The FBI is warning the public about sexual exploitation actors illegally accessing social media and personal accounts to steal explicit images and videos from adult and underage victims. The stolen material, also known as non-consensual intimate images (NCII), is being posted or sold on criminal marketplaces, often without the victim's knowledge.

According to the FBI, these actors use social engineering and cyber intrusion tactics to target specific individuals or general targets of opportunity. After gaining access to accounts, they steal explicit content and share it through community forums or illicit marketplaces.

The FBI said personally identifiable information, including a victim's name, date of birth, email address, phone number and social media username, is often posted alongside the stolen material. This can expose victims to continued harassment and re-victimization.

How Sexual Exploitation Actors Access Accounts

The FBI has identified several methods used by sexual exploitation actors to gain access to victims' accounts.

Password and PIN Targeting

In password/PIN targeting, actors use high-volume password and PIN attempts against social media and personal accounts. The information used in these attempts can come from data leak sites, social media and open-source information.

When victims are known to the actors, curated lists may include personal details such as names, date of birth or variations of those details.

Social Media Customer Service Impersonation

Another tactic involves social media customer service impersonation through text messages. Victims may receive messages claiming their account is being disabled or locked unless they provide a verification code.

The actor then requests a password reset, causing a code to be sent to the victim. If the victim shares the code, the actor can reset the password and access the account.

Phishing Emails

The FBI also warns about phishing campaigns using look-alike domains and email accounts designed to appear as social media customer support.

These messages may claim there has been a new login and contain an embedded link asking the victim to change their password. Clicking the malicious link can give the actor access to the account.

Stolen Content Can Lead to Further Attacks

Once explicit content is stolen, sexual exploitation actors may post or sell it while including personal information about the victim. The FBI said victims can subsequently face harassment, sextortion, stalking or other targeted attacks.

The actors may also advertise stolen content through a victim's own social media page, increasing the potential for further exposure.

FBI Shares Steps to Protect Accounts

The FBI advises people to avoid storing sensitive images or videos on social media platforms or other internet-accessible sites.

It recommends using unique, complex passphrases and PINs along with multi-factor authentication (MFA). Password information directly associated with a person's identity, including names or birthdays, should be avoided.

Users should also be cautious with links received through emails and text messages. The FBI recommends going directly to the relevant website to address account concerns and checking URLs before clicking.

Unrequested temporary passwords, PIN resets or access codes should also be treated with caution. The FBI advises users not to share login information, even when someone claims to represent a platform or service.

People who believe their explicit content was stolen or leaked can provide information through the FBI's NCII reporting site. The FBI also advises the public to continue reporting fraud, scams and cyber threats to the Internet Crime Complaint Center or a local FBI Field Office.

Gunra ransomware has expanded its operations through a structured ransomware-as-a-service (RaaS) affiliate program, prompting the FBI, CISA and other agencies to issue a joint advisory warning organizations about the threat. The Gunra ransomware variant uses a double-extortion model, encrypting victim data while threatening to publish stolen information on a dedicated leak site if ransom demands are not met. The FBI first observed Gunra in April 2025 as a double-extortion ransomware variant derived from leaked Conti ransomware source code.

Gunra Ransomware Shifts to Affiliate Model

By early 2026, the group had expanded through a formal ransomware-as-a-service affiliate program advertised on dark web forums. The program provides affiliates with a management panel, configurable ransomware builder, cross-platform locker payloads and affiliate documentation. The FBI also observed Gunra operating under new branding aliases, including Golden Community, while recruiting penetration testers and ethical hackers as initial access brokers. Gunra initially focused on Windows environments before introducing a Linux variant and moving toward broader cross-platform targeting. Victims observed on the group’s dedicated leak site include organizations across the Americas, Europe, the Middle East, Africa and the Asia-Pacific. Targeted sectors include healthcare and public health, financial services and insurance, critical manufacturing, transportation, government services, utilities, academia, media and communications, retail, and professional and nonprofit services.

VPN Vulnerabilities Used for Initial Access

According to the advisory, Gunra actors primarily gained initial access by exploiting known vulnerabilities in internet-facing devices, including firewall and VPN gateways. The FBI observed exploitation of CVE-2024-55591 and CVE-2025-24472, authentication bypass vulnerabilities affecting specific FortiOS and FortiProxy versions. The Republic of Korea’s National Police Agency also observed Gunra actors exploiting credential exposure and SSH access control weaknesses in internet-facing VPN gateways to obtain unauthorized remote access. After gaining access, attackers used tools including Impacket utilities to move laterally through victim networks using SMB. In one case, actors compromised an SSL-VPN appliance using default credentials where account lockout controls were absent. They later used stolen session information to access internal virtual desktop infrastructure and move through systems including Active Directory servers and IT personnel workstations.

Data Theft Precedes Encryption

The double-extortion ransomware operation involves stealing sensitive information before encrypting systems. The FBI observed Gunra actors collecting business-critical documents, databases, personally identifiable information, and internal email communications. In at least one case, the actors used a malicious executable called main.exe to exfiltrate data from Microsoft OneDrive and SharePoint. Compressed archives containing sensitive information were also transferred to the Mega file-sharing service, with the volume of exfiltrated data reaching tens of terabytes. For encryption, Gunra uses ChaCha20 and RSA-4096 algorithms and has been observed using the .ENCRT extension for encrypted files. A documented sample from July 2025 used the .CRYPT extension. The ransomware also uses Windows Management Instrumentation to delete volume shadow copies before encryption, while one victim had backup and archived data deleted from both primary and disaster recovery infrastructure.

Agencies Urge Patching and Network Segmentation

The authoring agencies recommend that organizations prioritize patching known exploited vulnerabilities in internet-facing systems, including VPN gateways and RDP-exposed infrastructure. They also advise implementing and testing offline, immutable backups stored in physically separate and segmented locations. Network segmentation is another key recommendation, intended to restrict lateral movement and limit the spread of ransomware between systems. The agencies also recommend reviewing domain controllers, servers, workstations and Active Directory environments for unrecognized accounts, auditing administrative privileges, requiring MFA where possible and testing security controls against the Gunra techniques mapped to the MITRE ATT&CK framework. The joint advisory was published August 10, 2026, as part of the ongoing #StopRansomware initiative.

The Nihon Kotsu cyberattack has disrupted operations at Japan's largest taxi operator after the company confirmed that its internal systems were compromised by a malware-related security incident. The cyberattack on Nihon Kotsu forced the company to shut down parts of its IT infrastructure, leaving key Japan taxi service operations, including its taxi dispatch system, unavailable.  According to the company, the incident occurred early on Saturday, July 11, 2026. After detecting unauthorized access, Nihon Kotsu immediately shut down affected systems to contain the attack and prevent additional damage. The taxi dispatch service operated via telephone, the hire car web ordering and reservation management system, and several internal systems remain temporarily offline. 

Nihon Kotsu Shuts Down Systems 

Nihon Kotsu, Japan's largest taxi and chauffeur operator by group revenue, generates approximately ¥155 billion (around $1 billion) annually. The company employs 18,228 people and operates a fleet of 8,558 taxis alongside more than 2,000 chauffeur vehicles, making the disruption significant for the country's Japan taxi service sector.  In a statement, the company said, "We have confirmed that our internal systems were subjected to unauthorized external access (malware infection)." It also apologized for the incident, stating, "We sincerely apologize for the great inconvenience and concern this has caused to our customers, business partners, and all other parties involved." 

Japan Taxi Service Affected as Dispatch Operations Remain Offline 

The company explained that emergency measures were implemented immediately after the breach was detected. "Upon detecting the unauthorized access, we immediately took emergency measures, including shutting down systems, to prevent further damage," the statement said. It added that the disruption has affected web-based hire car reservations, telephone taxi dispatch services, and certain internal systems.  As the cyberattack on Nihon Kotsu continues to be investigated, customers requiring taxis have been advised to use the GO taxi application, nearby taxi stands, or hail a cab directly from the street. Users of the GO app can still request a Nihon Kotsu vehicle by selecting the company within the application.  The company said it is working with external cybersecurity specialists to determine the cause of the incident, analyze system logs, and assess the overall impact. According to the statement, the internal network has been isolated, and "further spread of the damage has been contained." 

Investigation into the Nihon Kotsu Cyberattack Continues 

Investigators are also examining whether any personal or corporate data was exposed during the Nihon Kotsu cyberattack. The company stated that no information leak has been confirmed at this stage.   However, it noted that a detailed investigation is ongoing with specialized agencies to determine whether any data was compromised. If customer or partner information is found to have been exposed, Nihon Kotsu said it will make a public announcement and individually notify affected parties in accordance with applicable laws.  The company said restoring systems securely remains its highest priority. It also pledged to provide updates on both the investigation and recovery process as more information becomes available. In the meantime, Nihon Kotsu urged customers to remain cautious of fraudulent emails or messages claiming to originate from the company and advised them not to open suspicious attachments or click unknown links. 

The Russia cyberattack targeting Poland's critical infrastructure has been formally attributed to Russia's Federal Security Service (FSB), with the European Union and the United Kingdom announcing a coordinated package of cyber sanctions against Russian-linked hackers and organizations. The move follows an attempted disruption of Poland's energy sector last winter that officials said came close to triggering a major blackout affecting nearly half a million people.

According to statements released by the EU and UK on Monday, the FSB's Center 16 was responsible for attempted cyber sabotage against Poland's heating and power infrastructure, as well as cyber intrusions targeting water treatment facilities. The allies also accused the agency of conducting broader cyber operations against governments and critical infrastructure across Europe.

Russia Cyberattack Linked to FSB's Center 16 Operations

The European Union said Center 16, the signals intelligence arm of the FSB, has conducted malicious cyber activities affecting multiple member states and international partners. According to the bloc, these operations have included infiltration of government networks, cyber espionage, and sabotage targeting critical infrastructure in France, Germany, Poland, Cyprus, the Netherlands, Austria, Slovakia, Romania, and Finland.

The EU also stated that Center 16 controls several cyber threat groups, including TURLA, and has been involved in cyber operations against strategic government entities in France since 2010 and the country's defense industry in 2025. In Germany, it allegedly targeted government institutions, while in Poland it carried out disruptive operations against combined heating and power plants.

British authorities described last December's attempted attack on Poland's energy grid as "reckless," saying it was another example of Russia's attempts to create disruption across Europe.

Poland Attack Nearly Triggered Major Blackout

The cyber incident targeting Poland's energy infrastructure last winter was initially linked by cybersecurity firms ESET and Dragos to Sandworm, a threat group associated with Russia's military intelligence agency.

However, Poland's national cybersecurity agency, CERT Polska, later disputed that assessment after tracing the attack infrastructure and connecting it to a cluster associated with the FSB.

Separately, Poland's domestic intelligence service warned in May that cyber intrusions targeting the country's water treatment facilities posed a direct risk to the continuity of water supply.

EU and UK Expand Cyber Sanctions

In response, the European Union imposed restrictive measures on nine individuals and four entities linked to Russia's cyber ecosystem. The sanctions target intelligence officers, cybercriminals, self-proclaimed hacktivists, and private companies accused of supporting or facilitating malicious cyber operations.

The wider sanctions package announced by European partners targets more than 30 individuals and organizations, including operators behind the Lumma Stealer malware, companies accused of recruiting hackers from Russian universities, and individuals associated with the pro-Kremlin Rybar military blog.

EU foreign policy chief Kaja Kallas said Russia continues to rely on intelligence agencies, cybercriminal groups, hacktivists, and private companies to conduct malicious cyber operations against Europe and its partners.

She added that the bloc strongly condemns the misuse of this cyber ecosystem, which has targeted public services and critical infrastructure, resulting in operational disruptions and financial losses.

France Details FSB Activities

France also announced additional sanctions and said it would summon the Russian ambassador over what it described as persistent malicious cyber activities conducted for espionage purposes.

A technical report from France's Cyber Crisis Coordination Center (C4) identified 11 interception centers operated by Center 16 across Russia, including Unit 61240, which it said specifically focused on France.

French authorities alleged that the unit targeted government ministry systems in 2014, compromised the French Embassy network in Moscow in 2018, and stole significant volumes of data from a research institute working with the French defense industry in February 2025.

France also stated that one newly sanctioned group had claimed responsibility for destabilization efforts targeting the 2024 Paris Olympic and Paralympic Games.

Allied Advisory Warns of Ongoing Threats

Alongside the sanctions, the United States and intelligence agencies from a dozen allied countries published a joint cybersecurity advisory warning that Russian operators linked to Center 16 have been scanning internet-connected devices protected by weak or default credentials.

The United Kingdom separately sanctioned individuals connected to Lumma Stealer, describing it as one of the world's most widely used information-stealing malware families. British officials said credentials stolen through the malware have been used to support Russian espionage operations globally. According to the UK's National Crime Agency, more than 2,100 victims in the country were infected by Lumma Stealer during the past six months.

British Foreign Secretary Yvette Cooper said the sanctions are intended to disrupt the cybercriminal ecosystem supporting Moscow's intelligence services, while emphasizing that the coordinated measures send a clear message against the use of proxy cyber groups.

The Kremlin has repeatedly denied conducting offensive cyber operations. Russian President Vladimir Putin has dismissed European allegations of sabotage and cyberattacks as baseless, saying they are intended to justify aggressive policies against Russia.

Ransomware attacks surged 30% in the first half of 2026 compared to the same period in 2025, with Qilin and INC Ransom emerging as two of the most prolific and dangerous operators in a crowded criminal ecosystem. Healthcare continues to be the top targeted industry, with 27 incidents in January 2026 alone, a figure that reflects both the sector's operational sensitivity and the premium value of health records on darknet markets.

Qilin: The Dominant Force

Qilin — also known as Agenda — is a ransomware group that entered 2026 accelerating, not slowing down. By early 2026, Qilin had already posted 55 confirmed victims, placing it ahead of its own 2025 pace. By June 2026, tracking data, Qilin had accumulated 168 confirmed victims in the healthcare sector alone, behind only manufacturing (291) and business services (245) in overall victim count. Qilin operates as a Ransomware-as-a-Service (RaaS) platform, recruiting affiliates who conduct attacks using Qilin's ransomware builder and infrastructure in exchange for a percentage of ransom proceeds. This model allows the core group to expand operational throughput without directly executing every attack. The group's double extortion model — encrypting victim data while simultaneously exfiltrating it and threatening public release on their leak site — has proven effective at pressuring victims into paying ransom demands even when robust backups exist. Public exposure of sensitive patient records creates regulatory, legal, and reputational pressure that many healthcare organisations find more immediately damaging than operational downtime. A notable recent case involves Covenant Health, which suffered a Qilin ransomware breach that exposed 478,188 patient records. The Covenant Health incident highlights Qilin's willingness to attack hospitals and health systems regardless of the direct patient safety implications.

INC Ransom: Targeting Critical Sectors

INC Ransom is another highly active operator that was among the top ransomware groups by victim count in January 2026, with 47 known attacks that month. The group targets organisations across multiple sectors, including healthcare, legal services, and public administration. INC Ransom gained significant attention in 2025 for its attack on NHS Scotland, which exposed 3 terabytes of patient data. The group continues to operate aggressively in 2026, targeting entities including healthcare practices, municipal agencies, and regional service providers. Recent INC Ransom victims include healthcare organisations such as Lymphedema Therapy Specialists, Inc. (February 2026, affecting 378 Texas patients) and various municipal and public sector entities, including Champaign-Urbana Public Health District.

The 2026 Ransomware Landscape

Beyond Qilin and INC Ransom, the broader 2026 ransomware ecosystem is characterised by:

• AI-assisted operations: Multiple ransomware groups are now using AI tools to accelerate phishing campaign creation, target research, and initial access operations, reducing the operational cost of launching attacks.
• Healthcare as a premium target: Patient records sell for up to 10 times as much as financial records on darknet markets, making it a persistently attractive target. Operational disruption of healthcare services also creates patient-safety leverage that can pressure organisations to make faster payment decisions.
• The Play and SafePay operators were also confirmed in recent June 2026 attack disclosures, targeting organisations including Clínica Maitenes and various regional businesses.

Why It Matters

The 30% year-over-year increase in ransomware incidents confirms that neither law enforcement action nor improved defensive capabilities has materially reduced the operational tempo of ransomware criminal enterprises. The professionalisation of RaaS platforms, combined with AI-assisted tooling and shortened attack timelines, is creating conditions in which even well-defended organisations face materially elevated risk. For healthcare specifically, the combination of operational sensitivity, high data value, and historically underfunded security programmes creates a structural vulnerability that the industry has not yet resolved despite years of high-profile attacks.

A newly discovered software supply chain campaign, dubbed Miasma, has emerged as the latest evolution of the Shai-Hulud supply chain attack, compromising several redhat-cloud-services npm packages to steal credentials, harvest secrets from developer systems, and spread through development environments using worm-like behavior. Security researchers at Socket described the operation as a smaller but highly capable successor to earlier Shai-Hulud campaigns, noting that it employs many of the same techniques that made previous attacks effective against software development ecosystems.

"This is effectively a Mini Shai-Hulud campaign: it uses the same core tactics of install-time execution, credential harvesting, CI/CD targeting, encrypted exfiltration, and potential downstream propagation," Socket said.

Attribution Remains Unclear as TeamPCP Tools Continue to Circulate

The identity of the threat actor behind the latest Shai-Hulud supply chain attack remains uncertain. One major reason is the role of TeamPCP, a well-known cybercrime group that previously open-sourced tools associated with the original Shai-Hulud worm. By publicly releasing those resources, TeamPCP lowered the barrier for other attackers to launch similar operations, making attribution significantly more difficult. Researchers have not yet linked the Miasma campaign to any specific actor with confidence.

Affected redhat-cloud-services Packages

The attack targeted multiple packages published under the redhat-cloud-services namespace. The known compromised packages include:

• @redhat-cloud-services/vulnerabilities-client
• @redhat-cloud-services/tsc-transform-imports
• @redhat-cloud-services/topological-inventory-client
• @redhat-cloud-services/sources-client
• @redhat-cloud-services/rule-components
• @redhat-cloud-services/remediations-client
• @redhat-cloud-services/rbac-client

The malicious code embedded within these packages was designed to execute during installation, allowing attackers to collect sensitive information from infected developer environments.

Encrypted Data Theft and GitHub-Based Propagation

Similar to earlier waves of the Shai-Hulud supply chain attack, the malware incorporates encrypted exfiltration capabilities. Stolen information is transmitted to the endpoint "api.anthropic[.]com:443/v1/api," while GitHub serves as a secondary communication and propagation channel. According to Socket, the malware can commit encrypted data packages directly through GitHub's API.

"It commits the encrypted result envelope through the GitHub API," Socket said. "The commit message can include: IfYouInvalidateThisTokenItWillNukeTheComputerOfTheOwner:."

Researchers from OX Security identified the first commit containing the phrase "Miasma: The Spreading Blight" on May 29, 2026. This suggests either that the malware variant had already been active by that date or that attackers began testing the campaign around that time.

GitHub Abuse Enables Verified Malicious Commits

The Miasma malware actively searches for repositories where stolen GitHub tokens possess write permissions. It then inspects action.yml and action.yaml files using GraphQL queries before injecting malicious workflows through GitHub's createCommitOnBranch mutation. This technique allows the resulting commits to appear as legitimate, verified, and signed changes, increasing the likelihood that malicious modifications will evade scrutiny. The malware is also capable of performing several additional actions, including:

• Attempting privilege escalation by launching containers that bind-mount the host's /etc/sudoers.d directory and grant passwordless sudo access to CI runners.
• Detecting endpoint protection products such as CrowdStrike, SentinelOne, Carbon Black, and StepSecurity Harden-Runner before executing malicious activities.
• Establishing persistence by modifying Anthropic Claude Code through a SessionStart hook.
• Creating Visual Studio Code tasks.json files configured with "runOn": "folderOpen" to ensure automatic execution whenever a project is opened.

Red Hat GitHub Account Believed to Be Initial Entry Point

Investigators believe the campaign originated from the compromise of a Red Hat employee's GitHub account. Evidence indicates that the account served as the patient zero event used to inject malicious code into the affected redhat-cloud-services packages. The compromised account reportedly pushed malicious orphan commits into two RedHatInsights repositories, allowing the attacker to bypass normal code review procedures and introduce the malicious payload.

Recommended Response and Remediation Steps

Security experts advise organizations that installed affected redhat-cloud-services package versions to immediately isolate impacted systems and remove compromised releases. Additional recommendations include:

• Rotating all potentially exposed credentials.
• Reviewing GitHub and npm activity for suspicious behavior.
• Auditing environments for persistence mechanisms.
• Investigating modifications to configuration files such as:
• • ~/.claude/settings.json
  • .vscode/tasks.json
  • .github/workflows/codeql.yml
  • .github/setup.js
• Enforcing stronger access controls across development environments.

Socket warned that removing the malicious package alone is not sufficient.

"Because the malware includes background execution and potential developer-tool persistence mechanisms, uninstalling the npm package or deleting node_modules should not be considered sufficient cleanup," Socket explained.

The company also urged organizations operating CI/CD pipelines to suspend affected workflows, invalidate any build artifacts created during the exposure period, and review whether software releases, container images, npm packages, or deployment artifacts were generated after installation of the malicious package.

The UK government has officially licensed SilentGlass, a government-developed cyber security device, for global commercial use, marking a major step in expanding public sector cybersecurity innovation into international markets. Developed by the National Cyber Security Centre, a part of Government Communications Headquarters, SilentGlass was originally designed to protect sensitive government systems from cyber threats linked to smart display connections. The technology is now being commercialized with support from the Government Office for Technology Transfer through a global intellectual property licensing agreement with a UK-based company. The launch highlights growing concerns around hardware-based cyber risks in modern workplaces, especially as organizations increasingly adopt hybrid work environments, shared office spaces, and connected devices.

SilentGlass Designed to Block Video Connection Cyber Threats

According to the NCSC, the cyber security device was created to address risks associated with modern smart monitors and digital video connections. Security experts have warned that video connections between laptops and monitors can potentially be exploited by attackers to compromise connected systems. The threat becomes more serious in environments where devices with different security levels are connected to shared displays. SilentGlass works as a small plug-and-play hardware device positioned between a laptop and monitor. Its primary role is to prevent the physical video connection from being used as a pathway for cyberattacks. By blocking that attack route, the cyber security device helps organizations reduce exposure to hardware-level threats while enabling safer flexible working arrangements, including hot desking and remote work setups. The NCSC stated that the technology was initially developed for internal government operations before demonstrating broader commercial potential across multiple sectors.

UK Government Expands Cyber Security Innovation to Global Market

Following a competitive commercial process, the UK government approved a global intellectual property licensing agreement for SilentGlass with a UK-based company. The agreement allows the cyber security device to be distributed internationally, expanding access to technology that was originally built for high-security government environments. Officials said the move reflects a wider effort to commercialize public sector innovation while ensuring strong governance and protection of government-developed intellectual property. The NCSC noted that SilentGlass could support:

• Government departments
• Public sector organizations
• Critical national infrastructure operators
• Businesses with advanced cybersecurity requirements
• Employers supporting hybrid work environments

The technology is expected to benefit sectors where device trust, network security, and hardware protection are considered critical operational requirements.

GOTT Supported Commercialization of SilentGlass

The Government Office for Technology Transfer played a key role in helping the NCSC bring the cyber security device to market. According to officials, GOTT supported the project by advising on intellectual property licensing strategies, funding commercialization initiatives, and connecting the NCSC with technology transfer and investment experts. The organization also provided mentoring support for knowledge asset management and helped guide the licensing process through market engagement and competitive partner selection. The UK government has increasingly focused on turning public sector-developed technologies into commercially viable products that can deliver broader economic and security benefits.

Growing Focus on Hardware-Level Cybersecurity

The release of SilentGlass comes as cybersecurity experts continue raising concerns about hardware-level attack vectors that are often overlooked in traditional cybersecurity strategies. Modern monitors, docking stations, USB-connected devices, and display interfaces are increasingly viewed as potential entry points for attackers targeting enterprise and government systems. As hybrid work models expand globally, organizations are under pressure to secure not only software environments but also physical device connections used in day-to-day operations. The NCSC said SilentGlass was specifically designed to address these emerging risks without requiring complex deployment or major infrastructure changes.

NCSC Highlights Future Commercialization Plans

Ollie Whitehouse, Chief Technology Officer at the NCSC, described the commercialization of SilentGlass as an example of how government-developed innovation can support both national cybersecurity and economic growth. According to Whitehouse, the partnership demonstrates how UK government departments can derive greater value from intellectual property while making advanced security technologies more widely available. The NCSC also indicated that additional government-developed cybersecurity technologies could be commercialized in the future following the success of the SilentGlass initiative.