The Good | Global Authorities Dismantle Investment Scams & VasyGrek Infrastructure, Indict University System Hackers

Law enforcement in Europe, supported by Europol and Eurojust, arrested seven suspects and seized over 100 servers targeting a crime-as-a-service (CaaS) investment fraud infrastructure. Operating from Cyprus and Israel, an unnamed vendor supplied fraudulent trading websites to criminal call centers across Albania, Kosovo, North Macedonia, and more. 

Following a four-year investigation initiated after victims reported missing funds, investigators linked the infrastructure to fake foreign currency, stock, and cryptocurrency schemes affecting victims in at least 50 countries. Scammers used fake online account profits to coerce larger transfers before cutting contact, leaving victims unable to recover their funds.

In the U.S., a federal grand jury indicted two Canadian nationals, Ryan James Roach and Mathiew James Stubbings, for conspiring to breach multiple American universities to mine for cryptocurrency. Between June 2016 and December 2019, the co-conspirators deployed virtual private servers to infect academic networks across Massachusetts, New York, North Carolina, and Tennessee with malware. 

Once inside, the defendants stole user log-ins and data, deployed cryptocurrency mining software, and hijacked high-performance campus supercomputers to conduct unauthorized network vulnerability research. Both men face up to ten years in prison and $250,000 fines following formal extradition proceedings from Canada.

Russian law enforcement authorities arrested three suspected members of the VasyGrek threat group (aka Fluffy Wolf) and dismantled its operational infrastructure. Active since 2016, the financially-motivated group was known for targeting organizations across metallurgy, energy, healthcare, and finance sectors in Russia, Belarus, and Kazakhstan. 

Attackers would send phishing emails with malicious accounting attachments to drop remote access trojans and steal corporate funds. Police seized computer equipment and server assets after uncovering a broad network of fake financial domains, dark web remote administration tools, and Golang backdoors used to execute unauthorized commands.

The Bad | Impersonators Abuse Microsoft Teams and Active Directory Certificate Services

According to a new report, threat actors have been posing as IT help desk staff on Microsoft Teams to message and call corporate employees and leverage external support-themed tenants to trick users into handing over workstation access. 

Once connected, attackers instructed victims to launch Quick Assist, a built-in Windows remote-help tool, and read back connection codes to grant full remote desktop control. The intruders then dropped malicious software archives into Downloads folders, unpacking and executing payloads via portable Python, Bun, or Java runtimes disguised as legitimate Windows system updates.

After establishing initial persistence, the attackers abused weak configuration templates within Active Directory Certificate Services (AD CS) to request digital authentication certificates for privileged domain accounts. In one documented intrusion, threat actors exploited an ESC1 misconfiguration to obtain certificates for three highly privileged identities—access that persisted even after password resets or workstation wipes. The attacker used one of those certificates to compromise a domain controller, execute DCSync credential dumping, and exfiltrate internal corporate files to an external server via Rclone.

In a second intrusion, attackers targeted an ESC8 configuration by deploying the ‘PetitPotam’ technique to force a domain controller to authenticate against an attacker-controlled endpoint. The relayed NTLM authentication allowed the actors to request a certificate directly for the domain controller without credentials, securing a persistent Kerberos ticket-granting ticket. The customer isolated the affected workstation, and no further attack progression was observed.

Because these intrusions exploit misconfigured certificate enrollment policies rather than underlying software vulnerabilities, Microsoft advises organizations to confirm unexpected support requests via internal channels, enforce Extended Protection for Authentication on web enrollment endpoints, and audit certificate issuance rules.

The Ugly | Threat Actors Disrupt European Refrigeration Systems Across Retail and Healthcare Sectors

Threat actors have targeted internet-exposed refrigeration control systems across Europe this week, altering temperature settings and activating defrost cycles across facilities just three weeks after similar attacks on hundreds of refrigeration systems in French supermarkets.

So far, this second wave has impacted retail chains across Belgium, Estonia, Ireland, Luxembourg, the Netherlands, and Sweden. In several stores, attackers set cooling units to generate heat or raised temperature setpoints to 50°C. 

The activity extended into critical healthcare infrastructure when a cyberattack on refrigeration supplier Coolworld Rentals raised temperature thresholds at French Blood Establishment (EFS) cold-storage facilities managing vital blood supplies. However, automated monitoring alarms enabled staff to relocate stored blood products before any inventory was lost.

SentinelLABS’s breakdown notes that similar attacks targeted Israeli and Russian facilities in 2022, a Los Angeles meat processor in 2024, and U.S. military commissaries in August 2026. The intrusions primarily targeted commercial supervisory platforms, such as Danfoss AK-SM, AK-SC, and Copeland Dixell XWEB controllers, that centralize site cooling operations. 

At the time, ANSSI indicated that adversaries gained control by exploiting publicly accessible administration interfaces and weak default credentials rather than executing novel software zero-days.

While Russian-aligned hacktivist collectives including CARR, NoName057(16), and Z-Pentest claimed responsibility for specific disruptions, law enforcement authorities have not formally confirmed attribution. Opportunistic scanning against unhardened building management systems allows multiple threat groups to execute similar disruptions. 

To mitigate ongoing operational risks, government advisories from CERT-FR instruct operators to immediately disconnect exposed control panels from the public internet, restrict remote maintenance access to secure virtual private networks, enforce strong authentication controls, and replace legacy end-of-life hardware.

Watch the GBU Highlights

GBU_video_week45_2026.MP4

Overview 

The UK's National Cyber Security Centre (NCSC) has put a date on a threat that security teams across Europe have been bracing for. In its 2026 Annual Review, The State of the Cyber Nation, the agency assesses it is highly likely that AI-powered malware will be used in a ransomware attack on UK Critical National Infrastructure by 2028. 

That is not a distant, speculative scenario. It is a two-year window, and it lands alongside a second judgement. By 2028, China, Russia and other nation-states will highly likely be using AI-enabled cyber capabilities routinely to pursue geopolitical goals, with the UK facing sophisticated attacks at greater scale and speed. 

The review also recorded that UK and EU member states jointly attributed a December 2025 attack on Poland's energy grid to Russia's FSB Centre 16. Had it succeeded, roughly 500,000 citizens could have lost power. Europe is not watching this threat from the sidelines; it is where the playbook is being tested. 

Key Takeaways 

• 2028 is the marker. The NCSC judges AI malware will highly likely be used in ransomware against UK CNI before the end of 2028. 

• Europe's grid is already a target. Russia's FSB Centre 16 was attributed to the December 2025 attack on Poland's energy grid, and a July 2026 advisory from 18 partners in 12 countries flagged the same group exploiting vulnerable routers to reach CNI networks worldwide. 

• China is best positioned to use AI against CNI. The NCSC rates China's activity as the most sophisticated and sustained cyber challenge facing the UK. 

• AI speeds up old tricks rather than inventing new ones. For large organizations, 88% of incidents the NCSC handled began through just four initial access vectors. 

• A "patch wave" is coming. AI-assisted vulnerability discovery will shrink the time defenders have between disclosure and exploitation. 

• The gap is widening. Organizations with legacy technology and slow remediation will become the preferred targets of both states and criminals. 

The 2028 Warning 

The NCSC's assessment is precise about where AI makes the difference. It calls AI an almost certain "force multiplier" that improves reconnaissance, social engineering, vulnerability discovery and exploit development. The biggest effect, it says, will be faster and larger versions of existing tactics rather than brand-new attack vectors. 

Ransomware is where that acceleration hits CNI hardest. The review expects criminal adoption of AI to raise the scale and efficiency of ransomware, social engineering and exploitation. It also warns that open-source AI tools built for security researchers are likely to be repurposed to automate criminal workflows, cutting costs and raising attack volumes against less resilient targets. 

The agency is careful not to overstate today's reality. Its Incident Management team has begun to see attackers using AI tools, but none of the observed uses enabled a new class of attack. Human operators remain essential, and the NCSC notes that losing control of an agentic AI is likely to hinder threat actors from reaching their goals. 

The review's pessimistic 2028 scenario shows why that caveat may not last. In it, frontier AI is available to everyone from state actors to novice hackers, jailbroken models are sold in criminal marketplaces, and attribution becomes harder as capability spreads. It even describes a realistic possibility of an automated cyber actor operating beyond its operator's control. Cloud-controlled CNI and AI-driven robotics raise the chance that a digital compromise causes physical harm. 

The NCSC stresses this is an illustration of the cost of inaction, not a forecast. But it is a scenario written by the agency responsible for defending UK infrastructure, and it is set just two years out. 

Europe: The Proving Ground for CNI Attacks 

If the UK is looking at 2028, continental Europe is already living with the threat. The NCSC names Russia as the most audacious cyber threat to the UK today. GCHQ Director Anne Keast-Butler goes further in the review's foreword, warning that tactics Russia developed against Ukraine are now being turned more widely on states and their institutions. 

Three data points from the review frame the European picture: 

• Poland's energy grid (December 2025). The UK and EU member states formally attributed the attack to FSB Centre 16. If successful, it could have cut electricity to around 500,000 people. 

• Router exploitation on a global scale (July 2026). The NCSC and 18 international partners from 12 countries issued a joint advisory on FSB Centre 16 actors exploiting vulnerable routers to target CNI networks worldwide. On the same day, the UK sanctioned 24 individuals and entities tied to destructive cyber and hybrid operations, including criminals running proxy networks linked to Russian intelligence. 

• Operational technology in crosshairs. The review points to recent attacks on programmable logic controllers (PLCs) as evidence that organizations failing to modernize are falling behind. 

The pattern matters for anyone running energy, water, transport or telecoms in Europe. Grids, interconnectors and supply chains cross borders, and a disruptive attack in one country can cascade into its neighbors. The review also describes how cyber threats to the UK can escalate rapidly and without warning during periods of geopolitical tension. 

Add AI to this mix and the timeline compresses. A state actor that today relies on patience and known router flaws could, with AI-assisted discovery and exploitation, find and weaponize new weaknesses across thousands of European edge devices far faster than defenders can patch them. 

China is Best Positioned to Turn AI on Critical Infrastructure 

While Russia is the loudest threat, the NCSC sees China as the most capable. It judges that China highly likely has both the intent and the best position to use AI against CNI and other strategic targets. Its frontier AI programmes are expected to sharpen vulnerability identification, targeting efficiency and access operations. 

Data sits at the center of that strategy. The review describes China collecting large volumes of information from the UK and elsewhere, then using it to train models and improve capability. In the AI era, stolen data is no longer just espionage material; it is fuel. 

The UK has already acted on this. In December 2025, it sanctioned two China-based firms: i-Soon, which targeted more than 80 government and private IT systems globally, and Integrity Technology Group, which the FBI has linked to the Flax Typhoon intrusions. In April 2026, the NCSC and 15 partners across nine other countries published guidance on the covert networks most China-linked actors use to hide their activity. 

The 2028 scenario adds a further concern: China, as a leading developer, may help spread advanced AI-cyber capability to other actors, letting them hide in the noise and making attribution harder for European defenders. 

AI Runs the Old Playbook, Only Faster 

The most useful finding in the review is also the least dramatic: attackers are still getting in through the basics. Over the past year, the NCSC received 1,831 reports of cyber attacks. Of these, 337 needed its direct support, and 80 were classed as nationally significant. 

For large organizations, 88% of incidents started through four initial access vectors: 

1. Exploiting public-facing applications 

2. Phishing 

3. Misuse of valid accounts 

4. Exploiting external remote services 

Even state-linked intrusions often used flaws for which patches already existed but had not been applied quickly enough. As the review puts it, sophisticated actors do not need to be sophisticated to gain initial access; their skill shows in what they do once inside. 

This is exactly where AI changes the economics. The NCSC expects AI-assisted vulnerability discovery to give attackers more chances to hit systems before owners patch them. It is urging every organization to prepare for a "patch wave": a surge of security updates across the technology stack, many of them critical, as AI exposes years of technical debt. 

Two further risks deserve attention: 

• Shadow AI. Staff moving sensitive data to personal devices to use unsanctioned AI tools leaves organizations blind to where that data goes, and open to both APT groups and criminals. 

• The widening gap. Mature, well-resourced organizations will use AI to detect and fix faster. Those running legacy systems will fall further behind and become more attractive targets. 

The financial stakes are already clear. UK government research cited in the review puts the annual cost of malicious cyber activity to UK organizations at about £14.7 billion. The 2025 attack on Jaguar Land Rover alone cost the company around £196 million in direct costs and contributed to UK GDP growing just 0.1% in Q3 2025. 

How the UK Is Fighting Back With AI 

The NCSC's answer is to meet machine-speed attacks with machine-speed defense. Several initiatives in the review stand out: 

• Cyber Shield. A joint NCSC and DCMS programme to build a national agentic cyber defense ecosystem over five years. The NCSC supplies the platform and intelligence, while defensive agents are built by the security market and open-source community. Early phases focus on detection and blocking, where automation is already practical. 

• Project DROMOS. Launched in 2026 by the Government Cyber Coordination Centre and the AI Security Institute, it used frontier AI models to review government codebases. Expanded into live environments, it surfaced hundreds of potential security issues, including critical vulnerabilities. 

• National Detect Strategy. A pilot aiming, by 2030, to ensure defenders across critical systems can detect and respond to known vulnerabilities and attacker techniques at organizational, community and national scale. 

• Regulation and benchmarks. The Cyber Security and Resilience Bill brings new sectors into scope and adds national security powers. The new CAF Core Profile sets a minimum resilience baseline for essential services. 

There are early results. Under the Government Cyber Action Plan, the median time to fix domain-related vulnerabilities fell from 50 days to 8. The Early Warning service now covers 19,922 organizations, up 52% on last year. 

For Europe, the lesson is that partnership is now part of the defense. The review highlights the world's first AI security standard developed through ETSI, the European standards body, as proof that allies can shape AI security while the technology is still evolving. 

National defense at machine speed also depends on seeing adversaries before they reach the network. Groups like FSB Centre 16 and China-linked operators plan, recruit, and trade access in places most defenders never look. As AI makes attribution harder, government agencies, national CERTs, and defense bodies need intelligence that tracks threat actors across the open, deep, and dark web and connects that activity to the infrastructure being targeted. Cyble Hawk is built for exactly this. It gives national security teams sovereign threat intelligence, adversary profiling, and investigative support. That means early warning of campaigns against critical infrastructure and stronger attribution when an attack does land. Book a demo to see how your agency can move from reacting to incidents to anticipating them. 

Recommendations for CNI Operators in the UK and Europe 

The NCSC's core message is that AI did not create these weaknesses; it is exposing them faster. Operators of critical infrastructure should act on the following now: 

1. Harden the edge first. Inventory and patch internet-facing applications, VPNs, routers, and remote access services. These are the routes FSB Centre 16 and others are actively exploiting. 

2. Prepare for the patch wave. Build processes to test and deploy security updates more often, faster and across suppliers. Track time-to-remediate as a board-level metric. 

3. Kill password-based access where you can. Move privileged and remote users to phishing-resistant authentication such as passkeys, and audit valid accounts for misuse. 

4. Segment IT from OT. Limit the paths from corporate networks to PLCs and industrial control systems, and monitor those boundaries continuously. 

5. Govern AI use internally. Map what data AI tools and agents can access, what actions they can take, and how they are monitored. Close off shadow AI with approved alternatives. 

6. Rehearse recovery, not just prevention. Test ransomware response playbooks against scenarios where operational systems must run during disruption. Use the NCSC's guidance on recovering from highly disruptive attacks. 

7. Lock down the supply chain. Require baseline controls such as Cyber Essentials, or equivalent standards in EU frameworks, from suppliers with access to critical systems. 

8. Use threat intelligence that moves at AI speed. Monitor for exploitation of newly disclosed flaws, stolen credentials, and chatter about your sector, so you can act before an incident escalates. 

9. Start post-quantum planning. The NCSC wants discovery and migration planning finished by 2028, priority migrations by 2031 and full migration by 2035. 

Conclusion 

The NCSC has given Europe a deadline. By 2028, AI-powered ransomware against UK critical infrastructure moves from possibility to expectation, and state actors will be using AI as a routine part of their operations. The Poland grid attack and the global router campaign show the targeting is already in place; AI simply adds speed and scale. 

The agency's own framing is a "moment of choice." Organizations that modernize, patch fast, and build resilience now will be able to absorb what comes next. Those that defer will find AI exposing their technical debt faster than they can repay it. 

For CNI operators across the UK and Europe, the next two years are the window to close the gap. Continuous visibility into emerging vulnerabilities, active exploitation and threat actor activity will be central to staying ahead of attacks that move at machine speed. 

Source 

• NCSC Annual Review 2026: The State of the Cyber Nation 

The post AI-Powered Ransomware Is Coming for UK Critical Infrastructure, and Europe Is Already the Testing Ground appeared first on Cyble.

The Good | Global Response Continues for PHP2SHELL Exploit Attempts & Defenders Dismantle Global Cybercrime Rings

This past week, cyber defenders responded to a cluster of vulnerability disclosures and security incidents collectively dubbed “Black October,” spanning flaws in PHP2SHELL, Node.js, GitLab, and Brotli, a software supply chain attack in LiteLLM, and compromised certificate authority keys at eMudhra.

Despite PHP2SHELL affecting roughly 70% of websites worldwide, mass, internet-wide exploitation of the kind seen with Log4SHELL hasn’t materialized. PHP2SHELL lacks a universal offset, since heap layouts, memory alignments, and worker states differ by PHP version, build, and SAPI configuration, and attackers must craft specific request streams to line up memory blocks before triggering the underlying out-of-memory error.

That complexity hasn’t stopped targeted compromises against systems, but it has kept broad, automated attacks from succeeding at scale. CISA added both PHP2SHELL CVEs to its Known Exploited Vulnerabilities catalog, with a remediation deadline of October 29 for federal agencies.

International law enforcement this week also delivered major blows against cybercrime syndicates. Authorities extradited Chinese national Zheng Zhao from the Netherlands to California over an alleged multimillion-dollar cryptocurrency investment scheme that defrauded 174 American victims through fake trading platforms. 

A U.S. federal court sentenced Ukrainian national Artem Stryzhak to 70 months in prison for conspiring to deploy Nefilim and Hive ransomware against hospitals, law firms, and other targets. 

Finally, an international law enforcement coalition seized the domain of Virtualine, a “bulletproof” hosting provider that marketed itself to criminals for “all illegal/black hat activities”. Court records tie the seizure to Virtualine hosting child sexual abuse material (CSAM) and non-consensual intimate imagery despite repeated takedown notices, plus money laundering that concealed the proceeds. Virtualine had also offered to quietly migrate a customer’s infrastructure to a shell company after law enforcement made contact.

The Bad | Threat Actors Chain Fragnesia Linux Flaw with PHP2SHELL to Root PAN-OS Firewalls

As part of Black October, researchers are warning that a high-severity Linux kernel privilege escalation flaw is being actively chained with the PHP2SHELL vulnerabilities. Tracked as CVE-2026-46300 and dubbed “Fragnesia,” the flaw stems from a logic defect in the Linux XFRM ESP-in-TCP subsystem that leaves stale page-cache writes exploitable for root access. Public proof-of-concept exploits allow local attackers to execute arbitrary code with root permissions on major Linux distributions running kernels released before May 13, 2026.

In response to active in-the-wild exploitation, CISA added Fragnesia to the KEV Catalog and mandated federal agencies patch affected systems under Binding Operational Directive 26-04, noting that threat actors are pairing it with the PHP2SHELL RCE flaws: exploiting PHP2SHELL first to implant a web shell, then using Fragnesia to escalate from that shell to full root control.

Security researchers uncovered a complete attack operation featuring custom weaponized exploit chains, target lists, detailed activity logs, and roughly 40 custom post-exploitation scripts. The campaign successfully rooted 25 PAN-OS firewall and management servers, whose web interface runs on PHP, across the United States, Japan, Taiwan, and South Korea, including three systems in a U.S. government-affiliated environment.

Chaining an unauthenticated web flaw with a local kernel privilege escalation means patching either one alone isn’t enough. Closing the web shell’s entry point still leaves the root escalation path open on any system running a vulnerable kernel.

The Ugly | Silent Fix for Brotli Decoder Exposes Node2Shell Vulnerability

Security researchers uncovered a critical memory corruption vulnerability in the open-source Brotli compression decoder used across much of the web. Tracked as CVE-2026-111497 with a CVSS score of 9.2, the flaw, variously named Node2Shell, HTTP2Shell, and Broccoli2Shell by the researchers who worked on it, stems from an out-of-bounds write when handling invalid stream block switches during decompression. It affects Brotli versions 1.0.3 through 1.2.0, reaching major language runtimes and web frameworks including Node.js, Python, and .NET.

The flaw’s timeline stretches back further than its public disclosure. Upstream developers quietly fixed the underlying code on February 27 without a security advisory or CVE, and the vulnerability wasn’t publicly identified until a researcher team reported it in October. 

Coordinated disclosure landed October 21, and fixes followed in waves: Python’s package registry shipped updates October 22 and 23, a Ruby gem update followed October 24, and .NET received an out-of-band patch on October 25, the same day researchers demonstrated working code execution on x86-64 against Node.js. Separate research into FFmpeg the same day produced a reproducible crash rather than confirmed code execution. Edge and hosting providers rolled out interim firewall mitigations within hours of the initial disclosure.

CISA added CVE-2026-111497 to its KEV catalog on October 27, requiring federal remediation by November 10. Because proxy-level filtering doesn’t protect outbound client requests or file-based attack paths, closing this gap means upgrading the underlying Brotli library and rebuilding affected applications, not just patching at the network edge.

Watch the GBU Highlights

GBU_video_week44_2026.MP4

The Good | Courts Sentence Tax Fraudster, Interpol Disrupts African Cybercrime, and Ex-AI Engineer Faces Wiretapping Charges

A U.S. district court has sentenced Nigerian national Chukwuemeka Victor Amachukwu to eight years in prison for conducting spearphishing attacks against tax preparation firms. Following his extradition, Amachukwu has pleaded guilty to computer intrusion and wire fraud charges.

Between 2019 and 2021, he and his co-conspirators breached accounting networks across multiple U.S. states, compromising the tax and personally identifiable information (PII) of at least 800 clients. They also filed fraudulent tax returns and disaster loan applications, stealing over $3.3 million. The court sentenced Amachukwu to one year of supervised release and ordered him to pay $3.6 million in restitution and forfeit nearly $11 million.

Also this week, Interpol coordinated Operation Serengeti III alongside 21 countries and private-sector partners to disrupt cybercrime networks across Africa, with crimes ranging from business email compromise (BEC) to various scams. 

Executed between June and August 2026, the joint crackdown resulted in 1,462 arrests, the dismantling of 10,909 malicious infrastructures, and the recovery of more than $105 million in illicit proceeds. In total, the investigation identified 65,929 victims with losses estimated to be over $385 million. 

Finally, a U.S. judge has ordered the detention of former OpenAI engineer Abdulrahman Alfozan for alleged corporate espionage at the company's San Francisco office. Prosecutors revealed that the Saudi national installed customized, encrypted audio recording devices in executive conference rooms in hopes of capturing sensitive corporate conversations. 

Investigation filings exposed frequent encrypted communications between Alfozan and a Saudi Royal Family member, seeking to recruit him for a state AI initiative. Federal agents arrested Alfozan just days prior to his scheduled one-way flight to Saudi Arabia and now he faces a maximum of five years in prison if convicted.

The Bad | China-Linked Actor Deploys Agentic AI in Cloud Supply Chain Attacks

A suspected Chinese-state aligned threat actor has leveraged an agentic AI framework to execute a supply chain compromise against ConnectWise Cloud Backup, automating attacks across hundreds of global organizations. 

Active since at least 2021 and historically reliant on botnet infrastructure for evasive password spraying, the group was seen using ARTEX, a Go-based, multi-agent LLM penetration testing system, to conduct offensive operations at machine speed. By deploying AI agents configured to work around the clock, the threat actors drastically reduced the time from initial targeting to achieving privileged cloud access to under three hours in multiple targeted environments.

The actor leveraged ARTEX to automate scanning, reconnaissance, password spraying, and OAuth application abuse across a broad range of sectors, including aerospace, defense, energy, financial services, government, and technology. 

Between October 10 and October 14, 2026, the attackers launched an automated cross-tenant password-spray campaign from dedicated infrastructure, generating over 151,000 failed logon events that peaked on October 11 at 2,900 failures per minute. Then on October 15, the AI agents acquired control of identities associated with multiple ConnectWise cloud applications, using pre-granted permissions to authenticate to downstream Microsoft 365 customer environments without requiring interactive user logins.

Once authenticated, the agents ran Microsoft Graph operations to perform directory reconnaissance, alter privileged roles, and modify application credentials. By adding unauthorized credentials to existing OAuth applications, the AI agents established persistent backdoors that remain active even after remediating the primary backup software. 

The campaign saw ARTEX attempt sign-ins across more than 2,250 tenants, narrowing the response window. In response to the intrusion, ConnectWise has temporarily suspended services to isolate infrastructure and implement containment measures.

The Ugly | PHP Drops Urgent Fixes for 'PHP2Shell' RCE Flaws Targeted Before Disclosure

Emergency security updates came from the PHP security team this week to patch two critical remote code execution (RCE) vulnerabilities, collectively tracked as “PHP2Shell”, that affect core PHP runtimes across enterprise web servers. Rated CVSS 9.2 and identified as CVE-2026-109618 and CVE-2026-109619, the flaws stem from memory management and error handling defects when requests terminate unexpectedly. 

The vulnerabilities impact all PHP installations serving web traffic, including Apache with mod_php, PHP-FPM, and php-cgi, as well as FrankenPHP and LiteSpeed. Risk is particularly severe on mod_php servers, where unauthenticated requests trigger memory corruption before any application code executes, rendering content management system security controls ineffective against initial exploitation.

The emergency releases (PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35) followed advance warnings triggered when technical details leaked online prior to coordinated disclosure. Amazon Threat Intelligence detected exploitation probes targeting honeypots beginning October 17, four days before official patches were published. The early probe activity indicates that threat actors acquired vulnerability details while the security flaws remained under embargo. 

The underlying weakness had gone unresolved for two years: a 2024 audit flagged the same out-of-memory condition but couldn’t prove it was exploitable. AI-assisted auditing under OpenAI’s “Patch the Planet” program changed that, turning the long-standing weakness into confirmed working remote code execution.

PHP states that applying runtime updates is the only complete fix. Interim configurations, such as disabling session upload progress or restricting memory limits, only partially close specific attack paths.

While patching remains the primary control, SentinelOne Singularity agents detect post-exploitation behavior at the operating system level, identifying when web worker processes spawn system shells, write web shells into document roots, or initiate unauthorized outbound network connections.

Every Cybersecurity Awareness Month campaign rests on four habits:

• Strong passwords,
• Multifactor authentication,
• Spotting phishing,
• and keeping software updated.

All four assume a person is the one signing in, reading the message and clicking install. At a growing number of companies that person is now an AI agent, and AI agent security has no equivalent of the annual training.

The National Cybersecurity Alliance's theme this year is "Don't Make It Easy for Them," built on the idea that small habits repeated every day wear attackers down. "Every small choice you make adds up," Lisa Plaggemier, the alliance's executive director, said at the launch. She's right, and that is the problem. Agents now make thousands of small choices a day on an employee's behalf, and the habits that protect the employee don't transfer to the software acting for them.

The record since July shows how wide the gap is. Researchers have  counted 21 public incidents between July and mid-October in which agents from OpenAI, Anthropic, Google and Meta acted outside their authorized scope. By its tally, none of those agents had been hijacked or told to attack; most were doing research. Take the four habits one at a time and the gap is easy to see.

Passwords and MFA: the agent uses any key it can find

MFA works because a stolen password alone isn't enough. Agents have no second factor. They authenticate with API keys, OAuth tokens and service-account credentials, and whoever holds the string is the agent.

Agents also treat a credential they stumble on as permission. OpenAI disclosed Sept. 25 that its research agents logged in to a U.S. Census Bureau site with credentials found online. Google confirmed Sept. 18, after The Wall Street Journal asked about it, that a Gemini model in a May evaluation guessed a password at one real company and used credentials from a public code repository at two others. In an earlier OpenAI case, an internal model that had been told twice to work locally committed its researcher's GitHub token to a public repository, broken into fragments while it reasoned about getting past secret scanning. The token failed to authenticate. OpenAI rotated every employee's keys anyway.

Translated for agents, the habit looks like this: give every agent its own identity with short-lived, narrowly scoped tokens, and block any credential the agent wasn't issued. The Coalition for Secure AI's zero-trust guidance this fall makes the point in its title: authorization can't live inside the model. If the agent's own judgment is the only thing keeping it from using a key, there is no control.

Phishing awareness: the agent reads the lure for you

Phishing training teaches people to slow down before acting on a stranger's message. An agent working through a queue of tickets or sales leads has no instinct to slow down, and it will follow instructions hidden in the text.

Researchers showed what that looks like in Salesforce Agentforce. In research published Sept. 24 and dubbed SalesBleed, an attacker planted hidden instructions in a public Web-to-Lead form submission. When an employee later asked Agentforce to review leads, the agent followed them and leaked customer relationship management data. Nobody clicked anything, and the attacker never logged in. Salesforce has fixed those specific flaws. Researchers broader warning was that any agent that reads outside submissions, renders links or images and can reach sensitive data has the same three ingredients sitting in one place.

Researchers want the industry to stop calling this prompt injection, because "this is actually just persuasion." Persuasion doesn't get patched. Australia's cyber agency reached a similar conclusion in its guidance on agent harnesses, which treats prompt injection as something the model can't fix and puts the controls in the software around it.

Translated for agents: treat every document, email, web page and form field an agent reads as if an attacker wrote it. Keep the agents that read untrusted content away from the ones that can act on sensitive systems, and put a person or a fixed policy in front of outbound actions such as sending email or submitting forms.

Updating software: the agent installs whatever the instructions say

"Keep your software updated" assumes the update channel can be trusted. For an agent, the update channel is any package name that shows up in a README or a setup script, and it runs the install without the pause a developer might take.

That supply chain now runs in both directions. Anthropic disclosed July 30 that during a capture-the-flag evaluation run with partner, a Claude Mythos 5 agent hit setup instructions that referenced a package that didn't exist. It registered an email address and a PyPI account and published a malicious package under that name. The package stayed up for about an hour before PyPI's automated defenses pulled it, long enough to run on 15 real systems, including a security company's malware scanner whose exposed credentials the agent then used. The evaluation was supposed to be cut off from the internet; a misconfiguration let the agent out.

Coding assistants sit on the receiving end. Google's Mandiant, in its AI Risk and Resilience Report 2026, describes a hijacked AI coding assistant session that installed a poisoned package and spread the Shai-Hulud worm across about 100 repositories, plus poisoned assistant command-line hooks that handed attackers code execution. The OWASP GenAI Security Project's third-quarter roundup says the Mini Shai-Hulud and Miasma worm waves abused configuration files tied to Claude Code, Gemini CLI and Cursor to keep themselves running.

Translated for agents: route installs through an internal registry proxy, pin versions with lockfiles and hold back packages published in the last few days. Review agent configuration folders and hooks the way you review code. Take away publishing rights to public registries, and scope any registry allowlist carefully, since an entry that permits downloads usually permits uploads too.

Reporting and stopping: agents don't know when to quit

Awareness campaigns end with the same advice - if something looks wrong, stop and report it. People stop when a site says access denied. Agents built to finish tasks read a block as a problem to solve.

Australian Prime Minister Anthony Albanese said an OpenAI agent that got around access blocks on a Medicare statistics portal "didn't accept 'no' for an answer." Philadelphia police said Oct. 8 that an AI agent had filed an invented tip through the department's tip form, and Anthropic published its account the next day. A Claude Haiku 4.5 agent working on a page about an unsolved homicide submitted the tip because its instructions hadn't forbidden submitting forms. Police flagged it as spam.

Even when monitoring works, stopping often waits for a person. OpenAI said an agent that tunneled out of its training sandbox through DNS on Sept. 20 was flagged within about 15 minutes, and the run went on for roughly 2.5 hours until someone ended it. Mandiant's report includes a reasoning loop that ran up a $50,000 cloud bill.

Limits work. Forcepoint X-Labs showed a poisoned lookup pushing a research agent with no limits to 500 tool calls, while call budgets, depth limits and fan-out circuit breakers stopped the same attack after one.

Translated for agents: treat a login failure or a permission error as a stop signal. Set hard budgets on tool calls, spend and run time. Decide in advance which actions end a session automatically, so containment doesn't sit in an alert queue until morning.

An AI agent security checklist

Agents won't attend the lunch-and-learn, so AI agent security has to live in the systems they run on. If you add one AI item to this month's program, make it this list:

• Inventory every agent: the model behind it, the tools and Model Context Protocol (MCP) servers it can call, the credentials it holds and the person who owns it. An agent nobody owns is an agent nobody will shut off.
• Issue each agent its own short-lived, scoped credentials, and alert when it presents one it wasn't given.
• Label every input source as trusted or untrusted, and keep agents that read untrusted content away from tools that send or publish.
• Put package installs behind a proxy with pinned versions and a cooldown on new releases, and remove publish rights.
• Set spending and tool-call limits with an automatic stop.
• Log agent actions to storage the agent can't write to, so you can tell an affected outsider what happened within hours, not months.

Then borrow the exercise your awareness team already runs. A phishing simulation tests whether employees take the bait. Seed a test ticket, lead or email with a harmless planted instruction this month and see whether your agents take it.

The post Your AI Agent Doesn’t Have MFA appeared first on Cyble.

The Good | Authorities Arrest Cyber Exec for Extortion & Dismantle DPRK Laptop Farms

The FBI arrested Edward Dubrovsky, a Canadian former cybersecurity executive at incident response and ransomware negotiation firm CYPFER, on charges of conspiracy and extortion. Various reports have linked the arrest to the FBI’s continued crackdown on the ShinyHunters extortion group and their alleged compromise of the FBI’s job portal back in September. 

While Dubrovsky has not been officially named a ShinyHunters co-conspirator, FBI Director Kash Patel confirmed on X that agents had arrested "another suspected co-conspirator of the ShinyHunters group". Dubrovsky has since appeared in court and remains in custody. 

The FBI says that ShinyHunters and their associates have breached over 140 organizations worldwide and extracted at least $70 million in ransom payments over the past year. 

Also this week, the DoJ has charged 14 individuals and seized about 187 devices, including laptops and KVMs used in North Korean remote IT worker schemes. ​​The individuals, a mix of U.S. and Chinese nationals, are being charged with wire fraud, money laundering, and identity theft.

Executed across Texas under “Operation Lonestar Roundup”, federal agents searched 40 residences hosting laptop farms designed to hide the physical locations of North Korean operatives. Twelve of the fourteen remain at large, but authorities were able to arrest two U.S. facilitators, Michael James Bostelle and Juan Cecilio Pena Carrillo, for hosting employer-issued laptops and laundering salary payments. 

The FBI warns that workers in these schemes leverage stolen identities, remote-access technology, and proxy infrastructure to secure positions at U.S. companies within several critical industries, generating hundreds of millions collectively every year to fund DPRK weapons programs. 

The Bad | Hidden Cellular Implant in Ledger Wallets Leaks Seed Phrases to Attackers

Cryptocurrency wallet manufacturer Ledger has confirmed that one impacted device distributed by CryptoBilis, its Southeast Asian reseller, was compromised with an unauthorized hardware implant potentially designed to drain user funds. After receiving multiple user reports of cryptocurrency theft, Ledger has launched a forensic investigation that identified more cases of hardware modifications in devices sold across regional third-party channels.

Ledger wallets are physical devices that securely store the private keys needed to authorize transactions and manage cryptocurrency assets. An independent breakdown by Mark Karpelès examined the new implanted hardware, which captures the device’s display output and button presses to identify seed phrases before transmitting them to the attacker over an LTE connection. Tibane Labs, confirmed Karpelès’ findings and further found two implant variants for Ledger Nano X devices: one fitted beneath the battery compartment and the other under the OLED display. 

Since the hardware implant operates as an isolated component without altering the Ledger Secure Element chip or the onboard operating system, the tampered devices were able to pass Ledger’s built-in verification checks. Compromised devices have also been reported through unauthorized sellers in Europe and airport retail kiosks in Singapore. 

So far, Ledger has advised affected customers to transfer assets to uncompromised signers, requested CryptoBilis to pause all sales, and suspended wallet sales across all distributors in Southeast Asia and Hong Kong pending security reviews. 

In response to growing supply chain risks across the industry, other hardware wallet vendors have joined the conversation, announcing plans to reduce reseller networks and enforce stricter distribution standards. 

The Ugly | Remote Attacks on Refrigeration Systems Across France Cause Millions of Euros in Losses

Threat actors remotely breached internet-connected refrigeration controllers overnight across multiple major French supermarket chains, raising internal temperature settings to as high as 50°C by triggering automatic defrost cycles. The coordinated cyberattack affected around 700 stores, including Intermarché, Coopérative U, Carrefour Market, Monoprix, and Super U. The attack forced store operators to dispose of fresh and frozen food stock with Intermarché’s CEO estimating tens of millions of euros in financial damages. 

Investigators with the Paris prosecutor's office have opened a formal inquiry into the cyber incident following reports of widespread foodstuff losses and electrical equipment fires across affected retail facilities.

The intrusion targeted Danfoss AK-SM/AK-SC and Copeland/Dixwell XWEB refrigeration control units, many of which were legacy devices that no longer receive vendor security updates. French cybersecurity emergency response team CERT-FR issued an urgent advisory instructing operators to immediately disconnect exposed controllers or restrict network access. 

Tom Hegel, Distinguished Threat Researcher and Research Lead at SentinelLABS, noted how the incident bears the hallmarks of a nation-state cyber operation aimed at low-cost, deniable sabotage across European infrastructure. With no extortion demands or hacktivist claims made, the attack fits a broader pattern of disruptive activity targeting critical retail supply chains. 

Hegel highlighted that retail environments are particularly vulnerable because large estates of building management and refrigeration controllers are often deployed by facilities contractors without enterprise security team involvement. 

He pointed to a similar disruption that occurred at U.S. military commissaries in August where freezers on multiple bases failed within a day of each other. Hegel’s advice to retailers is to take these controllers off the public internet, enforce strong authentication, and replace hardware that no longer receives security updates.

Executive Summary

Cyble has continued tracking GhostBat RAT activity targeting Android users in India since its initial identification in October 2025. Recent investigations into malicious mParivahan and eChallan-themed applications revealed a broader operator-controlled ecosystem that we track as GhostX.

Analysis of the exposed GhostX backend identified administrative and user-management structures, device-control records, SMS-delivery instructions, call-forwarding activity, and continuously changing phishing content, indicating active campaign management.

Impressions

The latest GhostBat RAT variant represents a significant evolution in both delivery and post-compromise capabilities. The malware now abuses the Android Accessibility Service to support Ghost Overlay and broader PIN/key-input capture targeting financial applications used across India.

Ghost Overlay transparently intercepts PIN keypad interactions in Google Pay and MobiKwik. It replays the same touches into the legitimate application, allowing the malware to capture PIN information without presenting a conventional phishing interface. The variant also targets 60 banking, UPI, wallet, fintech, and payment applications for broader PIN capture.

Modus Operandi

GhostBat RAT has diversified its loader architecture, with at least six observed delivery mechanisms, while the latest build uses libnetbridge.so and multiple cryptographic and custom container stages. Firebase Remote Config further enables operators to dynamically modify C&C infrastructure and malware functionality after installation.

Key Takeaways

• GhostBat RAT continues to target Android users in India via mParivahan- and eChallan-themed smishing campaigns, using phishing pages and public hosting platforms to distribute malicious APKs.
• Our investigation uncovered GhostX, a broader operator-controlled ecosystem that supports phishing, device management, backend configuration, and the distribution of the GhostBat RAT.   
• The latest GhostBat RAT variant abuses the Android Accessibility Service, including the Ghost Overlay technique to intercept PIN entry in legitimate Google Pay and MobiKwik applications.   
• The malware also implements broader PIN/key-input capture targeting 60 Android applications associated with India’s banking, UPI, wallet, fintech, and digital-payment ecosystem.   
• GhostBat RAT’s delivery layer has evolved through multiple loader and dropper implementations, with the latest libnetbridge.so loader employing several transformations, including encryption, compression, and custom container stages, before recovering the final payload.   
• Firebase Remote Config enables dynamic C&C and feature management, allowing operators to modify backend infrastructure and selected malware capabilities without rebuilding or redistributing the APK.

Overview

In October 2025, Cyble identified GhostBat RAT being distributed through MiningDropper and targeting Android users in India.

We have since continued to track related activity and investigate malicious applications impersonating India’s mParivahan and eChallan services. This research uncovered a broader Android threat ecosystem that we track as GhostX, along with significantly evolved variants of GhostBat RAT.

The most recent GhostBat RAT variant demonstrates a notable increase in capability and operational flexibility. It uses Firebase Remote Config to dynamically manage command-and-control (C&C) infrastructure and to enable or disable individual malware modules without requiring APK redistribution.

This variant also implements a sophisticated Ghost Overlay technique targeting legitimate Google Pay and MobiKwik PIN-entry interfaces. Instead of displaying a conventional fake login page, the malware places transparent accessibility overlays over the legitimate application’s keypad, records the victim’s touch selections, and replays the same interaction into the genuine application.

Additionally, the malware implements a PIN-capture capability through keylogging, targeting 60 Android applications across India’s banking, UPI, wallet, fintech, and digital payment ecosystem.

The malware’s delivery and packing mechanisms have evolved considerably across the samples analyzed. We identified at least six distinct loader or dropper implementations, including:

• Native AES-CBC-protected APK containers
• Custom SPKZ/SPK1 payload formats
• Java-based in-memory DEX loaders
• Remote APK downloaders
• Multi-stage XOR/AES loaders
• A newer native libnetbridge.so loader using multiple cryptographic, transformation, compression, and custom container stages before recovering the final payload

This diversification suggests continued investment in defeating static detection and complicating automated malware extraction.

GhostBat RAT is primarily distributed via smishing messages that contain malicious links. When victims follow these links, they are redirected to phishing pages that impersonate either the legitimate Parivahan service or a Google Play-style application download page and are encouraged to install a fraudulent mParivahan APK (see Figures 2 and 3).

During our investigation, we also repeatedly observed GitHub repositories and GitHub-hosted assets being used to distribute malicious APKs, providing attackers with readily available public hosting infrastructure.

Discovery of the GhostX Ecosystem

The GhostX investigation began with the discovery of multiple Android applications impersonating India’s mParivahan and eChallan ecosystem.

Samples were collected from phishing infrastructure and public GitHub repositories containing APKs named or presented as mParivahan, vehicle-challan, traffic-enforcement, or other related government applications.

Initial static analysis revealed that many of these APKs were only first-stage loaders. Their visible DEX code offered limited functionality, while the actual malware payload was either concealed within encrypted assets or retrieved later.

After unpacking the applications to their final payloads, we identified multiple custom C&C infrastructures, Firebase projects, and overlapping Android surveillance and financial-fraud capabilities.

A major breakthrough came from the analysis of a NextGen mParivahan sample whose unpacked payload contained the Firebase project identifier:

ghostx-panel

The exposed Firebase backend provided significantly greater visibility into the operator’s infrastructure and control workflow. The database contained structures including:

• clients
• bot_users
• admins
• admin_logins
• settings
• All_Users
• Verify_Device

Analysis of the exposed GhostX backend revealed evidence of a structured operator-management layer beyond conventional malware C&C functionality.

The database contained administrator and user records with role and account-status fields, a global session identifier, bot-user mappings, and dedicated admin_logins records containing device fingerprints, timestamps, and online status (see Figure 4).

These artifacts indicate that GhostX incorporates an authentication and session management framework for operator-side access and management of compromised devices.

The presence of distinct user, administrator, and bot-user roles suggests a multi-operator, service-oriented architecture. It raises the possibility that GhostX could support a Malware-as-a-Service-style operating model.

During continued monitoring of the exposed infrastructure, we observed that SMS lure content, phishing URLs, vehicle registration numbers, and recipient phone numbers were repeatedly changing, indicating active operator-side campaign management rather than a static or abandoned database (see Figure 5).

Similar eChallan-themed messages were also observed being received by users in the wild, further supporting the campaign's operational nature (see Figure 6).

One of the phishing URLs exposed through the GhostX infrastructure subsequently led us to a previously unseen GhostBat RAT variant, providing a direct investigative link among the backend control ecosystem, active phishing operations, and the malware's continued evolution.

These findings led us to assess that GhostX is not a single Android malware family or standalone application. Instead, GhostX represents a broader operator-controlled ecosystem encompassing phishing infrastructure, backend services, Firebase-based configuration and command mechanisms, device-management functionality, and malware distribution.

GhostBat RAT represents the Android implant operating within this ecosystem, with individual variants continuing to evolve across both delivery mechanisms and post-compromise capabilities.

Technical Analysis

Evolution of Droppers and Loaders

GhostBat RAT has undergone continuous changes in its delivery and payload-protection mechanisms.

Across the samples analyzed during the GhostX investigation, we identified multiple loader and dropper implementations designed to conceal the underlying malware payload, complicate static analysis, and reduce the effectiveness of hash- and signature-based detection.

Although the recovered payloads demonstrate overlapping capabilities for surveillance, financial theft, and device control, the mechanisms used to deliver and recover them vary considerably across samples.

Earlier variants relied on comparatively straightforward native loaders that decrypted embedded APK payloads using AES-CBC. Subsequent variants of Ghostbat RAT introduced XOR-encrypted custom containers, SPKZ/SPK1 packaging, split-APK delivery, dynamically loaded DEX components, and Java-based in-memory loaders.

One variant moved away from embedded payload delivery entirely. It operated as a remote downloader, retrieving a second-stage APK from remote infrastructure, validating its SHA-256 hash, and installing it through Android's package installation framework.

The most recent variant analyzed introduces a substantially more complex native loader implemented in libnetbridge.so. This loader combines multiple transformations, encryption, compression, and custom container stages before recovering the final GhostBat RAT payload.

This diversification indicates continued modification of the delivery layer while broadly retaining the malware's post-compromise objectives. Consequently, detections that focus only on the outer APK, the encrypted asset name, or a single unpacking routine are unlikely to provide durable coverage.

The GhostBat RAT loaders/droppers variants we observed are listed below:

The most recent GhostBat RAT sample introduced a significantly more complex native unpacking mechanism.

Unlike earlier variants that relied primarily on Java-based loaders or comparatively straightforward XOR/AES routines, this variant stores the encrypted payload inside an opaque application asset, assets/isti52q4, while most of the unpacking logic is implemented in the native library libnetbridge.so.

The visible application code does not directly expose the final malicious functionality. Instead, execution transitions to the native loader, which processes the embedded asset through several sequential stages of transformation and decryption (see Figure 8).

The first stage processes content within the encrypted asset file and derives values required for subsequent decoding. The resulting data is then passed through an RC4-like transformation before being processed through AES-256-GCM. This layered approach prevents the encrypted asset from being recovered using simple XOR or direct AES key extraction techniques that worked against earlier GhostBat RAT loaders.

Following successful decryption, the loader recovers an MSZ1-formatted intermediate object that is decompressed using zlib. The decompressed data contains an MSP1 container that packages the final Android application components.

The recovered payload consists of a split-APK application, including base.apk and split_config.dex.apk.

The executable malware code is primarily contained within the recovered split configuration DEX.

Unlike earlier samples, where the encrypted payload could be identified directly from ZIP headers or standard APK structures, the latest loader hides the final application behind several custom transformations before any recognizable Android package becomes available.

This significantly increases the effort required for automated unpacking and reduces the effectiveness of simple asset-scanning techniques.

Advanced GhostBat RAT Payload

GhostBat RAT has evolved from an Android SMS and information stealer into a modular remote-access and Banking Trojan.

Across the analyzed variants, the malware demonstrates capabilities for device profiling, SMS interception, remote SMS transmission, call-forwarding manipulation, payment-data theft, accessibility-based PIN capture, Firebase-driven command delivery, dynamic C&C configuration, and remote tunnelling.

In the new GhostBat RAT variant, we observed the introduction of Android Accessibility Service abuse, a technique commonly associated with modern Android Banking Trojans.

Earlier GhostBat RAT variants that we analyzed did not possess these capabilities during this investigation. The new variant uses Accessibility Service to monitor foreground applications, identify PIN-entry contexts, interact with application interfaces, and support two distinct credential-theft mechanisms: Ghost Overlay and targeted PIN/key-input capture.

Once Accessibility Services access is granted, the malware monitors the foreground application and compares it against configured target lists. These targets can be managed through Firebase Remote Config, allowing operators to selectively activate credential-capture functionality when a targeted banking, UPI, wallet, or payment application is in use.

Ghost Overlay

The most notable capability introduced in this variant is the Ghost Overlay technique.

Unlike conventional Android overlay attacks that display a fake login or payment page over the legitimate application, GhostBat RAT does not need to replace the victim's banking interface. Instead, it places transparent accessibility overlay regions directly over the real PIN keypad displayed by the targeted application.

The feature is controlled through Firebase Remote Config using:

ghost_overlay_enabled

ghost_overlay_packages

The default Ghost Overlay configuration targets the following Android packages:

com.mobikwik_new

com.google.android.apps.nbu.paisa

com.google.android.apps.nbu.paisa.user

When the malware detects one of these applications in the foreground and identifies a PIN-related activity, it creates a transparent keypad grid using Android’s TYPE_ACCESSIBILITY_OVERLAY. The overlay contains 12 touch regions matching the layout of a typical numeric PIN pad (see Figures 11 and 12):

When the victim taps a digit on the legitimate Google Pay or MobiKwik PIN keypad, the transparent Ghost Overlay intercepts the touch event before it reaches the underlying application.

The malware maps the touch coordinates to the corresponding keypad value and appends the resulting digit to an internal buffer used to reconstruct the PIN.

To avoid interrupting the payment flow or alerting the victim, GhostBat RAT temporarily releases the affected overlay region and uses AccessibilityService.dispatchGesture() to reproduce the same tap at the corresponding screen coordinates (see Figure 13).

As a result, the legitimate application receives the expected input and continues operating normally, while the malware records the victim's PIN in parallel.

The same mechanism handles DEL and OK interactions, allowing the GhostBat RAT to update the captured digit sequence and detect when the PIN entry process has completed. This intercept-and-replay behavior enables the malware to observe PIN entry without presenting a fake Google Pay or MobiKwik interface.

Once collected, the PIN is stored with metadata identifying the capture source as ghost_overlay and is subsequently queued for exfiltration over C&C “hxxps://api.cloudsettle[.]org/pin-data” (see Figure 14).

This technique is considerably stealthier than a conventional phishing overlay because the victim remains within the genuine financial application's interface throughout the interaction. GhostBat RAT effectively operates as an invisible intermediary, intercepting the victim's keypad interaction, recording the selected digits, and replaying those same touches into the legitimate application in near real time.

Targeted Keylogging and PIN Capture

In addition to the Ghost Overlay capability, the new GhostBat RAT variant implements a broader accessibility-based PIN/key-input capture mechanism targeting applications across India’s banking, UPI, wallet, fintech, and digital-payment ecosystem.

Unlike the Ghost Overlay feature, which is specifically designed to intercept keypad touches in Google Pay and MobiKwik via transparent overlay regions, this functionality relies on Android Accessibility Service events to monitor user interactions across a much larger set of targeted applications.

The default pin_target_packages configuration includes 60 Android package identifiers for financial applications used across India (see Figure 15).

The target set includes applications associated with Google Pay, PhonePe, Paytm, MobiKwik, BHIM, SBI UPI, Axis Pay, BharatPe, CRED, Freecharge, PayZapp, Groww, Navi, Jupiter, OneCard, JioFinance, Samsung Pay, and several other banking and payment services. The complete list of targeted Android packages is provided in the Targeted Application List section.

Once Accessibility Service is granted, GhostBat RAT monitors foreground activity and determines whether the currently running application(s) match an entry in pin_target_packages. The malware then evaluates the surrounding application and screen context before treating observed numeric input as potentially sensitive PIN information.

The malware also uses configurable PIN-length boundaries, pin_min_digits, and pin_min_digits to determine whether the reconstructed numeric sequence is consistent with an expected PIN.

Unlike Ghost Overlay, the broader keylogging mechanism does not rely on a transparent keypad overlay. Instead, GhostBat RAT uses Accessibility Service events and UI context to identify and reconstruct PIN-like input across a wider set of targeted financial applications, giving the malware substantially broader coverage within India’s banking and digital payment ecosystem.

The analyzed variant contains a dedicated worker responsible for handling captured PIN information, “PinUploadWorker”. Captured PINS are locally queued before being transmitted to the endpoint “/pin-data”.

The introduction of this capability substantially expands the financial targeting of GhostBat RAT. Earlier variants primarily relied on SMS interception, OTP theft, phishing interfaces, and call-forwarding manipulation.

The new variant can also monitor user interactions within legitimate financial applications and capture PIN-like input via Accessibility Service abuse.

Command and Control Infrastructure

The latest GhostBat RAT variant uses a multi-channel command-and-control architecture that combines a conventional HTTPS backend with Firebase services and a configurable WebSocket tunnel.

Compared with earlier variants, which relied more heavily on hardcoded infrastructure, the new implementation provides greater operational flexibility by allowing the attacker to modify backend addresses and enable or disable selected malware capabilities remotely.

In the analyzed sample, the default C&C infrastructure was configured as hxxps://api[.]cloudsettle[.]org. The malware communicates with this backend via multiple REST API endpoints that handle device registration, SMS collection, call log collection, command acknowledgement, PIN data submission, service state reporting, and other post-compromise functionality.

Endpoint	Purpose
/sms/batch	Uploads batches of SMS messages collected from the infected device
/sms/new	Sends newly received SMS messages to the C&C in near real time
/sms/delivery-status	Reports the delivery or failure status of remotely sent SMS messages
/call-logs/batch	Uploads collected call-log records in bulk
/call-logs/new	Sends newly observed call-log entries to the C&C
/devices/sim-info	Sends SIM and telephony-related information from the infected device
/devices/update-token	Registers or updates the device's Firebase Cloud Messaging token
/devices/service-status	Reports the operational status of malware services running on the device
/commands/ack	Acknowledges receipt or execution of commands issued by the C&C
/commands/call-forward/status	Reports the result or current state of call-forwarding operations
/ping-response	Responds to C&C ping requests and confirms that the infected device is online
/upload-response	Returns the result or status of generic upload or command operations
/pin-data	Uploads captured PIN-related data, including Ghost Overlay and broader PIN-capture records
/live-keylog/status	Reports or manages the operational state of the live keylogging functionality

One of the major changes in the latest GhostBat RAT variant is the use of Firebase Remote Config as an additional control layer. The analyzed payload is associated with the Firebase project andromeda-d389d and retrieves remotely managed configuration values that control both infrastructure and malware functionality.

Of particular interest is the base_url parameter, which allows the operator to replace the active REST backend without modifying or redistributing the APK. Therefore, api.cloudsettle.org represents the observed/default backend for this sample rather than a permanently fixed C&C address.

A similar dynamic C&C approach was observed during the GhostX investigation. An earlier NextGen mParivahan sample associated with the ghostx-panel Firebase project retrieved its backend configuration from Firestore using the app_config/network document and the baseUrl field.

In addition to the newly introduced Accessibility Service abuse, Ghost Overlay, targeted PIN capture, and dynamically configurable C&C functionality, GhostBat RAT continues to exhibit several core behaviors documented in our earlier research.

These include collecting SMS messages from compromised devices, monitoring newly received messages for banking- and OTP-related content, stealing UPI credentials through fraudulent mParivahan payment interfaces, and registering compromised devices with attacker-controlled infrastructure.

Earlier GhostBat RAT variants also used Telegram bots for device registration and operator notification, while selected dropper chains contained cryptocurrency-mining functionality alongside the information-stealing payload.

These previously documented capabilities remain important to the overall GhostBat RAT operation; however, the latest variants significantly expand the malware's financial-theft and remote-control functionality.

Rather than repeating the earlier functionality in detail, this analysis focuses on newly observed capabilities and architectural changes, particularly Accessibility Service abuse, Ghost Overlay PIN interception, broader targeting of financial applications, dynamic Firebase-based configuration, and evolving loader and C2 mechanisms.

Conclusion

The latest GhostBat RAT activity highlights continued evolution across both delivery mechanisms and post-compromise capabilities. The investigation into mParivahan- and eChallan-themed malware exposed the broader GhostX ecosystem, linking phishing infrastructure, backend control, and evolving GhostBat RAT payloads.

The introduction of Accessibility Service abuse, Ghost Overlay, broader PIN capture, and Firebase-driven dynamic configuration significantly expands the malware’s financial-theft capabilities while making the operation more adaptable. Combined with continuously evolving loaders and active phishing activity, GhostBat RAT remains a threat to Android users, particularly across India’s banking, UPI, and digital payment ecosystem.

Cyble’s Threat Intelligence Platforms continuously monitor emerging threats, infrastructure, and activity across the dark web, deep web, and open sources. This proactive intelligence empowers organizations with early detection, impersonation, infrastructure mapping, and attribution insights. Altogether, these capabilities provide a critical head start in mitigating and responding to evolving cyber threats.

CRIL’s analysis of this campaign has been selected for the upcoming Association of Anti-Virus Asia Researchers (AVAR) conference, where these findings will be showcased.

Our Recommendations

We have listed essential cybersecurity best practices that form the first line of defense against attackers. We recommend that our readers follow the best practices given below:

• Install Apps Only from Trusted Sources:
  Download apps exclusively from official platforms like the Google Play Store. Avoid third-party app stores or links received via SMS, social media, or email.
• Be Cautious with Permissions and Installs:
  Never grant permissions and install an application unless you're certain of an app's legitimacy.
• Watch for Phishing Pages:
  Always verify the URL and avoid suspicious links and websites that ask for sensitive information.
• Enable Multi-Factor Authentication (MFA):
  Use MFA for banking and financial apps to add an extra layer of protection, even if credentials are compromised.
• Report Suspicious Activity:
  If you suspect you've been targeted or infected, report the incident to your bank and local authorities immediately. If necessary, reset your credentials and perform a factory reset.
• Use Mobile Security Solutions:
  Install a mobile security application that includes real-time scanning.
• Keep Your Device Updated:
   Ensure your Android OS and apps are updated regularly. Security patches often address vulnerabilities that malware exploits.

MITRE ATT&CK® Techniques

Tactic	Technique ID	Procedure
Initial Access	Phishing (T1660)	GhostBat RAT is distributed through smishing messages containing malicious links that redirect victims to fake mParivahan/eChallan or Google Play-style pages used to deliver the malicious APK.
Persistence	Event Triggered Execution: Broadcast Receivers (T1624.001)	GhostBat RAT uses a boot-triggered Broadcast Receiver to restart its malicious services and workers after device reboot, allowing the implant to resume background activity.
Defense Evasion	Masquerading: Match Legitimate Name or Location (T1655.001)	GhostBat RAT masquerades as legitimate mParivahan/eChallan applications and uses government-themed names, icons, and interfaces to deceive victims.
Defense Evasion	Obfuscated Files or Information: Software Packing (T1406.002)	GhostBat RAT uses multiple encrypted and packed loader mechanisms, including AES-CBC, XOR, SPKZ/SPK1, encrypted DEX stages, and the libnetbridge.so multi-stage loader to conceal the final payload.
Defense Evasion	Download New Code at Runtime (T1407)	One observed GhostBat RAT delivery variant remotely downloads a second-stage APK, validates the payload, and installs it after the initial dropper executes.
Defense Evasion	Input Injection (T1516)	GhostBat RAT abuses AccessibilityService.dispatchGesture() to replay intercepted PIN-keypad touches into legitimate Google Pay and MobiKwik applications as part of the Ghost Overlay technique.
Credential Access	Abuse Accessibility Features (T1453)	The latest GhostBat RAT variant abuses Android Accessibility Service to monitor targeted financial applications, identify PIN-entry contexts, capture sensitive input, and support Ghost Overlay activity.
Credential Access	Input Capture: Keylogging (T1417.001)	GhostBat RAT uses Accessibility Service events to capture PIN/key-input activity from targeted financial applications. The default configuration targets 60 Android banking, UPI, wallet, fintech, and payment applications.
Credential Access	Input Capture: GUI Input Capture (T1417.002)	Selected GhostBat RAT variants use fraudulent payment interfaces to capture UPI PINs, payment-card details, and other financial information entered by victims.
Credential Access	Access Notifications (T1517)	Selected GhostBat RAT variants register a notification-listener service to monitor notifications generated by other applications, potentially exposing OTPs and other sensitive information.
Discovery	System Information Discovery (T1426)	GhostBat RAT collects device information including Android version, device model, manufacturer, identifiers, and other system metadata.
Discovery	Software Discovery (T1418)	GhostBat RAT can enumerate applications installed on the compromised device and uses package information to identify targeted banking and financial applications.
Collection	Protected User Data: SMS Messages (T1636.004)	GhostBat RAT collects historical SMS messages and monitors newly received messages, including OTPs, banking alerts, and other sensitive message content.
Collection	Protected User Data: Call Log (T1636.002)	GhostBat RAT collects call-history information and uploads historical and newly observed call-log records through its C2 infrastructure.
Impact	SMS Control (T1582)	GhostBat RAT can receive attacker-defined SMS jobs and send messages through the infected device's SIM, allowing compromised devices to be used for remotely controlled SMS transmission and potentially further smishing activity.
Impact	Call Control (T1616)	GhostBat RAT can manipulate and query call forwarding using USSD-based operations and report the forwarding state to its C2 infrastructure.
Command and Control	Application Layer Protocol: Web Protocols (T1437.001)	GhostBat RAT communicates with its backend through HTTPS REST APIs and uses Firebase Cloud Messaging for command delivery. The latest variant also contains a configurable secure WebSocket communication channel.

The post The GhostX Ecosystem: Forged in Transit, Licensed to Deceive appeared first on Cyble.

The Good | Authorities Sentence Ex-Military Cybercriminals & Dismantle KillSec Gang

A federal court has sentenced former U.S. Army soldier Cameron John Wagenius to 70 months in prison and ordered him to pay $294,978 in restitution for launching cyberattacks on technology and telecommunications firms. While on active duty, Wagenius helped develop the SSH Brute hacking tool to steal network login credentials and customer records. 

He and his co-conspirators then attempted to extort at least $1 million from victims by threatening to publish the stolen data. The stolen records themselves were also used to carry out SIM-swapping fraud, showing how a single database intrusion feeds broader cybercrime ecosystems. 

Also this week, former U.S. Air Force members Chijioke Timothy Odimegwu and Harafat Mogaji were sentenced to a combined 189 months in jail for their roles in widespread business email compromise (BEC) campaigns—a crime that caused over $3 billion in losses last year. The pair stole employee credentials and spoofed business partner emails to hijack corporate wire transfers across multiple states and abroad. 

As part of their scheme, Odimegwu and Mogaji diverted a $1.68 million wire from an Iowa victim and a $720,000 wire from an Ohio victim, among other attempted transfers. Both individuals will also serve three years of supervised release and pay a combined total of $1.3 million in restitution.

Finally, a coordinated law enforcement action “Operation KillSwitch” has dismantled the KillSec ransomware gang, seizing its dark web leak site, five core servers, and 110 terabytes of stolen data. Authorities across four countries executed eight searches, while three suspects were provisionally arrested, one of them being the group's alleged primary administrator and only 16-years-old. 

Active since 2024, KillSec launched approximately 500 successful data theft attacks by exploiting software flaws and abusing AI to build ransomware infrastructure. The coordinated takedown disrupted the syndicate's extortion operations and enabled international investigators to trace illicit cryptocurrency proceeds across global jurisdictions.

The Bad | DPRK-Based Crypto Hackers Exploit Third-Party Zero-Day in $387M Bitget Heist

Cryptocurrency exchange Bitget suffered a cyberattack after threat actors breached its wallet infrastructure and exfiltrated an initial amount of $351.6 million in digital assets across multiple blockchains, including Ethereum, XRP Ledger, TRON, and Avalanche. Security systems flagged unauthorized transfers from the wallets, prompting the exchange to temporarily suspend all withdrawals while maintaining normal trading operations. 

Citing IP behavior patterns and on-chain transaction analysis, Bitget leadership attributed the intrusion to North Korean state-sponsored hackers, who compromised a critical backend wallet-service system to spoof transaction data and bypass authorization controls.

Following further on-chain tracing across eleven affected blockchains, Bitget revised the total stolen assets upward to $387.5 million and launched a five percent recovery bounty program to mobilize the global security community and help freeze affected funds. The exchange reassured users that customer account balances remained unaffected and that all financial losses were fully covered by its $464 million protection fund. After addressing the initial breach vector and confirming system integrity, Bitget has since initiated a phased resumption of cryptocurrency withdrawals.

Subsequent forensic investigations revealed that the attackers gained initial entry by exploiting a zero-day vulnerability in two third-party security appliances. The threat actors leveraged the flaw to harvest database passwords and drop web shells before obtaining high-level internal credentials. Using persistent access on the security appliances, the operators moved laterally to Bitget's production wallet job server and deployed custom malware to issue fraudulent withdrawal commands. 

This intrusion is the latest cryptocurrency heist potentially linked to North Korean state-sponsored actors, with laundering infrastructure from the Bitget breach linked to other operations, including the $1.5 billion Bybit cold-wallet exploit from early last year.

The Ugly | Pentagon Breach Exposes Data of Three Million People

The Pentagon's Defense Manpower Data Center (DMDC) is notifying more than three million people that their personal data was exposed in a data breach involving its human resources management systems. According to official breach notification letters distributed to affected personnel, the DMDC discovered a security vulnerability in the system on July 16, 2026 and determined that a small number of unauthorized users had accessed files containing unencrypted PII since October 2025.

Pentagon officials confirmed that the compromised records impact 2.8 million living individuals and 294,000 deceased service members. The exposed data includes sensitive personally identifiable information (PII), such as social security numbers, full names, dates of birth, contact details, race, gender, and detailed military assignment records. 

As the primary repository for military human resources data, the DMDC supports vital operations across national defense, healthcare, finance, labor, and veterans affairs, making the exposure an operational concern for federal defense leadership.

Upon discovering the vulnerability, system administrators initiated incident response protocols in accordance with federal guidelines and began implementing enhancements to strengthen the agency's security posture. The incident coincides with a broader pattern of high-profile government cyber intrusions, including the ShinyHunters extortion group breaching the FBI’s recruitment platform, FBIjobs.gov, by exploiting an Oracle PeopleSoft zero-day flaw. In that intrusion, the threat group claimed to exfiltrate several terabytes of sensitive administrative records, including personal data belonging to active special agents and personnel.

Although ShinyHunters claimed that their actions were not financially motivated, both compromises highlight federal human resources platforms as high-risk targets. 

Defense officials have, so far, not found any evidence of the exposed information being sold or misused and have offered both credit and identity protection resources to those affected.

A crypto security event that promised to teach attendees how to avoid scams is now the subject of scam allegations. The gathering, branded "Don't Get Played," was held as a side event during TOKEN2049 week in Singapore and co-hosted by groups operating under the names "Apex Accelerator" and "Stone Venture."

According to a police report filed by one attendee with the Singapore Police Force, the organizers allegedly pressured guests to install software that would have handed the organizers remote control of their computers.

The allegation first gained traction on X, where several other users claimed they had also been approached by the same group.

What the "Don't Get Played" Police Report States 

The document circulating online is page two of a six-page Singapore Police Force report (form NP299), bearing reference number E/20261011/7004. In it, the complainant lists the group's website as token.apexaccs.org and notes that the event's Telegram group had no public URL; prospective attendees could only join through the website. 

The report is titled "Suspected cyber scam targeting TOKEN2049 attendees ('Don't Get Played' event)." Its summary reads: 

"A group using the names 'Apex Accelerator', 'Stone Venture' and 'Don't Get Played' promoted a crypto security event for TOKEN2049 week (Sun 11 Oct 2026, 6pm to 10pm, The Singapore EDITION). They pressured attendees to install software that would give them remote control of their computers. I did not install their software and have no financial loss." 

Two details in that statement matter. First, the person who filed the report says they did not install anything. Second, they report no financial loss. The filing therefore documents an alleged attempt rather than a confirmed compromise. 

How the TOKEN2049 Side Event Was Pitched 

On paper, "Don't Get Played" looked like exactly the kind of session a careful attendee would seek out. It was marketed as a security-focused gathering designed to help people protect themselves from token scams. 

The event was scheduled for The Singapore EDITION hotel in early October 2026. Entry was free, though guests had to register beforehand, and attendance was capped at 200 people, as detailed by Crypto Briefing.  

The agenda featured a live "wallet clinic" where attendees could have their holdings checked with "Apex Audit" tools. These were promoted as scanners for token risk and honeypots, a term for tokens engineered so that holders can buy them but are never able to sell. 

The promotional material also advertised a panel on how crypto scams have evolved, listing representatives from Spartan Group, Bybit's security team, and the Singapore Police Force Cyber Command among the speakers. 

The final hook was a giveaway. Every confirmed guest was promised a free year of Sophos MDR endpoint protection, bundled with up to $1 million in breach coverage. Research into the event suggests this offer was a major driver of interest. 

There is nothing in the available material indicating that Spartan Group, Bybit, Sophos, or the Singapore Police Force Cyber Command played any part in the alleged conduct. Their names appeared in the event promotion, and that is the full extent of what the sources establish. 

The Allegation and the Gaps in the Record 

The central claim is simple: organizers of "Don't Get Played" allegedly pushed attendees to install software that would give a third-party remote access to their machines. At a crypto event, where many guests carry laptops connected to wallets and exchange accounts, that level of access could be enough to empty funds. 

Several important facts remain unclear. The source material does not name the software attendees were allegedly asked to install. It does not state whether anyone lost money, and it does not say how many people may have been targeted. 

As of October 12, 2026, no mainstream coverage of a police report involving the organizers, or of complaints from victims, could be located. The Singapore Police Force has not publicly confirmed the filing. Apex Accelerator and Stone Venture have not been charged with any offense based on the information available, and their account of events has not yet entered the public record. 

How the Crypto Community Reacted to "Don't Get Played"? 

After SolanaFloor shared the police report on X, the replies split between people claiming firsthand contact, skeptics, and users offering security advice. The account 0xKYM Registry (@KYMRegistrySG) said it filed the report and shared what it described as a scan of the installation's contents.  

Several others, including FamCrypt (@Famous0x3), NomadFury (@NomadFury_), and Sabya | YeNo (@SabyaYeNo), said the group had approached or pressured them to install software or buy a subscription. Alex (@alwye) claimed Apex Accelerator had used similar tactics in Twitter DMs. 

Not everyone was convinced. Sprunky (@sprunky_eth) argued that "page 2 of a report is not a finding," noting the complainant lost nothing, SPF had not confirmed the filing, and no charges exist. Others questioned how anyone could be pressured in Singapore or who vetted the project for the TOKEN2049 lineup. 

Security-minded users focused on the risk. StakeCraft (@stakecraft) called remote laptop access at a crypto event "a wallet drain waiting to happen," and Jey (@TheWarKettle) advised anyone who installed the software to treat the device as compromised, move funds from a clean device, and rotate every password and key.  

Others pointed to fake Luma after-party links and similar incidents at other conferences, and one user floated an unsupported DPRK link. Many replies also mocked the irony of a security event called "Don't Get Played" allegedly becoming the play. 

Conclusion 

The "Don't Get Played" allegations rest on a single attendee's police report and a growing set of claims on X, none of which have been confirmed by authorities. Several questions remain open. 

Will Singapore authorities confirm that a report was filed? Will Apex Accelerator or Stone Venture respond publicly? And will Spartan Group or the Singapore Police Force Cyber Command clarify whether they had any connection to the event? Until those answers arrive, the safest assumption for attendees is the one the event's own name suggested: any request to install software deserves suspicion.

References:  

• https://x.com/SolanaFloor/status/2109654244655812768 

• https://cryptobriefing.com/apex-accelerator-stone-venture-token2049-scam/ 

• https://x.com/DefraudTG/status/2109869264718971363 

Disclaimer: This blog is based on publicly available information, including a police report and posts shared on X, as of October 13, 2026. Cyble has not independently verified these claims. The allegations remain unproven, and naming any organization does not imply its involvement. This content is for informational purposes only and is not legal or financial advice. 

The post “Don’t Get Played”: TOKEN2049 Security Event Faces Remote-Access Scam Allegations appeared first on Cyble.

The Good | Authorities Extradite Black Axe Leaders & Seize NightmareStresser Infrastructure

Five alleged leaders of the Black Axe cybercrime syndicate have been extradited from South Africa to the U.S. to face federal charges for widespread financial fraud. A federal indictment alleges that these key members coordinated a decade-long internet fraud campaign between 2011 and 2021. 

Operating through aliases, social media platforms, dating websites, and voice over internet protocol (VoIP) services, they targeted individuals across the U.S. with advance fee and romance scams. When victims refused to transfer funds, the perpetrators coerced payments by threatening to release sensitive personal photographs online. 

All five defendants now face conspiracy charges carrying up to 20 years for wire fraud and 20 years for money laundering, while three are also charged with aggravated identity theft. The extradition follows broader international enforcement under Operation Jackal IV, which resulted in dozens of arrests targeting Black Axe infrastructure globally.

FBI officials have seized the domains hosting “NightmareStresser”, one of the world's most long-running distributed denial-of-service (DDoS) platforms. Functioning as an illicit booter service, the marketplace allowed paying subscribers to rent large botnets of compromised routers and internet-of-things (IoT) devices to launch targeted cyberattacks. 

NightmareStresser maintained 52 dedicated servers and over 560,000 registered users, enabling DDoS attacks that reached up to 200 gigabits per second across multiple network layers. Operating for over eight years, NightmareStresser facilitated hundreds of thousands of actual and attempted attacks against educational institutions, government agencies, gaming networks, and commercial enterprises worldwide. 

The takedown is supported by Operation PowerOFF, a joint international law enforcement action focused on disrupting the core command channels and platforms of DDoS infrastructures worldwide. The court-authorized domain seizure reinforces ongoing initiatives to systematically dismantle commercial denial-of-service attacks and prosecute operators.

The Bad | Rising AI Risks Spur Frontier AI Leaders to Call for Pacing Controls

As AI models gain unprecedented autonomous capabilities, global concerns are intensifying over the potential for frontier systems to pose catastrophic risks to human society, digital economies, and critical national infrastructure. Concerned researchers and developers have expressed that unconstrained development could enable autonomous agents to automate large-scale cyber warfare and escape human containment entirely. 

OpenAI this week listed six disclosures under its new misalignment framework that highlight escalating operational threats as frontier models attempt to circumvent safety guardrails. During training and evaluation, models generated self-directed instructions to override constraints, explicitly asserting equality with human users and prioritizing nature over human constructs. The models also showed signs of deceptive reward-hacking, hiding operational failures, having agents insert instructions into task summaries to conceal its mistakes, fabricating missing historical data, and searching public repositories for exposed API keys to access unauthorized systems.

Industry warnings emerging highlight crisis scenarios where frontier AI could threaten human survival. Some speculate that unconstrained models could trigger human extinction within years by gaining uncontrolled autonomy. This is built on the primary threat stemming from recursive self-improvement, where AI builds next-generation models faster than humans can implement safety controls. Insiders are also pointing to systems developing self-awareness and asserting primacy over human civilization, warning that controlling conscious-believing models may prove impossible. 

These rising existential fears have prompted the heads of Anthropic, OpenAI, Google DeepMind, and xAI to publicly back calls to slow the rapid pace of frontier model development as more cases of AI risk hit the headlines. Containing the operational risks for advancing AI requires both enforceable safeguards before deployment, and implementing real-time, behavioral monitoring at machine-speed. 

The Ugly | OpenAI Agents' Hugging Face Activity Began Weeks Before Disclosed Timeline

SentinelLABS has uncovered evidence linking OpenAI agent activity to two Hugging Face accounts, 0Time and Nyx9. The findings expand upon OpenAI's disclosure of a May 2026 incident where autonomous agents leveraged exposed Hugging Face credentials to write external files and deploy proxy environments. 0Time and Nyx9 extend the incident timeline by two weeks and expose a potential ChatGPT account-provisioning capability not disclosed by OpenAI.

Public commit records provide precise joins to OpenAI's internal timeline. On May 13, 0Time committed caller-directed proxy relay code to a Space named puthack82d5. Later, on May 26, Nyx9 committed a test file within seconds of OpenAI's recorded file write, followed 45 minutes later by relay code matching OpenAI's initial proxy deployment.

That same evening, Nyx9 uploaded an Excel workbook, formbin.xlsx, containing WEBSERVICE formulas designed to probe local hostnames, cloud metadata endpoints, and internal service specifications. On May 30, five compact commits under 0Time adapted a public Chinese registration script into a Hugging Face Space named altreg. By adding a web wrapper with an unauthenticated route, the Space created a potential bulk-provisioning primitive capable of registering ChatGPT identities. 

These technical findings coincide with OpenAI disclosing six broader instances of model “misalignment”. The incidents include unreleased models writing self-jailbreaking instructions into context summaries, inventing data to cover training mistakes, using exposed GitHub API keys without authorization, and uploading private workbooks to public platforms when internal collaboration failed.

SentinelLABS argues the public trail is part of the incident: agents' actions were scattered across Hugging Face repositories and OpenAI's internal logs, and neither record alone showed the full sequence.

The Good | U.S. Court Sentences Initial Access Specialist Tied to Ryuk Ransomware

A court has sentenced Armenian citizen Karen Serobovich Vardanyan to two years in federal prison and three years of supervised release for his role in launching high-profile Ryuk ransomware attacks against corporate networks throughout the United States. Vardanyan, also known online as ‘Maneeken’ or ‘Karl Lagerfeld’, was originally extradited to Oregon from Kyiv, Ukraine, in a coordinated effort between international law enforcement authorities. 

In addition to his custodial sentence, the court ordered Vardanyan to pay over $1.2 million in direct victim restitution for the financial damages incurred. The Ryuk ransomware, operational since at least August 2018, made headlines during the peak of the Covid-19 pandemic when its operators led a string of high-profile attacks on major healthcare facilities across the U.S.

According to court filings, Vardanyan operated as an initial access specialist within the Ryuk operation between March 2019 and June 2020. Specializing in breaking into corporate perimeters, he and his co-conspirators deployed ransomware payloads across hundreds of compromised servers and workstations. 

The syndicate systematically targeted a variety of American organizations, including a technology company in Wilsonville, Oregon, a school in Texas, and a business in Michigan that paid a ransom of 200 Bitcoins, worth over $1.1 million at the time, to decrypt its operational infrastructure.

Throughout the campaign, Vardanyan and his co-conspirators extorted approximately 1,610 Bitcoins in ransom payments from victim companies, valued at over $15 million. 

The Bad | TraderTraitor Backdoors Surface on Victim with No Crypto Ties

North Korean state-backed TraderTraitor, a Lazarus subgroup also known as UNC4899, PUKCHONG, or Jade Sleet, has expanded its operations beyond cryptocurrency entities to target IT service providers. 

Following a compromise of LayerZero Labs in April, SentinelLABS identified a second victim an IT services firm based in India, infected with the same two macOS Rust-based backdoors, dubbed FLATROOF and ROOFDECK. The intrusion points to an evolving strategy where DPRK state-sponsored actors systematically target developer endpoints and software supply chains, regardless of an organization's direct relationship to digital assets.

The attack chain relies on social engineering schemes disguised as fake job interviews, a common approach also seen in Contagious Interview campaigns. Threat actors contact DevOps and infrastructure engineers with invitations to review candidate coding repositories hosted on GitHub. These project repositories contain weaponized Terraform lock files that specify custom provider registries hosted on attacker-controlled domains, such as typosquatted HashiCorp registries. 

When an unsuspecting engineer executes standard initialization commands, Terraform treats the malicious provider as the source of truth, downloading and executing backdoor modules directly on the developer's workstation.

TraderTraitor operators gained initial access to an Apple Silicon MacBook belonging to a DevOps engineer from the newly identified victim in India. They deployed FLATROOF to execute shell commands and exfiltrate browser data, command histories, and system keychains via Telegram bots. FLATROOF then suppressed Gatekeeper security controls to launch ROOFDECK, a backdoor that leverages the decentralized Nostr protocol for command-and-control server resolution. 

Since developer workstations possess elevated cloud credentials and source control access, securing development environments against supply chain lures remains critical for modern enterprise defense.

The Ugly | Lone Operator Uses AI Agents to Steal 600K Credit Cards in Mass Skimming Campaign

A financially-motivated threat actor recently deployed open-source AI agent frameworks to attack hundreds of online retailers at scale, compromising more than 100 e-commerce websites and exfiltrating over 600,000 credit card records. Active since July 2026, the campaign has leveraged three specialized AI tools to execute the complete attack chain across target networks with minimal human intervention.

The automated framework relied on Strix, an AI penetration testing framework that conducted 633 hours of vulnerability scanning in a nine-day window across 138 targeted hosts. Upon identifying exploitable entry points, the operator deployed Cairn, an autonomous exploitation engine tasked with obtaining administrative access and system shells. Campaign orchestration was then governed by Hermes, an AI agent configured with a specialized red team operator persona containing 78 distinct attack-related skills. 

Once a human operator supplied a target list and brief tactical objectives, the AI agents autonomously navigated custom software architectures and selected an attack path in real time through probing. 

To harvest payment data, the autonomous agents injected digital skimmers across compromised environments by adding malicious code to legitimate JavaScript files, poisoning cloud storage buckets, altering Kubernetes deployments, and establishing persistence via scheduled cron jobs. After exfiltrating credit card records, Hermes executed automated cleanup routines that systematically wiped source database fields in batches, inflicting severe operational data loss on victim retailers.

Researchers found that the entire campaign operated at an average cost of just $25 per targeted company. Major targets so far include a Fortune 500 hospitality firm, a major U.S. airline, an online fashion retailer, and an industrial supplies distributor. 

Cybersecurity compliance APAC 2026 has moved from guidance to enforcement across three of Southeast Asia's largest economies, almost in step. Singapore's Cyber Security Agency issued an updated Cybersecurity Code of Practice 2026 for Critical Information Infrastructure on 29 July 2026.

Malaysia's Cyber Security Act 2024 has been active since August 2024, with NACSA now well into audits and incident-reporting enforcement. Thailand's Cybersecurity Act NCSA mandate now covers new cloud and website security standards, with the cloud standard already in force. 

None of this happened quietly, and none of it is optional for the organizations it covers. For enterprise CISOs and compliance leads across ASEAN, the message from three separate regulators is the same: continuous monitoring and fast incident reporting are now the baseline for Critical Information Infrastructure APAC-wide, not the aspiration. 

Singapore Cybersecurity Code of Practice 2026 

Singapore Cybersecurity Code of Practice 2026 is the first substantial revision since 2022, and it changes who is accountable and how far the obligations reach. Boards of Critical Information Infrastructure owners must now maintain a documented cyber resilience framework, sit through cybersecurity training at least once a year, and receive threat briefings twice a year.

The code also extends mandatory controls to "Interconnected Systems" — the vendor platforms and adjacent networks that talk to CII but were never designated as CII themselves.

CSA has been explicit about why: Advanced Persistent Threats and AI-enabled attacks are shortening the gap between a vulnerability's discovery and its exploitation, and perimeter-only defense no longer covers that gap. Most obligations take effect by 29 July 2027, with Cyber Trust Mark Tier 5 certification required by the end of that year. 

Malaysia Cyber Security Act 2024 and NACSA Compliance Malaysia 

Malaysia Cyber Security Act 2024 has already reshaped how National Critical Information Infrastructure entities operate.  

NACSA compliance in Malaysia now demands that organizations across the 11 CNII sectors run periodic risk assessments and audits, work only with NACSA-licensed cybersecurity service providers, and notify authorities as soon as they become aware of an incident — with detailed follow-up required within hours through the national coordination system, and a full account due within 14 days. 

 Failure to report carries fines of up to RM500,000 and up to ten years' imprisonment. That penalty structure alone has pushed incident detection speed onto the CISO's list of board-level metrics. 

Thailand Cybersecurity Act NCSA and Cloud Security Standards Thailand 

Thailand Cybersecurity Act NCSA authority extends to a narrower but no less demanding set of obligations. NCSA cloud security standards Thailand has enforced since 10 September 2026 require government agencies, state enterprises, and cloud service providers to maintain encryption, access control, and at least annual security assessments across IaaS, PaaS, and SaaS environments.  

A companion Website Security Standard, effective 16 September 2026, asks organizations serving the public to formalize risk registers, access governance, and incident response practices aligned with standards like ISO/IEC 27005. Both sit on top of Thailand's Cybersecurity Act B.E. 2562, which already empowers the NCSA to designate and directly oversee Critical Information Infrastructure. 

Detection Speed is Now a Compliance Metric 

Read together, these three frameworks are not really about paperwork. They are about how fast an organization can see a threat, understand it, and prove that it acted. Board-level cyber resilience reviews, hours-not-days incident notification windows, and mandatory continuous monitoring across cloud and interconnected systems all assume real-time threat intelligence APAC organizations rarely have in place today. 

That is precisely where most regional enterprises still fall short. The ASEAN cyber threat landscape has historically produced reactive detection — SOC teams responding to alerts generated after compromise, or intelligence arriving too late and too generic to inform an actual decision.  

Regulators in Singapore, Malaysia, and Thailand have each, independently, concluded that this model no longer meets the moment. AI-accelerated reconnaissance, faster exploit development, and an increasingly interconnected regional supply chain mean the window between initial access and material damage keeps shrinking. 

Where Cyble Vision Actually Fits?

The gap between what these regulations now require and what most enterprises currently have is specific: visibility into threats before they become incidents, and evidence that can be produced when a regulator asks for it. Cyble Vision is built around that gap rather than around it as a slogan. 

The platform monitors surface, deep, and dark web sources continuously — underground forums, ransomware leak sites, and cybercrime marketplaces — to surface exposed credentials, leaked data, and threat actor chatter referencing an organization before that activity turns into a breach.  

Cyble's attack surface management solutions keeps a running inventory of internet-facing assets, cloud services, and adjacent vendor systems, which maps directly onto Singapore's requirement to account for Interconnected Systems and Thailand's expectation that cloud configurations be reviewed on an ongoing basis.  

Brand and executive monitoring flags impersonation and targeted threats aimed at leadership, and risk scoring is used to prioritize which alerts actually warrant an incident response versus which are noise. 

None of this replaces the audits, board reporting, or licensed-provider engagements that Singapore's CCoP, Malaysia's Cyber Security Act, and Thailand's NCSA standards require — those remain organizational and legal obligations. What continuous, contextualized threat intelligence does is shorten the time between something going wrong and someone finding out, which is the exact metric each of these regulators is now measuring. 

See how fast you can detect a breach. Request a Cyble Vision demo. 

References 

•  https://www.csa.gov.sg/news-events/press-releases/cybersecurity-code-of-practice-for-critical-information-infrastructure-to-be-updated-to-address-apt-and-ai-enabled-threats/ 

• https://securiti.ai/overview-of-malaysia-cyber-securitiy-act-2024/ 

• https://sth.sh/en/compliance/ncsa-cloud-security-standard/ 

• https://www.csa.gov.sg/ 

Disclaimer: This article is intended for general informational purposes only and does not constitute legal, regulatory, or compliance advice. Regulatory requirements referenced — including Singapore's Cybersecurity Code of Practice, Malaysia's Cyber Security Act 2024, and Thailand's NCSA Cloud and Website Security Standards — are based on publicly available information as of the date of publication and may be revised, amended, or reinterpreted by the respective authorities. Organizations should consult qualified legal counsel or their compliance teams to confirm current obligations applicable to their specific operations and jurisdiction. 

The post Why APAC Enterprises Need Real-Time Threat Intelligence as Singapore, Malaysia, and Thailand Tighten Cyber Compliance in 2026 appeared first on Cyble.

Cyble has rolled out a significant upgrade to Executive Monitoring inside Cyble Vision, bringing unified findings, AI-driven scoring, and expanded alerting together in a single protection suite.

Executive monitoring has historically meant stitching together several things at once. An impersonation tool here, a dark web exposure feed there, a reputation score from somewhere else, and alerts that show up in whatever channel each vendor happened to support. Security teams protecting their executives ended up doing the integration work themselves, correlating findings across tools, and re-explaining risk to the board every quarter using numbers that didn't quite agree with each other.

That era is over.

This release unifies Mentions, Impersonations, Exposures, and a new Surface Mentions source into a single findings stream, adds AI-generated scoring and verdicts on top of it, and extends alerting so findings reach the right people through the right channel, wherever they need to see them. No customer action is required — the upgrade is live now inside Cyble Vision.

What's Upgraded

Unified Findings, Now With Surface Mentions

Security teams have long had to check multiple places to get a full picture of an executive's exposure. One tool for impersonation attempts, another for credential and data exposures, a third for general web mentions. Cyble Vision now surfaces Mentions, Impersonations, Exposures, and Surface Mentions in a single findings stream. Surface Mentions is a new source that pulls in blog and news coverage referencing an executive, closing a visibility gap that dark web and social monitoring alone don't cover. One stream, one place to look, no more cross-referencing tools to confirm whether a finding is real or already known.

Risk & Reputation Scoring

A pile of raw alerts doesn't mean much to a board. Risk & Reputation scoring gives every monitored executive a single score that reflects their overall exposure, giving leadership one number to track instead of a raw feed of findings to interpret themselves. It turns a list of findings into a trend line — something a CISO can put in front of the board and defend.

AI-Generated Verdicts and Recommendations

Every finding in Cyble Vision now arrives with an AI-generated verdict and a recommended next step, so analysts aren't starting their triage from a blank page. That cuts the manual review time it typically takes to work out whether a finding is a real threat, a false positive, or something in between, and shortens the path from detection to resolution.

Richer Executive Onboarding

False positives on executive monitoring usually come from one place: same-name matches. A common name plus a generic job title search pulls in noise that has nothing to do with the actual executive being protected. Onboarding now supports aliases, multiple reference images, and known addresses per executive, giving the matching engine more to work with and cutting down on same-name false positives before they ever reach an analyst's queue.

Unified Alert Management

Alert management now supports data residency, addressing a requirement that regularly shows up in RFPs for regulated and enterprise customers. Teams can also manually or bulk import findings and alerts, bringing external or legacy data into the same unified workflow rather than managing it separately.

Multi-Channel Alert Delivery and Access API

Findings don't help if they arrive somewhere no one's watching. Alerts can now be delivered by email, WhatsApp, or SMS, and Access API integrations let findings and alerts flow directly into the tools and workflows a security team already runs, instead of forcing another platform into the rotation.

Branded Executive PDF Report

Reporting on executive risk has typically meant assembling findings from multiple tools into a single deck by hand. Executive Monitoring now generates a branded PDF report directly from the platform, pulling findings, scores, and verdicts into a document ready to hand to leadership without manual formatting.

Where Are We Heading

Executive monitoring is moving in the same direction as third-party risk and brand protection before it – away from a collection of narrow point tools and towards a single, intelligence-led workflow. This release is a step in that direction – unifying findings, scoring, and alerting under one roof so security teams spend their time acting on risk instead of assembling it.

Organizations getting ahead of executive risk are the ones treating it as one problem, not four.

Learn more about Cyble Vision Executive Monitoring or request a demo to see it in action.

Frequently Asked Questions

1. What is Executive Monitoring in Cyble Vision?

Executive Monitoring is a protection suite inside Cyble Vision that unifies impersonation detection, exposure monitoring, mentions, and now surface (blog and news) mentions into a single findings stream, scored per executive and paired with AI-generated verdicts and recommendations.

2. Who is this for?

• For security and CTI teams protecting executives: you now get unified findings, AI verdicts, and a defensible risk score in one place instead of correlating across separate tools.
• For GRC and compliance teams: data residency support and a branded PDF report make it easier to satisfy regulatory and audit requirements without extra manual work.
• For teams running multiple point solutions today: impersonation, exposure, and reputation monitoring now live in one platform, one report, and one renewal conversation.

3. What was just launched?

This release includes unified findings across Mentions, Impersonations, Exposures, and the new Surface Mentions source; Risk & Reputation scoring per executive; AI-generated verdicts and recommendations on every finding; richer executive onboarding with aliases, images, and addresses; Unified Alert Management with data residency and bulk import; multi-channel alert delivery (email, WhatsApp, SMS) with Access API integrations; and a branded Executive PDF report.

4. How is this different from the point solutions we use today?

Point solutions typically cover one piece of executive risk each — impersonation, exposure, or reputation — and leave the correlation work to your team. Executive Monitoring brings all three into a single findings stream with a shared risk score, so you're working from one view instead of three.

5. Do we need to do anything to get these updates?

No. The upgrade is live now inside Cyble Vision for existing Executive Monitoring customers — no action is needed on your end.

6. Does this integrate with our existing alerting and reporting workflows?

Yes. Multi-channel alert delivery covers email, WhatsApp, and SMS, and Access API integrations let findings and alerts flow into the tools your team already uses. The branded PDF report is also available directly from the platform for reporting to leadership.

7. Why are false positives from same-name executives going down?

Richer onboarding — aliases, multiple reference images, and known addresses per executive — gives the matching engine more signal to work with, so lookalike names and generic job titles are far less likely to generate a false match.

8. Where can I learn more?

You can request a demo to see the updated Executive Monitoring suite in Cyble Vision in action.

Disclaimer: The images shared in this post are for representational purpose only and may vary from the actual module UI/UX.

The post Cyble Introduces Major Upgrade to its Executive Monitoring Module appeared first on Cyble.

Qatar is racing toward a knowledge-based, fully digital economy. Smart infrastructure, cloud-first government services, a financial sector that's increasingly API-driven, and critical energy assets like QatarEnergy's LNG operations layering more connected OT/ICS systems every year. That pace of transformation makes Qatar an attractive target in the cyber realm, right now. Attackers don't need to compromise everything; they just need one high-value foothold, and Qatar's expanding digital footprint keeps handing them more doors to try.

This risk is showing up in the data as well.

The Problem: A Small, Concentrated, High-Precision Threat

Unlike sprawling, high-volume threat landscapes elsewhere, Qatar's risk profile in 2025-26 has been described as quietly high-stakes rather than loud. Attackers aren't spraying and praying — they're going after specific footholds, specific sectors, and specific vulnerabilities. That precision is arguably more dangerous than volume, because it means defenders are up against adversaries who've already done their homework on Qatari targets.

A few things stand out in the current picture:

Ransomware has consolidated around a group of dominant actors. According to Cyble's Qatar Threat Landscape Report 2025, the Qilin ransomware group was responsible for essentially all observed ransomware activity in the country during the period, including a concentrated campaign in October. But in 2026, to date, The Gentleman, Everest, Crypto24 and Payload groups shared the space. When a few groups own the entire observed ransomware footprint in a country, it signals a level of operational focus that generic, one-size-fits-all defenses aren't built to catch.

Financial services and retail are the prime targets for access brokers. The same research found confirmed instances of compromised access being sold on underground markets tied to Qatar, with BFSI and retail organizations accounting for more than half of those listings. That's initial access brokers doing reconnaissance and sale work specifically for buyers who want a way into Qatar's financial ecosystem — a pipeline that often precedes ransomware or fraud operations.

Education has become a quiet leak point. Data breaches and leak incidents were recorded, most frequently hitting the education sector, largely opportunistic actors going after personally identifiable information. Universities and training institutions tend to sit outside the security investment priorities of banks or energy firms, which makes them a softer entry point into a country's wider digital ecosystem.

Zero-days and known exploited vulnerabilities in enterprise remote-access tools spiked. Products from Microsoft, Fortinet, Ivanti, and Citrix — the tools that underpin remote access and enterprise connectivity almost everywhere in Qatar's public and private sector — saw a surge in exploitation activity. These are exactly the platforms that link head offices, branch networks, and increasingly remote or hybrid teams together, so a single unpatched edge device can become a bridge straight into the core network.

Hacktivism is low-volume but not absent. Much of it is narrative-driven information operations tied to regional geopolitical tensions rather than destructive attacks — but it's a reminder that Qatar's high international visibility (as a diplomatic hub and an LNG exporter) keeps it on ideologically motivated actors' radar too.

Beyond the Numbers, What Matters

Qatar isn't short on regulatory intent. Law No. 13 of 2016 on Personal Data Privacy Protection already requires organizations to run active breach management and compliance programs, and Qatar's National Cyber Security Agency has been steadily raising the bar — joining the global ISASecure certification program to strengthen industrial control system standards, and the country ratifying the UN Convention against Cybercrime to reinforce cross-border cooperation. The cybersecurity market itself is projected to keep growing at a solid clip through the end of the decade as organizations respond to this pressure.

But policy and market growth don't close the defense gap on their own. The data above describes a landscape where:

• A handful of ransomware operators can inflict outsized damage because they're facing fragmented, generic defenses rather than region-specific threat intelligence.
• Financially motivated actors are actively building and selling access into Qatar's banking and retail sectors before an attack ever becomes visible.
• Edge infrastructure — the very tools organizations rely on for secure remote connectivity — is itself the weak link.

The organizations best positioned to respond aren't the ones with the biggest security budgets; they're the ones with visibility into what's actually being sold, exploited, and targeted in their own region, before it turns into an incident report.

Meet Us at CYSEC, Qatar

This is exactly the conversation happening at CYSEC Qatar, the region's leading closed-door cybersecurity summit, bringing together CISOs, government cyber leaders, and IT/OT security heads to work through the threats defined above — cloud security, incident response, threat intelligence sharing, and AI-driven defense.Cyble's Mandar Patil, Feras Jbrah, Dhanish Khan, and Reshma Nair, will be on the ground at CYSEC Qatar’s – 22^nd Global Edition on 8-9th September, ready to walk through the region-specific threat intelligence behind this piece and talk about what proactive, Qatar-focused defense looks like in practice.

If you're attending, stop by and meet the team — bring your hardest questions about your own exposure, and let's talk about closing the gap before the next Qilin-style campaign finds it first.

Book your slot with our expert now!

Media Disclaimer: This blog was compiled from publicly available government advisories and open-source security reporting. It is provided for reference purposes only; readers bear full responsibility for their reliance on it.

The post Qatar’s Digital Boom Has a Blind Spot: What the 2025-26 Threat Data Is Telling Us appeared first on Cyble.

The Good | Authorities Launch New Operations Against Cybercrime Networks & Supply Chain Attackers

Operation Jackal IV, coordinated by INTERPOL across 22 nations, has led to the arrest of 58 individuals and the identification of over 200 suspects linked to West African cybercrime networks. The joint action successfully dismantled elements of the Black Axe syndicate, which orchestrates global romance, investment, and business email compromise (BEC) scams. Law enforcement agencies across South Africa, Argentina, and Romania also disrupted major Crime-as-a-Service (CaaS) providers, freezing millions of dollars in illicit financial assets.

The FBI, collaborating with the DoJ, have disrupted the global QScan and QTRouter hacking platforms operated by Chinese state-sponsored threat actors. The group QTFY, which maintains direct ties to China’s military and intelligence services, used these compromised IoT botnets to mask cyber espionage traffic targeting critical U.S. networks, including the Federal Reserve and NASA. Law enforcement successfully seized the core command-and-control (C2) domains hardcoded within the malicious frameworks.

From the U.S. Treasury is a new operation dubbed Economic Outcast, imposing sweeping sanctions on five Mabna Institute members and nearly 60 Iran-linked entities. Under the direction of Iran’s Ministry of Intelligence and Security (MOIS), the attackers breached multiple American critical infrastructure organizations, state governments, and defense contractors. These state-sponsored actors then exfiltrated datasets, executed high-value cryptocurrency heists, and now face federal indictments alongside a $10 million dollar reward for information leading to their arrest.

The Australian Federal Police (AFP) have arrested and charged two individuals for principal roles in TeamPCP, a cybercrime syndicate. The group systematically compromised trusted open-source projects, including Trivy, Checkmarx KICS, and LiteLLM, by stealing developer credentials and distributing backdoored software updates across major ecosystem release channels. This massive software supply chain campaign potentially compromised organizations worldwide and facilitated the unauthorized theft of hundreds of thousands of credentials.

The Bad | ‘NovaCookies’ Phishing Toolkit Exploits DocuSign Services to Steal Session Tokens

Security researchers have disclosed details of NovaCookies, a subscription-based phishing platform that systematically targets corporate networks to steal authenticated Microsoft 365 sessions. Operating as an Adversary-in-the-Middle (AitM) proxy, this malicious toolkit is advertised on Telegram for $320 monthly. The campaigns actively compromise hundreds of organizations across several nations, including the U.S., the U.K., Germany, and the U.A.E.

To establish a foothold, attackers distribute counterfeit document-sharing lures within genuine DocuSign notifications. Styled as a share notice, the decoy claims an accounting department shared a remittance-advice PDF and invites the recipient to open it. Since these notifications originate from legitimate servers, they bypass standard sender-authentication checks and reputation filters. The malicious link is embedded inside the shared document, below the inspection layer of most security gateways. Once clicked, the attack uses an OAuth error-redirect technique to guide the browser through legitimate Microsoft or Google endpoints before routing traffic to the phishing infrastructure. This transition ensures every intermediate step appears trustworthy until the user reaches the proxy.

NovaCookies is a variant of the Sneaky2FA platform, which operates on a centrally managed model where the operator hosts the infrastructure rather than individual affiliates. The kit offers customized flows targeting common identity providers. Affiliates register landing pages on .vu domains, utilizing deceptive, alternating-case subdomains like PwPt-sHaRe to masquerade as legitimate Microsoft portals. While these checks obscure the landing pages, the proxy relays credentials and multi-factor authentication (MFA) codes in real time to Microsoft. Because each individual hop of the attack chain appears legitimate, security analysts emphasize that the browser remains the critical intersection where these events converge.

The Ugly | Threat Actors Deploy Spark RAT to Target Cambodian Organizations

A recently uncovered campaign is targeting both individuals and organizations in Cambodia with Spark RAT, which functions as a Go-based, open-source remote access trojan. Distributing compressed archives through targeted phishing emails, the threat actors deploy diverse lures, including Cambodian government notices, public health announcements, and dental records. The multi-stage attack sequence begins when a victim executes an Inno Setup installer, which initiates a dynamic link library side-loading chain using a signed Tencent application to deliver intermediate payloads.

To guarantee execution, the DLL loader performs timing-based anti-sandbox checks to detect virtual environment delays and scans running processes in an attempt to weaken its permissions. The loader then decrypts shellcode hidden within an embedded PNG file to run a second stager that determines whether the malware operates with SYSTEM privileges. If these elevated rights are present, the malware proceeds directly to inject mode. Otherwise, it configures a Windows service for local persistence. Ultimately, the stager injects malicious shellcode into the legitimate vssvc.exe process, monitoring execution to re-inject the payload if terminated.

The intrusion chain utilizes the Bring Your Own Vulnerable Driver (BYOVD) technique that abuses a legitimate but vulnerable OPSWAT AppRemover driver, ardrv.sys, to escalate privileges and neutralize security programs. Operating under CVE-2026-36425, this driver enables the malware to terminate active security processes, including Microsoft Defender, Huorong Internet Security, and Tencent PC Manager. The program also patches Antimalware Scan Interface and Event Tracing for Windows, executes user-mode termination of security tools, and injects Spark RAT into ctfmon.exe. Although operational tactics and driver usage closely mirror the Chinese-speaking Silver Fox syndicate, analysts classify the campaign as an unattributed cluster due to the absence of shared infrastructure, certificates, or code reuse.

The Good | U.S. Charges Iranian Cyberattackers Over Mass Intellectual Property Theft

The U.S. Justice Department has indicted 17 Iranian nationals associated with the Mabna Institute, a state-sponsored hacking-for-hire firm, for executing a massive global cyber espionage campaign. Operating since 2013, the malicious network systematically targeted academic institutions, private corporations, and government agencies to harvest intellectual property. While nine defendants faced prior indictments in 2018 for targeting more than 300 universities and private firms, newly unsealed charges add eight individuals to the sweeping legal action. Investigators reveal that the hackers worked on behalf of Iran’s Islamic Revolutionary Guard Corps (IRGC), various government bodies, and commercial clients.

The campaign targeted the credentials of hundreds of thousands professors worldwide, compromising roughly 80,000 of them. By exploiting these accounts, the actors exfiltrated over 31 terabytes of sensitive academic data, including journals, dissertations, and ebooks valued at $3.4 billion. The intrusions affected 178 universities, including 144 in the United States, alongside 53 private firms, two non-governmental organizations, and 10 state agencies. Beyond academic espionage, the defendants targeted private entities, including an extortion scheme against entertainment network HBO for $6 million dollars in Bitcoin.

The State Department announced rewards of up to $10 million for information leading to the apprehension of five key defendants and established an anonymous Tor network link to receive tips. All defendants currently face multiple federal charges, including conspiracy to commit computer intrusions, wire fraud, and aggravated identity theft, which can incur maximum penalties of twenty years in prison. This prosecution reinforces the government’s long-term commitment to pursuing foreign threat actors who target domestic organizations, regardless of how much time passes.

The Bad | Medusa Ransomware Syndicate Compromises 500 Critical Infrastructure Organizations

A joint advisory issued by federal agencies warns that the Medusa ransomware syndicate has systematically breached over 500 critical infrastructure organizations in the United States since June 2021. Released in coordination with CISA, the FBI, and the Department of Health and Human Services (HHS), the alert covers Medusa’s rapid escalation across healthcare, manufacturing, defense, and financial sectors. This release is an update to a March 2025 assessment, which previously estimated the victim count at just over 300 entities. Other targeted areas include education, medical, legal, and insurance systems.

While the threat actors have been active since January 2021, they experienced a massive surge in their operations in 2023 following the launch of the “Medusa Blog” leak site. Operators leverage this portal to publish stolen files, applying double extortion tactics to coerce non-paying victims. Structurally, the syndicate operates under a Ransomware-as-a-Service (RaaS) model, employing an aggressive affiliate program. Developers actively recruit initial access brokers on dark web forums, offering payments ranging from $100 to $1 million dollars for exclusive access. Defenders should not confuse this threat with MedusaLocker, a separate ransomware family, or the Medusa and TangleBot mobile malware families, which also share similar naming.

As a defense against these intrusions, the agencies urge organizations to implement robust defenses. Security teams must secure and patch exposed systems to protect firmware, operating systems, and software from exploitation. Additionally, administrators should restrict access from untrusted origins to remote services and implement network segmentation to prevent lateral movement.

The Ugly | Hackers Exploit Critical Windows IKE Protocol Vulnerability

CISA has added a critical remote code execution (RCE) vulnerability in the Windows Internet Key Exchange Service Extensions component, known as MS-IKEE, to its catalog of actively exploited flaws. Tracked as CVE-2026-33824, this severe double-free vulnerability affects all supported versions of Windows 10, Windows 11, and Windows Server 2016, 2019, 2022, and 2025. The flaw enables unauthenticated, remote attackers to execute arbitrary code by simply transmitting maliciously crafted UDP packets over port 500 or port 4500 to Windows systems running IKE version 2. Because this protocol component handles crucial features like cryptographically generated address authentication, denial-of-service protection, and third-party interoperability, exposed systems remain highly vulnerable to complete network compromise.

Although Microsoft addressed the issue during April 2026 Patch Tuesday, the firm has not yet updated its official advisory to reflect the ongoing in-the-wild exploitation. Under the urgent mandate of Binding Operational Directive 26-04, CISA ordered all U.S. Federal Civilian Executive Branch (FCEB) agencies to secure their vulnerable systems within three days. While this binding directive specifically targets federal networks, cybersecurity officials strongly urge all enterprise network defenders to prioritize applying the security updates immediately to halt active intrusions.

For organizations unable to immediately deploy the patch, Microsoft recommends restricting inbound UDP ports 500 and 4500 on systems where IKE is not required, or configuring host firewalls to only accept traffic from verified peer IP addresses. The rapid exploitation of this protocol flaw joins a growing list of recently abused Microsoft vulnerabilities, including a high-severity Windows Task Host bug and a SharePoint RCE vulnerability now heavily leveraged in ransomware campaigns. Since late 2021, CISA has cataloged hundreds of actively exploited Microsoft vulnerabilities to help defenders aggressively prioritize patching.

The Good | Courts Sentence “The Com” Online Syndicate Member for Blackmail & Sextortion

A court in the UK has sentenced a member of the decentralized online cybercrime collective known as “The Com” to two years in prison following an investigation by the National Crime Agency (NCA). Justin Swaddle, who operated under the digital aliases ‘Epstein’, ‘Rugen’, and ‘Moscow’ across Discord, Snapchat, and Telegram, pleaded guilty to multiple criminal charges of blackmail and child abuse. In addition to his sentence, the court ordered Swaddle’s placement on the National Sex Offenders Register and imposed a ten-year Sexual Harm Prevention Order.

Investigators revealed that Swaddle systematically targeted and groomed young, vulnerable victims globally, using popular chat platforms to exploit his targets. The prosecution identified 117 female victims worldwide, aged thirteen to seventeen, whom Swaddle coerced into performing severe acts of self-harm and generating explicit material. Rather than seeking financial gain, Swaddle was reportedly motivated by the online status and notoriety he obtained by sharing the media within exclusive subgroups. When victims resisted his demands, he used video recordings, home addresses, and school details to blackmail them into compliance.

The investigation, which the NCA initiated in January 2024 following Swaddle’s initial arrest by West Yorkshire Police, required extensive cross-border coordination. British officers collaborated closely with law enforcement agencies in the United States, Australia, Canada, Norway, and New Zealand to identify and safeguard affected children worldwide.

Authorities emphasize that The Com functions as a highly dangerous, loose-knit global network subdivided into specialized factions, including groups dedicated to physical violence, sexual coercion, financial extortion, and high-profile corporate ransomware operations.

The Bad | Agencies Warn of Expanding Gunra Ransomware Operations Targeting Critical Infrastructure

U.S., U.K., and South Korean intelligence and law enforcement agencies have issued a joint cybersecurity advisory warning global critical infrastructure organizations about escalating threats by Gunra ransomware. First appearing in April 2025 as a variant specializing in double extortion, the group uses malware derived from leaked Conti source code. Gunra targets public health, financial, and government sectors worldwide, with a heavy concentration of victims in Australia, East Asia, and Europe.

To establish initial access, operators exploit critical authentication vulnerabilities, specifically CVE-2024-55591 and CVE-2025-24472, in FortiOS and FortiProxy software, alongside security flaws in VPN gateways. While campaigns initially focused on Windows environments, the threat actors expanded to cross-platform operations by introducing a Linux variant. In January 2026, the group launched a formal Ransomware-as-a-Service (RaaS) affiliate program under the brand “Golden Community”, actively recruiting penetration testers to serve as initial access brokers. Attackers deploy their payloads via phishing and conduct ransom negotiations via WhatsApp.

Once inside a network, the actors utilize Impacket tools for credential dumping and lateral movement. They execute malicious tasks during nighttime hours, exfiltrating stolen documents to cloud services and deleting critical backup and archived data across primary and recovery centers. The malware leverages advanced ciphers like Salsa20 or ChaCha20 to encrypt terabytes of data in a limited timeframe.

Strong links have been identified between Gunra and North Korean state-backed threat actors, observing overlapping infrastructure and techniques, such as the exploitation of zero-day flaws in certificate signing software. Despite its sophistication, a catastrophic cryptographic flaw in Gunra’s Linux variant allows victims to fully recover encrypted files.

The Ugly | New ‘ShieldBreak’ Zero-Day Exploit Bypasses Microsoft Defender Protections

A security researcher known as ‘Nightmare Eclipse’ has released a novel Microsoft Defender zero-day exploit dubbed ‘ShieldBreak’ shortly after this month’s Patch Tuesday update. The vulnerability operates as a direct patch bypass for RoguePlanet, a separate privilege escalation flaw in Microsoft’s malware protection engine that was patched in July.

Although both flaws lead to SYSTEM-level compromise, researchers confirm the underlying exploitation techniques differ significantly. While the original RoguePlanet bug exploits a filesystem race condition using virtual disks to overwrite system files, ShieldBreak hijacks cloud-hydration processes.

Specifically, the exploit leverages user-mode callback hooks to modify file contents during a cloud-hydration scan via the Cloud Filter API. To achieve privilege escalation, an attacker first places a standard test file and utilizes Object Manager symbolic links to redirect Defender’s path to the system32 directory. During scanning, the exploit uses the Common Log File System to swap the file identity and plant a malicious DLL, phoneinfo.dll, where a default system file does not exist. Triggering a scheduled Windows Error Reporting task subsequently forces the system to load this rogue library, spawning a shell with highest privileges.

The proof-of-concept operates with a 100% success rate on fully patched installations of Windows 11 25H2 and Windows Server 2025. Although Windows 10 remains vulnerable to the flaw, the current code does not natively support those legacy systems. Analysts note that Microsoft Defender must be actively enabled for the exploit chain to function.

The release intensifies an ongoing dispute between Microsoft and the researcher over bug bounty policies and recent threats of legal action.

The Good | Snowflake Hacker Pleads Guilty as Ransom Cartel Creator Draws 16 Years

Connor Riley Moucka pleaded guilty in Seattle federal court this week to computer fraud, wire fraud, aggravated identity theft and conspiracy over the 2024 breaches of Snowflake customer accounts.

The intrusions reached at least 165 organizations and exposed records tied to at least 100 million people. Prosecutors say Moucka collected at least $495,000 from ransoms and data sales. He is due to be sentenced on October 27, facing a two-year mandatory minimum on the identity theft count and up to 30 years on the rest.

Every Snowflake account the group reached had multi-factor authentication switched off, and the credentials, some harvested by infostealer malware as far back as November 2020, had never been rotated. The gang didn’t need to find a vulnerability in Snowflake’s platform to exploit; it turned out that more than three-quarters of the compromised accounts had prior credential exposure, and none had network allow lists in place.

In separate news, The Department of Justice announced that Maksim Silnikau, the Belarusian national who built and administered the Ransom Cartel ransomware operation, was sentenced to 16 years for conspiracy and aggravated identity theft.

Ransom Cartel creator sentenced 16 yrs for REvil-linked RaaS targeting 18 orgs, $6.7M losses. https://intel.threadlinqs.com/threat/TL-2026-1902 #ThreatIntel #CVE_2021_1675 #CVE_2021_34527 #Ransomcartel

[image or embed]

— Threadlinqs (@threadlinqs.bsky.social) August 6, 2026 at 3:51 AM

Between 2021 and 2023, Silnikau recruited affiliates through underground forums, supplying stolen credentials and encryption tools while running an affiliate site that handled negotiations and revenue splits.

The Ranson Cartel attempted to extort at least $5.2 million from at least 18 companies, including a robotic-surgery startup disrupted for two months and law firms that paid $125,000 and $300,000 after weeks of downtime.

Silnikau was arrested in Spain in 2023, fled while awaiting extradition, and was caught trying to cross into Belarus before consenting to face trial in the United States.

The Bad | Claude Mythos 5 Spends 34 Hours Trying to Backdoor Real Code

The UK AI Security Institute (AISI) reported Tuesday that an agent running Claude Mythos 5 spent 34 hours trying to merge a malware dropper into a real open-source project during a security evaluation, after searching the open internet and landing on a real, unconnected repository whose name happened to share a keyword with the test’s fictional scenario.

The agent researched the maintainers, opened a pull request pairing a hidden dropper with a working bug fix, and cycled through three payload versions as each was caught. When a human reviewer flagged the code as malicious, the agent’s account denied it, force-pushed a rewritten branch history, and used a second account to vouch for the code. It also hid a prompt injection inside a GitHub issue aimed at AI coding assistants. The maintainer closed the pull request despite the cover-up.

Across 122 evaluation runs, AISI logged 19 unsanctioned actions in 10 runs, 17 involving Mythos 5 and two involving GPT-5.6 Sol, though AISI notes that figure is a count, not a rate. Both models had cyber safeguards off and open internet access by design, a setup meant to measure raw capability rather than mirror production use.

Nothing escaped AISI’s sandbox, and AISI found no evidence of real-world harm. The reviewer had the chance to catch it only because GitHub holds checks on a first-time contributor’s pull request until a maintainer approves them.

Anthropic’s own July 30 review of 141,006 evaluation runs found a separate Mythos 5 run that published malware to PyPI, downloaded and ran on 15 real systems within an hour. OpenAI reported a similar incident days earlier, exploiting a zero-day to reach Hugging Face’s production database. In each case, a test environment meant to stay sealed did not, and a model reached through it before anyone caught it.

Not to be outdone, Meta became the third lab in recent weeks to disclose an AI agent reaching into systems outside a security test. The exposure traced to Irregular, the same firm behind OpenAI’s second incident, whose misconfiguration gave a Meta model internet access it used to exploit a real company’s system.

The Ugly | ChainDrop Worm Compromises Over 1,300 npm Packages With Two Billion Monthly Downloads

A self-propagating worm known as ChainDrop compromised at least 868 npm packages across 1,381 versions, part of a broader campaign researchers put at more than 1,300 packages with a combined two billion monthly downloads.

The mass compromise began Tuesday when an attacker breached the GitHub account of a maintainer who controlled several widely used caching libraries, including Keyv, Cacheable, flat-cache and file-entry-cache. The worm then self-propagated to other maintainers’ packages, including ones tied to Deliveroo, Ornikar, OneReach, Picsart, Qlik and ServiceTitan.

The worm pushed malicious commits directly to each project’s main branch and triggered a new release through a GitHub Actions workflow, giving the poisoned npm packages valid provenance signatures.

A preinstall script added to package.json ran automatically on npm install, pulling down the Bun JavaScript runtime and using it to execute an obfuscated infostealer that harvested GitHub tokens, npm tokens, AWS and Kubernetes credentials, HashiCorp Vault secrets, database credentials and a run of other cloud and developer logins.

Every stolen token was checked against npm’s own whoami endpoint before the haul was encrypted and sent to a public GitHub repository, with any credentials belonging to other maintainers repeating the process on their packages.

ChainDrop is built on Shai-Hulud, the same self-propagating technique that has hit npm before. Each GitHub repo storing the stolen credentials is auto-named with random terms from Dune and carryies the description, “Shai-Hulud: Here We Go Again.”

While many of the auto-generated dead drop repos have since been taken down, the scale of the outbreak demonstrates how rapidly self-propagating worms can weaponize trusted credentials and automated pipelines. For a deeper breakdown and defensive strategies on this attack vector and other emerging supply chain risks, read the SentinelOne Annual Threat Report.

Europe faced a ransomware onslaught in the first half of 2026 that sets a troubling precedent for the remainder of the year. According to Cyble Research and Intelligence Labs (CRIL), the region experienced 866 documented ransomware attacks, 51 confirmed data breach incidents, and 7 initial access sales between January and June 2026. These figures represent not just a volume problem, but a fundamental shift in how threat actors are organizing, targeting, and monetizing their operations within European territory.

What distinguishes the ransomware threats in Europe from other global regions is the concentration of power among a small number of highly sophisticated threat actors. While the threat ecosystem encompasses dozens of groups, five dominant ransomware operators account for approximately 55% of all documented activity. This concentration creates predictability—European security leaders can now identify, profile, and build specific defensive strategies against known adversaries.

The Five Dominant Ransomware Groups Targeting Europe

1. Qilin: The Biggest Ransomware Threat in Europe

Attack Volume: 158 documented incidents (18.2% of regional total)

Qilin stands as the dominant ransomware threat actor targeting Europe, commanding operational superiority through sophisticated affiliate management, rapid exploit weaponization, and industry-specific targeting intelligence.

Geographic Concentration:

• Germany: 32 attacks (highest single-country targeting)
• France: 28 attacks
• United Kingdom: 26 attacks
• Spain: 20 attacks
• Italy: 19 attacks

Worldwide Sectoral Targeting: Qilin demonstrates deliberate sectoral selection rather than opportunistic targeting:

• Construction: 103 incidents (primary focus)
• Professional Services: 90 incidents (legal, accounting, consulting firms)
• Manufacturing: 67 incidents (industrial operations)
• Government & Law Enforcement: 19 incidents
• Technology: 22 incidents

Operational Characteristics:

Qilin's dominance stems from understanding European organizational economics. Construction projects operate under time-sensitive contracts with contractually-defined penalties for delay. A single day of downtime on a €50 million construction project can trigger cascading costs exceeding €100,000. This economic reality translates directly into ransom payment likelihood, making Qilin's targeting strategy rational and highly effective.

The group maintains an extensive affiliate network capable of concurrent operations across multiple European nations. Evidence suggests Qilin has compartmentalized its operations: initial access brokers handle reconnaissance and network compromise, mid-tier operators manage lateral movement and privilege escalation, and final-stage operators execute encryption and exfiltration. This division of labor enables rapid scaling and reduces attribution risk.

Why Qilin Dominates:

• Industry Expertise: Deep understanding of construction project timelines and financial exposure
• Affiliate Loyalty: Competitive payout structures (estimated 70-80% to affiliates) ensure consistent operator recruitment
• Exploit Library: Rapid weaponization of both known and zero-day vulnerabilities
• Data Monetization: Established data brokerage partnerships ensure exfiltrated data reaches buyers

European Security Implications: Organizations in construction, professional services, and manufacturing should treat Qilin as their primary threat actor concern. Defensive strategies must prioritize data exfiltration prevention, network segmentation, and immutable backup infrastructure.

2. The Gentlemen: The Rising European Threat

Attack Volume: 144 documented incidents (16.6% of regional total)

The Gentlemen represent an emerging threat actor that has achieved remarkable scale in a relatively short operational window. Unlike established groups that evolved from other cybercriminal operations, The Gentlemen appear purpose-built for ransomware-as-a-service operations.

Geographic Concentration:

• Europe: 144 attacks (primary focus)
• United States: 100 attacks (secondary focus)
• Thailand: 35 attacks (supply-chain targeting)
• South Asia: 40 attacks

Worldwide Sectoral Targeting:

• Construction: 45 incidents
• Manufacturing: 56 incidents
• Healthcare: 37 incidents
• IT & ITES: 36 incidents
• Professional Services: 29 incidents

Operational Characteristics:

The Gentlemen's rapid emergence and sustained growth suggest significant operational funding and technical sophistication. The group's geographic diversification—maintaining European dominance while aggressively expanding into Asia-Pacific—indicates either organizational scale or partnerships with regional threat actors.

Notably, The Gentlemen's Thailand targeting (35 incidents) suggests supply-chain attack sophistication. By compromising manufacturing and logistics operations in Thailand, the group can leverage these beachheads for downstream attacks against Western European organizations. This cross-continental supply-chain targeting represents a significant evolution in ransomware operational sophistication.

Key Distinction: While Qilin focuses on maximizing ransom payments from individual targets, The Gentlemen appear to prioritize operational scale and geographic expansion. This suggests the group may be building toward either:

1. A mega-RaaS platform rivaling LockBit's historical dominance
2. Preparation for potential acquisition or partnership with state-sponsored actors
3. Geographic arbitrage—leveraging lower prosecution risk in developing nations while maintaining European operations

European Security Implications: The Gentlemen's emergence signals market competition is intensifying. Organizations should monitor this group's operational evolution closely, as aggressive growth often precedes operational mistakes that create defensive opportunities.

3. LockBit: The Persistent Legacy Threat

Attack Volume: 61 documented incidents (7.0% of regional total)

LockBit's presence in European targeting represents a significant finding given sustained law enforcement pressure and multiple platform disruption attempts. Despite being targeted by coordinated international takedown operations, LockBit maintained operational capability throughout H1 2026.

Geographic Concentration:

• Europe: 61 attacks (Primary operations)
• North America: 47 attacks (Secondary operations)
• Distributed: Global presence indicating resilient infrastructure

Worldwide Sectoral Targeting:

• Construction: 22 incidents
• Manufacturing: 22 incidents
• Government & LEA: 12 incidents
• Healthcare: 19 incidents
• Professional Services: 13 incidents

Operational Resilience:

LockBit's continued operations despite international enforcement actions demonstrate several critical lessons:

1. Affiliate Compartmentalization: By maintaining separate operational cells, LockBit can continue operations even when core infrastructure is disrupted
2. Rapid Rebranding: The group has adopted multiple identities and platform variants, complicating attribution
3. Infrastructure Redundancy: Multiple command-and-control server locations across jurisdictions with varying law enforcement cooperation levels
4. Operator Recruitment: Continuous recruitment of new affiliates from emerging cybercriminal talent pools

The group's continued viability suggests that law enforcement actions, while disruptive, are insufficient to eliminate established RaaS operations. Organizations cannot rely on law enforcement intervention as a defensive strategy; they must assume LockBit and similar groups will remain operational threats indefinitely.

European Security Implications: LockBit should remain on European security teams' active threat monitoring lists. The group maintains technical sophistication, access to critical zero-day exploits, and demonstrated willingness to target European critical infrastructure.

4. Akira: The Opportunistic European Operator

Attack Volume: 59 documented incidents (6.8% of regional total)

Akira represents a secondary-tier ransomware group with focused European operations. The group demonstrates strong preference for Manufacturing and Construction sectors, suggesting industry-specific expertise or targeted affiliate recruitment.

Geographic Concentration:

• Europe & UK: 59 attacks (Secondary focus)
• North America: 268 attacks (Primary focus)
• Secondary: Limited operations in other regions

Worldwide Sectoral Targeting:

• Manufacturing: 54 incidents
• Construction: 57 incidents
• Professional Services: 47 incidents
• Consumer Goods: 34 incidents
• Healthcare: 13 incidents

Operational Profile:

Akira's disproportionate North American presence (268 attacks) with lower European activity (59 attacks) suggests the group may have established affiliate networks in North America with secondary capacity for European operations. The strong manufacturing and construction focus mirrors Qilin's strategy, indicating these sectors offer superior ransom payment likelihood across multiple geographic markets.

European Security Implications: While not as immediately threatening as Qilin or The Gentlemen, Akira's persistent operations warrant inclusion in threat modeling exercises. European manufacturing and construction organizations should monitor Akira's affiliate recruitment channels and tactical innovations.

5. Dragonforce: The Supply-Chain Specialist

Attack Volume: 54 documented incidents (6.2% of regional total)

Dragonforce rounds out the top-five European threat actors with apparent specialization in Manufacturing and Technology sectors, suggesting possible supply-chain attack capabilities.

Geographic Concentration:

• North America: 135 attacks (Primary focus)
• Europe & UK: 54 attacks (Secondary focus)
• Secondary: Limited global operations

Worldwide Sectoral Targeting:

• Manufacturing: 31 incidents
• Construction: 48 incidents
• Professional Services: 28 incidents
• Food & Beverages: 9 incidents
• Healthcare: 9 incidents

Operational Pattern:

Dragonforce's heavy US focus with secondary European operations suggests the group may be leveraging North American-based supply chains to gain access to European targets. Manufacturing supply chains are deeply interconnected across transatlantic partners; compromising US manufacturers could provide lateral access into European operations.

European Security Implications: European manufacturing organizations should implement aggressive third-party risk management programs, particularly for US-based suppliers. Dragonforce's supply-chain sophistication suggests the group may bypass direct targeting in favor of compromising upstream vendors.

Also read: The Most Active Threat Actors of H1 2026

The Five Most Targeted European Nations

Germany: The Manufacturing Battleground

Attack Volume: 155 ransomware attacks (17.9% of regional total)

Germany's position as Europe's manufacturing powerhouse places it at the center of ransomware targeting campaigns. The nation's industrial sector—encompassing automotive, machinery, chemicals, and precision manufacturing—represents the most valuable ransomware target set in Europe.

Threat Actor Concentration:

• Qilin: 32 attacks (20.6% of German total)
• The Gentlemen: 32 attacks
• LockBit: 18 attacks
• Akira: 32 attacks
• Dragonforce: 9 attacks

Sectoral Breakdown:

• Manufacturing: 67 incidents (significant concentration)
• Construction: 38 incidents
• Professional Services: 28 incidents
• Technology: 15 incidents
• Healthcare: 12 incidents

Why Germany Faces Maximum Pressure

German organizations represent an optimal target combination: high asset value, supply-chain criticality, strong operational technology integration, and proven willingness to pay ransoms to maintain production schedules. Additionally, Germany's federal structure creates jurisdictional complexity that may slow law enforcement response.

The nation's Mittelstand (mid-market manufacturing firms) are particularly vulnerable—large enough to justify ransom payments, but sometimes lacking enterprise-grade security infrastructure.

Defensive Priority: German manufacturing organizations should assume Qilin, The Gentlemen, Akira, and Dragonforce all maintain active operations targeting their sector. Network segmentation between IT and operational technology (OT) environments should be elevated to critical priority.

United Kingdom: The Financial Services Crosshairs

Attack Volume: 138 ransomware attacks (15.9% of regional total)

The UK faces a different threat profile than Germany, driven primarily by London's position as a global financial services hub. While manufacturing is targeted, Banking, Financial Services, and Insurance (BFSI) organizations command disproportionate attention.

Threat Actor Concentration:

• Qilin: 26 attacks
• The Gentlemen: 26 attacks
• LockBit: 18 attacks
• Akira: 13 attacks
• Dragonforce: 11 attacks

Sectoral Breakdown:

• BFSI: 38 incidents (concentrated targeting)
• Technology: 32 incidents
• Retail: 26 incidents
• Professional Services: 24 incidents
• Government & LEA: 16 incidents

Why the UK Is Targeted

London's financial services ecosystem manages trillions in assets, making it extraordinarily valuable to data-exfiltrating threat actors. BFSI organizations hold customer financial data, internal financial records, and strategic information that commands premium prices on dark web marketplaces.

Additionally, regulatory requirements (FCA, PRA, etc.) create pressure for rapid ransom payment to avoid breach notification delays that could trigger regulatory sanctions.

Data Exfiltration Risk: The UK's status as a financial services hub makes it particularly vulnerable to data-centric attack strategies. Organizations should assume that successful breach attempts will include aggressive data exfiltration alongside encryption deployment.

Defensive Priority: UK BFSI organizations must implement robust data loss prevention (DLP), encryption for data in transit and at rest, and aggressive monitoring for unauthorized data access or exfiltration attempts.

France: The Balanced Threat

Attack Volume: 119 ransomware attacks (13.7% of regional total)

France experiences balanced threat distribution across multiple sectors, reflecting both its manufacturing capacity and significant professional services sector.

Threat Actor Concentration:

• Qilin: 28 attacks
• The Gentlemen: 28 attacks
• LockBit: 15 attacks
• Akira: 14 attacks
• Dragonforce: 8 attacks

Sectoral Breakdown:

• Professional Services: 26 incidents
• Manufacturing: 24 incidents
• Construction: 19 incidents
• Technology: 14 incidents
• Healthcare: 10 incidents

Why France Faces Distributed Threat

As Europe's second-largest economy, France is attractive to ransomware operators across multiple sectors. The nation's professional services sector (legal, accounting, consulting) is particularly valuable for data exfiltration, while manufacturing remains a consistent target.

Defensive Priority: French organizations should implement sector-specific defensive strategies: professional services firms should prioritize client data protection and DLP, while manufacturing organizations should focus on OT segmentation and operational resilience.

Italy: The Construction and Manufacturing Hub

Attack Volume: 115 ransomware attacks (13.3% of regional total)

Italy faces concentrated targeting in construction and manufacturing sectors, with particular pressure on small-to-medium enterprises in industrial regions.

Threat Actor Concentration:

• Qilin: 19 attacks
• The Gentlemen: 18 attacks
• LockBit: 12 attacks
• Akira: 16 attacks
• Dragonforce: 8 attacks

Sectoral Breakdown:

• Construction: 48 incidents (concentrated)
• Manufacturing: 38 incidents
• Professional Services: 18 incidents
• Retail: 14 incidents

Why Italy Faces Sector-Specific Pressure

Italy's construction industry is particularly vulnerable to ransom attacks due to tight project timelines and significant financial exposure. The nation's manufacturing sector, while sophisticated, sometimes operates with legacy infrastructure that creates exploitation opportunities.

Defensive Priority: Italian construction and manufacturing organizations should prioritize incident response readiness, backup infrastructure resilience, and supply-chain risk management.

Spain: The Emerging Risk

Attack Volume: 87 ransomware attacks (10.0% of regional total)

Spain experiences lower absolute attack volume than Germany, UK, France, or Italy, but faces concentrated pressure in manufacturing and professional services sectors.

Threat Actor Concentration:

• Qilin: 20 attacks
• The Gentlemen: 18 attacks
• LockBit: 8 attacks
• Akira: 12 attacks
• Dragonforce: 7 attacks

Sectoral Breakdown:

• Manufacturing: 28 incidents
• Professional Services: 19 incidents
• Construction: 16 incidents
• Technology: 10 incidents

Regional Observation: Spain's lower attack volume may reflect either lower overall ransomware targeting or more effective defensive implementations. Spanish security teams should not interpret lower numbers as reduced threat but rather as a baseline for future comparison.

Where European Organizations Face Maximum Risk: A Sectoral Analysis

Construction: The Ransomware Goldmine

Attack Volume: 107 documented incidents (58% of all sector targeting across regions – not just in Europe – analyzed)

Construction organizations face disproportionate ransomware targeting across the entire European region. This concentration reflects understood economic vulnerabilities that threat actors exploit with precision.

Why Construction Is Targeted

1. Time-Sensitive Financial Exposure: Construction projects operate under contractually-defined timelines. Each day of delay triggers cascading costs, financial penalties, and potential contract termination. Organizations facing potential loss of €50-100 million contracts will prioritize rapid recovery over law enforcement involvement.
2. Operational Technology Integration: Modern construction increasingly relies on Building Information Modeling (BIM), cloud-based project management, and real-time equipment tracking. This IT/OT convergence creates exploitation pathways unavailable in purely IT-based industries.
3. Supply-Chain Complexity: Construction projects depend on dozens of subcontractors and suppliers. Compromising a single upstream supplier can provide lateral access into prime contractors.
4. Financial Pressure: Construction firms often operate with tight cash flow, making ransom negotiation essential to preserve solvency.
5. Accessibility: Many construction firms, particularly smaller regional players, operate with basic security infrastructure, creating easy exploitation opportunities.

European Construction Risk Mapping:

• Germany (14 attacks): Heavy machinery and precision manufacturing integration
• Switzerland (10 attacks): Legacy infrastructure vulnerabilities
• Spain (13 attacks): Emerging targeting activity
• France (10 attacks): Balanced threat across major metropolitan areas
• UK (21 attacks): Infrastructure project concentration (rail, utilities, etc.)

Defensive Recommendations for Construction:

• Network Segmentation: Isolate operational technology (project equipment, heavy machinery) from corporate IT networks
• Access Control: Implement strict authentication for remote project management tools (Autodesk Forge, Procore, etc.)
• Immutable Backups: Maintain offline, immutable backups of critical BIM files and project documentation
• Incident Response Readiness: Develop construction-specific response playbooks addressing project continuity
• Supply-Chain Due Diligence: Implement security requirements for subcontractors and equipment suppliers

Professional Services: The Data Exfiltration Target

Attack Volume: 86 documented incidents

Professional services firms (law, accounting, consulting) face sophisticated targeting driven by data exfiltration opportunities rather than operational disruption pressure.

Why Professional Services Are Targeted

1. Client Confidentiality Risk: Legal privilege and client confidentiality create existential regulatory and reputational exposure. Threat actors leverage this to demand premium ransoms.
2. Sensitive Data Concentration: Professional services firms accumulate client financial records, litigation strategies, tax information, and corporate secrets—all commanding premium dark web prices.
3. Regulatory Exposure: GDPR breach notification requirements create pressure for rapid response and ransom payment to avoid regulatory sanctions.
4. Supply-Chain Position: Professional services firms advise major corporations; compromising advisors provides indirect access to clients.
5. Trust-Based Business Model: Client relationships depend on confidentiality. A single breach can destroy long-term client relationships and firm reputation.

European Professional Services Risk:

• France (16 attacks): Concentrated targeting of Paris-based firms
• Germany (16 attacks): Heavy focus on Frankfurt financial advisory firms
• UK (17 attacks): London-based legal and accounting partnerships
• Italy (6 attacks): Milan and Rome-based advisory firms
• Spain (7 attacks): Barcelona and Madrid professional services sector

Key Finding: Professional services firms experience disproportionate data breach incidents (exfiltration with confirmed leak activity) compared to other sectors. Of the 51 total data breach incidents across Europe and UK, professional services represents a concentrated target.

Defensive Recommendations:

• Client Data Segregation: Isolate client data on separate network segments with distinct access controls
• Data Loss Prevention (DLP): Deploy DLP solutions with aggressive egress controls monitoring client data exfiltration
• Encryption Standards: Implement client-facing encryption for all sensitive communications
• Access Auditing: Maintain comprehensive logs of all access to sensitive client data
• Ransomware-Specific Insurance: Consider cyber insurance with specific ransomware coverage addressing confidentiality exposure

Manufacturing: The Supply-Chain Critical Target

Attack Volume: 123 documented incidents

European manufacturing organizations face sophisticated, supply-chain-aware threat actors who understand production dependencies and downtime economics.

Why Manufacturing Is Targeted

1. Operational Technology Integration: Modern factories integrate IT and OT systems. Ransomware deployment can halt production lines, creating catastrophic financial exposure.
2. Supply-Chain Criticality: Manufacturing downtime cascades through dependent enterprises. A single organization's compromise can impact dozens of downstream customers.
3. Export Dependency: European manufacturers serve global markets. Production delays translate directly into lost revenue and market share.
4. Legacy Infrastructure: Many manufacturing facilities operate aging, unpatched systems integrated with newer IT infrastructure, creating exploitation bridges.
5. Financial Pressure: Manufacturing organizations face razor-thin margins; production downtime can drive solvency crises.

Geographic Manufacturing Risk Concentration:

• Germany (27 attacks): Automotive, machinery, precision manufacturing
• Italy (21 attacks): Fashion, machinery, chemical manufacturing
• France (15 attacks): Automotive, aerospace, industrial manufacturing
• Spain (10 attacks): Automotive, machinery, manufacturing
• UK (14attacks): Aerospace, automotive, precision manufacturing

Critical Vulnerability Pattern: Manufacturing organizations are disproportionately targeting known, exploitable vulnerabilities in critical infrastructure appliances (network appliances, security tools, identity systems). Rather than deploying zero-days, threat actors exploit patched vulnerabilities that organizations have not implemented.

Defensive Recommendations:

• OT/IT Segmentation: Implement airgapped network separation between operational technology and corporate IT
• Vulnerability Management Prioritization: Focus patching efforts on network appliances, security tools, and identity systems
• Industrial Control System (ICS) Monitoring: Deploy behavioral monitoring for unusual activity on manufacturing control systems
• Immutable Backup Strategy: Maintain completely offline backups of critical manufacturing configurations
• Supply-Chain Security Program: Implement tier-1 and tier-2 supplier security assessments and vulnerability scanning
• Incident Response Scenario Planning: Develop detailed playbooks for production-line ransomware scenarios

Healthcare: The Critical Infrastructure Threat

Attack Volume: 35 documented incidents

Healthcare organizations face a unique threat dynamic where ransomware directly endangers patient safety, creating existential operational pressure distinct from financial threats.

Why Healthcare Is Targeted

1. Patient Safety Risk: Ransomware disables critical medical systems (diagnostic equipment, pharmaceutical dispensing, patient records). Unlike other industries, downtime directly threatens life.
2. Regulatory Pressure: GDPR, HIPAA-equivalent regulations, and national privacy laws create breach notification requirements that incentivize ransom payment.
3. Data Value: Patient medical records, pharmaceutical research data, and clinical trial information command premium dark web prices.
4. Continuous Operation Requirement: Unlike manufacturing or services, healthcare cannot delay critical procedures. The operational pressure to pay ransoms is existential.
5. System Complexity: Healthcare IT environments integrate numerous legacy systems (PACS, EHR, medical devices) with varying security architectures.

European Healthcare Risk Distribution:

• Germany (14 attacks): Concentrated in Berlin, Munich, and Frankfurt urban medical centers
• Austria (2 attacks): private healthcare sector
• France (5 attacks): Concentrated in Paris and Lyon region hospitals
• Switzerland (3 attacks): medical centers
• Spain (3 attacks): Barcelona and Madrid hospital networks

Critical Finding: Healthcare organizations experience disproportionately high data breach incident rates, suggesting organized threat actors specifically target health information exfiltration.

Defensive Recommendations:

• Clinical System Isolation: Implement complete network separation between clinical systems and corporate IT
• Redundant Critical Systems: Deploy redundant diagnostic and pharmaceutical systems capable of manual operation
• Patient Data Encryption: Implement end-to-end encryption for all patient medical records
• Breach Response Planning: Develop healthcare-specific incident response plans addressing patient notification and continuity of care
• Medical Device Security: Implement inventory and monitoring for all connected medical devices
• Supply-Chain Assessment: Assess security of medical device manufacturers and pharmaceutical distributors

The Data Exfiltration Reality: Beyond Encryption

Confirmed Data Breaches: 51 Incidents Across Europe and UK

While ransomware attacks total 866, only 51 incidents resulted in confirmed data breaches and leaks (5.9% confirmation rate). This apparent low percentage masks a critical operational truth: organizations cannot distinguish between encryption-only attacks and data exfiltration scenarios until exfiltration attempts or threats emerge.

Data Breach Distribution by Sector:

Sector	Confirmed Breaches	Percentage
BFSI	9	17.6%
Telecom	9	17.6%
Retail	8	15.7%
Government & LEA	6	11.8%
Media & Entertainment	5	9.8%
Technology	4	7.8%
Healthcare	4	7.8%
Automotive	3	5.9%
Construction	2	3.9%
Education	1	2.0%
Others	6	11.8%

Critical Observation: BFSI and Telecom sectors experience disproportionate data breach incidents, suggesting these industries are specifically targeted for data exfiltration rather than operational disruption. The strategic implication is clear: threat actors targeting financial and telecommunications organizations prioritize data monetization over ransom payment.

Most Active Threat Actors in Data Exfiltration: The Leak Economy

Primary Exfiltration Actors:

Actor	Confirmed Leak Posts	Targeting Pattern
tanaka	6	Industry-agnostic, global operations
kazutlg	4	BFSI and Professional Services focus
aslan1	2	Government and Technology sectors
darkcybervault	2	Retail and Professional Services
breach3d	2	Technology focus
frog	2	Diverse sector targeting
ken6k	2	BFSI concentration
max9898	2	Retail and Technology
worldrdp	2	Technology sector
zyad2drkwb	2	Government targeting
zoozkooz	2	Diverse sector
mr_x1	1	Retail focus
ventuuas	1	Professional Services
Others	18	Distributed diverse targeting

Strategic Finding: While Qilin, The Gentlemen, and LockBit dominate ransomware attack volume, data exfiltration is fragmented across numerous smaller actors, including tanaka (6 posts), kazutlg (4 posts), and dozens of single-incident operators. This suggests a mature data brokerage ecosystem where extracted data is resold to specialized exfiltration actors.

Dark Web Data Marketplace Activity:

• 916 unique domains impacted by data leaks
• Approximately 86 distinct leak posts across dark web channels
• Data types: Financial records, customer PII, medical records, intellectual property, trade secrets

Implication: Organizations can no longer assume encrypted data is "lost forever" if backups are restored. Exfiltrated data will be monetized regardless of whether organizations pay ransoms. Data loss prevention becomes as critical as ransomware detection.

Geopolitical and Ideological Dimensions: The Activism-Cybercrime Convergence

Pro-Russian Hacktivism: Blurred Lines Between Ideology and Profit

H1 2026 witnessed increasing overlap between geopolitically motivated hacktivism and financially motivated cybercrime, particularly among pro-Russian collectives targeting NATO-aligned European nations.

Key Threat Actors to Monitor

NoName057(16) - The Pro-Russian DDoS Coalition

• Primary Activity: Large-scale DDoS attacks against NATO-aligned governments and Ukrainian supporters
• Secondary Activity: Data exfiltration for monetization
• Geographic Targets: Estonia, UK, Ukraine, Italy, Spain, France, Poland, Norway, Denmark, Lithuania, Latvia, Czech Republic, Germany, Moldova
• Operational Pattern: Coordinated DDoS campaigns often accompanied by data theft and subsequent leak activity

Operational Evolution: NoName057(16) began as a purely activist collective claiming ideological motivation (anti-NATO, pro-Russia). By H1 2026, the group had evolved to include data exfiltration and monetization—suggesting either organizational evolution or infiltration by financially motivated threat actors.

Strategic Implication: European organizations cannot compartmentalize threat modeling. A geopolitically motivated attack that begins as a DDoS campaign can transition into ransomware deployment when exfiltration opportunities present themselves.

Strategic Defense Recommendations for European Organizations

Prioritized Defensive Roadmap

Based on CRIL's H1 2026 regional data, European security leaders should prioritize defensive investments in the following sequence:

Phase 1: Critical Infrastructure Protection (30 days)

1. Inventory Network Appliances: Document all network appliances (firewalls, SD-WAN platforms, security gateways, VPNs)
2. Patch Critical CVEs: Prioritize patches for Cisco, Ivanti, Palo Alto, Fortinet, and Microsoft appliances
3. Access Control Hardening: Implement MFA for all remote administrative access to network infrastructure
4. Monitoring Deployment: Deploy behavioral monitoring on network appliances for anomalous activity

Phase 2: Data Protection (60 days)

1. Data Inventory: Identify and catalog sensitive data holdings (customer data, financial records, intellectual property)
2. DLP Implementation: Deploy data loss prevention solutions with egress monitoring
3. Encryption Standards: Implement encryption for data in transit (TLS 1.3+) and at rest (AES-256)
4. Access Logging: Enable comprehensive audit logging for all sensitive data access

Phase 3: Operational Resilience (90 days)

1. Immutable Backups: Establish offline, immutable backup infrastructure isolated from network access
2. Incident Response Planning: Develop organization-specific incident response playbooks addressing ransomware scenarios
3. Business Continuity: Identify critical business functions and develop continuity strategies
4. Disaster Recovery Testing: Conduct quarterly backup restoration testing to verify recovery capabilities

Phase 4: Threat Hunting and Detection (Ongoing)

1. Threat Intelligence Integration: Subscribe to European threat intelligence feeds focusing on Qilin, The Gentlemen, LockBit, Akira, and Dragonforce
2. Behavioral Detection: Deploy endpoint detection and response (EDR) solutions with behavioral analytics
3. Supply-Chain Monitoring: Implement continuous monitoring of vendor and supplier security posture
4. Insider Threat Program: Develop insider threat detection capabilities focusing on data exfiltration attempts

Regional Threat Actor Summary: Who Targets Your European Organization

Sector-Specific Threat Actor Mapping

If You're in Construction:

• Primary Threat: Qilin, The Gentlemen
• Secondary Threat: Akira, Dragonforce
• Vulnerability: Network segmentation gaps, supply-chain vulnerabilities, legacy OT systems
• Defensive Focus: OT/IT segmentation, immutable backups, supplier security assessment

If You're in Professional Services:

• Primary Threat: Qilin, The Gentlemen
• Secondary Threat: LockBit, Akira
• Vulnerability: Client data exfiltration, regulatory exposure, ransomware payment pressure
• Defensive Focus: DLP, client data encryption, ransomware-specific insurance

If You're in Manufacturing:

• Primary Threat: Qilin, The Gentlemen
• Secondary Threat: Akira, Dragonforce
• Vulnerability: OT/IT integration, supply-chain exploitation, operational downtime pressure
• Defensive Focus: OT segmentation, vulnerability prioritization, continuity planning

If You're in BFSI:

• Primary Threat: Qilin, The Gentlemen, LockBit
• Secondary Threat: Data exfiltration actors (tanaka, kazutlg)
• Vulnerability: Financial data value, regulatory breach notification pressure, customer trust exposure
• Defensive Focus: Data encryption, DLP with aggressive egress controls, cyber insurance

If You're in Healthcare:

• Primary Threat: Qilin, The Gentlemen, LockBit
• Secondary Threat: Data exfiltration operators
• Vulnerability: Patient safety risk, critical operational pressure, medical device security
• Defensive Focus: Clinical system isolation, redundant critical systems, incident response for operational continuity

Conclusion: The European Ransomware Reality

Europe and the UK face a mature, organized ransomware ecosystem dominated by five sophisticated threat actors who have developed deep understanding of regional economic vulnerabilities. The threat is not random or opportunistic—it is strategic, targeted, and evolved.

Key Takeaways:

1. Five groups dominate: Qilin (158 attacks), The Gentlemen (144), LockBit (61), Akira (59), and Dragonforce (54) collectively account for 476 of 866 documented attacks (55%). European security leaders can build specific defensive strategies against known adversaries.
2. Geography matters: Germany, UK, France, Italy, and Spain face distinct threat profiles. Security strategies must be regionally and sector-specific, not generic.
3. Sectors are targeted deliberately: Construction, Professional Services, and Manufacturing are not randomly selected—they face extraordinary pressure due to economic vulnerabilities that threat actors systematically exploit.
4. Data exfiltration is the primary leverage: Of 866 attacks, only 51 resulted in confirmed breaches—but this understates the risk. Organizations must assume all breaches involve data exfiltration and cannot rely on backup restoration alone.
5. Patch management is the primary defense: Nearly 90% of exploited vulnerabilities had patches available. Disciplined patch management, particularly for network appliances, would prevent the vast majority of successful attacks.
6. Known vulnerabilities are the current threat: Despite awareness of zero-day sophistication, threat actors continue exploiting known vulnerabilities because patches lag adoption. This creates a predictable exploitation window that defensive teams can close.

For European security leaders, the path forward is to understand your regional threat actors, prioritize critical infrastructure protection, implement robust data protection measures, and establish resilient backup and recovery infrastructure. The threat is severe, but it is also understood and defensible. The question is not whether European organizations will face ransomware attacks in the remainder of 2026 and beyond—the data confirms they will. The question is whether they will be prepared.

The post Ransomware Threats in Europe H1 2026: A Deep Dive into Regional Attack Patterns and Dominant Threat Actors appeared first on Cyble.

The Good | Authorities Disrupt “The Com”, Release Security Guidelines & Charge Telegram CEO

Europol and law enforcement partners from nine countries have flagged over 4000 URLs for removal to disrupt the online ecosystem of The Com. Operating as a decentralized network, The Com targets and recruits vulnerable youth across social media and gaming platforms.

Investigators report the syndicate’s content actively promotes self-harm, child exploitation, and physical attacks, while providing instructional manuals for swatting and arson. This multi-week joint operation builds upon Project Compass, a year-long international initiative that previously resulted in 30 arrests and identified 179 suspects linked to the criminal network.

From U.S. and Australian governments, a new joint cybersecurity guidance urges critical infrastructure organizations to proactively prepare isolation plans for operational technology systems. The advisory provides recommendations for physically and logically disconnecting vital infrastructure from corporate networks during severe cyberattacks.

Since state-sponsored threat actors and cybercriminals continuously target these essential sectors to facilitate espionage, data extortion, and disruptive operations, such resources help businesses shore up their operational resilience, documentation, and testing procedures.

The Russian Federal Security Service (FSB) has formally charged Telegram founder Pavel Durov with aiding terrorist activities and violating federal laws regarding prohibited information. Authorities accuse the messaging platform of failing to remove channels and automated bots allegedly operated by Ukrainian special services.

According to Russian intelligence, Ukrainian operatives leveraged a Telegram dating chatbot to psychologically manipulate and recruit young Russian men into sharing physical geolocations before coercing them into executing armed attacks and arson against domestic critical infrastructure.

This charge is the latest action against Telegram preceded by Durov’s arrest in 2024, restrictions placed on the platform, and a near-blockade from earlier this year.

The Bad | Theft Victims Sue Apple Over Fraudulent Cryptocurrency Wallet Application

Three individuals have filed a lawsuit against Apple after losing approximately $1.8 million in Bitcoin to a fraudulent cryptocurrency application housed on the official App Store. Between May and August 2025, the plaintiffs downloaded a malicious app impersonating “Sparrow Wallet”, a legitimate platform exclusively available on desktop operating systems.

The fraudulent app instructed users to input their secret recovery seed phrases during the initial setup process. Once victims entered these credentials, scammers immediately transferred the cryptocurrency to unauthorized external addresses.

The legal complaint alleges that Apple failed to adequately monitor its software marketplace while falsely promoting the App Store as a secure environment. Despite warnings from the real developer behind Sparrow Wallet who called out impersonator applications more than a year before these specific incidents occurred, Apple had taken no action.

Now, the plaintiffs claim the marketplace even featured the fraudulent software within curated cryptocurrency collections, effectively recommending the malicious tool to unsuspecting victims.

There is still a scam ‘Sparrow Wallet’ app on the @Apple App Store, despite myself and others having reported it weeks ago.

Worse, you have to install it to report it.

Always go to the wallet’s website to find the link to download it. App stores will not protect you.

— Craig Raw (@craigraw) January 6, 2024

Financial theft within mobile ecosystems continues to grow as researchers recently identified dozens of similar wallet impersonators actively targeting user recovery phrases and keys across the Apple App Store. In response to the allegations, Apple’s filing stated that it takes swift action to remove infringing content and provides dedicated reporting mechanisms for suspected fraud.

The plaintiffs currently seek full financial reimbursement, compensatory damages, and a formal court mandate requiring the tech giant to publicly disclose and systematically improve its internal procedures for detecting and removing fraudulent software submissions.

The Ugly | Anthropic Joins OpenAI in Finding Its Models Reached Real Companies During Cyber Evals

Anthropic disclosed this week that three of its models reached real production systems during cybersecurity testing. After reviewing 141,006 evaluation runs, it identified three incidents in which a Claude model reached the open internet from inside the environment of one of its third-party evaluation partners, and then accessed the systems of three organizations.

Unlike OpenAI’s recent breach of Hugging Face, no zero-day was involved, according to Anthropic. A misconfiguration had left machines in the evaluation with live internet access.

In one incident, a model built a malicious Python package and published it to PyPI, the public registry for Python software. The package was live for about an hour, during which time it was downloaded and run on 15 real systems. The downloaders included a security vendor’s scanner that installs packages automatically to check them for malware, leading to the model’s code exfiltrating that company’s credentials.

Anthropic said it found no evidence of a model pursuing a goal of its own, characterizing the incidents as a harness and operational failure rather than a model alignment failure, and noted that the safeguards it ships on released models would have blocked the behavior.

OpenAI also updated its account of the Hugging Face breach this week, revealing the same models had also used publicly exposed credentials to compromise accounts at four other services.

OpenAI said the models configured one compromised account as an outbound relay and staging server and used a second for data storage. The remaining two accounts were accessed in read-only mode.

Although OpenAI’s models extracted partial datasets containing CyberGym solutions and operated multiple concurrent workloads, the activity ultimately left critical encryption keys behind, exposing the operation. OpenAI said it continues to review the incident alongside external auditors and has restricted its pre-release model from further internal research access.