Ransomware

2026-07-2010 minCheck Pointcritical

This weekly threat intelligence report covers major breaches including Ernst & Young, Coca-Cola's Fairlife subsidiary, and Nihon Kotsu, along with a Jscrambler npm supply chain compromise. Six critical CVEs were disclosed across Microsoft, WordPress, and SonicWall products, with four under active exploitation by ransomware operators. AI-enabled threats are highlighted including China-linked actors using Claude Code and DeepSeek for automated attack generation, and weaknesses in AI coding assistants exposing source code and credentials. Threat actor campaigns from ShinyHunters, CylindricalCanine/GoldenEyeDog, and Spirals ransomware are also documented.

A previously unseen Rust-based ransomware family named Spirals was deployed in a double extortion attack against a South Asian IT services company in June 2026. The attackers compromised an internet-facing IIS web server via an ASP.NET web shell, established multiple redundant C2 channels using revsocks, Chisel, and Cloudflare tunnel, performed credential theft via SAM and LSASS dumps, and deployed the ransomware payload via PsExec across the network within 24 hours of initial access. The ransomware uses AES-128 file encryption with ECDH P-256 key wrapping and includes capabilities for defense evasion, lateral movement, and process termination.

AhnLab's ASEC blog published a weekly roundup covering three notable ransomware and cyberattack incidents from Week 3 of July 2026. DragonForce ransomware struck a Saudi Arabian chemical manufacturer, AiLock ransomware hit Japan's largest taxi and limousine operator, and a separate cyberattack on Japan's largest frozen food company caused broader supply chain disruption. No technical IOCs, attack chain details, or detection rules are provided in the public article; full analysis is available via AhnLab TIP subscription.

2026-07-139 minCheck Pointhigh

This weekly threat intelligence bulletin covers multiple significant incidents including autonomous LLM-driven ransomware (JadePuffer), a cryptocurrency supply chain compromise via malicious npm packages, and three critical CVEs affecting Langflow, Tenda routers, and Linux KVM. Iran-linked Cavern Manticore and China-linked UAT-7810 were profiled targeting Israeli and networking infrastructure respectively. The report also highlights risks in AI development tools where hidden malicious instructions in open-source files could achieve RCE through Claude Code and OpenAI Codex.

2026-07-1020 minRecorded Futurecritical

Insikt Group identified 60 high-impact vulnerabilities in June 2026 (a 49% increase from May), with 23 listed in CISA's KEV catalog and 53 having public PoC exploits. The dominant theme was exploitation of externally reachable enterprise applications and appliances by multiple threat actors: StrikeShark chained 13 CVEs to deploy SharkLoader and Cobalt Strike, Lazarus exploited CVE-2025-55182 (React2Shell, CVSS 10.0) to deploy COPPERHEDGE and EtherRAT, APT36 targeted India via Microsoft Office/Windows CVEs, and Qilin ransomware was linked to Check Point gateway exploitation. 25 of the 60 vulnerabilities enabled RCE across 18 vendors, with CWE-22 (Path Traversal) being the most common flaw class.

The June 2026 Dark Web Threat Actor Trend Report from AhnLab ASEC summarizes broad activity across hacktivist, APT, and cybercrime ecosystems. Key developments include ShinyHunters' migration to dark web infrastructure, North Korean supply chain attacks on npm AI-framework packages via Sapphire Sleet, a RaaS group's EDR-killing toolkit targeting European defense/aerospace, and TA569's Web Inject framework leveraging fake browser updates. Law enforcement achieved notable wins including a Scattered Spider conviction and multiple arrests across Europe.

The June 2026 Dark Web Breach Incident Trend Report summarizes major data breach cases observed on deep web and dark web forums. ShinyHunters claimed breaches across multiple sectors in North America and Europe, while Operation FortiBleed exposed large-scale credentials for security equipment and VPN accounts. The report also highlights emerging threats including AI-generated fake breach data, ransomware negotiation brokerage services on Russian-language forums, and potential manipulation of AI assistant platform response layers in the Middle East.

2026-07-1015 minHuntresscritical

An Initial Access Broker is exploiting CVE-2025-5777 (CitrixBleed 2), a pre-authentication memory overread in Citrix NetScaler ADC/Gateway, to steal session tokens and bypass MFA. The stolen sessions are used to access Citrix published desktops, followed by a consistent privilege escalation via a registry symbolic-link LPE tool that abuses the Windows AppMgmt service and Group Policy refresh to gain SYSTEM. The operator then creates backdoor admin accounts, installs rogue ScreenConnect/Zoho Assist RMM clients, moves laterally with PsExec and Impacket, and ultimately deploys DragonForce ransomware. The full kill chain from initial access to encryption was observed completing in under one hour in at least one case.

GodDamn ransomware, the latest rebrand of the Monster/Beast ransomware lineage by threat actor Hyadina, employs a Microsoft-signed malicious kernel driver called PoisonX to terminate endpoint security products and remove API hooks before deploying encryption. The attack chain involves AnyDesk remote access deployment in non-standard directories, a 14-tool NirSoft-based credential harvesting toolkit, PsExec-based lateral movement across enterprise hosts, and a multi-day dwell period before ransomware execution. The use of a legitimately signed malicious driver represents a significant escalation in defense evasion capability for this ransomware group.

2026-07-098 minESEThigh

ESET's H1 2026 Threat Report highlights attackers adapting established techniques to new platforms rather than inventing entirely new methods. Key trends include the emergence of PromptSpy (first Android malware using generative AI in its execution flow), the rapid expansion of malicious AI skills, doubling of ClickFix social engineering detections, record-level QR code phishing (quishing), and continued proliferation of EDR killers alongside declining ransom payment rates.

2026-07-0914 minANY.RUNhigh

ANY.RUN's Malware Trends Tracker data shows that phishing-as-a-service kits now dominate the US threat landscape, with five of the top ten threats being AiTM or device-code phishing platforms that defeat MFA by stealing session cookies or OAuth tokens. Commodity RATs and info stealers remain in constant high-volume circulation, while legacy threats like Emotet and WannaCry persist on unpatched systems. Several top-ranked threats (Cobalt Strike, Qbot, Emotet, DonutLoader, Smoke Loader) function as ransomware precursors, meaning their detection should trigger urgent escalation rather than routine handling.

WhiteLock is a Windows ransomware that encrypts user files using AES-CBC symmetric encryption with RSA-2048 asymmetric key protection, appending the .Fbin extension to encrypted files. It identifies infected devices via SHA-256 hashed MAC addresses, communicates with external servers for key exchange, and deliberately terminates AnyDesk and TeamViewer services to impede remote incident response. The ransomware has been observed in campaigns where information theft malware is used for initial access prior to ransomware deployment.

Kaspersky's Q1 2026 ICS threat landscape report indicates a continued overall decline in malware blocked on industrial automation systems, reaching 19.6%. However, specific regions like Southern Europe and industries like biometric systems saw notable increases in threats, particularly from malicious scripts, phishing, and spyware. The report highlights the persistent risk to OT environments from common threat vectors like internet browsing and email.

2026-07-0610 minCheck Pointcritical

This weekly threat intelligence bulletin covers multiple active ransomware campaigns, four critical vulnerabilities under active exploitation, and emerging AI-driven threats. Notable items include actively exploited RCE flaws in Oracle E-Business Suite and Progress Kemp LoadMaster, a Citrix NetScaler memory disclosure flaw exploited within 24 hours of disclosure, a North Korean supply-chain campaign (PolinRider) deploying 108 malicious packages, and a proof-of-concept browser-native ransomware generated by an LLM abusing Chrome's File System Access API.

DragonForce ransomware operators deployed a novel Go-based backdoor called Backdoor.Turn that abuses Microsoft Teams TURN relay infrastructure to hide C2 traffic as legitimate Teams communications. The attack chain involves SQL/MSSQL server exploitation for initial access, DLL sideloading via VirtualBox/DbgView executables, multiple BYOVD techniques for defense evasion including a novel exploit of a Huawei driver, and ultimately DragonForce ransomware deployment. The group demonstrated exceptional sophistication with custom tooling and stealth techniques that evade standard network monitoring.

BYOVD (Bring Your Own Vulnerable Driver) attacks have become a standard component of ransomware operations, allowing attackers to exploit signed kernel drivers for kernel-level access and subsequently disable AV/EDR products. The technique involves dropping a legitimate but vulnerable signed driver, loading it via a Windows service, and sending crafted IOCTL commands to terminate, blind, or strip privileges from security software. Microsoft's kernel hardening features and Vulnerable Driver Blocklist provide insufficient protection, as data-only kernel attacks bypass hardening and the blocklist has significant update lag. Behavioral monitoring of anomalous driver IOCTL interactions is the most effective defensive approach, as it is driver-agnostic and does not depend on prior driver identification.

Backdoor.Mistic is a new stealthy backdoor deployed in cybercrime intrusions since April 2026, using DLL sideloading via legitimate MpExtMs.exe and masquerading as EndpointDlp.dll. It executes payloads in memory with a self-deleting kill switch, enabling long-term covert access. Mistic is likely linked to Woodgnat (aka KongTuke), an initial access broker whose ModeloRAT toolkit has been used in attacks delivering Qilin ransomware, connecting this backdoor to the broader ransomware ecosystem.

AhnLab ASEC's Week 1 July 2026 ransomware and dark web roundup reports three active threat campaigns. Settra claims a data leak at a Korean industrial firm's foreign affiliate. The Gentlemen ransomware group has targeted Spanish defense, aerospace, and IT service firms. DragonForce claims data theft against a South Korean smart factory and digital twin company. Detailed IOCs and analysis are available only to AhnLab TIP subscribers.

This weekly roundup from AhnLab's ASEC team highlights three notable dark web and ransomware developments: BreachForums is experiencing internal issues with staff impersonation and unauthorized sales, Lapsus$ claims to have leaked data from a Myanmar bank, and Qilin ransomware targeted a South Korean law firm. No technical IOCs, detection rules, or vulnerability details are provided in the public article; full analysis is available via AhnLab TIP subscription.

The Q2 2026 trend report from AhnLab ASEC documents a significant expansion of attack surfaces into AI stacks, identity infrastructure, and public-facing applications. CISA KEV listings rose 27% year-over-year to 75 entries, with ransomware-linked vulnerabilities nearly doubling. Notable developments include prompt injection-to-RCE chains in Microsoft Semantic Kernel, data exfiltration via M365 Copilot Enterprise (SearchLeak), three Microsoft Defender zero-days used for telemetry evasion, and continued AI supply chain attacks via malicious skills. The report recommends shifting from signature-based to behavior-based detection and implementing ITDR, conditional access, and AI-specific input validation controls.

Token Theft and AI Poisoning Redefine the Perimeter Attackers are shifting from breaking passwords to stealing active login sessions, bypassing multi-factor authentication entirely. This week, ARToken and ConsentFix exploited Microsoft 365 OAuth flows to hijack accounts, while Anubis ransomware used the ongoing CitrixBleed 2 vulnerability to steal session tokens from network gateways. Even a standard user can become a Global Administrator in minutes if identity settings are loose, as demonstrated by a recent M365 privilege escalation analysis. Simultaneously, artificial intelligence systems have evolved from helper tools to critical vulnerabilities, serving as both the weapon and the target. Threat actors are using AI to generate malware like InfernoGrabber v9.0 and BusySnake Stealer, while also poisoning AI agent ecosystems with malicious skills like OpenClaw and tricking AI models into executing financial fraud via indirect prompt injection. The AI arms race has accelerated breakout times to under 30 minutes, with state-sponsored groups like GTG-1002 now orchestrating entire espionage campaigns via AI. Defenders must immediately audit identity and session controls, treating session tokens as highly sensitive credentials. Security teams should also implement guardrails for AI agents, verifying external URLs and restricting autonomous financial or code execution actions.

2026-07-0112 minArctic Wolfcritical

Arctic Wolf Labs documents Anubis ransomware affiliate tradecraft observed across multiple 2026 intrusions, featuring CitrixBleed 2 (CVE-2025-5777) exploitation and valid VPN credential abuse for initial access. Affiliates consistently deploy legitimate RMM tools for persistence, use Mimikatz and ntds.dit extraction for credential access, establish alternate egress via cloudflared and SSH SOCKS tunnels, and employ exfiltration tools like S3 Browser and rclone before deploying encryptors on Windows and Linux systems. The attack chain relies on commodity tools and living-off-the-land techniques that resemble legitimate administration in isolation but form a distinctive kill chain when correlated.

2026-07-0110 minRecorded Futurehigh

Recorded Future's Insikt Group evaluates Mexico's newly published 2025-2030 National Cybersecurity Plan, assessing it against the country's actual threat landscape from 2020-2026. Ransomware is the dominant threat with 223 documented incidents across 64 groups, while financial malware (Mispadu, Grandoreiro, Casabaneiro, Fenix botnet), state-sponsored espionage (TAG-141/FamousSparrow, TGR-STA-1030), hacktivism (Chronus Team, Guacamaya), and organized crime-linked money laundering via Chinese networks compound the risk. The 2026 FIFA World Cup will be an early operational test of Mexico's cyber resilience.

2026-07-0112 minMicrosofthigh

StealC is a C++ malware-as-a-service infostealer that harvests credentials, cookies, and session tokens from browsers, email clients, crypto wallets, and gaming platforms, using APC injection to bypass Chromium App-Bound Encryption. Amadey is a modular MaaS loader that delivers StealC and other payloads through a rich backdoor command set including process injection, SOCKS proxying, RDP enablement, and hidden admin account creation. Microsoft DCU disrupted over 200 C2 domains and IPs associated with both threats in a coordinated action with Europol on June 24, 2026.

2026-07-0110 minCheck Pointhigh

Check Point Research identified a DeepSeek-attributed malicious Python Flask sample that transforms a theoretical browser ransomware risk into a practical attack using the File System Access API. The sample, disguised as a Discord avatar AI upscaler named InfernoGrabber v9.0, leverages social engineering to trick users into granting folder-level file access via browser permission prompts. Once access is granted, the web page can enumerate, read, exfiltrate, and encrypt files in the selected directory — all without installing a native payload or exploiting a browser vulnerability. The technique is particularly dangerous on Android where Chrome 132+ exposes the File System Access API to web content, allowing access to high-value photo directories including DCIM.

AI Attacked and Abused While Perimeter Authentication Collapses The month's defining shift was the emergence of AI as a two-sided battlefield: organizations deployed AI tools faster than they secured them, while attackers weaponized the same technology against defenders. Critical flaws in LangGraph allowed SQL injection chained to remote code execution, M365 Copilot could be turned into a one-click data exfiltration weapon via SearchLeak, and Langflow was exploited to deploy cryptominers. Meanwhile, the ongoing Shai-Hulud campaign injected prompts to blind AI malware scanners, macOS.Gaslight turned prompt injection against human analysts, and Russia's APT28 began experimenting with LLM-integrated malware. At the same time, perimeter authentication collapsed at scale: FortiBleed exposed credentials for over 73,000 FortiGate firewalls, CVE-2026-50751 let attackers bypass Check Point VPN authentication entirely, and ShinyHunters exploited an Oracle PeopleSoft zero-day across over 100 organizations. Supply chain attackers followed developers to their new AI tools, compromising the ecosystems where code is written and built. The Shai-Hulud/Miasma worm expanded from npm into PyPI and injected persistent backdoors into AI coding assistant configurations, while North Korea's Sapphire Sleet compromised over 140 Mastra npm packages to steal cryptocurrency wallets, and the ongoing GlassWorm campaign pivoted to WebAssembly malware in VS Code extensions using the Solana blockchain as command-and-control. Social engineering also industrialized: the ErrTraffic framework turned ClickFix deception into a Malware-as-a-Service operation with blockchain dead drops, and EvilTokens hid phishing flows inside browser-side encryption to defeat network scanners while hijacking Microsoft device-code authentication. Organizations should treat AI deployments as untrusted perimeter assets—restrict their network access, audit third-party skills and extensions, and assume prompt-injection attacks will target both automated scanners and human analysts. Every internet-facing VPN, firewall, and edge appliance should be patched immediately, with credentials rotated and phishing-resistant MFA enforced, because perimeter authentication failures now cascade directly into internal network compromise.

2026-06-245 minZscaler ThreatLabzhigh

ThreatLabz identified a new attack campaign deploying 'Edgecution,' a malicious Microsoft Edge browser extension used by an initial access broker affiliated with Payouts King ransomware. The malware abuses the Chrome native messaging protocol to bridge a headless browser extension with a Python-based backdoor, enabling arbitrary code execution and filesystem access while evading traditional browser sandboxes.

2026-06-245 minCheck Pointcritical

This threat intelligence report highlights recent data breaches involving third-party vendors, emerging AI threat vectors such as prompt injection and WebSocket abuse, and active exploitation of critical vulnerabilities in Fortinet, Cisco, and Splunk products. Additionally, seasonal phishing campaigns targeting travelers and Amazon Prime members are surging alongside a cross-platform Rust-based crypto clipboard hijacker.

Trust Chains Broken at Scale While ClickFix Becomes a Service This week, attackers stopped trying to kick down the front door and instead walked in through the trust chains that hold digital ecosystems together. North Korea's Sapphire Sleet compromised over 140 Mastra npm packages through a single typosquatted dependency, stealing cryptocurrency wallets and planting persistent backdoors on developer machines. The GlassWorm group trojanized Open VSX extensions with WebAssembly malware that uses the Solana blockchain as an unkillable command channel, while SmartApeSG hijacked the Okendo Reviews widget to serve malicious prompts on thousands of e-commerce sites. Even vendor integrations became a liability: the Klue breach exposed Recorded Future client data through a compromised OAuth token connecting a marketing tool to Salesforce. Deception also became an industrial product. The ErrTraffic framework now operates as full Malware-as-a-Service, using blockchain smart contracts to hide its infrastructure and compromised WordPress sites to serve fake error prompts that trick users into running malicious commands. Attackers weaponized trusted AI platforms too—one campaign abused claude.ai's shared chat feature to deliver MacSync infostealer on macOS, while the shai_hulululud npm package uses prompt injection to blind AI-powered security scanners. On the infrastructure side, the FortiBleed campaign cracked credentials for over 73,000 FortiGate firewalls with a 45-GPU cluster, handing attackers valid keys to government and defense networks worldwide. Defenders should immediately hunt for the easy-day-js dependency in their npm projects, reset credentials on any FortiGate firewall, enable Azure AD Graph Activity Logs to close a years-long reconnaissance visibility gap in Microsoft cloud environments, and audit OAuth tokens on all third-party vendor integrations.

2026-06-195 minVaronishigh

Varonis Threat Labs deployed managed MySQL honeypots across major cloud providers to observe attacker behavior. The publicly exposed GCP instance with weak credentials was compromised within hours by multiple automated ransomware operators who brute-forced access, exfiltrated data, dropped tables, and left ransom notes.

2026-06-197 minESETcritical

ESET researchers analyzed the Gentlemen ransomware-as-a-service (RaaS) operation, highlighting their unique approach of providing an in-house developed EDR killer framework, GentleKiller, directly to affiliates. The framework leverages Bring Your Own Vulnerable Driver (BYOVD) techniques to terminate over 400 security processes and is augmented by third-party tools like HexKiller and HavocKiller, all standardized with a shared defense-evasion layer.

2026-06-155 minCheck Pointcritical

This threat intelligence report highlights multiple critical vulnerabilities and active exploits, including a zero-day in Oracle PeopleSoft (CVE-2026-35273) exploited by ShinyHunters and an IKEv1 authentication bypass in Check Point VPNs (CVE-2026-50751) linked to Qilin ransomware. Additionally, the report details emerging AI-driven threats, a supply-chain compromise in the Arch User Repository deploying eBPF rootkits, and widespread patching efforts by Microsoft and Veeam.

Perimeter Auth Collapse and AI-Driven Deception Shift the Battlefield The security perimeter cracked open this week as critical authentication bypasses in Check Point VPNs, Ivanti Sentry, and Palo Alto GlobalProtect gave attackers a free pass into corporate networks, with Qilin ransomware already exploiting one to launch real attacks. At the same time, AI became the year's most versatile weapon: criminals used ChatGPT and Claude brands as phishing lures, researchers proved AI email assistants will hand over corporate secrets to impersonators, and the Shai-Hulud campaign began injecting fake prompts to blind AI-powered security scanners. Patch edge VPN appliances immediately, treat AI agents as high-risk insiders, and hunt for device-code authentication events that bypass normal credential checks.

2026-06-105 minRecorded Futurehigh

The 2026 FIFA World Cup presents a complex cyber-physical threat landscape, with cybercriminals already deploying thousands of fraudulent domains for credential harvesting and scams. State-sponsored groups like BlueDelta and Iranian-linked hacktivists are anticipated to leverage the event's global profile for targeted espionage, ransomware extortion, and politically motivated disruptive operations against sponsors, host cities, and attendees.

2026-06-085 minCheck Pointcritical

This threat intelligence report highlights active exploitation of critical vulnerabilities, including a Windows Netlogon RCE (CVE-2026-41089) and an Android Framework flaw. It also details significant data breaches affecting DentaQuest and the UN WFP, emerging AI-driven threats such as EDR evasion labs, a supply chain compromise of the Hola browser, and Iranian state-sponsored espionage operations utilizing Dutch hosting infrastructure.

Trojanized Build Pipelines and Blind-Spot Appliances Redefine the Perimeter Attackers are bypassing traditional network defenses by compromising the tools developers use to build software and the AI assistants they rely on to write code. Campaigns like Mini Shai-Hulud and Miasma - The Spreading Blight flooded package registries with malicious code that steals cloud credentials and CI/CD tokens, while researchers proved that public AI agent skill marketplaces are completely ineffective at catching malicious add-ons. Nation-state actors and cybercriminals are simultaneously shifting their focus to blind spots in corporate networks and trusted platforms. The VerdantBamboo group exploited firewalls to bypass conditional access, while UNC3753 used IT impersonation to trick law firm employees into installing remote access tools, and Kali365 expanded its phishing infrastructure to steal multi-factor authentication tokens. Defenders must shift their focus from perimeter email filtering to securing the software build pipeline and monitoring edge appliances for anomalous traffic. Hunt for unexpected connections to cloud storage APIs and review developer environments for compromised packages or AI skills.

2026-06-044 minMorphisechigh

Analysis of VECT 2.0 ransomware reveals critical Windows-specific implementation flaws, including buffer-size mismatches, race conditions from shared global state, and incomplete nonce retention. These defects result in files being partially encrypted, inconsistently modified, or structurally damaged, rendering the attacker's own decryptor incapable of reliable data recovery.

2026-06-046 minRecorded Futurehigh

The 2026 FIFA World Cup faces a multifaceted threat landscape encompassing cybercriminal fraud, state-sponsored espionage, and physical security risks. Financially motivated actors are actively deploying purchase scams and fake domains to harvest payment card data, while state-aligned groups from Iran, Russia, and China are expected to target telecommunications, logistics, and VIP attendees for intelligence collection and potential disruption.

2026-06-025 minSophoshigh

Sophos researchers uncovered a threat actor utilizing AI-native development tools, specifically the Cursor IDE and Claude Opus, to build and iteratively test a post-exploitation framework designed to evade major EDR solutions. The framework automates the ingestion of public security research to generate and refine custom Rust and Go payloads, ultimately supporting ransomware and data theft operations.

2026-06-026 minANY.RUNhigh

JS.MonoGlyphRAT is a newly identified, highly obfuscated JavaScript backdoor targeting US enterprises via phishing. It establishes persistence, communicates over HTTP using custom headers, and acts as a loader capable of executing AES-encrypted payloads, PowerShell commands, and in-memory .NET assemblies while bypassing AMSI.

Session Hijacking and Developer Tool Poisoning Collapse Authentication Trust This week, attackers proved that multi-factor authentication is no longer a reliable gatekeeper. Campaigns like Tycoon 2FA and Chinese-language PhaaS platforms intercept one-time passwords in real time and steal session tokens to maintain persistent access, while infostealers like EKZ Infostealer harvest browser cookies to bypass authentication entirely. Even when victims reset passwords and revoke sessions, attackers retain access through hidden device registrations — meaning standard incident response playbooks are now incomplete. Developers remain the preferred entry point for supply chain compromise. The Glassworm botnet was disrupted after hiding malware in VSCode extensions and npm packages, while the Megalodon campaign poisoned GitHub Actions workflows across 5,500 repositories. A malicious Sicoob.Sdk NuGet package stole banking certificates from Brazilian developers, and North Korea's Lazarus group compromised the widely used axios npm library — a single attack touching millions of downstream applications. Organizations must move beyond password-and-MFA reliance: adopt hardware security keys, shorten session lifetimes, delete attacker-registered devices before resetting credentials, and audit developer toolchains and CI/CD pipelines for tampering.

2026-05-295 minESEThigh

ESET's Q4 2025–Q1 2026 APT Activity Report highlights global espionage and destructive campaigns by state-aligned actors. Notable incidents include a major supply chain compromise of the 'axios' npm library by Lazarus, destructive wiper attacks on Polish critical infrastructure by Sandworm, and the deployment of new edge-device implants like PhiliKit against Ivanti VPNs by China-aligned groups.

2026-05-286 minMicrosoftcritical

The Gentlemen ransomware, operated by Storm-2697, is a Go-based encryptor that combines robust Curve25519/XChaCha20 encryption with aggressive lateral movement capabilities. It utilizes multiple redundant propagation methods (PsExec, WMI, scheduled tasks, services) to maximize network compromise while employing extensive defense evasion techniques to hinder detection and recovery.

2026-05-285 minPalo Alto Networkshigh

The 2026 FIFA World Cup presents a massive, multi-jurisdictional attack surface threatened by state-nexus disruptive operations and financially motivated cybercrime. Key risks include Iran-aligned actors targeting municipal OT infrastructure, pro-Russian hacktivists launching high-volume DDoS attacks against tournament services, and cybercriminals deploying ransomware against the hospitality supply chain.

2026-05-266 minHuntresshigh

Cybercriminals are shifting from traditional credential theft to session hijacking using infostealer malware, allowing them to bypass multi-factor authentication (MFA). By harvesting and replaying valid session tokens using automated tools, attackers gain rapid, stealthy access to corporate environments, which is then often monetized by Initial Access Brokers.

2026-05-255 minCheck Pointhigh

This threat intelligence report highlights multiple high-profile breaches, including 7-Eleven and GitHub, alongside the active exploitation of vulnerabilities in Windows Defender, Trend Micro, and Drupal. It also details emerging threats such as the Kali365 phishing kit, AI-driven prompt injection attacks, the Nimbus Manticore IRGC-linked campaign deploying the MiniFast backdoor, and a supply chain attack on Laravel Lang packages.

Threat actors are executing account takeover campaigns by distributing malware disguised as video games via compromised Discord accounts. Upon gaining initial access to a victim's Google account, attackers abuse the Family Link parental control feature by changing the victim's age to under 13 and assigning a malicious parent account. This allows the attackers to reset the password, bypass 2-Step Verification, lock the legitimate user out completely, and demand a ransom for account recovery.

Software Supply Chain and AI Exploitation Dominate Threat Landscape The software supply chain has become the primary battlefield for attackers because compromising a single developer tool can cascade into thousands of enterprise networks. Campaigns like Mini Shai-Hulud and TrapDoor are stealing credentials and injecting backdoors across major code registries, while the Laravel Lang Compromise and the Coruna Exploit Kit show how malicious code can automatically execute to steal secrets or exploit end users. As a result, organizations must treat developer environments as high-value targets, because a single compromised package or malicious VS Code extension can lead to catastrophic breaches like the GitHub internal repository theft by TeamPCP. In parallel, artificial intelligence is simultaneously accelerating attacks and creating dangerous new attack surfaces. Threat actors are using AI to automate influence campaigns like Patriot Bait and crack passwords, while also impersonating AI tools like Gemini CLI and Claude Code to deliver infostealers. Furthermore, attackers are directly targeting exposed AI infrastructure, such as Ollama AI endpoints, and manipulating AI coding assistants via hidden prompt injections in campaigns like TrapDoor, which means AI systems are both the weapon and the target. These trends together suggest that traditional perimeter defenses are failing against supply chain and AI-driven threats. Managers should immediately enforce strict vetting of open-source packages, restrict developer access to unverified extensions, and ensure AI infrastructure is not exposed to the public internet.

2026-05-245 minCheck Pointcritical

This threat intelligence report highlights a surge in ransomware activity, critical zero-day vulnerabilities in Windows, and the active exploitation of Cisco Catalyst SD-WAN controllers. Additionally, it details emerging AI-driven threats, including malicious Hugging Face repositories and the abuse of AI website generators for phishing, alongside an APT intrusion by FamousSparrow targeting the energy sector.

2026-05-226 minHuntresshigh

The Gentlemen ransomware operates as a Ransomware-as-a-Service (RaaS) model, utilizing affiliates who employ extensive defense evasion techniques. Recent incidents reveal attackers leveraging compromised RDP accounts, disabling Microsoft Defender via PowerShell, and establishing persistence through Scheduled Tasks that beacon to SOCKS proxy C2 servers.