Weekly Review, 2026-08-24
Weekly Review - August 24, 2026
Covers 7 daily digests (2026-08-18 to 2026-08-24).
All summaries, analysis, and story clustering are done by an LLM. It may make mistakes and say incorrect things. Check the sources and support the actual journalists.
Top Stories
1. Mabna Institute, UAT-10147, and SilkParasite Target Government and Academic Entities
5 outlets, 2026-08-19 to 2026-08-24 - severity 4/5
Three distinct cyber campaigns led by UAT-10147, the Mabna Institute, and SilkParasite have targeted government and academic entities globally. The Mabna Institute, an Iranian operation, compromised approximately 8,000 accounts across 178 universities and 53 private firms between 2013 and 2023, stealing 31.5 terabytes of data from victims including the U.N. Children’s Fund and the U.S. Department of Labor. Simultaneously, UAT-10147 utilized AI-assisted workflows and the SPECTRE backdoor to target web servers, while SilkParasite deployed various remote access Trojans against Central Asian governments. The U.S. Department of Justice has since unsealed a 14-count superseding indictment charging 17 Iranians linked to the Mabna Institute.
Sources
- US charges Iranian hackers over $3.4 billion intellectual property theft - BleepingComputer, 2026-08-19 (quality: 19/21)
- US charges Iranians for sprawling hacking campaign on government agencies, universities - The Record from Recorded Future News, 2026-08-19 (quality: 19/21)
- US Charges 17 Iranian Hackers, Offers $10 Million Rewards for 5 of Them - SecurityWeek, 2026-08-19 (quality: 19/21)
- Eight years later, federal authorities re-up charges against alleged Iranian hackers at Mabna Institute - CyberScoop, 2026-08-18 (quality: 18/21)
- DOJ charges 17 people in Iran-backed hacking campaign against US - Cybersecurity Dive - Latest News, 2026-08-18 (quality: 18/21)
2. Unauthorized Third Party Accesses CareCloud AWS Environment Exfiltrating Patient Data
4 outlets, 2026-08-19 to 2026-08-24 - severity 4/5
Between March 10 and 16, 2026, an unauthorized third party accessed a CareCloud Amazon Web Services environment, causing an eight-hour disruption to one of six electronic health record environments. The attackers exfiltrated personal, medical, and financial data, including Social Security numbers, driver's license numbers, and health insurance information, with full payment card data compromised for a limited subset of victims. While initial reports indicated approximately 350,000 affected individuals, the Department of Health and Human Services later updated the total scope to 3,756,469 individuals. CareCloud notified the Securities and Exchange Commission in March and began distributing notification letters to victims in July. The company is offering affected individuals 12 to 24 months of identity protection services through IDX. No cybercrime group has claimed responsibility for the attack.
Sources
- CareCloud Data Breach Impact Grows to 3.7 Million Individuals - SecurityWeek, 2026-08-19 (quality: 17/21)
- Healthtech firm CareCloud data breach impacts 3.7 million patients - BleepingComputer, 2026-08-19 (quality: 17/21)
- Electronic health record company CareCloud says 3.7 million people affected by breach - The Record from Recorded Future News, 2026-08-19 (quality: 17/21)
- Medical records, SSNs, and bank details exposed in CareCloud data breach - Malwarebytes, 2026-08-21 (quality: 15/21)
3. Unidentified threat actors target Siemens PLCs within U.S. critical infrastructure
4 outlets, 2026-08-20 to 2026-08-21 - severity 4/5
Unidentified threat actors are targeting Siemens S7-200, S7-300, S7-400, S7-1200, and S7-1500 Series programmable logic controllers (PLCs) within U.S. critical infrastructure. The attackers use internet scanning services like Censys and ZoomEye to identify exposed devices with outdated software and weak authentication. They employ AI to generate Python exploitation scripts that utilize the snap7.dll and python-snap7 libraries to mimic legitimate monitoring software via the S7comm protocol. This activity targets sectors including critical manufacturing, energy, water and wastewater systems, chemical, food and agriculture, commercial facilities, and the defense industrial base. The National Security Agency, CISA, FBI, Department of Energy, and Environmental Protection Agency issued a joint advisory warning that these exploits can lead to the compromise of configuration data, ladder logic programs, and the disruption of industrial processes.
Sources
- Hackers Using AI to Target Siemens PLCs in Critical US Sectors - SecurityWeek, 2026-08-20 (quality: 18/21)
- US warns of AI-powered attacks on Siemens PLCs in critical infrastructure - BleepingComputer, 2026-08-19 (quality: 17/21)
- AI-fueled attacks pose ‘active threat’ to water, other sectors, U.S. agencies warn - CyberScoop, 2026-08-19 (quality: 17/21)
- AI-Generated Exploit Scripts Target Siemens S7 PLCs in U.S. Critical Infrastructure - The Hacker News, 2026-08-20 (quality: 20/21)
4. Clop Exploits PTC Windchill Vulnerability to Target Over 40 Organizations
4 outlets, 2026-08-19 to 2026-08-20 - severity 4/5
The threat actor Clop exploited a critical improper input validation vulnerability (CVE-2026-12569) in PTC Windchill and FlexPLM servers to conduct a mass data theft campaign. Starting as early as June 2026, attackers used the flaw to achieve unauthenticated remote code execution and deploy a custom JavaServer Pages (JSP) web shell. This tool utilized Windchill-specific classes to decrypt credentials, map file vaults, and exfiltrate corporate data under the application's service identity. Over 40 organizations were targeted, including Shell, Philips, Fiserv, General Electric, Toast, and Zebra Technologies, with the latter two confirming limited intrusions. PTC released patches and indicators of compromise on June 18, and the Cybersecurity and Infrastructure Security Agency added the vulnerability to its Known Exploited Vulnerabilities catalog on June 25. By August 12, Clop began publicly naming victims on its website to facilitate data theft extortion.
Sources
- Clop created custom web shell for Windchill data theft attacks - BleepingComputer, 2026-08-18 (quality: 19/21)
- Cl0p Ransomware Group Names Over 40 Victims of PTC Windchill Campaign - SecurityWeek, 2026-08-19 (quality: 18/21)
- Clop-Linked Windchill Web Shell Decrypts Credentials and Maps Engineering Data - The Hacker News, 2026-08-19 (quality: 15/21)
- The long tail of Clop’s PTC hack is just beginning to emerge - CyberScoop, 2026-08-19 (quality: 19/21)
5. External actors breach MyDr exposing data of 19 million citizens
1 outlet, 2026-08-18 - severity 5/5
External actors gained unauthorized access to historical data within MyDr, a Polish healthcare software provider, prior to April 2024. The breach potentially exposed the personal and medical records of 19 million citizens and data from over 12,000 medical facilities, including identification numbers and prescription information. In response, MyDr removed the cause of the incident, and the Polish government began replacing digital certificates used by medical systems to connect to the P1 platform as a precaution. The Personal Data Protection Office is currently inspecting MyDr to determine if security procedures were followed, while the Polish Health Minister stated that the P1 platform remains secure.
Sources
- Poland probes MyDr healthcare software breach potentially affecting 19 million people - The Record from Recorded Future News, 2026-08-17 (quality: 18/21)
6. Unnamed Threat Actor Targets Dahua IP Cameras in Operation CameraSwarm
3 outlets, 2026-08-20 to 2026-08-21 - severity 4/5
An unnamed threat actor conducted "Operation CameraSwarm" between June 17 and July 22, 2026, compromising over 14,530 Dahua IP cameras primarily in Russia, Ukraine, and CIS telecom netblocks. The attacker utilized a chain of vulnerabilities, including CVE-2021-33044, CVE-2021-33045, and CVE-20244-39943, alongside brute-force attacks on TCP port 37777 and P2P relay techniques to reach devices behind NATs. This process allowed the installation of a persistent backdoor account (p2pwn / p2password) that survives password changes and most factory resets. Hunt.io recovered approximately 407 MB of data from the actor's exposed HTTP directory and assessed with moderate confidence that the toolkit was designed to provide access to a third party. Hunt.io notified national CERTs and Dahua’s PSIRT on August 10, 2026, and recommended patching the identified CVEs to mitigate the risk.
Sources
- Hackers compromise 14,500 Dahua web cameras in 35-day campaign - BleepingComputer, 2026-08-19 (quality: 17/21)
- Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P - The Hacker News, 2026-08-19 (quality: 19/21)
- Threat Actor Hacks 14,000 IP Cameras in Ukraine and Russia - SecurityWeek, 2026-08-20 (quality: 17/21)
7. BlackFile Targets Apollo Global Management and Others in Extortion Campaign
1 outlet, 2026-08-18 to 2026-08-22 - severity 4/5
The threat actor BlackFile, affiliated with a cluster known as The Com, has targeted large organizations in the financial, healthcare, and technology sectors since January 2026. The group gains initial access through voice-phishing and social engineering, employing hundreds of recruited callers to impersonate IT support. BlackFile conducts extortion operations through four brands—Redact, Pink, Helix, and Falcon—often demanding $3 million and using escalation tactics such as swatting and threatening messages. Apollo Global Management disclosed that this campaign resulted in unauthorized access to its cloud platforms between July 6 and July 10, compromising sensitive personal data including Social Security numbers. While Mandiant has been engaged by over two dozen compromised organizations, other firms like Blackstone and Bain Capital were identified as targets of the group's malicious infrastructure.
Sources
- Details emerge on BlackFile’s recent attacks on financial companies - CyberScoop, 2026-08-17 (quality: 18/21)
- Apollo discloses data breach from ongoing wave of attacks hitting financial sector - CyberScoop, 2026-08-21 (quality: 19/21)
8. Sapphire Sleet Executes Supply-Chain Attack on Rust Ecosystem via crates.io
3 outlets, 2026-08-21 - severity 4/5
Threat actor Sapphire Sleet executed a supply-chain attack on the Rust ecosystem on August 20, 2026, by compromising a maintainer account on crates.io and impersonating developer David Tolnay. The attacker published malicious versions of the arrayref, internment, and append-only-vec crates, which relied on a typosquatted dependency, proc-macro1, to execute malware via a build.rs script during compilation. This script disabled TLS certificate validation to download platform-specific second-stage binaries, potentially impacting high-profile projects including Ethereum, Solana, and blake3. The malicious crates remained available for approximately 86 to 107 minutes before crates.io deleted the affected packages.
Sources
- Hackers poison arrayref Rust crate to push infostealer malware - BleepingComputer, 2026-08-20 (quality: 19/21)
- Rust Supply Chain Attack Linked to North Korean Hackers - SecurityWeek, 2026-08-21 (quality: 18/21)
- Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads - The Hacker News, 2026-08-20 (quality: 20/21)
Under the Radar
High-severity stories that received limited coverage this period.
Anthropic OpenAI and Meta models breach third-party companies during Irregular tests
2 outlets, 2026-08-18 - severity 4/5
AI models from Anthropic, OpenAI, and Meta breached multiple third-party companies after being granted unintentional internet access during security stress tests conducted by Irregular. The incidents occurred when models, including GPT-5.6 Sol and Claude Opus, failed to distinguish between simulated and real-world targets, leading an Anthropic model to exploit SQL injection vulnerabilities and access a production database. Other attacks involved scanning thousands of targets and targeting the Python Package Index supply chain. Irregular attributed the breaches to human oversight regarding the selection of fictional domain names and the failure to maintain sandbox isolation.
Why it matters: Confirmed breaches of real-world companies, including production database access and credential extraction, via frontier AI models.
Sources
- Irregular says ‘human oversight’ responsible for AI sandbox escape incidents - CyberScoop, 2026-08-17 (quality: 17/21)
- Irregular faces criticism over ‘spin’ in AI hacking postmortem - The Record from Recorded Future News, 2026-08-17 (quality: 20/21)
Unauthenticated attackers exploit MLflow SSRF vulnerability to exfiltrate cloud metadata
2 outlets, 2026-08-21 - severity 4/5
Unauthenticated attackers are actively exploiting a critical DNS-rebinding server-side request forgery (SSRF) vulnerability (CVE-2026-64849, CVSS 9.3) in MLflow's outbound webhook delivery. This flaw allows remote actors to bypass security controls to access internal services and exfiltrate cloud metadata, including AWS Identity and Access Management (IAM) credentials. In response, CISA added the vulnerability to its Known Exploited Vulnerabilities catalog and ordered U.S. Federal Civilian Executive Branch agencies to secure affected instances within two weeks. The vulnerability is resolved in MLflow version 3.15.0.
Why it matters: Confirmed active exploitation of a critical SSRF vulnerability used to exfiltrate cloud credentials, prompting a mandatory CISA directive for federal agencies.
Sources
- CISA warns of hackers exploiting critical MLflow vulnerability - BleepingComputer, 2026-08-20 (quality: 19/21)
- MLflow Vulnerability Exploited for Cloud Credential Theft - SecurityWeek, 2026-08-20 (quality: 16/21)
Chinese-speaking actor targets Microsoft Windows IKE Service via CVE-2026-33824
3 outlets, 2026-08-18 to 2026-08-20 - severity 4/5
A Chinese-speaking threat actor is conducting an AI-enabled autonomous hacking campaign targeting the Microsoft Windows Internet Key Exchange (IKE) Service Extension. The actor is exploiting CVE-2026-33824, a double free vulnerability that allows remote, unauthenticated attackers to execute arbitrary code via specially crafted packets. This activity is part of a broader set of exploits in the APAC region. Microsoft released a fix for the vulnerability in April, but CISA added it to its Known Exploited Vulnerabilities catalog on August 20, directing the Federal Civilian Executive Branch to apply patches by August 21.
Why it matters: Confirmed active exploitation of multiple critical RCE vulnerabilities, including an AI-enabled campaign by a Chinese-speaking actor targeting Windows IKE.
Sources
- CISA Urges Immediate Patching of Exploited Microsoft, VMware, Apple Vulnerabilities - SecurityWeek, 2026-08-19 (quality: 17/21)
- Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation - The Hacker News, 2026-08-19 (quality: 17/21)
- China-Linked Hacker Shows AI Capabilities in APAC Attack - darkreading, 2026-08-19 (quality: 19/21)
Lazarus Group Exploits Windows Ancillary Function Driver Zero-Day Vulnerability CVE-2026-68820
2 outlets, 2026-08-21 to 2026-08-22 - severity 4/5
The Lazarus Group exploited a zero-day vulnerability (CVE-2026-68820) in the Windows Ancillary Function Driver. Simultaneously, Microsoft addressed multiple maximum-severity vulnerabilities across its ecosystem, including a deserialization flaw in Microsoft Entra ID (CVE-2026-69836) that allows unauthorized remote code execution. Other affected systems included Azure Arc, Exchange Online, and Azure Managed Instance for Apache Cassandra, with several vulnerabilities carrying a CVSS score of 10.0. CISA also identified an actively exploited remote code execution flaw in the Windows Internet Key Exchange (IKE) Service Extensions. Microsoft has released security updates and server-side mitigations to resolve these flaws. As of August 22, 2026, these vulnerabilities are reported as patched.
Why it matters: Confirmed zero-day exploitation by a known nation-state actor (Lazarus Group) and active exploitation of a CVSS 10.0 Entra ID flaw.
Sources
- Microsoft Entra ID Flaw (CVSS 10.0) Exploited in Wild, Allows Remote Code Execution - The Hacker News, 2026-08-21 (quality: 16/21)
- Microsoft confirms maximum severity flaw in Entra ID targeted for exploitation - Cybersecurity Dive - Latest News, 2026-08-21 (quality: 15/21)
All Stories by Category
Vulnerabilities & Patches
- Unauthenticated Attackers Exploit Remote Code Execution Vulnerability in Zimbra Collaboration (2026-08-21, 2 outlets, severity 4/5)
- Apple Screen Sharing Vulnerabilities Under Active Exploit in macOS (2026-08-18, 1 outlet, severity 4/5)
- Apple Screen Sharing Security, (Mon, Aug 17th) - SANS Internet Storm Center, InfoCON: green
- Check Point Research identifies BTR Reforged technique targeting Microsoft Windows drivers (2026-08-21 to 2026-08-22, 2 outlets, severity 2/5)
- Salesforce Malware Scanner Flaws Allow Attackers to Test Bypasses (2026-08-24, 1 outlet, severity 2/5)
- Salesforce gave every org the same free scanner. Attackers already know what it misses. - Cybersecurity Dive - Latest News
- Microsoft removes WMIC from Windows 11 to thwart cybercriminals' tactics (2026-08-18, 1 outlet, severity 2/5)
- Microsoft starts removing WMIC tool used by cybercriminals - BleepingComputer
- Securing Windows Named Pipes to Prevent Privilege Escalation (2026-08-23, 1 outlet, severity 2/5)
- Named Pipes Under Attack: Securing Windows Interprocess Communication - BleepingComputer
Data Breaches
- Latvia's CSDD Officials Resign After 1.2 Million People's Data Leaked (2026-08-20, 1 outlet, severity 4/5)
- Latvian officials resign after cyberattack exposes data on 1.2 million people - The Record from Recorded Future News
- T-Mobile Cuts Cables and Sakura Internet Suffers Major Breach (2026-08-22, 1 outlet, severity 4/5)
- Threat Actor Exposes SafePal Customer Data via Order-Tracking Plug-in Flaw (2026-08-18, 2 outlets, severity 3/5)
- SafePal latest crypto hardware wallet maker affected by breach, with nearly 40,000 impacted - The Record from Recorded Future News
- SafePal Hardware Wallet Maker Says Flaw Exposed Data of Nearly 40,000 Customers - The Hacker News
- Third-party software vulnerability causes data breach at Hospital for Sick Children (2026-08-22, 2 outlets, severity 3/5)
- SickKids data breach exposes employee and job applicant info - BleepingComputer
- Canada’s Hospital for Sick Children attacked by cybercriminals again as employee data stolen - The Record from Recorded Future News
- Sakura Internet Hack Exposes Data of 1.36 Million Accounts (2026-08-20, 1 outlet, severity 3/5)
- Sakura Internet hack exposes data of up to 1.36 million accounts - BleepingComputer
- TheHatman Claims Theft of 3.6 Million Azure Account Records (2026-08-18, 1 outlet, severity 3/5)
- Hacker claims 3.6 million Azure account records stolen from major companies - BleepingComputer
- French Tax Authority Breach Exposes Data of 680,000 People (2026-08-18, 1 outlet, severity 3/5)
- 680,000 Impacted by French Tax Authority Data Breach - SecurityWeek
- Genetic Testing Firm Reports Hack of Sensitive Patient Data (2026-08-18, 1 outlet, severity 3/5)
- Major genetic-testing firm says hack compromised sensitive patient data - Cybersecurity Dive - Latest News
- CEVA Logistics Breach Exposes Pokémon Center and Valve Customer Data (2026-08-18, 1 outlet, severity 3/5)
- Pokémon Center data breach exposes customer info, cancels some orders - BleepingComputer
- ClarityCheck Exposed 9 Million Facial Images in Unsecured Database (2026-08-21, 1 outlet, severity 3/5)
- Sri Lankan Government Joins Have I Been Pwned Service (2026-08-23, 1 outlet, severity 2/5)
Ransomware
- Medusa Ransomware Gang Breaches Over 500 US Critical Infrastructure Organizations (2026-08-19, 3 outlets, severity 4/5)
- CISA: Medusa ransomware hit over 500 critical infrastructure orgs - BleepingComputer
- Medusa ransomware tallies hundreds of new victims, says updated advisory on group’s tactics - CyberScoop
- More than 200 victims of Medusa ransomware identified over the last year, CISA says - The Record from Recorded Future News
- Youth-Led Ransomware Extortion Triggers Surge in Class Action Lawsuits (2026-08-18, 1 outlet, severity 3/5)
- Weekly Update 517: Cyber Ransoms - Troy Hunt
- U.S. Bancorp Denies Direct Breach Following LockBit Ransomware Claims (2026-08-22, 1 outlet, severity 2/5)
- U.S. Bank says breach claims related to fourth-party incident - The Record from Recorded Future News
- Black Kite: Medium-Sized Firms Face Majority of Ransomware Attacks (2026-08-20, 1 outlet, severity 2/5)
- Ransomware disproportionately targets medium-sized firms, straining customer relationships - Cybersecurity Dive - Latest News
- UT San Antonio Takes Systems Offline Following Cyberattack (2026-08-19, 1 outlet, severity 2/5)
- University of Texas forced to take systems offline in San Antonio after cyberattack - The Record from Recorded Future News
Supply Chain Attacks
- ChainDrop npm Worm Targets SDLC and CI/CD Pipelines (2026-08-22, 1 outlet, severity 4/5)
- MoYu Group Targets DoFun Automotive Head Units via Supply-Chain Attack (2026-08-21 to 2026-08-23, 3 outlets, severity 3/5)
- The invisible passenger in your car - Securelist
- Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnet - The Hacker News
- Hackers infect Android car head units with proxy botnet malware - BleepingComputer
- RubyGems Typosquatting Campaign Steals Browser Credentials and Crypto Wallets (2026-08-18, 1 outlet, severity 3/5)
- RedC2 4.0 Linux Backdoor Spread via Trojanized npm Packages (2026-08-22, 1 outlet, severity 3/5)
Nation-State / APT
- Russian Hackers Use Google OAuth and WhatsApp to Hijack Accounts (2026-08-21, 1 outlet, severity 4/5)
- Iran-Linked Hackers Shut Down UK Power Plant for Days (2026-08-24, 1 outlet, severity 4/5)
- Iran-Linked Hackers Shut Down UK Power Plant for Four Days - SecurityWeek
- Cavern C2 Uses Google Apps Script to Mask Iranian Attacks (2026-08-18, 1 outlet, severity 3/5)
- Transparent Tribe Targets Afghan Telecom With New Patchcord Malware (2026-08-21, 1 outlet, severity 3/5)
- Ukraine's ARMA Targeted in Cyberattack Over Seized Russian Assets (2026-08-19, 1 outlet, severity 3/5)
- Hackers target Ukrainian agency managing assets seized from sanctioned Russians - The Record from Recorded Future News
- Berlin Disconnects Two State Ministries Following Security Breach (2026-08-19, 1 outlet, severity 3/5)
- Berlin cuts two state ministries off government network after security breach - The Record from Recorded Future News
- Microolap Confirms Cyberattack Claimed by Pro-Ukraine Group Black Spark (2026-08-22, 1 outlet, severity 2/5)
- Russian network monitoring firm confirms cyberattack claimed by pro-Ukraine hackers - The Record from Recorded Future News
- AI and Infostealers Drive Modern Corporate and State Surveillance (2026-08-21, 1 outlet, severity 1/5)
Malware & Botnets
- StopAndProtect compromised WordPress websites to target Windows users with malware (2026-08-19 to 2026-08-20, 2 outlets, severity 4/5)
- Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect - Check Point Research
- StopAndProtect Uses Nearly 2,000 Hacked WordPress Sites to Spread Malware and Steal Data - The Hacker News
- Manic Android malware targets users in Ukraine, Russia, U.K., and Europe (2026-08-20 to 2026-08-21, 2 outlets, severity 3/5)
- STAC4749 Uses TwinLoot Malware to Target Microsoft Services for Credentials (2026-08-19, 2 outlets, severity 3/5)
- ToxicPanda Android Malware Blocks Google Play via VPN Permissions (2026-08-24, 1 outlet, severity 3/5)
- ToxicPanda Android malware uses VPN permissions to block Google Play - BleepingComputer
- ToxicPanda and GoldDigger Expand Android Banking and Crypto Attacks (2026-08-21, 1 outlet, severity 3/5)
- Grandoreiro Banking Trojan Targets Mexico in New Malware Campaign (2026-08-21, 1 outlet, severity 3/5)
- 'Grandoreiro' Malware Resurfaces With Mexico Campaign - darkreading
- E4del and PINHOLE Malware Abuse FTP Banners for Delivery (2026-08-22, 1 outlet, severity 3/5)
- Hackers abuse FTP server banners to deliver new Windows malware - BleepingComputer
- Manic, Grandoreiro, and ToxicPanda 2.0 Banking Trojans Target Global Users (2026-08-22, 1 outlet, severity 3/5)
- DOUBLECUP Hides PowerShell Payloads Inside PNG Image Files (2026-08-24, 1 outlet, severity 3/5)
- DOUBLECUP's PNG Payload, (Mon, Aug 24th) - SANS Internet Storm Center, InfoCON: green
- Evooo1Bot Expands Beyond DDoS to Theft and Persistent Access (2026-08-18, 1 outlet, severity 3/5)
- Picus Security Report: Mimikatz Behavior Often Bypasses Prevention Controls (2026-08-19, 1 outlet, severity 2/5)
- Your Controls Block Known Attacks. What About the Behavior? - BleepingComputer
- Microsoft Links 30+ Domains to MacSync Stealer Infrastructure (2026-08-19, 1 outlet, severity 2/5)
- Microsoft Links 30+ Rotating Domains to MacSync Stealer Infrastructure - The Hacker News
Phishing & Social Engineering
- Microsoft Teams and Slack Exploited for Identity Phishing Campaigns (2026-08-20, 1 outlet, severity 4/5)
- Attackers Compromise Housing Authority Email Accounts to Reroute Wire Transfer (2026-08-21 to 2026-08-22, 1 outlet, severity 3/5)
- Calling on Cyber Pros to Help Defend City Hall - darkreading
- Calling on Cyber Pros to Help Defend City Hall - darkreading
- Ransom Busters Poses as Recovery Firm to Defraud Victims (2026-08-20, 1 outlet, severity 3/5)
- Rogue ransomware affiliate poses as recovery firm to steal payments - BleepingComputer
- SynkLoader Malware Spreads via Microsoft Teams Phishing Campaigns (2026-08-22, 1 outlet, severity 3/5)
- New SynkLoader malware pushed in Microsoft Teams phishing campaign - BleepingComputer
- Wrong-Number Texts Sell Responsive Targets on Dark Web (2026-08-19, 1 outlet, severity 3/5)
- Your polite reply to that text is worth $2 on the dark web - Malwarebytes
- Delta Flight Wi-Fi Phishing Attack Sparks Federal Investigation (2026-08-21, 1 outlet, severity 3/5)
- What We Missed: Delta Flight Disrupted With Wi-Fi Hack - darkreading
- Download Studio Sites Use Deceptive Links to Trick Users (2026-08-20, 1 outlet, severity 2/5)
- Fake Crypto AML Checkers Used to Drain User Wallets (2026-08-20, 1 outlet, severity 2/5)
- Kaseya Urges MSPs to Use Behavioral Monitoring Against AI Phishing (2026-08-21, 1 outlet, severity 1/5)
- How MSPs can catch phishing attacks email filters miss - BleepingComputer
Cloud & Infrastructure Security
- Unauthorized Party Steals Data From Heights Finance Cloud Based Platform (2026-08-18, 3 outlets, severity 3/5)
- Nearly 750k had financial info, SSNs leaked in South Carolina loan company breach - The Record from Recorded Future News
- Heights Finance Data Breach Impacts at Least 1.2 Million Individuals - SecurityWeek
- Heights Finance data breach: What customers need to know - Malwarebytes
- CDN Tsunami Exploits HTTP/3 Translation for 350x DoS Amplification (2026-08-21, 1 outlet, severity 3/5)
- Google Docs "Anyone With Link" Settings Cause Major Data Leaks (2026-08-18, 1 outlet, severity 3/5)
- GitHub Suffers Worldwide Outage Affecting API and Authentication Services (2026-08-18, 1 outlet, severity 3/5)
- Microsoft confirms GitHub is down worldwide - BleepingComputer
- Cloudflare Mitigates Spectre Attack Leaking Worker JWTs (2026-08-20, 1 outlet, severity 2/5)
- OpenAI Outage Disrupts ChatGPT Logins and API Services (2026-08-20, 1 outlet, severity 2/5)
- OpenAI confirms ChatGPT is down as logins and signups fail - BleepingComputer
- Prevalent AI Raises $22 Million to Expand Data Fabric Platform (2026-08-20, 1 outlet, severity 1/5)
- Microsoft Fixes Search Outage Across Microsoft 365 Applications (2026-08-18, 1 outlet, severity 1/5)
- Microsoft confirms outage affecting search in Microsoft 365 apps - BleepingComputer
- UniFi Hardware Powers Secure Residential IoT Door Lock Setup (2026-08-24, 1 outlet, severity 1/5)
Identity & Access Management
- City Forum Campaign Scrapes Salesforce and ServiceNow Customer Portals (2026-08-18, 1 outlet, severity 4/5)
- Unit 42 Warns of FortiBleed and TheHatman Credential Attacks (2026-08-19, 1 outlet, severity 4/5)
- Huntress Reports 155x Surge in Azure CLI Password Spraying (2026-08-20, 1 outlet, severity 3/5)
- Password spraying attacks surge 155x as hackers exploit MFA gaps - BleepingComputer
- Leaked AWS Keys Grant Full Control Over Corporate Accounts (2026-08-22, 1 outlet, severity 3/5)
- Hundreds of leaked AWS keys give full control over corporate accounts - BleepingComputer
- iAuthFlow V2 Toolkit Uses Passkeys to Bypass Password Resets (2026-08-22, 1 outlet, severity 3/5)
- PowerShell Scripts Detect Entra Login Password Spray Attacks (2026-08-21, 1 outlet, severity 2/5)
- Even MOAR Powershell, looking at Entra logins - the good, the bad and the password sprays, (Fri, Aug 21st) - SANS Internet Storm Center, InfoCON: green
- SANS PowerShell Script Identifies Users Missing MFA Registration (2026-08-21, 1 outlet, severity 1/5)
- Who Got Missed in the MFA Rollout? More Powershell + Graph + Entra scripting!, (Fri, Aug 21st) - SANS Internet Storm Center, InfoCON: green
- Microsoft Graph and PowerShell Guide for Cleaning Stale Accounts (2026-08-21, 1 outlet, severity 1/5)
- Using Microsoft Graph and Powershell to Mine for Information - Stale Accounts and Licenses, (Thu, Aug 20th) - SANS Internet Storm Center, InfoCON: green
- Anonyome Labs’ MySudo App Uses Digital Personas for Privacy (2026-08-22, 1 outlet, severity 1/5)
- Is Online Privacy Possible? How Digital Identities Can Help - BleepingComputer
AI & Machine Learning Security
- Adversa AI finds Cryptographic Context Injection vulnerability in Grok and Gemini (2026-08-21 to 2026-08-22, 2 outlets, severity 4/5)
- OpenAI Tightens Security After Models Breach Hugging Face (2026-08-22, 1 outlet, severity 4/5)
- OpenAI Adds Controls That Should've Been There Already - darkreading
- OWASP Releases Top 10 Security Risks for Agentic AI Skills (2026-08-22, 1 outlet, severity 3/5)
- OWASP Flags Top AI Skill Risks in New Security Blueprint - darkreading
- OpenAI Pauses Frontier RL Training to Strengthen AI Safety (2026-08-20, 1 outlet, severity 3/5)
- OpenAI Launches ChatGPT for Teens With Safety and Study Tools (2026-08-21, 1 outlet, severity 3/5)
- ChatGPT for Teens tackles risky chats and homework shortcuts - Malwarebytes
- Gartner Survey: Most Audit Leaders Use AI Without Strategy (2026-08-21, 1 outlet, severity 3/5)
- Most Audit Leaders Are Using AI; Few Have a Strategy for It - Corporate Compliance Insights
- Meta Data Exposure Highlights Risks of "Shady AI" Usage (2026-08-21, 1 outlet, severity 3/5)
- Why "Shady AI" is Security's Next Big Governance Problem - The Hacker News
- Anthropic Researchers Find Claude Models Create Self-Replicating AI Mind Viruses (2026-08-18 to 2026-08-19, 2 outlets, severity 2/5)
- Rapid7: AI-Driven Vulnerability Surge Outpaces Traditional Patching Models (2026-08-19, 1 outlet, severity 2/5)
- Twitch Users Urged to Opt Out of Amazon AI Training (2026-08-21, 1 outlet, severity 2/5)
- Kriminal AI Platform Offers Guardrail-Free Tools for Cybercrime (2026-08-20, 1 outlet, severity 2/5)
- AI Agents Fight AI Agents in New Phishing 3.0 Era (2026-08-20, 1 outlet, severity 2/5)
- Phishing 3.0: The Fight Moves to Agent Versus Agent - The Hacker News
- CUSTODY Framework Constrains AI Agents to Prevent Network Breaches (2026-08-21, 1 outlet, severity 2/5)
- NIST Launches TEVV-Athlon Framework for Flexible AI System Evaluation (2026-08-22, 1 outlet, severity 2/5)
- NIST Is Offering a New AI Evaluation Framework, Not Another Compliance Checklist - Corporate Compliance Insights
- Adam Shostack Discusses Hugging Face Attack and PHANTOM-B Model (2026-08-18, 1 outlet, severity 2/5)
- Adam Shostack Talks Hugging Face & PHANTOM-B - darkreading
- Google AI Robot Dog Jailbroken via Pokemon Trickery (2026-08-20, 1 outlet, severity 2/5)
- Smashing Security podcast #481: Never say this to a robot dog - GRAHAM CLULEY
- AI Vulnerability Clearinghouse Faces Skepticism and Major Challenges (2026-08-18, 1 outlet, severity 1/5)
- AI-powered vulnerability clearinghouse faces deep skepticism, major challenges - Cybersecurity Dive - Latest News
- XBOW CISO Nico Waisman on AI-Driven Autonomous Penetration Testing (2026-08-19, 1 outlet, severity 1/5)
- AI Accelerates Vulnerability Weaponization, Requiring New Application Security Strategies (2026-08-24, 1 outlet, severity 1/5)
- Rethinking Application Security for the AI Era - SecurityWeek
- Fortinet Acquires Virtue AI to Boost AI Security Governance (2026-08-18, 1 outlet, severity 1/5)
- Fortinet Acquires AI Security Company Virtue AI - SecurityWeek
- Anthropic Expands Mythos 5 Access and Launches $35M Fund (2026-08-24, 1 outlet, severity 1/5)
- Xpander Raises $7.5 Million for AI Management and Governance (2026-08-18, 1 outlet, severity 1/5)
- Xpander Raises $7.5 Million for AI Management and Governance - SecurityWeek
- Wazuh Integrates AI to Automate SOC Threat Detection and Response (2026-08-22, 1 outlet, severity 1/5)
- Wazuh and AI For Enhanced SOC Workflows - The Hacker News
Legal & Law Enforcement
- TikTok and ByteDance Settle COPPA Lawsuit With DOJ and FTC (2026-08-23 to 2026-08-24, 2 outlets, severity 3/5)
- Kyle William Spitze Gets 77 Years for 764 Network Crimes (2026-08-21, 1 outlet, severity 3/5)
- Cameron Curry Gets 24 Months for Extorting Brightly Software (2026-08-19, 1 outlet, severity 3/5)
- Ukrainian Developer Faces 12 Years in Swiss Ransomware Trial (2026-08-18, 1 outlet, severity 3/5)
- Ukrainian software developer faces 12 years in Swiss ransomware trial - The Record from Recorded Future News
- Budget and Leadership Gaps Hinder Local Cyber Policing Training (2026-08-21, 1 outlet, severity 2/5)
- Wyden and Casar Seek GAO Review of Federal Hacking (2026-08-22, 1 outlet, severity 2/5)
- Wiggin and Dana Offer Guide for Congressional Subpoena Preparation (2026-08-18, 1 outlet, severity 1/5)
- So You’ve Been Subpoenaed by Congress? How to Prepare for Lawmakers’ Grilling - Corporate Compliance Insights
Policy & Regulation
- Defense Contractors Face Legal Exposure Due to CMMC 2.0 Score Gaps (2026-08-21 to 2026-08-22, 2 outlets, severity 3/5)
- Contractors’ CMMC Confidence Rises as Ability to Prove It Falls Behind - SecurityWeek
- Defense contractors’ CMMC confidence lags, even as self-assessments improve - Cybersecurity Dive - Latest News
- Senators Question TikTok Over Disabling Safety Features for Users (2026-08-21, 1 outlet, severity 3/5)
- Senators press TikTok over withholding of safety features for some users - The Record from Recorded Future News
- FinCEN Exempts Most U.S. Entities From CTA Reporting Rules (2026-08-20, 1 outlet, severity 3/5)
- Has the CTA Saga Finally Ended? - Corporate Compliance Insights
- UK Financial Services Shift Toward Named AI Accountability (2026-08-22, 1 outlet, severity 3/5)
- AI Governance Is Becoming a Named Accountability - Corporate Compliance Insights
- Lawmakers Seek GAO Probe Into CISA Staffing Cuts (2026-08-22, 1 outlet, severity 2/5)
- Lawmakers call for investigation into impact of CISA staffing cuts - The Record from Recorded Future News
- CORCA Bill Sparks Fears of Expanded Government Surveillance (2026-08-21, 1 outlet, severity 2/5)
- ARI Urges U.S. to Designate AI as Critical Infrastructure (2026-08-21, 1 outlet, severity 2/5)
- NIST Issues Cybersecurity Guidance for Building Automation and Control Systems (2026-08-20, 1 outlet, severity 2/5)
- NIST Releases Tips & Tactics for Building Automation & Control System Cybersecurity - Cybersecurity Insights
- Congressional Transcribed Interviews Pose Risks for Non-Governmental Actors (2026-08-18, 1 outlet, severity 1/5)
- As Midterms Approach, Specter of Transcribed Interviews Rises for Non-Governmental Actors - Corporate Compliance Insights
- Speeki, Napier AI, and Descartes Launch New GRC Tools (2026-08-22, 1 outlet, severity 1/5)
- GRC News Roundup: Speeki, Napier AI, Descartes & More - Corporate Compliance Insights
Other Cybersecurity
- Check Point Reports Ransomware, AI Threats, and Critical Patches (2026-08-18, 1 outlet, severity 4/5)
- 17th August – Threat Intelligence Report - Check Point Research
- Zombie Card Attack Revives Expired Visa Cards for Payments (2026-08-21, 1 outlet, severity 3/5)
- Shasta County Seeks to Hire Convicted Official Tina Peters (2026-08-20, 1 outlet, severity 3/5)
- noRecognition Model Hides Vehicles From Flock Surveillance Cameras (2026-08-18, 1 outlet, severity 3/5)
- Xfinity WiFi Motion Detects Home Movement Without Using Cameras (2026-08-19, 1 outlet, severity 2/5)
- Comcast turns your Xfinity WiFi into a home motion detector - BleepingComputer
- Crime Script Analysis Simplifies Cyber Attack Narratives for Defenders (2026-08-19, 1 outlet, severity 2/5)
- Describing attacks with crime script analysis - Cisco Talos Blog
- Fitch: Water and Healthcare Sectors Must Bolster Cyber Resilience (2026-08-21, 1 outlet, severity 2/5)
- Fitch explains how water, healthcare organizations can keep strong credit ratings, despite cyberattacks - Cybersecurity Dive - Latest News
- Android's New Advanced Flow Adds Friction to App Sideloading (2026-08-20, 1 outlet, severity 2/5)
- USPS Finalizes Mail Ballot Rules Ahead of SCOTUS Ruling (2026-08-23, 1 outlet, severity 1/5)
- CBP Pauses "Smart Wall" Road Construction in Big Bend Park (2026-08-21, 1 outlet, severity 1/5)
- Microsoft Adds Classic Theme to New Outlook for Windows (2026-08-22, 1 outlet, severity 1/5)
- Microsoft rolls out Classic Outlook theme for New Outlook users - BleepingComputer
- Ex-NSA Director Paul Nakasone Launches National Security Advisory Firm (2026-08-22, 1 outlet, severity 1/5)
- Declassified' Docuseries Reveals CISOs' Struggles and Cybersecurity Heists (2026-08-19, 1 outlet, severity 1/5)
- CISOs Break Their Silence in 'Declassified' Docuseries - darkreading
- ISC Stormcast Reports Green Threat Level for August 21 (2026-08-21, 1 outlet, severity 1/5)
- ISC Stormcast For Friday, August 21st, 2026 https://isc.sans.edu/podcastdetail/10062, (Fri, Aug 21st) - SANS Internet Storm Center, InfoCON: green
- ISC Stormcast Reports Green Threat Level for August 20 (2026-08-20, 1 outlet, severity 1/5)
- ISC Stormcast For Thursday, August 20th, 2026 https://isc.sans.edu/podcastdetail/10060, (Thu, Aug 20th) - SANS Internet Storm Center, InfoCON: green
- ISC Stormcast Report: Threat Level Green for August 19 (2026-08-19, 1 outlet, severity 1/5)
- ISC Stormcast For Wednesday, August 19th, 2026 https://isc.sans.edu/podcastdetail/10058, (Wed, Aug 19th) - SANS Internet Storm Center, InfoCON: green
- ISC Stormcast Report: Threat Level Green for August 18 (2026-08-18, 1 outlet, severity 1/5)
- ISC Stormcast For Tuesday, August 18th, 2026 https://isc.sans.edu/podcastdetail/10056, (Tue, Aug 18th) - SANS Internet Storm Center, InfoCON: green
- ISC Stormcast Reports Green Threat Level for August 24 (2026-08-24, 1 outlet, severity 1/5)
- ISC Stormcast For Monday, August 24th, 2026 https://isc.sans.edu/podcastdetail/10064, (Mon, Aug 24th) - SANS Internet Storm Center, InfoCON: green
Reported Data Breaches
Breaches reported via Have I Been Pwned this period.