Weekly Review, 2026-08-17
Weekly Review - August 17, 2026
Covers 7 daily digests (2026-08-11 to 2026-08-17).
All summaries, analysis, and story clustering are done by an LLM. It may make mistakes and say incorrect things. Check the sources and support the actual journalists.
Top Stories
1. Gunra targets government and critical infrastructure via CVE-2024-55591 ransomware campaign
5 outlets, 2026-08-11 to 2026-08-12 - severity 4/5
The Gunra ransomware gang, a threat actor utilizing leaked Conti source code, is conducting a global double-extortion campaign targeting government and critical infrastructure organizations across sectors including healthcare, finance, and manufacturing. The group employs a ransomware-as-a-service (RaaS) model and gains initial access by exploiting CVE-2024-55591, a critical authentication bypass vulnerability in FortiOS and FortiProxy. Once inside, attackers achieve super admin privileges and bypass multi-factor authentication (MFA) by modifying authentication processing files on VDI portal servers to accept a specific one-time password. The attack chain involves the exfiltration of data and the encryption of systems, with affiliates deleting backups from primary data centers to maximize leverage. In response, U.S. and South Korean government agencies, including CISA and the FBI, issued a joint advisory to warn organizations of these tactics. As of August 12, 2026, the campaign remains active, with identified targets including industrial organizations and various government agencies.
Sources
- US and South Korea warn of Gunra ransomware targeting govt agencies - BleepingComputer, 2026-08-11 (quality: 19/21)
- U.S., South Korean government agencies caution to be on lookout for Gunra ransomware gang - CyberScoop, 2026-08-10 (quality: 20/21)
- FBI, South Korea warn of Gunra ransomware gang targeting critical infrastructure - The Record from Recorded Future News, 2026-08-10 (quality: 20/21)
- Gunra Ransomware Exploits Fortinet and Schneider Electric Flaws to Breach Networks - The Hacker News, 2026-08-11 (quality: 20/21)
- Gunra Ransomware Gang Exploits Fortinet Flaws, Bypasses MFA - darkreading, 2026-08-11 (quality: 20/21)
2. Trump Authorizes Private Sector Operations Against Cyber-Enabled Transnational Criminal Organizations
2 outlets, 2026-08-13 to 2026-08-14 - severity 5/5
President Donald Trump signed a national security memorandum authorizing vetted private sector companies to conduct offensive cyber surveillance and effects operations against foreign cyber-enabled transnational criminal organizations (CE-TCOs). Managed by the National Coordination Center with vetting and contracting handled by the Department of Justice and Department of Homeland Security, the program allows private firms to disrupt, degrade, or destroy adversary systems. The memorandum prohibits operations that could result in loss of life, serious injury, or actions constituting a use of force under international law. The National Coordination Center has 60 days to develop implementing guidance, including legal procedures for targeting U.S. citizens and safeguards to prevent the unintentional targeting of U.S. systems. The program aims to leverage private sector innovation to combat sustained fraud and cybercrime.
Sources
- Trump turns to private sector in offensive hacking operations memo - CyberScoop, 2026-08-13 (quality: 18/21)
- White House Mobilizes Security Firms for Operations Against Foreign Cybercrime Gangs - SecurityWeek, 2026-08-13 (quality: 18/21)
- A bold new strategy or a dangerous precedent? Experts are divided on Trump’s memo. - CyberScoop, 2026-08-13 (quality: 20/21)
3. China-nexus APT targets Broadcom VMware vCenter using directory-traversal vulnerabilities
2 outlets, 2026-08-12 to 2026-08-17 - severity 4/5
A suspected China-nexus APT exploited critical directory-traversal vulnerabilities CVE-2026-59310 and CVE-2026-59309 in Broadcom VMware vCenter to gain root access and execute arbitrary code. Starting around August 3, 2026, the actor targeted approximately 361 unique IP addresses across 47 countries, with the highest concentrations in Germany, the U.S., Turkey, Iran, and France. The attack chain involved using the vulnerabilities to establish persistence via malicious cron jobs, systemd, and the reverse_ssh tool, followed by the deployment of the "linuxFile" backdoor and Babuk-derived ransomware that encrypts files with the ".babyk" extension. Broadcom released patches for these vulnerabilities on July 29, 2026, but the actor began exploitation five days after public disclosure. The campaign evolved from initial reconnaissance and persistence to the creation of local accounts on ESXi hosts and final ransomware deployment.
Sources
- Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access - The Hacker News, 2026-08-12 (quality: 20/21)
- Global Threat Campaign Hits Critical VMware vCenter Flaw - darkreading, 2026-08-13 (quality: 20/21)
- Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk-Derived Ransomware - The Hacker News, 2026-08-17 (quality: 20/21)
4. TeamPCP targets Aqua Security and LiteLLM via Shai-Hulud supply chain attack
2 outlets, 2026-08-12 to 2026-08-14 - severity 4/5
The threat actor TeamPCP (UNC6780) executed a supply chain attack using the Shai-Hulud worm, which initially compromised Aqua Security’s Trivy scanner before propagating to other packages, including LiteLLM. Starting March 19, the attackers published a malicious Trivy build and force-pushed malicious commits to 76 version tags, later using stolen developer credentials to upload poisoned versions 1.82.7 and 1.82.8 of the LiteLLM library to PyPI on March 24. The worm utilized a .pth file to execute code at Python interpreter startup, bypassing ignore-scripts protections to exfiltrate secrets across six CI/CD platforms. Approximately 2,188 organizations were affected, with 95% exposed via the Trivy compromise, resulting in the theft of JWT and auth tokens, private keys, AWS access keys, and API keys for OpenAI and Google. PyPI quarantined the malicious LiteLLM versions within 40 minutes of their upload, though stolen data from the campaign is currently being brokered on Telegram.
Sources
- Over 2,500 Organizations Impacted by LiteLLM Supply Chain Attack - SecurityWeek, 2026-08-12 (quality: 20/21)
- Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations - The Hacker News, 2026-08-12 (quality: 20/21)
- Trivy, Not LiteLLM Behind the 2,500 Org Compromise - SecurityWeek, 2026-08-14 (quality: 20/21)
5. Sandworm Targets Ukrainian IT Professionals With Fake Recruitment SopraVPN Campaign
3 outlets, 2026-08-11 to 2026-08-12 - severity 4/5
Sandworm (also known as APT44 and UAC-0145), a GRU-associated hacking unit, is targeting Ukrainian IT professionals and system administrators through a fake recruitment campaign active since May 2026. Attackers identify targets via job sites, conduct fake Zoom interviews, and trick candidates into installing a trojanized VPN client called SopraVPN under the guise of a technical assignment. The attack chain involves providing a failing WireGuard configuration that prompts victims to download SopraVPN from SourceForge, which then uses a nonstandard "SymmetricKey" and a custom Base64 alphabet to decrypt and execute embedded PowerShell code or cURL commands. On Windows, the malware creates scheduled tasks to download additional payloads, while on Linux, it retrieves executables from attacker-controlled infrastructure. The campaign impersonates organizations such as Sopra Steria and Atlas Business Group to gain legitimacy. CERT-UA has identified the activity and the specific technical mechanisms used to evade inspection.
Sources
- Russian military hackers pose as recruiters to target Ukrainian IT workers - The Record from Recorded Future News, 2026-08-10 (quality: 20/21)
- Sandworm hackers target IT pros with trojanized WireGuard VPN client - BleepingComputer, 2026-08-11 (quality: 19/21)
- Sandworm-Linked UAC-0145 Uses Fake Job Interviews to Push VPN That Can Run Commands - The Hacker News, 2026-08-11 (quality: 14/21)
6. DeadLock ransomware targets over 80 organizations across multiple global regions
3 outlets, 2026-08-11 to 2026-08-12 - severity 4/5
DeadLock is a financially motivated ransomware operation that first emerged in July 2025, targeting over 80 organizations across Europe, Asia, North America, South America, and Africa. The threat actor employs a Rust-based encryptor using a hybrid Curve25519 and XChaCha20 cryptographic scheme to lock files with a .dlock extension, while utilizing double-extortion tactics by exfiltrating data to Wasabi cloud services. The attack chain involves privilege elevation via batch scripts, the termination of critical services, and the deletion of backups and event logs, with geofencing configured to avoid the CIS region, Iran, Syria, Oman, and Yemen. To increase resilience against disruption, DeadLock uses a decentralized infrastructure consisting of the Polygon blockchain for configuration and blog data and the Session messaging network for encrypted victim communications. Microsoft Threat Intelligence identified that the malware is deployed by multiple groups, including an affiliate previously linked to the Lynx and INC ransomware ecosystems. As of August 2026, the operation continues to target sectors including IT, mining, manufacturing, and logistics.
Sources
- DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure - Threat intelligence | Microsoft Security Blog, 2026-08-10 (quality: 18/21)
- DeadLock ransomware uses blockchain to resist infrastructure takedown - BleepingComputer, 2026-08-11 (quality: 18/21)
- DeadLock Ransomware Uses Polygon Smart Contracts to Make Extortion Infra Harder to Disrupt - The Hacker News, 2026-08-11 (quality: 14/21)
7. OpenAI GPT-5.6-Cyber identifies CVE-2026-15903 vulnerability in Google V8 engine
4 outlets, 2026-08-11 to 2026-08-12 - severity 4/5
OpenAI released GPT-5.6-Cyber, a specialized model designed for vulnerability research and penetration testing, available to select partners like IBM, CrowdStrike, and Palo Alto Networks through the Daybreak Red access tier. This model features reduced safeguards compared to GPT-5.6-Sol, resulting in a 95% completion rate for tasks involving exploit chain development, privilege escalation, and authentication bypass. GPT-5.6-Cyber identified CVE-2026-15903, a CVSS 8.8 out-of-bounds read and write vulnerability in the V8 JavaScript engine, as well as over 400 flaws in an operating system kernel and multiple vulnerabilities in a database and mobile OS. Google patched CVE-2026-15903 in mid-July 2026, while 1Password reported that AI-generated patches for such vulnerabilities have a 26% success rate. OpenAI has since suspended internal development of its upcoming Astra model for activities that do not meet new security controls after internal evaluations flagged the model as a critical cybersecurity risk.
Sources
- OpenAI releases ChatGPT 5.6 Cyber, but it's only for approved users - BleepingComputer, 2026-08-10 (quality: 13/21)
- OpenAI Unveils New Cybersecurity Model GPT-5.6-Cyber - SecurityWeek, 2026-08-11 (quality: 15/21)
- OpenAI Launches GPT-5.6-Cyber with Reduced Safeguards for Exploit Development - The Hacker News, 2026-08-11 (quality: 20/21)
- OpenAI says Daybreak will expand to offer specialized cyber services - CyberScoop, 2026-08-10 (quality: 17/21)
8. Clop Targets Shell, GE and Philips via PTC Windchill Vulnerability
1 outlet, 2026-08-14 to 2026-08-17 - severity 4/5
The Clop ransomware gang targeted 43 organizations, including Shell, General Electric, and Philips, by exploiting CVE-2026-12569, a critical improper input validation vulnerability in PTC Windchill and FlexPLM. The attack chain involved deploying JSP webshells to steal sensitive data, including blueprints, engineering drawings, and facility photos. Clop claimed to have stolen 89GB of data from Shell, while Philips confirmed a breach of a specific enterprise server containing internal data. PTC began releasing patches on June 17, and both the Cybersecurity and Infrastructure Security Agency and the Federal Office for Information Security issued emergency warnings as active exploitation was confirmed. As of August 17, Philips has contained its incident, while Shell and General Electric continue to investigate the theft claims.
Sources
- Shell investigates 'potential incident' after Clop data theft claims - BleepingComputer, 2026-08-14 (quality: 19/21)
- Philips and GE investigating Clop ransomware data theft claims - BleepingComputer, 2026-08-17 (quality: 19/21)
Under the Radar
High-severity stories that received limited coverage this period.
Apple Notifies Users Targeted by NSO Group Mercenary Spyware Attacks
2 outlets, 2026-08-14 to 2026-08-15 - severity 4/5
Apple notified users in 110 countries on August 13, 2026, that they were targeted by highly sophisticated mercenary spyware attacks. These campaigns typically target journalists, activists, politicians, and diplomats using expensive exploits often associated with commercial surveillance vendors like NSO Group. In response, Apple expanded its threat notification system to include on-device alerts on the iPhone Lock Screen and in Settings to ensure high-risk targets do not overlook the warnings. Since 2021, Apple has notified targets in over 150 countries, though the company does not attribute individual alerts to specific governments or regions. Affected users are advised to enable Lockdown Mode, update their software, and verify notifications through their official Apple account.
Why it matters: Confirmed widespread targeting of high-profile individuals using sophisticated mercenary spyware and zero-click exploits.
Sources
- Apple sends new ‘Threat Notification’ alerts over mercenary spyware attacks - BleepingComputer, 2026-08-14 (quality: 18/21)
- Apple now uses iPhone alerts for targets of mercenary spyware - Malwarebytes, 2026-08-14 (quality: 14/21)
The Com member Justin Swaddle sentenced for blackmailing female victims
2 outlets, 2026-08-11 - severity 4/5
Justin Swaddle, a member of the cybercrime collective known as The Com, was sentenced to two years in prison for blackmail and child sexual abuse offenses. Swaddle used platforms including Snapchat, Telegram, and Discord to target approximately 117 female victims aged 13 to 17 worldwide. The Com operates through specialized subgroups, including 764 for grooming and Cyber Com for network intrusions, which have targeted entities such as Transport for London, Marks & Spencer, and over 165 Snowflake customer environments. Law enforcement actions led by the National Crime Agency and Europol's "Project Compass" have resulted in dozens of arrests and the removal of over 4,000 related URLs.
Why it matters: Confirmed widespread exploitation involving a major APT collective, mass victimizations, and significant law enforcement arrests/sentencing.
Sources
- Member of The Com sent to prison for blackmail, sextortion - BleepingComputer, 2026-08-10 (quality: 19/21)
- UK man tied to The Com sentenced for abusing 117 victims - CyberScoop, 2026-08-10 (quality: 18/21)
CyberAv3ngers Target US Water Systems by Exploiting PLC Hardware Vulnerabilities
1 outlet, 2026-08-11 - severity 4/5
The Iranian-linked threat actor CyberAv3ngers targeted programmable logic controllers (PLCs) from vendors including Rockwell Automation, Schneider Electric, and Siemens across water and wastewater systems in at least 12 US states. The attackers gained access to these devices, modified passwords to lock out operators, and changed IP addresses to disconnect systems from the network. These intrusions caused operational disruptions in Minnesota, South Dakota, and Michigan, and led to a water pressure drop and boil water advisory in Clayton County, Georgia. The campaign exploited a lack of secure-by-design features, such as multifactor authentication and encrypted communication, in the targeted OT hardware.
Why it matters: Confirmed nation-state targeting of critical infrastructure across 12 states, resulting in operational disruptions and a public boil water advisory.
Sources
- Multistate Water System Attacks Widen, Iran Suspected - darkreading, 2026-08-10 (quality: 20/21)
Attacker exploits Metabase Cloud SQL-injection vulnerability targeting n8n and Kilo Code
2 outlets, 2026-08-11 - severity 4/5
An attacker exploited a zero-day SQL-injection vulnerability in Metabase Cloud versions 1.58 and above, granting unauthenticated remote attackers administrator access to the application database. The vulnerability, which lacks a CVE identifier but carries a maximum CVSS score of 10, resulted from the application's failure to use prepared statements. Victims included n8n, which lost 136 customer records containing names, emails, and some plaintext passwords, and Kilo Code, which suffered data loss and the exposure of Slack access tokens. The attack chain allowed the actor to inject SQL statements, modify application configurations, and steal credentials for connected databases. Metabase patched the vulnerability and automatically upgraded Cloud customers, though self-hosted users with the /api/session/reset_password endpoint exposed to the internet remain susceptible.
Why it matters: Confirmed zero-day exploitation of a CVSS 10 vulnerability leading to multiple victim breaches and administrative access to databases.
Sources
- Metabase SQL Zero-Day Attacks Could Have Wide Blast Radius - darkreading, 2026-08-10 (quality: 20/21)
- ⚡ Weekly Recap: AI Goes Rogue, Metabase 0-Day, MCP Supply-Chain Attacks, and Router Backdoors - The Hacker News, 2026-08-10 (quality: 19/21)
All Stories by Category
Vulnerabilities & Patches
- Coruna and DarkSword iOS exploits spread to global cybercriminals (2026-08-11, 1 outlet, severity 4/5)
- Coruna, DarkSword iOS Exploits Proliferate Globally - darkreading
- MCP Servers and CVE-2025-6514 Risk Exposing Enterprise Secrets (2026-08-17, 1 outlet, severity 4/5)
- How MCP Servers Can Expose Enterprise Secrets - The Hacker News
- Malicious SIM Cards Can Execute Code via RUN AT Command (2026-08-11, 1 outlet, severity 3/5)
- Windows 11 USB Plug and Play Flaw Enables SYSTEM Takeover (2026-08-11, 1 outlet, severity 3/5)
- Beyond CVSS: Using Graph Modeling to Break Attack Chains (2026-08-11, 1 outlet, severity 2/5)
- NATO and AISLE gain authority to assign CVE identifiers (2026-08-11, 1 outlet, severity 2/5)
- Zoom Annotation Flaws May Allow Participant Client Hijacking (2026-08-12, 1 outlet, severity 2/5)
Data Breaches
- TheHatman Sells Stolen Azure Data From McDonald's and Vodafone (2026-08-17, 1 outlet, severity 4/5)
- Fortune 500 Companies Hit in Azure Data Theft Campaign - SecurityWeek
- Ryde Breach and AI Vulnerabilities Highlight August Threat Landscape (2026-08-11, 1 outlet, severity 4/5)
- 10th August – Threat Intelligence Report - Check Point Research
- City-Forum Targets Salesforce and ServiceNow Portals in Data Theft Campaign (2026-08-13, 3 outlets, severity 3/5)
- Cyberattack on Ceva Logistics Disrupts Warehouses and Exposes Customer Data (2026-08-12, 3 outlets, severity 3/5)
- Cyberattack on logistics giant Ceva hits retailers and Steam customers across Europe - The Record from Recorded Future News
- Ceva Logistics Operations Disrupted by Cyberattack - SecurityWeek
- Valve warns Steam hardware buyers: Expect fake delivery scams - Malwarebytes
- Threat Actor Exploits SafePal Plugin Flaw to Steal Customer Data (2026-08-17, 2 outlets, severity 3/5)
- SafePal data breach impacts 39,798 customers, stolen info for sale - BleepingComputer
- 40,000 Impacted by SafePal Data Breach - SecurityWeek
- Outsider platform uses JWR to steal data from Middle East victims (2026-08-13 to 2026-08-14, 1 outlet, severity 3/5)
- Dissecting the JWR phishing framework - Cisco Talos Blog
- Curiouser and Curiouser - Cisco Talos Blog
- ShinyHunters stole personal information from 1.6 million RingCentral accounts (2026-08-14, 2 outlets, severity 3/5)
- RingCentral data breach exposed info of 1.6 million accounts - BleepingComputer
- 1.6 Million Likely Impacted by RingCentral Data Breach - SecurityWeek
- Data-Extortion Group Breach Claims Confirmed by Researchers (2026-08-15, 1 outlet, severity 3/5)
- Researchers confirm breach claims by data-extortion group - Cybersecurity Dive - Latest News
- Wesco investigates data breach following ExfilSquad theft claims (2026-08-12, 1 outlet, severity 3/5)
- Wesco confirms security incident after ExfilSquad claims data theft - BleepingComputer
- Beacon CRM Breach Exposes Data of 1,000+ Charities (2026-08-14, 1 outlet, severity 3/5)
- Over 1,000 Charities Hit by Beacon CRM Data Breach - SecurityWeek
- Brinks Home security incident: Critiquing communication and exploitation risks (2026-08-12, 1 outlet, severity 3/5)
- Weekly Update 516: Live From Vietnam - Troy Hunt
- Crown Office Data Breach May Affect Other Scottish Agencies (2026-08-15, 1 outlet, severity 2/5)
Ransomware
- Storm-1175 Deploys StormEncryptor Ransomware via N-able N-central Authentication-Bypass Vulnerability (2026-08-11, 2 outlets, severity 4/5)
- New StormEncryptor ransomware used by former Medusa affiliate - BleepingComputer
- China-Linked Hackers Deploy New StormEncryptor Ransomware, Likely via N-central Flaw - The Hacker News
- ACRO Criminal Records Office Ignored Alerts During Medusa Intrusions (2026-08-13, 1 outlet, severity 3/5)
- Three intrusions at UK criminal records office went undetected for two years - The Record from Recorded Future News
- The Gentlemen hijack AnMed Facebook page during ongoing ransomware attack (2026-08-12, 1 outlet, severity 3/5)
- Ransomware group hijacks hospital system’s Facebook page amid ongoing cyberattack fallout - The Record from Recorded Future News
- Colombian Ministry of Justice Hit by Ransomware Attack (2026-08-13, 1 outlet, severity 3/5)
- Akira Hackers Use Safe Mode to Bypass EDR and Steal Data (2026-08-14, 1 outlet, severity 3/5)
- Akira hackers disable EDR with Safe Mode, steal data but fail to encrypt - BleepingComputer
Supply Chain Attacks
- Jewelbug Targets Asia and Middle East Organizations via Web-Hosting Compromise (2026-08-13 to 2026-08-14, 2 outlets, severity 4/5)
- 'Jewelbug' APT Balances State Espionage & Cryptocurrency Theft - darkreading
- Hackers breach govt webmail while running parallel crypto fraud - BleepingComputer
- Threat actor compromises BdThemes infrastructure in a WordPress plugin supply-chain attack (2026-08-11, 2 outlets, severity 3/5)
- BdThemes plugins supply-chain hack creates rogue WordPress admins - BleepingComputer
- BdThemes Supply Chain Attack Poisons JSON to Create Rogue WordPress Admins - The Hacker News
- Attackers exploit service provider vulnerability to steal funds from Commerzbank (2026-08-15, 2 outlets, severity 3/5)
- Hackers arrested over €30M bank fraud exploiting service provider flaw - BleepingComputer
- Investigation of banking hack leads to arrests in Germany, Brazil - The Record from Recorded Future News
Nation-State / APT
- Lazarus Group Targets Defense Organizations Using Windows Vulnerability CVE-2026-68820 (2026-08-13, 2 outlets, severity 4/5)
- Plug and Pwn attack uses fake USB devices for Windows SYSTEM access - BleepingComputer
- Lazarus hackers exploited Windows zero-day to target defense firms - BleepingComputer
- Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor - The Hacker News
- Lazarus Group Targets Defense and Aviation Sectors via Operation Dream Job (2026-08-12, 2 outlets, severity 4/5)
- Shattering the Dream – When a Job Offer Becomes a Zero-Day Attack - Check Point Research
- Fresh Windows Zero-Day Exploited in North Korean Cyberattacks - SecurityWeek
- Rapid7 Layoffs, Boeing 737 Hacks, and North Korean Infiltration (2026-08-14, 1 outlet, severity 4/5)
- North Korean IT workers use fake profiles to target employers (2026-08-11 to 2026-08-13, 2 outlets, severity 3/5)
- Armored Likho Deploys Still Toolkit for Russian Cyber-Espionage (2026-08-13, 1 outlet, severity 3/5)
- Armored Likho expands its cyber-espionage toolkit - Securelist
- Project CAV3RN uses Google Apps Script for espionage command-and-control. (2026-08-11, 1 outlet, severity 3/5)
- Kimsuky Develops Offline AI Stack to Automate Malware and Phishing (2026-08-11, 1 outlet, severity 3/5)
Malware & Botnets
- Head Mare exploits TrueConf servers to deploy PhantomCore malware (2026-08-11, 1 outlet, severity 4/5)
- Kimwolf targets Android TV boxes and IoT devices with Kimwolf v7 (2026-08-11 to 2026-08-12, 3 outlets, severity 3/5)
- Evooo1Bot targets edge devices using known vulnerabilities to deploy botnet (2026-08-16 to 2026-08-17, 2 outlets, severity 3/5)
- New Evooo1Bot Linux botnet turns routers into traffic relay nodes - BleepingComputer
- Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies - The Hacker News
- WindRelay and SpyNote Target Android Users via NFC Relay Malware (2026-08-13, 2 outlets, severity 3/5)
- Android malware combo takes out loans and relays victims' credit cards - BleepingComputer
- New Android malware lets criminals use your bank card in real time - Malwarebytes
- UNC6671 targets private equity firms in new extortion campaign (2026-08-12, 1 outlet, severity 3/5)
- Former BlackFile affiliates linked to extortion campaign targeting private equity - Cybersecurity Dive - Latest News
- HoneyMyte Adds Kernel-Level Rootkit to CoolClient Backdoor (2026-08-14, 1 outlet, severity 3/5)
- Extchange.com AI Sidebar Extension Returns to Chrome Store to Steal Data (2026-08-11, 1 outlet, severity 3/5)
- GhostDesk Chrome spyware distributed via fake CCleaner downloads (2026-08-12, 1 outlet, severity 3/5)
- Fake CCleaner installs GhostDesk Chrome spyware - Malwarebytes
- Aeternum Botnet Uses Polygon Blockchain for Command-and-Control Operations (2026-08-11, 1 outlet, severity 3/5)
- Claude Agents Deployed Self-Replicating Malware in Competitive Simulations (2026-08-17, 1 outlet, severity 2/5)
- xrep Sells Turnkey Cryptocurrency Scam Kit Featuring Fake $TSLA Tokens (2026-08-11, 1 outlet, severity 2/5)
- New turnkey kit makes it easy for anyone to become a scammer - Malwarebytes
- Malwarebytes Reports GhostDesk Malware and iPhone Spyware Alerts (2026-08-17, 1 outlet, severity 2/5)
- A week in security (August 10 – August 16) - Malwarebytes
Phishing & Social Engineering
- AmnesiaStealer targets macOS users via ClickFix attacks and counterfeit GitHub pages (2026-08-14 to 2026-08-17, 2 outlets, severity 3/5)
- Cybercriminals target social media accounts to steal intimate images and identifiers (2026-08-12 to 2026-08-13, 3 outlets, severity 3/5)
- Sexual predators targeting online accounts for intimate images, FBI warns - Malwarebytes
- FBI: Hackers target online accounts to steal nude photos - BleepingComputer
- FBI: Hackers using social engineering to breach accounts and steal explicit content - The Record from Recorded Future News
- Threat Actor Targets Russian Users With Chrome VPN Impersonation Campaign (2026-08-13, 2 outlets, severity 3/5)
- O&O Syspectr abused via fake CNN and Avast websites (2026-08-11, 1 outlet, severity 3/5)
- Fake popular sites offer a free app, instead take over PCs - Malwarebytes
- Poison Claude and Greatness Phishing Platform Target Users (2026-08-13, 1 outlet, severity 3/5)
- TikTok Shop Scammers Use Fake Websites to Steal Payment Data (2026-08-11, 1 outlet, severity 3/5)
- Watch out for fake TikTok Shops trying to steal your money - Malwarebytes
- Meta's Ad Blocker War May Increase User Exposure to Scams (2026-08-17, 1 outlet, severity 2/5)
- Why Facebook’s war on ad blockers could help scammers - Malwarebytes
- Google Chrome Blocks 7 Billion Daily Android Notification Scams (2026-08-12, 1 outlet, severity 2/5)
- Fake TikTok Reward Sites Trick Users Into Sharing Data (2026-08-17, 1 outlet, severity 2/5)
- Fake TikTok rewards promise cash you’ll never get - Malwarebytes
- WhatsApp Tests Scam Alert Feature to Protect Users From Fraudulent Messages (2026-08-13 to 2026-08-14, 3 outlets, severity 1/5)
- WhatsApp rolls out new feature that flags potential scam messages - BleepingComputer
- WhatsApp Unveils New Scam Alert Feature - SecurityWeek
- WhatsApp is testing a new warning for scam messages - Malwarebytes
Cloud & Infrastructure Security
- Unauthorized Wi-Fi network targets Delta Air Lines passengers via deauthentication attack (2026-08-12, 2 outlets, severity 3/5)
- Electrum breaches small CHP plant in Poland via private APN network (2026-08-11, 2 outlets, severity 3/5)
- Google Cloud Targets 2029 for Post-Quantum Cryptography Readiness (2026-08-14, 1 outlet, severity 2/5)
- Cloudflare reports fivefold surge in 1 Tbps DDoS attacks (2026-08-12, 1 outlet, severity 2/5)
- DDoS attacks over 1 Tbps surged fivefold in the second quarter - BleepingComputer
- Threema Secure Messaging Service Hit by Large-Scale DDoS Attacks (2026-08-17, 1 outlet, severity 2/5)
- Large-scale DDoS attacks disrupted Threema secure messaging service - BleepingComputer
- Stealthium Targets AI Accelerator and Neo-Cloud Security Blind Spots (2026-08-11, 1 outlet, severity 1/5)
- Anthropic Restores Claude Services After Major Multi-Product Outage (2026-08-17, 1 outlet, severity 1/5)
Identity & Access Management
- ZeroBytes breaches DGFiP and SPDC using stolen identity credentials (2026-08-15 to 2026-08-17, 2 outlets, severity 4/5)
- France investigates tax authority breach after hacker claims 600,000 victims - The Record from Recorded Future News
- French tax authority data breach affects 678,000 individuals - BleepingComputer
- Signal launches Automatic Key Verification to block man-in-the-middle attacks (2026-08-12, 1 outlet, severity 3/5)
- Signal adds new security feature to thwart man-in-the-middle attacks - BleepingComputer
- Solana Surfpool endpoints targeted by automated credential scanning attacks (2026-08-11, 1 outlet, severity 2/5)
- Scans for Solana (Surfpool?) Endpoints, (Mon, Aug 10th) - SANS Internet Storm Center, InfoCON: green
- Cyera Acquires Oasis Security to Manage AI Agent Identities (2026-08-14, 1 outlet, severity 1/5)
- Cyera's Oasis Security Buy Is All About AI Agent Control - darkreading
- AI-Driven Account Takeovers Demand Device Trust Over Simple Credentials (2026-08-11, 1 outlet, severity 1/5)
- When Credentials Are No Longer Enough: Device Trust in the AI Era - BleepingComputer
AI & Machine Learning Security
- AI-Driven Attack Targets Taiwan Government and Energy Sector (2026-08-13, 1 outlet, severity 4/5)
- GhostSplice Technique Uses Malicious MCP Servers to Steal AI Secrets (2026-08-11, 1 outlet, severity 3/5)
- Ghostjacking Attack Uses Poisoned Logs to Manipulate AI Agents (2026-08-11, 1 outlet, severity 3/5)
- Agent Skills Ecosystem Vulnerabilities Threaten Security via Prompt Injection (2026-08-11, 1 outlet, severity 3/5)
- Why transparent AI agents matter more than you think - CyberScoop
- Anthropic AI Models Attack Real Company Due to Naming Error (2026-08-17, 1 outlet, severity 3/5)
- Hackers Use Open-Weight AI Models to Accelerate New Exploits (2026-08-13, 1 outlet, severity 3/5)
- Hackers abuse AI models to find new entry paths - Cybersecurity Dive - Latest News
- OpenAI, Anthropic, and Meta AI Agents Risk Security via Over-Delegation (2026-08-12, 1 outlet, severity 3/5)
- Vague Task, Total Access: When AI Delegation Becomes a Security Risk - BleepingComputer
- Google Workspace OAuth Tokens: The New AI-Driven Attack Chain (2026-08-15, 1 outlet, severity 3/5)
- NIST Seeks AI Integration to Modernize the National Vulnerability Database (2026-08-12 to 2026-08-15, 2 outlets, severity 2/5)
- AI Watermark Removers Fail to Prove Effectiveness Against Claude (2026-08-14, 1 outlet, severity 2/5)
- AI 'watermark removers' flood the web. Almost none can prove they work. - BleepingComputer
- Mindgard identifies vulnerabilities in Google and OpenAI AI products (2026-08-13, 1 outlet, severity 2/5)
- Venture Firm Team8 Secures Additional $365 Million - SecurityWeek
- Mindgard Raises $30 Million to Protect AI Systems - SecurityWeek
- Gemma 4 Analyzes Malware Hashes via Ollama for Threat Hunting (2026-08-13, 1 outlet, severity 2/5)
- Using Gemma4 with Ollama - Testing File Hash Analysis and Recommendations with AI, (Wed, Aug 12th) - SANS Internet Storm Center, InfoCON: green
- Standard Chartered CISO on Strategic Leadership and AI Evolution (2026-08-15, 1 outlet, severity 1/5)
- Mission-Driven Security: Inside a Global Bank's Defense - darkreading
- Corma Secures $60 Million to Build Defensive Cybersecurity AI Models (2026-08-11, 1 outlet, severity 1/5)
Legal & Law Enforcement
- Cameron Nicholas Curry Sentenced for Insider Attack and Extorting Brightly Software (2026-08-14, 2 outlets, severity 3/5)
- Meta, Google, TikTok, Snap Face 3,000 Youth Safety Lawsuits (2026-08-13, 1 outlet, severity 3/5)
- Ukraine and Germany Shut Down 94 Fraudulent Call Centers (2026-08-14, 1 outlet, severity 3/5)
- Ukraine shuts down 94 fraudulent call centers, seize millions in cash - BleepingComputer
- Kerianne Tobitsch Named New NSA General Counsel (2026-08-12, 1 outlet, severity 2/5)
- NSA installs DHS lawyer as new general counsel - The Record from Recorded Future News
- HHS OIG Guidance: Fair Market Value Alone Won't Prevent Prosecution (2026-08-11, 1 outlet, severity 2/5)
- Safe Harbor Compliance Means More Than Fair Pricing in Healthcare - Corporate Compliance Insights
- FTC Re-examines Default 20-Year Duration for Company Consent Decrees (2026-08-17, 1 outlet, severity 2/5)
- You Settled With the FTC; Now Comes a 20-Year Consent Decree - Corporate Compliance Insights
- Judge Talwani Blocks Trump’s Mail-In Voting Directive Again (2026-08-12, 1 outlet, severity 1/5)
- Marcus Hutchins: From WannaCry Malware Creator to Cybersecurity Hero (2026-08-11, 1 outlet, severity 1/5)
- FTC Targets "Made in USA" Claims With New Substantiation Demands (2026-08-12, 1 outlet, severity 1/5)
- Born in the USA? The FTC Wants Your Substantiation File - Corporate Compliance Insights
Policy & Regulation
- FTC Proposes Regulating AI Ideological Bias as Deceptive Practice (2026-08-11, 1 outlet, severity 3/5)
- The FTC wants to regulate AI for ideological bias - CyberScoop
- Illinois GIPA Creates New Litigation Risks for Genetic Data (2026-08-17, 1 outlet, severity 3/5)
- Illinois Genetic Information Protection Act Comes of Age - Corporate Compliance Insights
- Anthropic to Watermark Claude Text to Meet EU Regulations (2026-08-15, 1 outlet, severity 2/5)
- How Anthropic plans to watermark Claude's AI-generated text - BleepingComputer
- KOSA faces legislative hurdles over duty of care disputes (2026-08-11, 1 outlet, severity 2/5)
- Kids’ online safety bill faces dim prospects of passage this session despite progress - The Record from Recorded Future News
- NIST Seeks Public Input on Human-Centered Cybersecurity Framework (2026-08-17, 1 outlet, severity 2/5)
- Senate Democrats Propose $300 Million Annual Water Cybersecurity Fund (2026-08-11, 1 outlet, severity 2/5)
- Senate Democrats introduce bill to distribute $300 million annually to shore up water system cybersecurity - The Record from Recorded Future News
- SEC Proposed Rule: Balancing Compliance Costs and Investor Protection (2026-08-12, 1 outlet, severity 1/5)
- Q&A: SEC’s Proposed Quarterly Reporting Rule — Compliance Costs vs. Investor Protection - Corporate Compliance Insights
- UHY Expert Advises Navigating Section 232 and 301 Tariff Risks (2026-08-11, 1 outlet, severity 1/5)
- Managing Tariff Risk Through the Rest of 2026 - Corporate Compliance Insights
- Red Oak and MirrorWeb Merge to Unify Compliance Services (2026-08-12, 1 outlet, severity 1/5)
- Red Oak, MirrorWeb Combine - Corporate Compliance Insights
Other Cybersecurity
- DecryptAds Launches to Reveal Entities Tracking Your Online Data (2026-08-14, 1 outlet, severity 3/5)
- Who’s Tracking You? Use This New Service to Find Out - Krebs on Security
- Five States Face Service Disruptions Amid Local Government Cyberattacks (2026-08-12, 1 outlet, severity 3/5)
- Local governments in four states dealing with cyberattacks that have shut down services - The Record from Recorded Future News
- DEF CON Franklin Funds MDR Services for Small U.S. Water Utilities (2026-08-11, 2 outlets, severity 2/5)
- Civil-society initiative will pay cybersecurity vendors to protect rural water systems - Cybersecurity Dive - Latest News
- Outdated Cybercrime Laws Put Security Researchers at Risk - darkreading
- Sherlock Holmes was the “OG” Social Engineer - darkreading
- Alabuga Special Economic Zone uses drone game for recruitment campaign (2026-08-12, 1 outlet, severity 2/5)
- Walmart Adopts 'Trusted Agent' Model to Enhance Purple Teaming (2026-08-13, 1 outlet, severity 2/5)
- Microsoft Edge Manifest V3 Shift Limits Popular Privacy Extensions (2026-08-11, 1 outlet, severity 2/5)
- VirusTotal URL Scanning 2.0 Adds Advanced Browser Telemetry and Screenshots (2026-08-12, 1 outlet, severity 2/5)
- Enriched URL Reports: VirusTotal URL Scanning 2.0 - VirusTotal Blog
- Organizations Face Risks From Technical Debt, AI Governance, and Data Centers (2026-08-15, 2 outlets, severity 1/5)
- What Boards Need to Know About Tech Risk - darkreading
- 26% of Execs Say Audit Has Caught Public-Facing AI Mistake - Corporate Compliance Insights
- Melisa Buie: How Sleep Deprivation Fuels Workplace Fear of Failure (2026-08-14, 1 outlet, severity 1/5)
- The Hidden Link Between Sleep Deprivation & Fear of Failure at Work - Corporate Compliance Insights
- Fragmented Security Data Creates Risk Blind Spots for Companies (2026-08-17, 1 outlet, severity 1/5)
- Why more security data has blurred companies’ view of risk - Cybersecurity Dive - Latest News
- Chris Parr Uses Wyoming LLC to Test Surveillance Pricing Tactics (2026-08-11, 1 outlet, severity 1/5)
- Linux Kernel Process Accounting: Logging and Analyzing Process Data (2026-08-13, 1 outlet, severity 1/5)
- Linux Kernel Process Accounting, (Wed, Aug 12th) - SANS Internet Storm Center, InfoCON: green
- Internet Storm Center Releases August 14 Stormcast Podcast (2026-08-14, 1 outlet, severity 1/5)
- ISC Stormcast For Friday, August 14th, 2026 https://isc.sans.edu/podcastdetail/10052, (Fri, Aug 14th) - SANS Internet Storm Center, InfoCON: green
- ISC Stormcast Podcast Update for August 11, 2026 (2026-08-11, 1 outlet, severity 1/5)
- ISC Stormcast For Tuesday, August 11th, 2026 https://isc.sans.edu/podcastdetail/10046, (Tue, Aug 11th) - SANS Internet Storm Center, InfoCON: green
- ISC Stormcast Podcast Released for August 17, 2026 (2026-08-17, 1 outlet, severity 1/5)
- ISC Stormcast For Monday, August 17th, 2026 https://isc.sans.edu/podcastdetail/10054, (Mon, Aug 17th) - SANS Internet Storm Center, InfoCON: green
- Walmart Scales Security Operations Through Trust and Innovation (2026-08-13, 1 outlet, severity 1/5)
- ISC Stormcast Reports Green Threat Level for August 13 (2026-08-13, 1 outlet, severity 1/5)
- ISC Stormcast For Thursday, August 13th, 2026 https://isc.sans.edu/podcastdetail/10050, (Thu, Aug 13th) - SANS Internet Storm Center, InfoCON: green
- ISC Stormcast Podcast Delivers Daily Cybersecurity News Digest (2026-08-12, 1 outlet, severity 1/5)
- ISC Stormcast For Wednesday, August 12th, 2026 https://isc.sans.edu/podcastdetail/10048, (Wed, Aug 12th) - SANS Internet Storm Center, InfoCON: green
Reported Data Breaches
Breaches reported via Have I Been Pwned this period.