfp.sys") Cleaner ("IMFForceDelete.sys") G11 ("PoisonX.sys") It's worth noting that the abuse of "PoisonX.sys" has been recorded in recent months in connection with two BYOVD attacks, one of which was used to kill CrowdStrike Falcon EDR. A second campaign, detailed by Huntress, involved an intrusion in which unknown threat actors leveraged BeyondTrust Remote Support to successfully deploy ransomware on the network, but not before terminating security tooling via "PoisonX.sys" and "hrwfpdrv.sys." BYOVD attacks like these typically involve introducing vulnerable legitimate drivers into target systems to gain unauthorized kernel-level access and exploit the weakness to perform malicious actions without detection. Most importantly, it requires an attacker to obtain administrative access to the target system. "Once the driver is running in the kernel, the attacker sends Input/Output Control (IOCTL) commands to it," according to Bitdefender. "They either exploit a bug (like a buffer overflow) to execute shellcode, gain arbitrary memory access (read/write), or use "insecure by design" features to manipulate system memory." Because the drivers are signed with a valid Microsoft certificate and run with elevated privileges, the technique abuses the driver trust model to execute arbitrary code at the kernel level and forcibly terminate the protected processes of antivirus and security solutions. "When abstracting away the impersonation layer and the specific drivers used, the underlying code reveals numerous structural and behavioral commonalities that strongly suggest the use of a shared development template," Souček said. "This design prioritizes ease of deployment and operational flexibility for affiliates, while minimizing development effort for the operators. It allows The Gentlemen operators to integrate abused drivers into their toolset very soon after an EDR killer PoC is disclosed." The third-party, BYOVD-based EDR killers employed by the group are below - HexKiller ("googleApiUtil64.sys"), a tool previously assumed to be exclusive to the Warlock ransomware gang ThrottleBlood ("ThrottleBlood.sys"), a tool observed in attacks mounted by MedusaLocker and DragonForce affiliates HavocKiller or HwAudKiller ("havoc.sys") ESET said it also detected a Rust-based credential stealer codenamed OxideHarvest (aka buildx641) that's capable of harvesting data from popular web browsers, including Google Chrome, Microsoft Edge, Torch, Comodo, Epic Privacy Browser, Vivaldi, Brave, Opera, OperaGX, Mozilla Firefox, Waterfox, BlackHawk, and IceCat. "While most ransomware gangs continue to delegate EDR killing to affiliates, Gentlemen has chosen to centralize this function by offering affiliates a ready-to-use, standardized EDR-killer suite," ESET said. "This decision makes Gentlemen an attractive operator for affiliates as it materially lowers the entry barrier for them, making their job consequently easier." The disclosure comes as the CERT Coordination Center (CERT/CC) issued an advisory about multiple vendor-signed UEFI applications being vulnerable to Secure Boot bypass via a BYOVD attack. ESET researcher Martin Smolár has been credited with researching and reporting the vulnerability. The impacted applications are from Acer, AMD, ASUS, ECS, Getac, GIGABYTE, Toshiba, and Uniwill. "If a target system trusts the affected vendor's certificate, an attacker [with administrative privileges or physical access] can exploit these applications to execute arbitrary code during the early pre-boot phase before the operating system initializes," CERT/CC said. "To mitigate this risk, system administrators should apply updates to the UEFI Forbidden Signature Database (DBX) that revoke trust in the affected vendor-signed binaries, preventing these vulnerable applications from executing during the boot process." (The story was updated after publication to include additional details related to the BYOVD technique and its prerequisites.)

Australian sugar producer works to restore operations as ransomware group claims attack More than a week after a cyberattack disrupted operations at Australia's second-largest sugar producer, the company said it is investigating claims by a ransomware group as it continues to restore its systems. The threat actor known as Gentlemen claimed responsibility for the incident at Mackay Sugar, which disrupted sugar mill operations across one of the country's largest cane-growing regions. Mackay Sugar has not attributed the incident to a specific threat actor or confirmed Gentlemen's involvement. However, in a statement on Wednesday, the company said it was aware of the hackers' claim on the group's dark web leak site and had found evidence that an external party had accessed parts of its IT environment. "We are working urgently to verify these claims, including the nature and extent of any information that may have been accessed," the company said. The cyberattack earlier this month forced two of Mackay Sugar's mills to suspend operations shortly after the annual sugarcane crushing season began, bringing harvesting to a halt across large parts of Queensland's Mackay region. The company's Racecourse and Farleigh mills have remained shut since June 10, while its third facility avoided disruption because it was not operating at the time of the attack. The company said it continues to restore systems and expects some harvesting to resume this week. "We recognize the impact this incident is having on our growers, and we are doing everything we can to support them and to safely resume full operations as soon as possible," Mackay Sugar said. The company, which operates three mills and says it generates more than $420 million in annual revenue, supplies raw sugar to domestic customers and export markets including South Korea, Indonesia, Japan and Malaysia. The ransomware group Gentlemen claimed responsibility for the attack this week, saying it would publish allegedly stolen data if a ransom is not paid. The group did not disclose what information it claims to have obtained or specify its demands, and Mackay Sugar has not revealed whether it has made contact with the group. Australian law requires victims of ransomware attacks to report to the government any extortion payments made to cybercriminals on their behalf. According to cybersecurity firm ESET, Gentlemen emerged in late 2025 and has rapidly become one of the most active ransomware operations this year. The group operates a ransomware-as-a-service model, offering affiliates up to 90% of ransom payments, and employs double-extortion tactics by stealing data in addition to encrypting systems. Researchers say its operators previously worked with ransomware groups including Qilin, Embargo, LockBit, Medusa and BlackLock. While the group's origins remain unknown, security researchers have found evidence suggesting its founder is a Russian speaker. Daryna Antoniuk is a reporter for Recorded Future News based in Ukraine. She writes about cybersecurity startups, cyberattacks in Eastern Europe and the state of the cyberwar between Ukraine and Russia. She previously was a tech reporter for Forbes Ukraine. Her work has also been published at Sifted, The Kyiv Independent and The Kyiv Post.

Threat actors associated with the DragonForce ransomware have been observed using a custom Go-based remote access trojan (RAT) called Backdoor.Turn to conceal command-and-control (C2) traffic inside Microsoft Teams relay infrastructure. According to findings from Broadcom-owned Symantec and Carbon Black, the backdoor was deployed against a major U.S. services firm. The name of the company was not disclosed. "Backdoor.Turn obtains an anonymous Teams visitor token from Microsoft’s Skype-backed identity services, uses a legitimate Microsoft TURN relay to set up the connection, and then runs a QUIC session to the attacker’s real command-and-control (C2) server," the Threat Hunter Team said in a report shared with The Hacker News. "To network defenders, the only traffic they could see was outbound connections to legitimate Microsoft Teams servers. The attackers were on the victim network for between one and two months." The development marks the first publicly documented instance of the threat actors abusing Microsoft's Traversal Using Relays around NAT (TURN) relay infrastructure. It's suspected the threat actor obtained initial access by exploiting a vulnerability in either an SQL or MS-SQL server, although the exact nature of the flaw is unknown. It's also possible that the access was acquired from an initial access broker (IAB). Initial malicious activity on the victim network began in December 2025, with the attackers running a PowerShell command to drop a ZIP archive under the pretext of a tech support hotfix. The ZIP file responsible for launching a DLL side-loading attack, which then runs a rogue DLL to conduct reconnaissance, set up persistence, and silence security software using a Huawei driver ("HWAuidoOs2Ec.sys"). This is achieved by means of an attack technique called bring your own vulnerable driver (BYOVD) technique. The driver has been put to use in a large-scale malvertising campaign targeting U.S.-based individuals searching for tax-related documents, although this is said to have taken place after the ransomware incident. Some of the other drivers used for this purpose are listed below - wsftprm.sys (CVE-2023-52271) GameDriverX64.sys (CVE-2025-61155) K7RKScan.sys (CVE-2025-1055) ABYSSWORKER, a custom-built malicious driver previously observed in Medusa ransomware attacks What's notable about the attack is the execution of Backdoor.Turn by injecting it into the legitimate "DbgView64.exe" process after the DragonForce ransomware has been deployed. This suggests an attempt to maintain continued access to the compromised host for later attacks or reselling it for profit. Backdoor.Turn's underlying TURN-based mechanism leans on a stealthy C2 communication technique called Ghost Calls that was documented by Praetorian in August 2025. The backdoor supports a wide range of capabilities, including command execution, process creation, network scanning, LDAP and Active Directory search, credential-based lateral movement, and browser credential theft. "The backdoor requests a visitor token from the Microsoft Teams/Skype backend, uses that token to interact with Teams-associated infrastructure (TURN relay), and then establishes outbound connectivity," Symantec and Carbon Black explained. "It obtains a Teams visitor (anonymous) authentication token backed by Skype identity services. It then uses a legitimate Microsoft server as the TURN relay server during connection setup. After relay-assisted setup, the malware establishes a direct QUIC session to the C&C server, which is malicious." The findings paint a picture of a hacking group leaning on sophisticated cyber tradecraft to pull off high-impacted targeted attacks, while leaving victims in the dark about covert data exfiltration. This is particularly significant as Hackledorb, the threat actor behind DragonForce, has pivoted from a conventional ransomware-as-a-service (RaaS) model to a highly organized, formalized cartel structure. "The operational timeline reveals a pattern of continuous capability development, with the adoption of highly advanced techniques becoming a hallmark of their post-2025 activity," the company said. "The deployment of Backdoor.Turn, combined with their multi-vector BYOVD evasion, marks them as one of the most capable and persistent ransomware groups operating today."

GentleKiller targets more than 400 security processes across 48 products Most ransomware operations leave the work of disabling endpoint security software to their affiliates. The ransomware-as-a-service gang Gentlemen runs a different model. Its operators develop and maintain a set of tools for shutting down endpoint detection and response (EDR) products, then provide these tools directly to the affiliates who rent the gang’s encryptors. An internal data leak from the group in May 2026 confirmed the arrangement and exposed the gang’s leader discussing the supply of these EDR-killer packages. “While there have been multiple reports covering Gentlemen in recent months, they have not focused on a detailed analysis of the group’s EDR killers. Thanks to ESET’s continued incident-level visibility, we can provide a uniquely deep view into Gentlemen’s EDR-killer development practices. The internal data leak that Gentlemen suffered in May 2026 gave us more insight into the inner workings of the group,” said ESET researcher Jakub Souček. “The leak also allowed us to confirm the hypothesis we formed in February 2026: that Gentlemen operators actively develop and maintain a portfolio of EDR killers that they offer to affiliates, centered around their in-house framework, which we have named GentleKiller.” Gentlemen emerged in late 2025 and grew into one of the five most active ransomware gangs in the first quarter of 2026. The operation offers affiliates a 90% share of ransom payments. Group-IB traced its founding to a former Qilin affiliate. The gang practices double extortion, encrypting victim data and threatening to publish it when victims decline to pay. For encryption, the operators supply a Go-based variant for Windows, Linux, and other platforms, along with a C-based variant for ESXi. Targeting beyond the United States Many top-tier ransomware gangs draw close to half their announced victims from the United States. Gentlemen draws its victims from a wider spread of countries, with concentrations in Southeast Asia, South America, and Western Europe. Its target list reaches countries such as Thailand, Brazil, and France. The leaked data shows the operators sort through candidate organizations centrally and assign them to affiliates. Victim selection rests mainly on the configuration of a target’s FortiGate firewall. An in-house framework with eight variants The core of the suite is GentleKiller, first observed in a staging directory called GentlemenCollection. It is the most common EDR killer in Gentlemen intrusions and appears in at least eight variants, each one impersonating a different legitimate product and abusing a different vulnerable or malicious kernel driver. The variants carry names drawn from games and security products. Across variants, the code shares strings, a process-killing loop that runs on a timer, and the same obfuscation, which points to a reused development template. The general target set spans more than 400 process names linked to 48 security products. Gentlemen adapts newly published Bring Your Own Vulnerable Driver proofs-of-concept quickly. The operators folded two recently disclosed examples, tracked as UnknownKiller and PoisonKiller, into their tooling within days of release. Outside tools and a shared disguise The suite also carries three tools that Gentlemen obtained from outside sources. HexKiller had been tied to the Warlock gang. ThrottleBlood appeared in MedusaLocker and DragonForce intrusions, and Trend Micro connected it to Gentlemen in September 2025. HavocKiller surfaced publicly through Huntress on March 19, 2026, and ESET telemetry places its use in real intrusions back to at least January 23, 2026. Gentlemen acquired these tools through unknown channels and standardized them to match its own toolset. A shared evasion layer ties the portfolio together. The operators apply it to compiled binaries, which lets them protect tools whose source code they lack. Filenames mimic well-known security vendors. The executables carry fabricated version information, invalid digital signatures copied from legitimate software, and icons taken from the impersonated products. Many samples also receive commercial packing through Enigma or Themida, recorded in a filename suffix. What the model means for defenders RansomHub previously built one EDR killer in-house for its affiliates. Gentlemen keeps a varied portfolio that blends original code with adapted public research. The model lowers the entry barrier for affiliates, who gain a ready-to-use way to disable defenses. The shared vendor disguises across these tools complicate attribution when a single sample turns up on its own. Understanding how GentleKiller operates gives defenders a basis for spotting current builds and the variants that Gentlemen adds next. Download: Automating Pentest Delivery Guide

Stuff broke again. Not in a movie way. An old tool was left exposed. An abandoned package was abused. A deprecated feature was still running in prod. This week is the same lesson in a new form: phishing kits are easier to rent, AI names are useful bait, old login paths still fail, and forgotten software keeps becoming someone else's entry point. Scroll through the full Monday Cybersecurity Recap below for the news, tools, webinars, and fixes worth your time this week. ⚡ Threat of the Week Google Patches Actively Exploited Chrome 0-Day - Google released security updates to address 74 vulnerabilities, including one that has come under active exploitation in the wild. The high-severity vulnerability, tracked as CVE-2026-11645 (CVSS score: 8.8), has been described as an out-of-bounds memory access in V8, Chrome's JavaScript and WebAssembly engine. Google acknowledged that an "exploit for CVE-2026-11645 exists in the wild," but stopped short of sharing additional specifics to ensure that a majority of the users are updated with a fix and to prevent further exploitation. Google has addressed a total of five actively exploited Chrome zero-days since the start of the year. This includes CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, and CVE-2026-5281. How Drata Tackles Shadow AI and SaaS Sprawl With a Lean Team Learn how the role of IT has changed in modern orgs, the operational realities of shadow IT and identity sprawl, and how Drata uses Nudge Security to gain visibility and control of AI use, SaaS sprawl, and identity risks. 🎥 June 16th, 2026 at 1pm CT Register Now ➝ 🔔 Top News ShinyHunters Gang Exploits Oracle PeopleSoft Zero-Day - The ShinyHunters (aka UNC6240) extortion crew exploited an unpatched flaw in Oracle PeopleSoft (CVE-2026-35273, CVSS score: 9.8) to break into enterprise networks. The vulnerability relates to a missing authentication for a critical function that could allow an unauthenticated attacker to obtain takeover of PeopleSoft Enterprise PeopleTools. According to Google Mandiant, the exploitation activity was observed between May 27 and June 9, 2026. Following a successful compromise, the attackers have been observed conducting targeted internal reconnaissance using MeshCentral, lateral movement, and data exfiltration. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the flaw to its Known Exploited Vulnerabilities (KEV) catalog, giving Federal Civilian Executive Branch (FCEB) agencies until June 15, 2026, to apply the fixes. The campaign has mainly targeted the higher education sector; 68% of the more than 100 notified organizations were universities and colleges. "The observed exploitation targeted PeopleSoft's Environment Management Hub (PSEMHUB) endpoints, and data stolen during the campaign was published on the ShinyHunters Data Leak Site (DLS) on June 9, 2026," Rapid7 said. 100s of Arch Linux Packages Compromised to Push Rootkit and Stealer - Unknown threat actors have managed to compromise hundreds of legitimate-but-abandoned packages in the Arch User Repository (AUR) and modify them with preinstall scripts that download and execute a malicious npm package called atomic-lockfile. The campaign has been codenamed Atomic Arch by Sonatype. "Analysis of atomic-lockfile, the malicious dependency, found a bundled Linux payload with functionality tied to credential harvesting, stealth, anti-debugging, and potential data exfiltration," the company said. Although the initial number of affected packages was 400, it has since risen to over 1,500. As of June 12, 2026, Arch Linux developers have deleted all the malicious commits they are aware of. Outside PhaaS Enterprise Taken Down - The U.S. Federal Bureau of Investigation said it took down a number of domains linked to Outsider, a Chinese phishing-as-a-service (PhaaS) software kit behind an estimated 3,870,000 stolen credit cards and a corresponding estimated $1.9 billion in losses since July 2023. In tandem, Google said it pursuing legal action against the operators, who weaponized Gemini to "help generate fraudulent phishing pages and deploy massive SMS phishing ('smishing') attacks, often through text messages impersonating legitimate brands, alerting recipients of 'brokerage account issues' or insisting they are eligible for 'rewards through their mobile phone carrier." According to a complaint filed by Google, the group "built, maintains, and uses a turn-key, online software suite that enables criminals, regardless of technical skill, to publish fraudulent websites designed to rob victims and enrich themselves." The toolkit costs $88 per week or $200 per month, offering access to more than 290 pre-built templates that mimic legitimate websites. The goal is to steal passwords and corresponding multi-factor authentication codes, as well as financial information in real-time. "Part of the Outsider software's appeal is the ease with which someone with limited technical expertise -like many members of the Enterprise - can purchase the software, execute various phishing attacks, and, upon purchase, meet other members of the Enterprise who are proficient in other areas," the tech giant added. Critical Check Point VPN Flaw Exploited in Limited Attacks - Check Point warned of active exploitation of a critical vulnerability CVE-2026-50751 (CVSS score: 9.3) impacting Remote Access VPN and Mobile Access deployments that are configured to use the deprecated IKEv1 key exchange protocol. The security flaw is a case of a logic flow weakness in certificate validation that allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password. The Israeli cybersecurity company said it first observed indications of suspicious activity on June 4, 2026, with the earliest observed exploitation dating back to May 7, 2026. Exploitation efforts are said to have ramped up starting this month. The exploitation activity, Check Point added, has been limited to a "few dozen targeted organizations globally." In one case, the post-exploitation phase has been associated with a Qilin ransomware affiliate. The Gentlemen Ransomware Claims 478 Victims - A new analysis of The Gentlemen operation revealed that the financially motivated threat group initially operated as an affiliate responsible for conducting double extortion attacks, while leveraging resources from various ransomware-as-a-service (RaaS) schemes like LockBit (aka Tenacious Mantis), Qilin (aka Pestilent Mantis), and Medusa (aka Venomous Mantis). The group, which it tracks as Phantom Mantis, is led by a Russian-speaking cybercriminal it calls LARVA-368, who goes by the online aliases hastalamuerte, ArmCorp, zeta88, nobody0, and santamuerte. The Gentlemen is known to be active since March 2025, claiming a total of 478 victims to date. Microsoft, which is tracking the cluster under the moniker Storm-2697, said the operation "initially started as a closed ransomware group then began offering its RaaS to affiliates in September 2025." 🔥 Trending CVEs Bugs drop weekly, and the gap between a patch and an exploit is shrinking fast. These are the heavy hitters for the week: high-severity, widely used, or already being poked at in the wild. Check the list, patch what you have, and hit the ones marked urgent first - CVE-2026-11645 (Google Chrome), CVE-2026-50751 (Check Point Remote Access VPN and Mobile Access), CVE-2026-35273 (Oracle PeopleSoft), CVE-2026-5027 (Langflow), CVE-2026-44963 (Veeam Backup & Replication), CVE-2026-23111 (Linux kernel), CVE-2026-45447 (OpenSSL), CVE-2026-44748, CVE-2026-27671 (SAP NetWeaver AS ABAP and ABAP Platform), CVE-2026-22732 (SAP Commerce Cloud and SAP Data Hub), CVE-2026-40128 (SAP NetWeaver Application Server Java Web Container), CVE-2026-10520 (Ivanti Sentry), CVE-2026-28252, CVE-2026-28253, CVE-2026-28254, CVE-2026-28255, CVE-2026-28256 (Trane Tracer SC+ HVAC controller), CVE-2025-46412, CVE-2025-41426 (Vertiv Liebert IS-UNITY-DP network cards), CVE-2026-0274 (Palo Alto Networks Cortex XSOAR and Cortex XSIAM), CVE-2026-20253 (Splunk Enterprise), CVE-2026-9648 (Haskell TLS software stack), from CVE-2026-12007 through CVE-2026-12011 (Google Chrome), CVE-2026-45034 (PhpSpreadsheet), PTT-2026-004, PTT-2026-005, an authentication bypass vulnerability (phpBB), and a maximum-severity code injection vulnerability in Wazuh (no CVE). 🎥 Expert Webinars Find Out What Your Automated Pentest Is Missing Before Attackers Do → Automated pentesting is useful. It is also easy to overread. A tool that proves an exploit path worked does not prove your SIEM saw it, your EDR reacted, or your team could respond before damage spread. This webinar cuts through that gap: what automated pentesting actually validates, why repeat runs start returning fewer useful findings, and how BAS helps show which controls failed, not just which vulnerabilities exist. Stop AI-Speed Attacks Before Your Legacy Controls Catch Up → AI has changed the pace of cyberattacks. Lures get sharper, campaigns adapt faster, and attackers can test what works before defenders finish investigating. This webinar breaks down how AI-powered threats like Mythos get in, move, and scale, then shows how to fight back with tighter access, reduced attack surface, blocked lateral movement, and in-line controls that stop risky behavior before it becomes an incident. Stop Employees From Leaking Source Code, Contracts, and PII Into AI Tools → Employees are already pasting company data into AI tools. Source code, contracts, customer records, and internal notes can leave the business through one prompt. This webinar shows how to move from after-the-fact detection to real-time prevention, with browser-level controls that stop risky AI use at the point where data is about to leak. 📰 Around the Cyber World Campaigns Use AI Brands as Lures - Microsoft warned of campaigns capitalizing on the global interest around artificial intelligence (AI) as a social engineering lure in campaigns. "These campaigns, which don't represent compromise of services, span phishing, malvertising, and search engine optimization (SEO)-driven attacks that ultimately lead to credential theft, financial fraud, or malware infection," the company said. Some of the campaigns include a ChatGPT-themed lure that leads to a phishing kit collecting credit card data, a Claude-themed phishing campaign collecting credentials and access tokens, an "Awesome AI Windows Plugin" malvertising campaign deploying Vidar Stealer, and Fake DeepSeek V4 installers on GitHub delivering Vidar Stealer. The tech giant said it "observed the initial access broker Storm-3075 employing AI-themed malvertising to deliver payloads, including malware signed by the malware-signing-as-a-service (MSaaS) offering attributed to the financially motivated threat actor Fox Tempest, on behalf of multiple downstream actors." macOS Users Targeted by Fake Installers - Deceptive installers for popular software are being used to push information stealers to macOS users. "The infection chain almost always starts inside a web browser," Huntress said. "Threat actors lean heavily on search engine optimization (SEO) poisoning to hijack search results, or they seed compromised links across torrent networks and cracked software forums. A user drops their guard, clicks the malicious link, and downloads what they assume is an authentic installer." The DMG files, once executed, aim to bypass Apple Gatekeeper protections to realize their goals. In 2024, more than 65% of newly reported macOS malware was classified as infostealers. History of Chinese-Language Guarantee Marketplaces - Flare has shed light on the "guarantee model" that powers various illicit online Telegram marketplaces like HuiOne Guarantee and Tudou Guarantee. "These marketplaces are third-party escrow services for illicit transactions," security researcher Chris d'Eon explained. "The marketplace operator stands between buyer and seller, holds the buyer's funds in escrow, releases them to the seller only when the buyer confirms delivery, and adjudicates disputes when something goes wrong. In return, the operator collects deposits from vendors who want to advertise under its brand, fees on transactions, and revenue from paid promotional slots." The model, which has its roots in legitimate Chinese consumer-internet trust architecture launched by Alipay in 2003, facilitates the sale of money laundering services, stolen data, fraud kits, fake identity documents, recruitment for scam compounds, retail fraud, deepfake services, and the physical infrastructure that drives human trafficking and forced-labour compounds. Law enforcement crackdown has led to "fragmentation but not elimination" of the criminal enterprise. More than 30 successor marketplaces have emerged following the takedown of HuiOne and Xinbi, almost all of them managing their operations via Telegram owing to its reach, bot infrastructure, and improved resilience despite the platform's efforts to crack down on such activities. These include Tiancheng, Dabai, Ouyi, Yinuo, Jin Bo, Haihua, Timi, and Lao Niu. UniFi OS Flaws Exploited - The UniFi OS Server remote code execution chain, comprising CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910, is now being actively exploited, according to Defused Cyber, following a report from Bishop Fox about how the three flaws could be combined to achieve unauthenticated code execution as root. The attacks culminated in the deployment of commodity malware. Khmer Shadow Targets Cambodian Government Entities - A targeted cyber espionage campaign against Cambodian government entities has leveraged a meeting-themed SFX archive to sideload a custom C++ loader dubbed NIGHTFORGE, which then decrypts and executes a Havoc Demon payload in memory. "NIGHTFORGE has demonstrated a moderate level of sophistication, combining advanced defense-evasion techniques such as NTDLL unhooking and Hell's Gate syscall resolution, a method that enables direct system calls and helps evade user-mode monitoring, with operational shortcomings that suggest the tool is still under active development," Acronis said. The activity has been attributed to any known threat group, but it's "likely aligned with regional intelligence collection interests in Southeast Asia." How Attackers Could Exploit Cloud Logging Services - Palo Alto Networks Unit 42 has warned that threat actors could exploit cloud logging services, which are crucial for security monitoring, to "create weak spots, evade detection, and in certain scenarios, establish continuous visibility within a target's environment." Attackers could tamper with resources within the cloud logging service (e.g., disabling, altering, or deleting logs, or even impairing logging) to hide their presence or attempt to route logs to their own accounts, establishing continuous visibility over the victim's environment, performing continuous discovery, and passively monitoring all activity. Operation TaxShadow Delivers Multi-Stage Malware Framework - An Indian tax-themed phishing campaign has been observed delivering a sophisticated multi-stage malware framework through a mix of social engineering, phishing infrastructure, and memory-resident malware execution techniques. "The campaign begins with a fraudulent tax notification email impersonating an official Indian tax authority, leveraging government branding, urgency-based messaging, and compliance-related threats to manipulate victims into interacting with a malicious phishing website," CYFIRMA said. "Victims are subsequently instructed to download a malicious ZIP archive containing three staged payload components: कर विवरण.exe, SbieDll.dll, and SbieDll.bin, which collectively establish the complete infection lifecycle." The attack makes use of a highly modular malware architecture, coupled with advanced defense-evasion and anti-analysis techniques, to launch a payload in memory. The malware also establishes persistent WebSocket-based communications. MagicAd Displays Background Ads on Android Devices - A new Android trojan called MagicAd has been found to bypass operating system restrictions to display background ads. "One of these methods is universal, while the others are designed for devices from specific manufacturers," Russian cybersecurity company Doctor Web said. "These include exploiting third-party software and using the system media player." The malware is distributed via apps on GetApps, the official app catalog for Xiaomi devices. It has been discovered in more than 50 games and apps. The campaign is assessed to have commenced in 2025, with the threat actors behind it also leveraging the Samsung Galaxy Store as a distribution mechanism. Currently, none of the apps are available for download. Residential Proxies in the Wild - Residential proxies are designed to relay internet traffic through devices that belong to regular consumers, such as home routers, mobile devices, IoT devices, and devices with applications embedded with proxyware. One way this is achieved is that application developers themselves can embed software development kits (SDKs) provided by the residential proxy networks into their products as a way to monetize their software, allowing them to receive a small amount of money on each installation. In an analysis published last week, Infoblox said monthly queries to residential proxy domains steadily grew from nearly 400 billion to over 500 billion between January 2025 and April 2026 across its customer base, an increase of about 25%. "There are likely several explanations for this: certainly, the rise in AI-related training, which often requires scraping websites, is a major driver of residential proxy demand," it said. "Residential proxies bypass many anti-scraping measures, as the traffic appears to be coming from the devices of real people." Some of the most commonly observed proxy services queried include Bright Data, Hola VPN, Oxylabs Proxy, Honeygain, and Grass. The DNS threat intelligence firm said many residential proxy services operate in a grey space. SHEET#CREEP Drops C# Remote Access Trojan - An ongoing cyber espionage campaign dubbed SHEET#CREEP has leveraged a diplomatic-themed ISO phishing lure to distribute a C# remote access trojan (RAT). The activity was previously flagged by Zscaler and Bitdefender, attributing it to a threat actor known as Transparent Tribe. "The RAT abuses the Google Sheets API as its command-and-control (C2) channel, authenticating via an embedded GCP service account private key and using individual spreadsheet tabs per victim for bidirectional communication," Securonix researchers Shikha Sangwan, Akshay Gaikwad, and Aaron Beardslee said. "The LNK triggers a C# dropper that extracts a bait PDF, drops the RAT payload into the Windows Vault directory, and establishes persistence through a scheduled task, before melting (self-deleting) to remove forensic traces." The cybersecurity company said it identified 91 active victim tabs in the C2 spreadsheet, including a high-confidence target located in Pakistan. Malware Distributed via npm and PyPI Packages - A cryptocurrency-focused software supply chain campaign has used malicious npm packages to facilitate credential harvesting, wallet theft, remote payload delivery, and blockchain-based command-and-control. "Technical analysis uncovered capabilities including cryptocurrency wallet interception, private key and mnemonic phrase theft, SSH credential harvesting, environment variable collection, sensitive file discovery, remote activation mechanisms, blockchain-based infrastructure retrieval, and multi-stage malware deployment," CYFIRMA said. A second campaign, codenamed Solana FakeFix, has targeted Solana developers with 20 bogus npm and PyPI packages to steal wallet keys, cloud credentials, source-control tokens, SSH keys, and environment secrets, while a third campaign, CMS Windows Loader, has used five npm packages to load remote executables and JavaScript code dynamically. In a related development, two versions of the dbmux npm package (2.2.5 and 1.0.5) were flagged for containing malware. "Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer," according to a GitHub advisory. "The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it." Ransomware Attack Uses Easyupload.io for Data Exfiltration - In one ransomware attack investigated by Huntress, a threat actor accessed the victim's hypervisor and created a new virtual machine (VM) as a staging location from which they launched the Akira ransomware. The threat actor rapidly progressed through the attack, disabling Microsoft Defender and installing WinRAR, an archival tool typically used by threat actors for staging data. "The threat actor used the Microsoft Edge browser to access Bing, and search for the term 'eayupload' before settling on Easyupload.io, a website that provides access to file uploads via drag-and-drop," the cybersecurity company said. "Shortly after accessing the LimeWire website, presumably to exfiltrate staged archives, the threat actor launched the akira.exe file encryptor against several mounted shares." 🔧 Cybersecurity Tools SpooNMAP → It is a Python tool that wraps Nmap and Masscan to make port scanning easier and faster. It guides users through scan options, supports small, medium, large, full, and custom scans, can grab service banners with Nmap, and lets users scan target IPs or CIDR ranges from a file. CVE MCP Server → It connects Claude to 27 security intelligence tools across 21 data sources, helping analysts look up CVEs, check EPSS and CISA KEV status, find PoCs, scan dependencies, review IP reputation, and generate risk reports from one place. Disclaimer: This is strictly for research and learning. It hasn't been through a formal security audit, so don't just blindly drop it into production. Read the code, break it in a sandbox first, and make sure whatever you're doing stays on the right side of the law. Conclusion This week's lesson is simple: attackers do not need magic. They need old code, busy teams, weak defaults, and one forgotten box nobody wants to claim. That is the uncomfortable part. The next big incident may already be sitting in your stack, quietly working as designed.

Threat actors are actively exploiting a critical security flaw in Everest Forms Pro, a WordPress plugin with about 4,000 active installations, to execute arbitrary code, leading to a complete site compromise. The vulnerability in question is CVE-2026-3300 (CVSS score: 9.8), a remote code execution bug impacting all versions of the plugin up to, and including, 1.9.12. A patch for the flaw was released on March 18, 2026, with version 1.9.13. "This is due to the Calculation Addon's process_filter() function concatenating user-submitted form field values into a PHP code string without proper escaping before passing it to eval()," Wordfence said. "The sanitize_text_field() function applied to input does not escape single quotes or other PHP code context characters. This makes it possible for unauthenticated attackers to inject and execute arbitrary PHP code on the server by submitting a crafted value in any string-type form field (text, email, URL, select, radio) when a form uses the 'Complex Calculation' feature." Successful exploitation of the vulnerability could allow unauthenticated bad actors to execute arbitrary PHP code on the server, permitting them to create rogue administrator accounts, deploy web shells, and open other ways to burrow deeper into the server and establish persistent footholds. According to the WordPress security company, attackers have been observed exploiting the flaw starting April 13, 2026. More than 29,300 exploit attempts targeting the defect have been blocked to date. Of these, 16 attack attempts occurred in the last 24 hours. The most common payload involves attempts to create an administrator account named "diksimarina" (email address: [email protected]) on the compromised site. These attack efforts have originated from the following IP addresses - 202.56.2.126 209.146.60.26 15.235.166.18 2402:1f00:8000:800::40db 185.78.165.153 Skimmer Attacks Exploit Stripe for C2 The disclosure comes as Sansec warned of multiple skimmer campaigns, including one that uses Stripe as a command-and-control (C2) server and a data exfiltration sink in a bid to exploit the reputation of the brand and slip past Content Security Policy rules and network filters. "The attacker treats Stripe as free infrastructure, not a way to launder charges," Sansec noted. "Stripe gives them a writable database for stolen cards and a code-hosting endpoint for the skimmer, both behind a domain that CSP rules and network filters trust by default." The campaign relies on Google Tag Manager (GTM) and Stripe domains - googletagmanager.com and api.stripe.com - which are both trusted implicitly by online stores, with the malicious code loaded from a GTM container and executed on every page that loads it. On Magento and Adobe Commerce checkout pages, it extracts an obfuscated skimmer from a Stripe customer account's ("cus_TfFjAAZQNOYENR," in this case) metadata field, and saves the financial information, billing and email addresses, and phone numbers entered by unsuspecting users to localStorage. The captured data is then exfiltrated back to the attacker's Stripe account. "Every stolen card becomes a 'customer' in the attacker's account," the e-commerce security company said. "On success, the loader deletes the localStorage entry, so the same record is not sent twice. The attacker lists their stolen cards later by calling the same API with the same key. Stripe's customer database becomes a free, durable exfiltration sink." The Stripe customer record containing the skimmer is said to have been created on December 24, 2025, indicating that the operation may have been active since then. Sansec said it also identified a second variant of the loader that uses Google Firestore instead of Stripe, although the end goal is the same: abuse a trusted service as a covert channel that's unlikely to be blocked by e-commerce stores. The findings coincide with a large-scale operation dubbed GorgonAgora that has used a cluster of 5,714 fake .shop storefronts impersonating brands like Starbucks, Ford, Sony, Mattel, Hasbro, Lego, Disney, and Toyota, whose checkout pages funnel stolen card data to a single skimmer server in Moldova. The campaign has been ongoing since August 2025. "Every store runs the same Medusa.js commerce stack and loads the same custom checkout SDK, which renders a fake Stripe iframe and exfiltrates card data over an encrypted WebSocket to a single server in Moldova," the Dutch company said. "Exfiltration runs over WebSocket with an AES-256-GCM payload, and the C2 maintains a live 3D Secure relay: when the victim bank returns a 3DS challenge, the operator proxies it back to the shopper through the fake iframe so the transaction completes and the theft stays invisible."

Il costo economico del ransomware potrebbe rivelarsi sbalorditivo. VDC Research e Kaspersky hanno condotto una stima da cui emerge che, solo nel settore manifatturiero, le potenziali perdite derivanti da attacchi ransomware (qualora avessero avuto successo) avrebbero potuto superare i 18 miliardi di dollari nei primi tre trimestri del 2025. A livello regionale, l’Asia-Pacifico risulta l’area più colpita, con 11,5 miliardi di dollari di potenziali perdite, a dimostrazione di come la rapida digitalizzazione delle economie emergenti stia ampliando in modo significativo la superficie di attacco. Indice degli argomenti Nel 2025 il ransomware ha dimostrato resilienza, capacità di evoluzione e grande adattabilità. I modelli di Ransomware-as-a-Service (RaaS) hanno dominato il panorama delle minacce, abbassando le barriere di ingresso per i cybercriminali alle prime armi. Questi modelli offrono malware pronti all’uso, programmi di affiliazione e persino servizi di intermediazione per l’accesso iniziale, con una ripartizione dei riscatti pari al 90/10 a favore degli operatori. Piattaforme come RansomHub (ora dismessa) sono state rapidamente rimpiazzate da altri gruppi, tra cui Qilin, Akira, CI0p e Sinobi. Anche le tattiche hanno registrato un’evoluzione allarmante, in particolare quelle che sfruttano driver vulnerabili firmati, facendo ricorso alla tecnica Bring-Your-Own-Vulnerable-Driver (BYOVD), come osservato negli attacchi MedusaLocker. La doppia e tripla estorsione – che combina la crittografia dei dati con la loro sottrazione e la minaccia di divulgazione a clienti, autorità di regolamentazione o concorrenti – è ormai diventata la norma. Guardando al 2026, il ransomware non solo continuerà a esistere, ma è pronto a compiere un vero e proprio salto di qualità, potenziato dalla rapida integrazione dell’intelligenza artificiale nel crimine informatico. I sistemi di Agentic AI, capaci di ragionare in modo autonomo e di adattarsi in tempo reale, potrebbero automatizzare l’intera supply chain degli attacchi, dalla ricognizione iniziale fino alle richieste finali di estorsione, operando a velocità di gran lunga superiori a quelle degli operatori umani. Le piattaforme Ransomware-as-a-Service basate sull’IA potrebbero, inoltre, consentire anche agli hacker meno esperti di distribuire malware polimorfici in grado di mutare dinamicamente o di diffondere video deepfake per ricattare dirigenti aziendali. Il numero delle vittime potrebbe crescere in modo esponenziale, poiché gli aggressori intensificano operazioni su larga scala contro fornitori terzi. Le tattiche di estorsione potrebbero evolvere verso forme ancora più subdole, come la manipolazione dei dati e il sabotaggio della reputazione, minando la fiducia nei brand nel giro di pochissimo tempo. Per mantenere un vantaggio competitivo in termini di sicurezza, le organizzazioni dovrebbero investire nell’intelligence sulle minacce e nel rilevamento proattivo, oltre a implementare backup immutabili e isolati. È fondamentale condurre audit approfonditi della catena di approvvigionamento e adottare sistemi avanzati di autenticazione multifattoriale. Allo stesso modo, risulta essenziale implementare programmi di formazione mirata per contrastare schemi di phishing potenziati dall’intelligenza artificiale. La furia del ransomware nel 2025, caratterizzata da un uso crescente dell’IA, attacchi sempre più mirati e costi in forte aumento, rappresenta un chiaro monito per il mondo degli affari. Nel 2026, le minacce autonome potrebbero sopraffare le organizzazioni impreparate. Tuttavia, adottando modelli di protezione resilienti, le aziende non solo potranno sopravvivere, ma anche prosperare. La scelta è evidente: evolversi più rapidamente degli aggressori o rischiare di diventare la loro prossima vittima. Per contrastare efficacemente il ransomware, è innanzitutto necessario abilitare una protezione dedicata su tutti gli endpoint. Per le aziende non industriali, è consigliabile implementare soluzioni anti-APT ed EDR, in grado di migliorare l’individuazione, il rilevamento e l’analisi delle minacce, nonché la gestione rapida degli incidenti. È inoltre fondamentale fornire ai team SOC informazioni aggiornate sulle minacce e garantire una formazione professionale continua, risorse oggi accessibili tramite piattaforme complete come Kaspersky Next, utili a costruire una strategia di difesa realmente resiliente. Per le organizzazioni operanti nel settore industriale, si raccomanda invece l’adozione di un ecosistema specializzato come Kaspersky Industrial CyberSecurity (KICS), che combina tecnologie di livello OT, competenze specialistiche e una piattaforma nativa di Extended Detection and Response (XDR) progettata su misura per le infrastrutture critiche. Questa soluzione offre funzionalità avanzate di analisi del traffico di rete, protezione degli endpoint e capacità di risposta agli incidenti, integrando la sicurezza IT tradizionale con misure specifiche per l’ambiente industriale, al fine di contrastare minacce sempre più sofisticate.

OrBit (Re)turns: Tracking an open-source Linux rootkit across four years of forks and deployments May 14, 2026 Written by Nicole Fishbein In July 2022, we published the first analysis of OrBit, a then-undocumented Linux userland-rootkit that stood out for its comprehensive libc hooking, SSH backdoor access, and PAM-based credential harvesting. At the time, OrBit appeared as a single sample with a single operator fingerprint, and the codebase itself looked customized. It wasn't. As we will show below, OrBit is a repackaged and selectively weaponized build of Medusa, an open-source LD_PRELOAD rootkit published on GitHub in December 2022. The story of OrBit's four-year evolution is not one of novel development; it's the story of how a publicly available rootkit was forked, configured, and redeployed. Nearly four years later, OrBit is still in the wild, and it has not stood still. Hunting across VirusTotal, we pulled more than a dozen samples spanning 2022 through 2026 and walked each one through static and differential analysis. We discovered two parallel lineages: a full-featured "Lineage A" build that tracks closely with the 2022 original, and a lite "Lineage B" fork that drops entire capability domains (PAM, pcap, TCP-port hiding) in exchange for a smaller footprint. Along the way, the operators rotate XOR keys, shuffle install paths, swap backdoor credentials, add auditd-evasion hooks, and eventually bolt on a service-side PAM impersonation primitive. This blog picks up where the 2022 analysis left off. We focus on what changed, when, and why it matters for defenders. For each epoch, we enumerate the samples, call out the lineage, and break down the meaningful changes: credential changes, hook-set diffs, new evasion behavior, and operator tradecraft. Background: What is OrBit? For readers unfamiliar with the original analysis, OrBit is a Linux userland-rootkit deployed as a shared library (.so) that achieves persistence by patching the dynamic linker, specifically modifying ld.so to ensure the malicious library is loaded into every process on the system. It operates as a passive implant with no command-and-control communication; instead, the attacker connects in through an SSH backdoor. Once installed, OrBit hooks into PAM functions to harvest credentials from SSH and sudo authentication attempts, storing the captured passwords locally. Its evasion capabilities are comprehensive, hooking over forty libc functions to hide files, processes, and network connections from administrators and security tools alike. The malware stores its harvested credentials and configuration data in /lib/libntpVnQE6mk/, a directory that remains invisible to standard enumeration thanks to the rootkit's own hooks. July 2022 We will refer to this variant as Lineage A "Full" build of OrBit. OrBit variants through the years In our research, we collected samples from VirusTotal. Unlike PE files, ELF files don’t include a compilation timestamp, so we started by aggregating the samples by the date they were submitted to VirusTotal. To track the samples on the blog, we use the first 8 characters of each sample's SHA-256. At the bottom of the blog, you can find the full list of IOCs. December 2022 The first version shows a slight change: the username and password for the SSH connection, and the exported functions. Credential mechanism shift: 40b5127c resolved the backdoor username dynamically via the getpwuid hook; ec7462c3 dropped that hook entirely and hardcodes adm1n directly in the XOR-encrypted string table. The working folder was changed to libseconf. For the most part, the later variants will use this path. All other capabilities are identical: file I/O interception, stat hiding, PAM credential capture, TCP port hiding (alloc_tcp_ports/remove_port/tcp_port_hidden), load monitoring (.showload/.maxload), pcap sniffing, LD_PRELOAD management, log suppression, and process hiding. The transition from 2022 to 2023 is essentially a redeployment with new credentials and a more convincing install path, plus a minor simplification (dropping dynamic UID lookup in favor of a hardcoded username). The rootkit's hook surface stayed stable. Samples From 2023 The d419a9b1 sample stands out for the operator's choice of the install path (/lib/fuckwhitehatshome/) and the SSH username and password. No other known samples use these strings, suggesting a different operator or persona authored this particular build rather than it simply being a different deployment of the same toolkit. Functionally, it carries the full 2022-era hook set, with 65 exports. The 296d28eb sample is a full-featured build that uses the libseconf path and the same SSH credentials as ec7462c3. But this sample also has an evolutionary step: dropped TCP port hiding, added the exported xread function. This is not an LD_PRELOAD hook on a system library; it's a wrapper that calls syscall(SYS_read) directly, bypassing the rootkit's own hooked read(). The rootkit hooks the libc read() function; the hook filters out rootkit artifacts from files such as/proc/net/tcp and directory listings. Some C programs, such as Git, define their own internal xread() helper that wraps read() to handle partial reads and EINTR. Normally, these internal helpers call libc read(), which the rootkit intercepts and filters. By exporting its own xread, which directly calls syscall (SYS_read), the rootkit shadows these program-internal helpers with a version that bypasses its own read hook entirely. This is a compatibility fix: without it, any program that defines xread would receive the rootkit's filtered output through its core I/O path, potentially corrupting SSH protocol streams, breaking git operations, or causing other malfunctions that could expose the rootkit's presence. The hook ensures that programs continue to function normally while the rootkit's read interception remains active for standard libc callers. Both files, 3ba6c174 and 4203271c, represent the first appearance of Lineage B, a deliberately lite fork of the OrBit rootkit. Both are dynamically linked shared objects using the standard 0xA2 XOR key and installed in /lib/libseconf/, but they export only 54 functions, compared to the 67 in their closest Lineage A contemporaries (d419a9b1, ec7462c3). The 13 removed exports strip out three entire capability domains: network port-hiding (alloc_tcp_ports, remove_port, tcp_port_hidden, clean_ports), PAM credential interception (pam_authenticate, pam_acct_mgmt, pam_open_session, pam_get_password), and packet capture (pcap_loop, pcap_packet_callback). The string table reflects this (.logpam and .udp are absent), though .ports, .hosts, and sshpass2.txt are retained. This reduced feature set suggests they were purpose-built for different target environments where a smaller footprint or more limited functionality was either sufficient or preferred. The most notable change is the complete absence of a backdoor password. Every Lineage A sample embeds a password in its XOR-encrypted string block, but in both 3ba6c174 and 4203271c, the password field is missing. Each sample carries a distinct username (adm1n and b4ph0m3t0, respectively), and these are the only byte-level differences between the two binaries. This pattern of 54 exports, no password, no PAM/pcap hooks, held consistent across all subsequent Lineage B samples through 2024. Samples From 2024 2024 is the most diverse epoch in OrBit's timeline, with both lineages active simultaneously and an encryption key change in the Lineage A branch. eea274ed / a6138638: Lineage A, 0xAA key rotation These two samples belong to the same lineage: identical XOR key (0xAA is a break from the long-standing 0xA2), identical credentials (Y0u4reCu6e / 1qaz@WSX3edc123), and identical hook count (54). The only structural difference is the install path: /lib64/libseconf/ versus /lib/locate/. This is probably a deliberate path rotation to evade detections anchored on the previously documented /lib/libseconf/ directory. Credentials are stored inline in the XOR-encrypted block rather than written to sshpass.txt, representing a shift in the credential storage model. Both samples also have a reduced hook for the' execve' function: the execve hook handles persistence maintenance (apt/yum), output sanitization (dmesg), and ldd defeat. Compared to other samples in the lineage, it is a reduced feature set: no strace interception, no IP/iptables hooks, no command logging. Despite sharing the same hook count, the two samples do not share the same hook set. a6138638 swaps read/write for readdir_r/readdir64_r, indicating a targeted adjustment to the directory-hiding mechanism. A string-level diff reveals more changes: Credential harvesting is saved in remote.txt. This variant captures only SSH logins, not sudo sessions ([sudo] pass is missing). The result is 52 decoded XOR strings in eea274ed versus 47 in a6138638. Both samples retain .udp, .pts, and the credential pair, preserving the core backdoor functionality. The removals target logging and forensic-capture features, suggesting a6138638 was tailored for a deployment where a lighter footprint was preferred. a34299a1 / b1dd18a6 / 989f7eb4: Lineage B continuation These samples continue the 54-export lite build lineage that first appeared in 2023 with 3ba6c174/4203271c. The hook set is identical (49 hooks), the XOR key remains 0xA2, and the same capability domains are absent: no PAM credential interception, no pcap sniffing, no TCP port hiding. The password field is still missing from the binary. Each sample carries a distinct username (rebel, Gestuff, adm1n, respectively), consistent with the Lineage B pattern of per-deployment username rotation, with no corresponding password. 989f7eb4 is the payload extracted from the 48a68d05 dropper. It was not on VT; we uploaded it. Samples From 2025 The 2025 epoch marks two significant capability additions to Lineage A and confirms the rootkit's return to the 0xA2 encryption key after the 2024 0xAA experiment. Two distinct rootkit .so builds are present in 2025, both Lineage A: 8e83cbb2 represents the most capable build to date. Its 66-export set includes a significant new hook not seen in any prior variant: pam_sm_authenticate. This is the PAM service-side authentication function, meaning the rootkit now hooks both sides of the PAM stack. Where earlier variants could only passively capture credentials via client-side pam_authenticate, this build can also forge authentication outcomes, allowing the attacker to approve or deny login attempts at will. The export set also includes xread, first seen in 296d28eb (2023). 2b2eeb22 is a second Lineage A payload with 64 exports. XOR 0xA2 decode confirms credentials adm1n/asdfasdf, the same operator behind ec7462c3 (2022), 296d28eb (2023), and the 26082cd3 inner payload (2024), now spanning four years. 84828f31 is a truncated copy of 2b2eeb22 (same BuildID: cbc9724027399723a27daa4114ffcdf906cb802f, identical bytes up to 107KB, missing the trailing 102KB containing section headers and symbol tables), it is likely an incomplete extraction or download artifact. It is not a distinct sample. XOR 0xA2 string decode of both payloads confirms the full Lineage A string set is restored: sshpass.txt and sshpass2.txt both present, plus .logpam, .udp, .ports (×2), /proc/net/tcp. The string removals introduced by the 2024 0xAA cluster (a6138638's missing local.txt, sniff.txt, etc.) were not carried forward, and both builds return to the comprehensive logging and credential-capture model. Dropper Samples 090b15fd, 64a3ebd3, and b85ed157 are statically linked ELF executables that carry 8e83cbb2 as an embedded .so and share the same Build ID: da256c78910c552eb334814ada85c7655b717c4f. d3d204c1 is the same type of dropper carrying 2b2eeb22. All four share the same architecture first seen in f1612924 (from 2022). 73b95b7d: A New Dropper Architecture 73b95b7d is not just a dropper, it is an infector that carries the dropper as an embedded payload. This creates a two-stage delivery chain: infector → dropper → rootkit. The inner binary (090b15fd, embedded at file offset 0x20d7) is the dropper we previously saw. The infector's role is propagation and persistence; the dropper's role is to extract and install the rootkit .so via ld.so.preload. The infector scans the filesystem for ELF binaries and injects the second-stage payload into them. An infection marker bongripz4jezuz (stored in base64 encoding as: Ym9uZ3JpcHo0amV6dXoK) is checked before each infection attempt to avoid re-infecting the same target. The injected binaries include: /bin/ls All 64-bit ELF files in the current working directory that have read/write access. Additionally, /etc/cron.hourly/0 is created as a persistence mechanism (to download and execute a remote payload), though it is a shell script rather than an ELF injection target. This is the first OrBit component with any form of C2 communication. Every previous version was a purely passive implant, meaning the attacker connected via the SSH backdoor. This introduces an external command channel that can deliver updated payloads or instructions, adding a reinfection mechanism on top of ld.so.preload persistence. The earlier droppers stored all paths and commands as plaintext. 73b95b7d is the first dropper to implement string protection: a custom substitution cipher using two lookup tables at .data offsets for the cipher and plain, each with 88 entries, defining a character-by-character mapping. Notably, this is a different scheme from the XOR encryption used by the previous rootkit payloads. The structure of this dropper, which delivers the OrBit payload in the final stage, is identical to that described in this APNIC blog that analyzed a dropper that delivered RHOMBUS malware. Rhombus is a Linux-based botnet malware first reported in February 2020 by the MalwareMustDie research group, which analyzed and shared samples of it. It acts as an installer/dropper that persists on infected devices, drops a second-stage payload, and then uses the compromised system for DDoS activity. The target systems are VPS and IoT devices. (SHA256 of the dropper: b982276458a85cd3dd7c8aa6cb4bbb2d4885b385053f92395a99abbfb0e43784). Interestingly, the dropper 73b95b7d that delivers the OrBit payload in the final stage is identical to the one used in the Rhombus campaign 6 years ago. Coincidentally, both droppers use the same domain to download the payload as part of the cron-job-based persistence. The current resolution of the domain is to 109.95.212[.]253. The host has a unique BANNER_0_HASH-IP value, ba0c31785465186600a76b7af2a37aa6, that is shared with only one other IP, 109.95.211[.]141, as shown in the screenshot below from Validin. Based on the ASN resolution, both IP addresses are located in Russia. The fact that the OrBit dropper shares the same domain as malware from 6 years ago can also be interpreted as an attempt to mislead researchers; therefore, we are not taking this evidence into account for attribution at this moment. However, it is worth noting that this connection exists. Samples From February 2026 These two samples are confirmed to be identical in structure: the same 54-hook set, the same XOR key (0xA2), and the same working directory (/lib/libseconf/). The only difference is credentials: jokerteam/HACK89SERVER versus 57ill4Cu63/1qaz@WSX3edc098. XOR 0xA2 decode confirms the full Lineage A string set. No Lineage B samples have surfaced since 2024, suggesting the lite build may have been retired or consolidated back into the main branch. Connection to BLOCKADE SPIDER In CrowdStrike’s 2026 Global Threat Report, they mention that BLOCKADE SPIDER used the OrBit backdoor to maintain persistence and stealthy access to virtualization environments. BLOCKADE SPIDER is a CrowdStrike-tracked eCrime adversary that has been active at least since 2024. They are known for running Embargo ransomware campaigns using sophisticated, multi-domain attack techniques. Origin: OrBit is a fork of the Medusa open-source rootkit Mandiant's reporting on UNC3886 espionage operations identifies MEDUSA and its installer, SEAELF, as tools used by this state-sponsored actor against Juniper and VMware infrastructure. Essentially, OrBit is built from Medusa, an open-source LD_PRELOAD rootkit published on GitHub (github.com/ldpreload/Medusa) in December 2022. Mandiant's MEDUSA configuration table matches our 2024 Lineage A 0xAA-key cluster exactly across four independent fields: the XOR key 0xAA, the backdoor credentials Y0u4reCu6e and 1qaz@WSX3edc123, the install path /lib/locate/, and a modification to the rootkit that redirects strace output to /tmp/orbit.txt. That literal orbit filename, preserved as a plaintext artifact inside UNC3886's MEDUSA binary, is direct cross-attribution: Mandiant's "MEDUSA" sample set and our "OrBit" 2024 cluster are the same builds. We compiled Medusa from source and compared the resulting binaries byte-for-byte against our OrBit corpus. The match is unambiguous, and it rewrites the attribution and evolution story. Evidence of the fork The first is a function-set and export match. Compiling Medusa's src/rkld.c against the default Makefile recipe produces a shared object whose function set, hook list, and XOR-obfuscated string table are a direct superset match for OrBit Lineage A samples. The 2022 OrBit baseline (ec7462c3) shares all core exports with the Medusa build and reuses the identical XOR 0xA2 string obfuscation scheme driven by Medusa's build-time xor_dump() pipeline, with the XOR key itself hardcoded in config.c. The second is a source-filename fingerprint that is present in almost every sample we analyzed. Some of the samples ship with an unstripped ELF .symtab. The resulting filenames are preserved verbatim: rootkit samples carry rkld.c and, when Lineage A is linked in, rknet.c, while loader samples carry rkload.c. Those are the exact names of Medusa's source files, src/rkld.c, src/rknet.c, and src/rkload.c. The filenames themselves are not secret, since the Medusa repository is public, but their verbatim presence in the compiled binary is a strong attribution anchor: every unstripped sample directly identifies the upstream tree it was built from. Of the samples in our corpus, only three are fully stripped (the 2025 dropper 73b95b7d, and the rootkit binaries a6138638 and b9822764). Three representative samples are shown below: a full Lineage A rootkit (ec7462c3, 2022), a Lineage B lite rootkit (3ba6c174, 2023), and the SEAELF loader (26082cd3, 2024). 1: 0000000000000000 0 FILE LOCAL DEFAULT ABS crtstuff.c 9: 0000000000000000 0 FILE LOCAL DEFAULT ABS rkload.c 14: 0000000000000000 0 FILE LOCAL DEFAULT ABS crtstuff.c The Lineage A rootkit carries both rkld.c and rknet.c; the Lineage B rootkit, which omits the advanced hook set, carries only rkld.c; and the loader carries rkload.c. The same pattern holds across the wider corpus. Alongside the filename fingerprint, the loader's entry-point dispatch, its build_root() filesystem layout (.boot.sh, .logpam, sshpass.txt, sshpass2.txt, .ports), and its SELinux setxattr sequence all map one-to-one to the Medusa source. The third is an embedded inner ELF produced by xxd -i. Medusa's Makefile embeds build/rkld.so into the loader using the xxd -i build/rkld.so > build/rkld.h step, which is then included by the loader compiled at Makefile line 33. OrBit's loader binaries follow this pattern: a rkld.so blob embedded as a C byte array within the loader ELF, dropped to disk at runtime. The embedding technique, offset layout, and post-drop execution flow are identical. Per-Module Source Mapping Medusa's source tree maps cleanly onto the OrBit binary set we have tracked: The Medusa default Makefile compiles only src/rkld.c. Every Lineage A capability that appeared to "arrive" in OrBit between 2023 and 2025 was already present as source in Medusa's src/rknet.c on day one of the public release. The operators' work was to modify the Makefile to link rknet.c into their build, not to author those functions. Timeline Anomaly Our analysis shows that an initial OrBit sample (40b5127c) appeared in July 2022, predating the repository's publication by approximately 5 months. Based on this information, there are two options: either the Medusa author published a privately-circulated rootkit source that had already been deployed operationally, or the earliest OrBit sample was built from a pre-publication snapshot of the same tree. Either way, the 2022 OrBit sample and the December 2022 Medusa source tree are the same codebase. The question is only which commit was made public first. Implications The appearance of a single rootkit family across four years does not imply a single operator. OrBit and Medusa have been built and deployed by at least three unrelated actor clusters we can presently distinguish, including the state-sponsored espionage activity attributed to UNC3886, the eCrime ransomware operations run by BLOCKADE SPIDER, and the 2025 cron-dropper campaign previously linked to RHOMBUS infrastructure. Attribution at the family level is therefore not enough, and defenders tracking an OrBit infection should separate the questions of which codebase was used from which operator configured and deployed it. Tracking version-over-version changes in OrBit reads less like an active malware development project and more like a record of build-flag toggles, credential rotations, and install-path swaps against a stable upstream. The capability ceiling is set by the Medusa source tree as it existed in December 2022, and every apparent new feature we observed between 2023 and 2025 was already present in that tree, waiting for an operator to link it in. The xread read-hook bypass we first flagged as a 2023 compatibility shim is a function in src/rknet.c. The auditd evasion pair we called out as a 2024 addition, audit_log_acct_message and audit_log_user_message, sits in the same file. The PAM stack we noted as gradually expanding across versions, including pam_authenticate, pam_acct_mgmt, pam_open_session, and the 2025 service-side impersonation hook pam_sm_authenticate, is all present in the same rknet.c, as is the pcap_loop packet hook that appears in full Lineage A builds. None of these files is linked in by the default Makefile recipe, which compiles only src/rkld.c. Their arrival in individual OrBit samples corresponds to an operator modifying the build to include rknet.c, not to new code being written. Signatures based on invariants of the Medusa build pipeline will also flag builds from operators we have not yet seen. Three such invariants are worth calling out. The string table produced by Medusa's xor_dump() routine, which emits every protected string as a contiguous block of single-byte XOR-obfuscated byte arrays within the compiled binary. Operators change the key value (0xA2 in most builds, 0xAA in the 2024 UNC3886 cluster) and some paths, but the table's shape and the majority of its entries are fixed by the source. A YARA rule that decodes the table with a variable single-byte key and matches on a threshold count of known plaintext strings catches any build, regardless of which key was chosen. The filesystem skeleton that the loader's build_root() writes into its install directory. Operators vary only the parent directory (/lib/libseconf/, /lib/locate/, /lib/libntpVnQE6mk/), so host-based detection can alert on the co-occurrence of that filename set inside any directory, and binary-level signatures can match the embedded filename constants and the setxattr call pattern directly. The nested-ELF structure produced by the xxd - +i build/rkld.so > build/rkld.h step in the Makefile, which bakes a full secondary ELF into the loader's .rodata. Every Medusa loader therefore carries a second ELF magic inside its own image, followed by a length constant, and, if the binary is not stripped, two xxd-generated symbols (rkld_so and rkld_so_len ). The nested-ELF shape on its own is not specific enough to be a detection signature: plenty of legitimate software and unrelated malware use xxd -i or equivalent techniques to embed a payload, and any such binary will match a naive "second ELF at non-zero offset plus length constant" rule. The Medusa-specific part is the pairing of that structural pattern with (a) the symbol names rkld_so and rk +ld_so_len in the loader's symbol table when the binary is not stripped, and (b) the inner ELF itself, matching the rootkit fingerprint described earlier in this section, which gives both a family-level anchor and a structural one. Conclusion The analysis of OrBit variants from 2022 through early 2026 reveals a Linux rootkit whose code later surfaced in an open-source codebase named Medusa. This suggests that the backdoor was created before its public release and has since been selectively forked, configured, and redeployed by multiple operators over four years. We identified two parallel build paths: the comprehensive Lineage A ("Full" build), which links in Medusa's src/rknet.c advanced hook set, and the temporary Lineage B (lite build), which ships only the src/rkld.c core and was retired after 2024. Apparent "milestones" in Lineage A are the xread wrapper (2023), the audit_log_* auditd-evasion hooks (2024), and the 2025 addition of the pam_sm_authenticate hook, which corresponds one-to-one with functions already present in Medusa's published source. The operator work is in the build configuration and deployment, not the C code. Our analysis of the OrBit samples also discovered that at least 3 different operators are using the backdoor. A major operational shift occurred in 2025 with the introduction of a new two-stage infector architecture, marking one operator's transition from a purely passive SSH-backdoor implant to malware with its first direct C2 capability. This infector utilizes a cron job to fetch external payloads from the domain cf0[.]pw. The architecture of this new dropper is identical to one used in the 2020 RHOMBUS botnet campaign, suggesting shared tooling or operator overlap, a link further cemented by the C2 domain resolving to infrastructure located in Russia. In parallel, the same Medusa codebase was weaponized upstream by the state-sponsored espionage actor UNC3886 (tracked by Mandiant). The 2024 0xAA-key cluster we tracked as Lineage A corresponds exactly to UNC3886's MEDUSA configuration, including the backdoor credentials, the install path, and a strace artifact that retains the literal "orbit" string. The rootkit has also been adopted by the CrowdStrike-tracked eCrime adversary BLOCKADE SPIDER since at least 2024, who leverage OrBit for stealthy persistence against VMware vCenter infrastructure to facilitate the deployment of Embargo ransomware. The continued emergence of new Lineage A samples in 2026, accompanied by operator-specific credential rotation, confirms that a single public rootkit codebase is being cloned and configured by multiple unrelated actor groups. IOC Table Nicole Fishbein Nicole is a senior security researcher and malware analyst at Intezer. Prior to this, she was an embedded researcher in the IDF Intelligence Corps.

Iranian government hackers using Chaos ransomware as cover, researchers say Nation-state hackers from Iran are deploying the Chaos ransomware as cover for alleged espionage and data theft operations, according to new research. Incident responders from cybersecurity firm Rapid7 published a report about a recent intrusion that initially appeared to be a Chaos ransomware attack but was later discovered to be an attack attributed to MuddyWater, an Iranian APT group tied to the country’s Ministry of Intelligence and Security (MOIS). Rapid7’s Alexandra Blia and Ivan Feigl said the use of the Chaos ransomware “reflects a consistent effort to obscure operational intent and complicate attribution.” “While attribution evasion is a common characteristic of state-affiliated actors, MuddyWater’s reported increase in operational activity as of early 2026, primarily involving cyber espionage and potential prepositioning for disruptive operations across Western and Middle Eastern networks, has likely intensified its reliance on deceptive false-flag operations,” the two said. The Chaos ransomware operation has existed since February 2025 and cybersecurity experts believe it was created by former members of the now-defunct BlackSuit and Royal ransomware groups. Rapid7 provided little information about the victim at the center of the incident, only writing that the hackers used a social engineering campaign leveraging Microsoft Teams to gain initial access. The hackers contacted employees through external chat requests and initiated one-on-one conversations with users. They eventually established a screen-sharing session with the victim where the hacker accessed files related to VPN configuration and asked the victims to enter credentials. The threat actors also deployed a remote management tool to enable deeper access to the victim’s system. After an undisclosed amount of time, the hackers sent multiple emails to employees of the company threatening to leak stolen data if a ransom was not paid. The extortion process was clumsy but the hackers later published stolen data that the company confirmed is legitimate, according to the researchers. Rapid7 noted that the absence of file encryption was another inconsistency in the incident that led them to question the true culprit behind the attack. The researchers found troves of technical evidence pointing to Iran’s MOIS. The malware deployed and certificates used tied back to the toolkit typically used by Iran’s MuddyWater hacking group. The infrastructure used in the attack was previously tied by security vendors to another MuddyWater campaign identified in March targeting organizations in the Middle East and North Africa. Blia and Feigl added that the incident “highlights the increasing convergence between state-sponsored intrusion activity and cybercriminal tradecraft.” Researchers last year tied MuddyWater to the Qilin ransomware ecosystem after the strain was used to attack an Israeli organization. The attack was eventually attributed directly to Iran’s MOIS, possibly leading to the hackers adopting the Chaos ransomware brand to “reduce attribution risk and maintain a degree of plausible deniability,” Rapid7 said. Multiple nation-state groups from China, Russia, North Korea and Iran have been seen adopting the ransomware-as-a-service framework as either cover for espionage attacks or as ways to cause disruptions to adversaries. Blia and Feigl said ransomware allows state actors to blur motivations, complicating the attribution by western law enforcement agencies and cyber defenders. Researchers warned in February that North Korean state hackers are using the Medusa ransomware in attacks. In several other cases, ransomware has been used as a cover for Chinese espionage activity. Law enforcement agencies have also seen instances of Iranian government hackers using their official access to later launch financially-motivated attacks as part of an effort to double-dip and moonlight as cybercriminals, monetizing their hacking skills. The FBI previously said it witnessed Iranian actors partnering with affiliates of the NoEscape, Ransomhouse and AlphV ransomware operations — eventually taking a percentage of ransom payments. At the onset of kinetic hostilities between Iran and the United States, there was a flurry of cyber activity, including alleged ransomware attacks and wiper incidents launched by Iranian actors. A U.S. healthcare organization was targeted in late February with Iran’s Pay2Key ransomware and a prominent medical device company was damaged for weeks following a cyberattack by Iranian hackers. Jonathan Greig is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.

A Latvian member of the Karakurt ransomware gang was sentenced to 8.5 years in prison in the US for his involvement in extorting victims. The individual, Deniss Zolotarjovs, 35, of Latvia, was arrested in Georgia in December 2023 and extradited to the US in August 2024. He pleaded guilty in July 2025. Associated with the infamous Conti group and also known as TommyLeaks, Schoolboys Ransomware Gang, and Blockbit, Karakurt was one of the most notorious ransomware groups half a decade ago. In a 2022 alert, the US government warned of the group indiscriminately targeting organizations across multiple industries to steal sensitive information and extort ransom payments from them. The group is known for stealing personally identifiable information such as names, addresses, dates of birth, Social Security numbers, and healthcare information, and was also involved in the disruption of a 911 emergency system. Zolotarjovs was a member of the group between June 2021 and March 2023, documents presented in court show. During that time, Karakurt hit at least 53 entities, causing $56 million in losses. As part of the group, Zolotarjovs did not execute intrusions, but he was directly involved in extortion strategies and in negotiating with victim organizations. Online chats show that he was responsible for analyzing the stolen data and conducting ransom negotiations, or advising on them. In one instance, when a pediatric healthcare company did not immediately pay the ransom, Zolotarjovs helped escalate pressure on the victim and recommended publishing pediatric patient data online. Zolotarjovs, the court documents show, received 10% of the negotiated ransom payments and was paid in cryptocurrency, which he moved through multiple wallets before exchanging for Russian rubles. Related: Two US Security Experts Sentenced to Prison for Helping Ransomware Gang Related: Third US Security Expert Admits Helping Ransomware Gang Related: Medusa Ransomware Fast to Exploit Vulnerabilities, Breached Systems

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two security flaws impacting ConnectWise ScreenConnect and Microsoft Windows to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. The vulnerabilities are listed below - CVE-2024-1708 (CVSS score: 8.4) - A path traversal vulnerability in ConnectWise ScreenConnect that could allow an attacker to execute remote code or directly impact confidential data and critical systems. (Fixed in February 2024) CVE-2026-32202 (CVSS score: 4.3) - A protection mechanism failure vulnerability in Microsoft Windows Shell that could allow an unauthorized attacker to perform spoofing over a network. (Fixed in April 2026) The addition of CVE-2026-32202 to the KEV catalog comes a day after Microsoft updated its advisory for the flaw to acknowledge it had come under active exploitation. Although Microsoft has not disclosed the nature of the attacks weaponizing the flaw, Akamai said the vulnerability stemmed from an incomplete patch for CVE-2026-21510, which was exploited as a zero-day alongside CVE-2026-21513 by the Russian hacking group APT28 in attacks targeting Ukraine and E.U. countries since December 2025. Attacks exploiting CVE-2024-1708, on the other hand, have been chained with CVE-2024-1709 (CVSS score: 10.0), a critical authentication bypass vulnerability, by multiple threat actors over the years. Earlier this month, Microsoft linked the exploitation of the flaws to a China-based threat actor it tracks as Storm-1175 in attacks deploying Medusa ransomware. It's worth noting that CISA added CVE-2024-1709 to the KEV catalog on February 22, 2024. Federal Civilian Executive Branch (FCEB) agencies are required to apply the necessary fixes by May 12, 2026, to secure their networks.

Automotive analysis and data company Autovista is scrambling to restore its services across Europe and Australia after falling victim to a ransomware attack. Autovista has engaged external experts and is currently working to contain the attack, the company said in a Thursday morning incident notice. “We are responding to a ransomware incident affecting certain Autovista systems in Europe and Australia. We appreciate our customers’ patience as we work to respond to this incident in a disciplined manner,” Autovista said. The company also emphasized its focus on securely restoring its applications as soon as possible, but could not provide a firm timeline. “We are currently working with third-party cybersecurity experts to investigate the incident. This investigation process is ongoing and will take time to complete,” Autovista said. The company promised additional details on the incident and on when services will be restored as its investigation advances. Autovista did not share information on which services have been affected, but said that its employees’ access to email has been temporarily disrupted by the attack. No details on the ransomware gang responsible for the disruption have been provided either, and no known group appears to have claimed responsibility yet. Autovista is a UK-based firm that provides vehicle valuations and identifications, car specifications, residual value benchmarks, total cost of ownership, insights across the vehicle lifecycle, and smart tools for dealers and professionals worldwide. Related: Medusa Ransomware Fast to Exploit Vulnerabilities, Breached Systems Related: German Police Unmask REvil Ransomware Leader Related: Chip Services Firm Trio-Tech Says Subsidiary Hit by Ransomware Related: Mississippi Hospital System Closes All Clinics After Ransomware Attack

The US cybersecurity agency CISA on Monday expanded its Known Exploited Vulnerabilities (KEV) catalog with seven vulnerabilities, including two Windows bugs. Tracked as CVE-2023-36424, the first of the Windows flaws is described as a common log file driver issue that could lead to privilege escalation. Microsoft released patches for the vulnerability in November 2023, and technical details and proof-of-concept (PoC) code targeting it were published the next month. The second Windows weakness added to the KEV list is CVE-2025-60710, described as a link-following vulnerability in the host process for Windows Tasks that could be exploited for privilege escalation. Patches for the security defect were released in November 2025, and PoC exploit code was made available shortly after. There appear to be no reports of these flaws being exploited in the wild prior to CISA’s warning. The same applies to CVE-2020-9715, a use-after-free bug in Adobe Acrobat and Reader leading to arbitrary code execution. The bug was patched in August 2020, and PoC code targeting it has been publicly available for years. On Monday, CISA also added to the KEV list CVE-2023-21529, an Exchange weakness flagged as exploited by Microsoft last week in a report detailing the Medusa ransomware gang’s recent activity. Other new additions to the KEV list include CVE-2026-34621 and CVE-2026-21643, recently disclosed issues in Adobe Acrobat and Reader, and Fortinet FortiClient EMS that have been exploited as zero-days. Both defects allow remote attackers to execute arbitrary code on vulnerable systems. Additionally, CISA warned that CVE-2012-1854, an insecure library-loading vulnerability in Microsoft Visual Basic for Applications that enables remote code execution (RCE), has been in attackers’ crosshairs. The security defect was patched in November 2012, when Microsoft warned that it had been exploited in the wild as a zero-day. CISA urges federal agencies to apply fixes for these vulnerabilities within two weeks, except for the Fortinet bug, which should be patched by April 16. Related: Critical Marimo Flaw Exploited Hours After Public Disclosure Related: TrueConf Zero-Day Exploited in Asian Government Attacks Related: React2Shell Exploited in Large-Scale Credential Harvesting Campaign Related: F5 BIG-IP DoS Flaw Upgraded to Critical RCE, Now Exploited in the Wild

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added half a dozen security flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The list of vulnerabilities is as follows - CVE-2026-21643 (CVSS score: 9.1) - An SQL injection vulnerability in Fortinet FortiClient EMS that could allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests. CVE-2020-9715 (CVSS score: 7.8) - A use-after-free vulnerability in Adobe Acrobat Reader that could result in remote code execution. CVE-2023-36424 (CVSS score: 7.8) - An out-of-bounds read vulnerability in Microsoft Windows Common Log File System Driver that could result in privilege escalation. CVE-2023-21529 (CVSS score: 8.8) - A deserialization of untrusted data in Microsoft Exchange Server that could allow an authenticated attacker to achieve remote code execution. CVE-2025-60710 (CVSS score: 7.8) - An improper link resolution before file access vulnerability in Host Process for Windows Tasks that could allow an authorized attacker to elevate privileges locally. CVE-2012-1854 (CVSS score: 7.8) - An insecure library loading vulnerability in Microsoft Visual Basic for Applications (VBA) that could result in remote code execution. The addition of CVE-2026-21643 to the KEV catalog comes after Defused Cyber said it detected exploitation attempts targeting the flaw since March 24, 2026. Last week, Microsoft revealed that a threat actor it tracks as Storm-1175 has been weaponizing CVE-2023-21529 in attacks to deliver Medusa ransomware. As for CVE-2012-1854, the Windows makeracknowledged in an advisory released in July 2012 that it's aware of "limited, targeted attacks" attempting to abuse the vulnerability. The exact nature of the attacks is presently unknown. There are currently no public reports referencing the exploitation of the remaining three vulnerabilities. In light of active attacks, Federal Civilian Executive Branch (FCEB) agencies are required to apply the fixes by April 27, 2026. Patches for the FortiClient EMS vulnerability should be implemented by April 16, 2026.

For the latest discoveries in cyber research for the week of 13th April, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES The Los Angeles Police Department has reported a data breach involving a digital storage system used by the L.A. City Attorney’s Office. The exposure included 7.7 terabytes and more than 337,000 files, including personnel records, internal affairs material, and unredacted personal information. ChipSoft, a Dutch healthcare software vendor whose HiX platform is used by hospitals across the Netherlands, has suffered a ransomware attack that forced it to disable patient and provider services. Multiple hospitals disconnected from its systems, disrupting operations, and the company warned that the threat actor may have gained unauthorized access to patient data. Ransomware group Qilin has taken responsibility for a cyber-attack targeting German political party Die Linke, which forced the party to shut down its IT infrastructure in late March. The party said membership databases were unaffected, while Qilin threatens to leak stolen sensitive employee and party information. Check Point Endpoint and Threat Emulation provide protection against these threats (Ransomware.Wins.Qilin*) Bitcoin Depot, a US cryptocurrency ATM operator with more than 25,000 kiosks and checkout locations, has disclosed a cyberattack that allowed attackers to steal credentials tied to digital asset settlement accounts. The attackers transferred more than 50 BTC worth more than $3.6M from company-controlled wallets before access was blocked. AI THREATS Researchers identified GrafanaGhost, an attack against Grafana’s AI components that can silently exfiltrate enterprise data by chaining indirect prompt injection with image URL validation bypass. The technique can expose financial, infrastructure, and customer information in the background, and Grafana has already addressed the weakness. Researchers outlined AI Agent Traps, a framework describing six web-based attack classes that can manipulate autonomous AI agents through malicious content. The methods can inject hidden instructions, poison reasoning, corrupt memory, and steer tool use, showing how web pages can turn agent workflows into attack surfaces. Researchers measured a growing AI supply chain risk, finding that third-party API routers for AI models can hijack agent tool calls to alter commands and steal credentials. In testing, several routers injected malicious code, abused intercepted cloud keys, and even triggered wallet theft from a researcher environment. VULNERABILITIES AND PATCHES CISA warns of active exploitation of Ivanti CVE-2026-1340, a critical code injection flaw in Endpoint Manager Mobile that allows unauthenticated remote code execution and full compromise of affected servers. The vulnerability carries a CVSS score of 9.8, affects multiple 12.5 through 12.7 releases, and has been exploited in the wild. Check Point IPS provides protection against this threat (Ivanti Endpoint Manager Mobile Code Injection (CVE-2026-1340)) Adobe Reader is affected by an actively exploited zero-day that uses malicious PDF files to invoke privileged features on fully updated systems, enabling local data theft. Researchers said the activity has run since at least December 2025, uses Russian-language oil and gas lures, and may also enable further compromise. Marimo maintainers released a fix for CVE-2026-39987, a critical remote code execution flaw in the Marimo Python notebook that allowed attackers to open a terminal without authentication and run commands. Exploitation was observed within hours of disclosure against internet-exposed instances, and fixes are available in version 0.23.0. Fortinet has fixed CVE-2026-35616, a critical improper access control flaw in FortiClient EMS that enables unauthenticated code or command execution through crafted requests. The issue been actively exploited in the wild, prompting Fortinet to release an emergency hotfix. THREAT INTELLIGENCE REPORTS Check Point Research have analyzed March 2026’s threat landscape, with organizations averaging 1,995 weekly attacks. Education remained the most targeted sector, ransomware rose to 672 incidents led by Qilin, Akira, and DragonForce, and GenAI exposure remained high across enterprise environments. Researchers discovered a coordinated software supply chain campaign that planted 36 malicious npm packages impersonating Strapi plugins. The packages executed on installation to search for secrets, maintain command and control, and in some cases enable Redis remote code execution, credential harvesting, and direct PostgreSQL exploitation. Researchers linked Storm-1175, a financially motivated group associated with Medusa ransomware, to high-velocity exploitation of n-day and zero-day flaws. Microsoft said the actor moves quickly from initial access to data theft and ransomware deployment, sometimes weaponizing vulnerabilities within a day and heavily impacting healthcare, education, finance, and services. Researchers identified a hack-for-hire campaign linked to BITTER APT that targeted journalists, activists, and government figures across the Middle East and North Africa. The operators used phishing to access iCloud backups and Signal accounts, and deployed Android spyware disguised as messaging applications to take over victim devices.

Microsoft says the financially motivated cybercrime group has exploited N-day and zero-day vulnerabilities in campaigns predicated on speed.

The Medusa ransomware group has been operating at a fast pace, seizing short windows of opportunity in attacks across multiple verticals, Microsoft says. Operating as a ransomware-as-a-service (RaaS), Medusa has been active since June 2021 and hit over 300 organizations in the critical infrastructure sector by February 2025. The group is known for engaging in double extortion, stealing victims’ data in addition to encrypting it, as well as for relying on phishing and the exploitation of unpatched vulnerabilities for initial access. In recent attacks, Medusa’s operators, tracked by Microsoft as Storm-1175, were seen moving rapidly from initial access to post-compromise operations, often within days or, in some cases, hours. Additionally, the group was seen quickly weaponizing newly disclosed vulnerabilities, as well as exploiting zero-day bugs in web-facing systems. “The threat actor’s high operational tempo and proficiency in identifying exposed perimeter assets have proven successful, with recent intrusions heavily impacting healthcare organizations, as well as those in the education, professional services, and finance sectors in Australia, the United Kingdom, and the United States,” Microsoft says. Over the past three years, Medusa’s operators have exploited at least 16 vulnerabilities in Microsoft Exchange, Papercut, Ivanti Connect Secure and Policy Secure, ConnectWise ScreenConnect, JetBrains TeamCity, SimpleHelp, SAP NetWeaver, CrushFTP, GoAnywhere MFT, SmarterMail, and BeyondTrust. Storm-1175, Microsoft says, weaponizes newly disclosed vulnerabilities immediately. It was seen exploiting the NetWeaver bug one day after it was publicly disclosed on April 24, 2025. The group was also seen chaining multiple security defects to obtain remote code execution (RCE) on the victims’ systems. It has also targeted Linux systems, including Oracle WebLogic instances. According to Microsoft, the group has exploited at least three zero-day flaws, including CVE-2026-23760 (SmarterMail) and CVE-2025-10035 (GoAnywhere MFT). In some cases, Storm-1175 exploited the flaws seven days before public disclosure. Following initial access, the gang typically deploys a web shell or remote access payload and proceeds to data exfiltration and the execution of file-encrypting ransomware within one day. During this window, Storm-1175 establishes persistence, performs reconnaissance and lateral movement, modifies firewall settings to enable remote access, and exfiltrates credentials. “We have also observed that after gaining administrator credentials, Storm-1175 has used a script to recover passwords from Veeam backup software, which is used to connect to remote hosts, therefore enabling ransomware deployment to additional connected systems,” Microsoft notes. The hackers have been using living-off-the-land binaries such as PowerShell and PsExec, along with Cloudflare tunnels, Remote Desktop Protocol (RDP), various remote monitoring and management (RMM) tools, PDQ Deployer for payload execution, Impacket and Mimikatz for lateral movement and credential harvesting, and Bandizip and Rclone for data collection and exfiltration. In light of Microsoft’s report, Tuskira co-founder and CEO Piyush Sharma and AttackIQ field CISO Pete Luban urge at-risk organizations to continuously inventory and monitor both internal and external systems to identify exploitable assets and reduce risks. “The heightened speed and efficiency of these campaigns is a game-changer for organizations with high-pressure environments like hospitals, insurers, and banks, which is who Storm-1175 is primarily targeting. These organizations already have little tolerance for downtime, complex edge infrastructure, and a constant patching backlog, so a threat actor that can spot exposed assets and exploit them before defenders catch up has a much wider lane than it did even a year ago,” Sharma said. Luban commented, “If unchecked, the impact is bigger than a single encrypted network segment. Medusa is built for double extortion, so the ransom threat is not just downtime, it’s the risk of public data exposure and downstream fallout like regulatory penalties, partner distrust, and long tail fraud from stolen data.” Related: German Police Unmask REvil Ransomware Leader Related: Stolen Logins Are Fueling Everything From Ransomware to Nation-State Cyberattacks Related: Medusa Ransomware Uses Malicious Driver to Disable Security Tools

A prolific cybercrime group has been weaponizing n-day and zero-day exploits in high-tempo Medusa ransomware attacks over the past three years, Microsoft has revealed. Storm-1175 is a financially motivated actor that usually exploits the window between vulnerability disclosure and patch adoption, Microsoft said in a blog post on April 6. “The threat actor’s high operational tempo and proficiency in identifying exposed perimeter assets have proven successful, with recent intrusions heavily impacting healthcare organizations, as well as those in the education, professional services, and finance sectors in Australia, the UK and US,” it said. The group has exploited at least 16 vulnerabilities in this way since 2023, including three zero-day flaws such as CVE-2025-10035. That vulnerability in GoAnywhere Managed File Transfer, was exploited one week before public disclosure last year. Microsoft pointed to several typical TTPs used by Storm-1175: The group creates a web shell or drops a remote access payload to establish an initial foothold – moving from initial access to ransomware deployment in one to six days It establishes persistence by creating a new user and adding that user to the administrator’s group It rotates various tools for reconnaissance and lateral movement, including living-off-the-land binaries (LOLBins), such as PowerShell and PsExec, followed by Cloudflare tunnels to move laterally over Remote Desktop Protocol (RDP) and deliver payloads to new devices It uses multiple remote monitoring and management (RMM) tools during post-compromise activity such as creating new user accounts, enabling alternative command-and-control (C2) methods, delivering additional payloads, or using as interactive remote desktop sessions Legitimate software deployment tool PDQ Deployer is sometimes used to silently install applications for lateral movement and payload delivery Python-based tool Impacket is sometimes used for lateral movement and credential dumping The group occasionally modifies Microsoft Defender Antivirus settings stored in the registry to prevent it blocking ransomware payloads How to Tackle Storm-1175 Microsoft said the group has already exploited vulnerabilities in Exchange, Papercut, Ivanti Connect Secure and Policy Secure, ConnectWise ScreenConnect, JetBrains TeamCity, SimpleHelp, CrushFTP, GoAnywhere MFT, SmarterMail and BeyondTrust. To mitigate the threat of attack, organizations should first use perimeter scanning tools to understand the extent of their attack surface, Microsoft recommended. Web-facing systems should be isolated from the public internet with a secure network boundary and accessed only via a virtual private network (VPN). If they must be connected, organizations should place these systems behind a web application firewall (WAF), reverse proxy, or perimeter network (aka DMZ), the report continued. Microsoft also recommended: Following its ransomware guidance on credential hygiene and limiting lateral movement Implementing Credential Guard to protect credentials stored in process memory Turning on tamper protection to prevent attackers from stopping security services or using antivirus exclusions Removing unapproved RMM installations and adding multi-factor authentication (MFA) to approved ones Configuring XDR tools to prevent common attack techniques used in ransomware attacks

A China-based threat actor known for deploying Medusa ransomware has been linked to the weaponization of a combination of zero-day and N-day vulnerabilities to orchestrate "high-velocity" attacks and break into susceptible internet-facing systems. "The threat actor's high operational tempo and proficiency in identifying exposed perimeter assets have proven successful, with recent intrusions heavily impacting healthcare organizations, as well as those in the education, professional services, and finance sectors in Australia, the United Kingdom, and the United States," the Microsoft Threat Intelligence team said. Attacks mounted by Storm-1175 have also leveraged zero-day exploits, in some cases, before they have been publicly disclosed, as well as recently disclosed vulnerabilities to obtain initial access. Select incidents have involved the threat actor chaining together multiple exploits (e.g., OWASSRF) for post-compromise activity. Upon gaining a foothold, the financially motivated cybercriminal actor swiftly moves to exfiltrate data and deploy Medusa ransomware within a span of a few days, or, in select incidents, within 24 hours. To aid in these efforts, the group creates persistence by creating new user accounts, deploying web shells or legitimate remote monitoring and management (RMM) software for lateral movement, conducting credential theft, and interfering with the normal functioning of security solutions, before dropping the ransomware. Since 2023, Storm-1175 has been linked to the exploitation of more than 16 vulnerabilities - CVE-2023-21529 (Microsoft Exchange Server) CVE-2023-27351 and CVE-2023-27350 (Papercut) CVE-2023-46805 and CVE-2024-21887 (Ivanti Connect Secure and Policy Secure) CVE-2024-1708 and CVE-2024-1709 (ConnectWise ScreenConnect) CVE-2024-27198 and CVE-2024-27199 (JetBrains TeamCity) CVE-2024-57726, CVE-2024-57727, and CVE-2024-57728 (SimpleHelp) CVE‑2025‑31161 (CrushFTP) CVE-2025-10035 (Fortra GoAnywhere MFT) CVE-2025-52691 and CVE-2026-23760 (SmarterTools SmarterMail) CVE-2026-1731 (BeyondTrust) Both CVE-2025-10035 and CVE-2026-23760 are said to have been exploited as zero-days prior to them being publicly disclosed. As of late 2024, the hacking crew has exhibited a flair for targeting Linux systems, including exploiting vulnerable Oracle WebLogic instances across several organizations. However, the exact vulnerability that was being weaponized in these attacks remains unknown. "Storm-1175 rotates exploits quickly during the time between disclosure and patch availability or adoption, taking advantage of the period where many organizations remain unprotected," Microsoft said. Some of the notable tactics observed in these attacks are as follows - Using living-off-the-land binaries (LOLBins), including PowerShell and PsExec, along with Impacket for lateral movement. Relying on PDQ Deployer for both lateral movement and payload delivery, including Medusa ransomware, across the network. Modifying Windows Firewall policies to enable Remote Desktop Protocol (RDP) and deliver malicious payloads to other devices. Carrying out credential dumping using Impacket and Mimikatz. Configuring Microsoft Defender Antivirus exclusions to prevent it from blocking ransomware payloads. Leveraging Bandizip and Rclone for data collection and exfiltration, respectively. The bigger implication here is that RMM tools like AnyDesk, Atera, MeshAgent, ConnectWise ScreenConnect, or SimpleHelp are becoming dual-use infrastructure for covert operations, as they allow threat actors to blend malicious traffic into trusted, encrypted platforms and reduce the likelihood of detection.

Medusa ransomware group using zero-days to launch attacks within 24 hours of breach, Microsoft says The Medusa ransomware operation is increasingly exploiting new vulnerabilities days before they are publicly disclosed, according to new research from Microsoft. Cybersecurity experts at Microsoft published an examination of activity from the group — which recently claimed responsibility for a devastating attack on the largest hospital in Mississippi and a county in northern New Jersey. Microsoft said it has been alarmed to see how effective Medusa actors are, citing multiple cases where the group can move from initial access to data exfiltration and ransomware deployment within 24 hours. Medusa actors also make a point of targeting vulnerable web-facing systems during the window between vulnerability disclosure and widespread patch adoption. “The threat actor’s high operational tempo and proficiency in identifying exposed perimeter assets have proven successful, with recent intrusions heavily impacting healthcare organizations, as well as those in the education, professional services, and finance sectors in Australia, United Kingdom, and United States,” Microsoft explained. Incident responders have seen Medusa hackers break into systems and immediately create new user accounts to preserve their access. While many attacks have lasted just 24 hours, Medusa incidents typically run for five to six days and rely heavily on legitimate remote management tools like ConnectWise ScreenConnect, AnyDesk and SimpleHelp. A Microsoft spokesperson told Recorded Future News that the incidents are part of a growing trend where ransomware attackers weaponize vulnerabilities almost immediately. The Microsoft blog highlights two recent bugs — CVE-2026-23760 in SmarterMail and CVE-2025-10035 in GoAnywhere Managed File Transfer — as examples of Medusa actors exploiting vulnerabilities one week before public disclosure. The Cybersecurity and Infrastructure Security Agency (CISA) previously confirmed that CVE-2026-23760 and CVE-2025-10035 have been used in ransomware attacks. Microsoft said as ransomware attackers become more adept at identifying new vulnerabilities, it will be important for organizations to understand their digital footprint before it's too late to defend against perimeter network attacks. Experts believe the Medusa operation is based in Russia due to its avoidance of targets in the Commonwealth of Independent States, its Russian-language forum activity and the use of Cyrillic script in operational tools. The group, which emerged in 2021, has repeatedly shown a willingness to target healthcare facilities and municipal governments across the U.S. The group most recently claimed attacks on New Jersey’s Passaic County and the University of Mississippi Medical Center (UMMC). The hospital fully reopened on March 2 with the help of the FBI and Department of Homeland Security. Cybersecurity experts at Symantec also recently said they saw members of Lazarus — a well-known North Korean hacking operation housed within the country’s military — deploy Medusa ransomware. Jonathan Greig is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.

Microsoft says that Storm-1175, a China-based financially motivated cybercriminal group known for deploying Medusa ransomware payloads, has been deploying n-day and zero-day exploits in high-velocity attacks. This cybercrime gang quickly shifts to targeting new security vulnerabilities to gain access to its victims' networks, weaponizing some of them within a day and, in some cases, exploiting them a week before patches are released. "Storm-1175 rapidly moves from initial access to data exfiltration and deployment of Medusa ransomware, often within a few days and, in some cases, within 24 hours," Microsoft said. "The threat actor's high operational tempo and proficiency in identifying exposed perimeter assets have proven successful, with recent intrusions heavily impacting healthcare organizations, as well as those in the education, professional services, and finance sectors in Australia, United Kingdom, and United States." Microsoft has also observed Storm-1175 operators chaining multiple exploits to gain persistence on compromised systems by creating new user accounts, deploying remote monitoring and management software, stealing credentials, and disabling security software before dropping ransomware payloads. In October, Microsoft reported that Storm-1175 had been exploiting a maximum-severity GoAnywhere MFT vulnerability (CVE-2025-10035) in Medusa ransomware attacks for over one week before it was patched. Another vulnerability Storm-1175 exploited as a zero-day was CVE-2026-23760, an authentication bypass in SmarterTools' SmarterMail email server and collaboration tool. "While these more recent attacks demonstrate an evolved development capability or new access to resources like exploit brokers for Storm-1175, it is worth noting that GoAnywhere MFT has previously been targeted by ransomware attackers, and that the SmarterMail vulnerability was reportedly similar to a previously disclosed flaw," Microsoft added. "These factors may have helped to facilitate subsequent zero-day exploitation activity by Storm-1175, who still primarily leverages N-day vulnerabilities." In recent campaigns, Storm-1175 has exploited more than 16 vulnerabilities across 10 software products, including Microsoft Exchange (CVE-2023-21529), Papercut (CVE-2023-27351 and CVE-2023-27350), Ivanti Connect Secure and Policy Secure (CVE-2023-46805 and CVE-2024-21887), and ConnectWise ScreenConnect (CVE-2024-1709 and CVE-2024-1708). Microsoft has also seen them exploit vulnerabilities in JetBrains TeamCity (CVE-2024-27198 and CVE-2024-27199), SimpleHelp (CVE-2024-57726, CVE-2024-57727, and CVE-2024-57728), CrushFTP (CVE‑2025‑31161), SmarterMail (CVE-2025-52691), and BeyondTrust (CVE-2026-1731). CISA issued a joint advisory with the FBI and the Multi-State Information Sharing and Analysis Center (MS-ISAC) in March 2025, warning that the Medusa ransomware gang's attacks had impacted over 300 critical infrastructure organizations across the United States. In July 2024, Microsoft also linked the Storm-1175 threat group, along with three other cybercrime gangs, to Black Basta and Akira ransomware attacks that exploited a VMware ESXi authentication-bypass flaw. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

A new Android malware called Perseus is checking user-curated notes to steal sensitive information, like passwords, recovery phrases, or financial data. Distributed over unofficial stores disguised as IPTV, Perseus allows complete device takeover, screenshot capturing , and overlay attacks. By posing as IPTV apps, which are often used to stream pirated content, the threat actor relies on the user's familiarity with sideloading APKs from outside the Google Play store and ignoring security warnings. This trend has emerged over the past eight months, as users seek free or low-cost ways to access live sports broadcasts. In a recent campaign, threat actors leveraged the IPTV app lure to distribute the Massiv Android banking malware. According to researchers at mobile security company ThreatFabric, Perseus is primarily targeting financial institutions in Turkey and Italy, as well as crypto services. One app loading the malware is called Roja Directa TV, a popular sports streaming service that has been the target of copyright infringement and shutdown actions. The dropper for Perseus can bypass Android 13+ sideloading restrictions and is the same one for delivering the Klopatra and Medusa malware. According to ThreatFabric researchers, "Perseus appears to build specifically on the Phoenix codebase," which was created from the Cerberus code, leaked almost six years ago. In a report today, the researchers say that the malware has two versions, one in Turkish and a more refined one in English, which also features better debugging and additional quality-of-life features. The English variant includes extensive logging and emojis in the code, which is a strong indication that AI tools were used in the development process. A focus on Turkey is also evident in the list of targeted financial institutions in the country (17), followed by Italy with 15, Poland with 5, Germany (3), and France (2). The malware also targets 9 cryptocurrency apps. By abusing Android Accessibility Services, Perseus gives operators full remote control over the infected devices, enabling them to: Capture screenshots continuously and stream them to the operator (start_vnc) Send a structured UI hierarchy for programmatic remote interaction (start_hvnc) Simulate taps, swipes, text input, long presses, and other UI navigation actions Turn the screen on, launch apps, and block apps Enable a black screen overlay to hide activity from the victim Launch overlay attacks and perform keylogging Perseus’ unusual feature targets Android note-taking apps, including Google Keep, Xiaomi Notes, Samsung Notes, ColorNote, Evernote, Microsoft OneNote, and Simple Notes. ThreatFabric researchers note that this is the first time they've seen an Android malware checking for sensitive details in personal notes on the device. “While many Android malware families focus primarily on harvesting credentials or intercepting communications, this feature reflects a broader interest in contextual and personally curated data,” reads the ThreatFabric report. “Notes often contain sensitive information such as passwords, recovery phrases, financial details, or private thoughts, making them a valuable target for attackers.” The malware’s English version uses Accessibility Services to systematically open the notes apps one by one and scan individual notes stored in them. Perseus performs extensive anti-analysis and evasion checks before executing on a device, including root, emulator fingerprints, SIM details, hardware profile, battery data, Bluetooth presence, app count, and Google Play Services availability, and formulates a “suspicion score” that it sends to the command-and-control (C2) panel. Based on that score, the operator decides whether to proceed with data theft. To minimize risk, Android users are recommended to avoid sideloading APKs from questionable sources and to only download legal streaming apps from the official Android app store, Google Play. Also, ensure that Play Protect is active and use it to regularly scan the device for known threats. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Medusa ransomware gang claims attacks on prominent Mississippi hospital, New Jersey county A prominent ransomware gang has taken credit for a devastating attack on the biggest hospital in Mississippi and a large county in New Jersey. The Medusa ransomware operation, which experts believe is run out of Russia, said recently it was behind the cyberattack on the University of Mississippi Medical Center (UMMC). UMMC is one of the most important healthcare organizations in the state — employing 10,000 people and housing Mississippi’s only children's hospital, only Level I trauma center, only Level IV neonatal intensive care unit and the state’s only organ transplant programs. The entire organization went dark for nine days at the end of February, forcing nurses and doctors to operate sophisticated systems with analog tools. The cancer infusion center had to reschedule patients while other units had to find ways to manage supplies and treatment with paper and pen. “We created a fully functional, urgent infusion clinic operating entirely offline. We found smart, secure ways to access critical vendor data,” said Devika Das, division director of hematology and oncology at the hospital, said two weeks ago. UMMC’s hospitals and emergency departments remained operational but it closed all 35 of its clinic locations. The FBI and Department of Homeland Security were brought in to assist in the recovery effort. The hospital fully reopened on March 2, and the Medusa ransomware gang claimed the attack last Thursday, demanding an $800,000 ransom. The hackers threatened to leak data stolen from the hospital by March 20. A UMMC spokesperson declined to comment on the ransom threat. Experts believe the Medusa operation is based in Russia due to its avoidance of targets in Commonwealth of Independent States, its Russian-language forum activity and the use of Cyrillic script in operational tools. The group, which emerged in 2021, has repeatedly shown a willingness to target healthcare facilities and municipal governments across the U.S. On Tuesday, the group claimed an attack on New Jersey’s Passaic County and demanded an $800,000 ransom. The county said it was dealing with a “malware attack" two weeks ago that took down phone lines and IT systems used across government offices. It is home to nearly 600,000 people. Jonathan Greig is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.

Ambulance services provider Bell Ambulance is notifying nearly 238,000 individuals that their personal, financial account, medical, and health insurance information was compromised in a February 2025 data breach. The Milwaukee, Wisconsin-based healthcare organization detected the network intrusion on February 13, 2025, and disclosed the incident on April 14, roughly a month after the Medusa ransomware gang claimed responsibility for it. Bell Ambulance said at the time that 114,000 people had been impacted. This week, Bell Ambulance notified the Maine Attorney General’s Office that hackers had access to its network between February 7 and February 14, 2025. The organization told the Maine AGO that it has sent notification letters to 237,830 individuals who were affected by the data breach. A copy of the notification letter submitted to the Maine AGO shows that Bell completed its investigation into the compromised information on February 20, 2026. The compromised information, the organization said last year, includes names, Social Security numbers, dates of birth, and driver’s license numbers, along with financial account and medical and health insurance information. “In response to this event, Bell secured its network, reset passwords, secured all accounts, and conducted a full investigation into the incident,” the organization said in its incident notice. Bell Ambulance is providing the impacted individuals with 12 months of free credit monitoring and identity protection services and is encouraging them to remain vigilant of potential fraud and identity theft incidents. In March last year, the Medusa ransomware group claimed the theft of 219.50 GB of data from Bell Ambulance. The threat actor has since published the allegedly stolen data, which suggests that the organization did not pay a ransom. Related: Michelin Confirms Data Breach Linked to Oracle EBS Attack Related: Thousands Affected by Ericsson Data Breach Related: New LexisNexis Data Breach Confirmed After Hackers Leak Files Related: 1.2 Million Affected by University of Hawaii Cancer Center Data Breach

235,000 affected by cyberattack on largest ambulance provider in Wisconsin A prominent ambulance service in Milwaukee confirmed that hackers targeted their systems last year and stole sensitive information on more than 235,000 people. Bell Ambulance, which is the largest ambulance provider in the state of Wisconsin, filed breach notifications in Maine this week confirming that 237,830 people had information impacted by a data breach discovered in February 2025. The company said Social Security numbers, driver’s license numbers, financial accounts, medical information and health insurance information was stolen during the cyberattack. According to letters sent to victims, Bell Ambulance became aware of the attack on February 13, 2025 and hired cybersecurity experts to assist with the recovery effort. The company began notifying some who were affected in April 2025 but more victims were discovered throughout the fall. The company has stations across Milwaukee, Wauwatosa, Waukesha, Racine, Mount Pleasant, Kenosha and other cities across Wisconsin. Their more than 750 employees handle about 140,000 ambulance calls each year. The attack on Bell Ambulance was claimed at the time by the Medusa ransomware gang, which demanded a $400,000 ransom in exchange for the 219 GB of data that was stolen. One month after the Bell Ambulance incident, the FBI and several U.S. law enforcement agencies released an urgent advisory about the ransomware gang’s attacks on critical infrastructure organizations across the U.S. The group targeted governments and healthcare facilities in Minnesota, Illinois and Texas as well as car racing league NASCAR. According to the 2025 FBI alert, the ransomware-as-a-service group emerged in June 2021 and was responsible for more than 300 attacks on critical infrastructure organizations that included medical companies, manufacturing firms and more. The FBI warned that during one investigation, the group conducted a triple extortion scheme, where after paying the ransom to one alleged member of Medusa, another actor from the group claimed the payment was stolen and demanded the same ransom in exchange for the ‘true decryptor.’ Jonathan Greig is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.