Black Arrow Cyber Threat Intelligence Briefing 21 August 2026
Welcome to this week’s Black Arrow Cyber Threat Intelligence Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Executive Summary
While many organisations need to fulfil regulatory requirements for cyber security, it is important to ensure that the choices made not only help prevent a cyber incident from occurring, but also enable the organisation to continue operating while an incident is being investigated and managed.
We highlight the need for cyber resilience in our review this week, alongside insights on the developing tactics of attackers, including exploiting gaps in multi-factor authentication and repurposing older domains with an established reputation and using them to deliver malicious software.
We discuss how attackers are exploiting vulnerabilities in security appliances to enter organisations, and how they use techniques to avoid detection and to identify the systems and business information most valuable to target, again underlining the need for resilience planning. We also share information on an emerging ransomware tactic, where a suspected attacker later poses as an expert who can help the victim recover from the attack.
As cyber risks continue to develop, including through the use of AI, business leaders need to focus not only on preventing attacks but also on ensuring the organisation can continue operating when an incident occurs. This resilience requires effective governance across people, operations and technology, with controls proportionate to the organisation and its risks. Contact us to discuss how we help leadership teams strengthen their cyber security and resilience.
Top Cyber Stories of the Last Week
Why Compliance Does Not Guarantee Cyber Resilience
Compliance frameworks provide an important security baseline, but passing an audit or holding a certification does not prove that an organisation can keep critical services running during serious disruption. Documented controls may exist without showing how systems, people, suppliers and recovery arrangements will perform under pressure. Scenario-based exercises can expose hidden dependencies, unclear responsibilities and unrealistic recovery assumptions before a real incident occurs. For business leaders, the key is to test whether controls deliver the intended outcomes in practice, rather than treating documented compliance as sufficient evidence of resilience.
https://www.itsecurityguru.org/2026/08/19/why-compliance-does-not-guarantee-cyber-resilience/
Infostealers Harvest 1.7 Billion Credentials in Six Months
Flashpoint recorded 7.4 million devices infected with information-stealing malware in the first half of 2026, up 27% on the previous six months, with 1.7 billion login credentials stolen. The firm also tracked 21,667 software vulnerabilities, an 8% increase, although only 239 were being actively exploited. Malicious use of AI is also growing, with more than 22 million related posts identified across illicit online channels. Ransomware activity rose sharply too, with 6,256 victims recorded, a 45% increase, highlighting how automation, cheaper initial access and established ransomware-as-a-service operations are increasing the scale of ransomware activity.
https://www.infosecurity-magazine.com/news/infostealers-17-billion/
Password Spraying Attacks Surge 155x as Hackers Exploit MFA Gaps
Huntress has recorded a 155-fold increase in password spraying attacks during the first half of 2026, including more than 81 million login attempts and 78 compromised accounts in just two weeks. Attackers combined previously stolen passwords with older sign-in methods that can bypass multi-factor authentication when security policies are not applied consistently. Of 23 affected organisations analysed, eight had no multi-factor authentication, while the remaining 15 had gaps that excluded certain users, applications or sign-in methods. The findings highlight the importance of applying strong authentication controls consistently across all cloud access.
Crooks Are Buying Your Expired Domains and Using Them to Deliver Malware
Attackers are buying expired internet domains to exploit the trust and traffic that was built under previous owners. Infoblox found that around 65,000 expired domains are re-registered every day, accounting for nearly 20% of new registrations in the first half of 2026. One criminal operation reportedly spent almost $7 million on more than 10,000 expired domains, using them for unauthorised sports-streaming sites, betting promotion and systems supporting malware. Because expired domains can continue receiving web traffic, appear in stored search results and benefit from an established reputation, organisations should recognise that a familiar or long-established domain is not necessarily a safe one.
UK Cyberattacks Jump 26% Year-on-Year as Ransomware Activity Doubles Globally
UK organisations faced an average of 1,597 cyberattacks per week in July 2026, up 26% year-on-year and growing faster than the global rate of 16%. Ransomware also surged globally, with 964 reported victims, an 87% annual increase. At the same time, generative AI is creating new data risks, with one in 36 prompts from business networks carrying a high risk of exposing sensitive information and high-risk activity identified in 88% of organisations that regularly use these tools. For business leaders, the findings support maintaining defences across networks, cloud services, endpoints, email and AI use rather than relying on one layer.
Your Security Appliances Are the Attack Surface
Security and networking appliances such as firewalls and VPN gateways are becoming an increasingly attractive route into organisations. Google tracked 21 previously unknown vulnerabilities targeting these products in 2025, while they accounted for over 25% of newly recorded actively exploited vulnerabilities in the first half of 2026. 75 known weaknesses in security appliances have also been linked to ransomware campaigns. The risk is heightened because these devices are internet-facing, highly trusted and often difficult to monitor, meaning a compromise can provide attackers with significant access while remaining largely invisible to existing security controls.
https://securityboulevard.com/2026/08/your-security-appliances-are-the-attack-surface/
Stealthy Attacks: How to Protect Your Business
Attackers are increasingly favouring stealth over disruptive malware, using stolen credentials and legitimate business tools to move through systems without raising alarms. Research found critical Microsoft vulnerabilities doubled year-on-year from 78 to 157, while flaws exposing sensitive information rose by 73%. Privilege escalation, where attackers gain higher levels of access, accounted for 40% of disclosed issues. With Microsoft fixing 570 vulnerabilities in July alone, organisations face growing pressure to prioritise risk. Strong access controls, multi-factor authentication, continuous monitoring and effective patch management remain essential to limiting the impact of these quieter cyberattacks.
https://insight.scmagazineuk.com/stealthy-attacks-how-to-protect-your-business
Attackers Turn to AI for Help Identifying Files Worth Stealing
Gambit Security has identified several cases where cyber attackers used artificial intelligence to support attacks, from creating malicious tools and harvesting credentials to identifying which business data was most valuable to steal. In one case, AI helped a suspected ransomware operator assess systems across six organisations and prioritise production databases, client documents and backups. Separately, a credential-harvesting operation used a tool developed with AI to collect 2,975 valid keys and credentials from 1,742 victim systems in under two months. For organisations, the cases show that AI can assist attackers with both technical tasks and identifying the business information most worth targeting.
https://www.helpnetsecurity.com/2026/08/18/gambit-security-ai-cyberattack-tools-report/
Rogue Ransomware Affiliate Poses as Recovery Firm to Steal Payments
Security researchers have identified a suspected ransomware affiliate posing as a recovery firm and approaching victims before attacks become public, claiming it could provide decryption keys and seeking $20,000 to $60,000 to delete stolen data from servers controlled by the ransomware group. Evidence suggests the same individual or group may be behind both the original ransomware attacks and the subsequent recovery offers, creating an additional route to profit. The activity raises concerns that growing distrust among the criminal parties involved in ransomware operations could expose victims to multiple parties seeking payment, while providing no guarantee that stolen data will remain confidential even after a ransom is paid.
The 80% Problem: Why AI Resilience Is More Important Than Ever
AI is now embedded in daily business operations, with ISACA finding that 82% of European companies permit its use at work. Governance has not kept pace, as only 42% have a formal AI policy and 20% do not know who would be accountable if an AI system caused harm. With Microsoft Copilot used by 80% of organisations adopting AI, reliance on a single provider creates operational risk. For business leaders, this makes advance planning for AI outages important, including clear ownership and an agreed alternative for critical work.
UK Fraud Cases Hit Record High in 2026
The National Fraud Database recorded more than 220,000 cases in the first half of 2026, its highest total for that period. Identity fraud rose 9% to nearly 130,000 cases and now accounts for three-fifths of all filings, while account-takeover incidents increased 5%. SIM-swap fraud, where criminals transfer a victim’s mobile number to another SIM card to intercept calls and messages, rose 402% to more than 4,100 cases. Money-muling cases also rose 69%, with people under 30 accounting for 57%, reinforcing the importance of fraud education, awareness and prevention for younger people.
https://www.infosecurity-magazine.com/news/uk-fraud-cases-hit-record-high/
How CSOs Can Turn Cyber Security into a Business Growth Strategy
Cyber security is a business enabler rather than simply a defensive function. As organisations adopt AI, modernise infrastructure and expand digital operations, Chief Security Officers (CSOs) have an opportunity to shape investment and transformation decisions from the outset. Building security into new initiatives early can reduce costly changes, improve operational resilience and make secure working easier for employees. Measuring success should also extend beyond preventing incidents to how quickly the organisation can recover and maintain critical services when disruption occurs, helping cyber security support innovation, productivity and growth.
Threats
Ransomware, Extortion and Destructive Attacks
Three-quarters of Ransomware Attacks Target Mid-Market Firms - Infosecurity Magazine
UK Cyber Attacks Jump 26% Year-on-Year as Ransomware Activity Doubles Globally - IT Security Guru
Law Firms Increasingly Targeted By Ransomware/Vishing Attacks - Security Boulevard
Cl0p Ransomware Group Names Over 40 Victims of PTC Windchill Campaign - SecurityWeek
The long tail of Clop’s PTC hack is just beginning to emerge | CyberScoop
27M records allegedly stolen via misconfigured Microsoft portals | Cybernews
Akira Ransomware Uses Safe Mode to Bypass EDR
Ransomware gang crashes own attack — with no-one to blame but themselves | TechRadar
CISA: Windows Task Host flaw now exploited by ransomware gangs
Rogue ransomware affiliate poses as recovery firm to steal payments
Storm-1175 Replaces Medusa With New StormEncryptor Ransomware
Data analyst sent to prison for stealing data, extorting employer
Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk-Derived Ransomware
Prison for data analyst who tried to extort $2.5 million from his employer
Ransomware and Destructive Attack Victims
Cl0p Ransomware Group Names Over 40 Victims of PTC Windchill Campaign - SecurityWeek
Clop-Linked Windchill Web Shell Decrypts Credentials and Maps Engineering Data
The long tail of Clop’s PTC hack is just beginning to emerge | CyberScoop
Hacking group claims mass data theft from Shell, Philips, GE, Fiserv and dozens of others | Reuters
Multiple organisations investigating fresh wave of Cl0p breaches | Computer Weekly
CISA: Medusa ransomware hit over 500 critical infrastructure orgs
Researchers Confirm ExfilSquad’s Access to Sensitive Data - Infosecurity Magazine
European nation rocked by major hacker attack: “largest data leak in history” | Cybernews
Details emerge on BlackFile's recent attacks on financial companies | CyberScoop
Co-op chief digital and technology officer resigns | Retail Week
Ransom Busters Claims It Hacked Ransomware Servers, Asks Victims for Up to $60,000
BMW hit by ransomware attack, allegedly breaching motorcycle data | Cybernews
Other Social Engineering
Law Firms Increasingly Targeted By Ransomware/Vishing Attacks - Security Boulevard
How QR-code phishing can slip past corporate security measures
MaaS Campaign Combines ClickFix, ErrTraffic and Cruciferra - Infosecurity Magazine
Novel macOS Infostealer AmnesiaStealer Spread via ClickFix - Infosecurity Magazine
Burnham messaged person posing as Trump’s chief of staff
Your polite reply to that text is worth $2 on the dark web | Malwarebytes
Hackers want your nudes. Here’s how to keep your privates, private | PCWorld
2FA/MFA
Password spraying attacks surge 155x as hackers exploit MFA gaps
AML/CFT/Money Laundering/Terrorist Financing/Sanctions
Artificial Intelligence
A hollowed out data layer is making CISOs fly blind into AI attacks - Help Net Security
AI is making fraud harder to spot and identity harder to prove - Help Net Security
80% of Organizations Experienced AI or Cybersecurity Incidents
AI’s ‘middle class’ has gotten dramatically better at hacking | CyberScoop
Governance Gap: AI Accountability Crisis
Fake Evidence: How Generative AI Is Changing Fraud
Attackers turn to AI for help identifying files worth stealing - Help Net Security
The 80% Problem: Why AI resilience is more important than ever - IT Security Guru
NCSC CTO calls for strong AI safeguards | UKAuthority
Irregular says ‘human oversight’ responsible for AI sandbox escape incidents | CyberScoop
Turf War Between Claude Agents Leads to Self-Replicating Malware
Citizen developers are becoming a security problem | perspective | MSSP Alert
Anthropic sees AI risks rising, no plan to release stronger "Model 2"
ChatGPT’s new feature could give infostealers a map of your Mac activity - Help Net Security
The 'Industrial Accidents' Behind Rogue AI Attacks
No-Filter 'Kriminal' AI Platform Raises Cybercrime Concerns
AI Is Calling In Cybersecurity's Technical Debt
LiteLLM Supply-Chain Attack - Technology, Banking and Healthcare the Most Affected
153GB of stolen credentials surface after LiteLLM supply chain attack - Help Net Security
Invisible AI Prompts Trigger Court Sanctions - Security Affairs
How Cybercriminals Are Weaponizing Frontier AI Models Like Grok
Rise of Malicious AI Skills Expands Enterprise Risk
UK Legal Regulator Raises AI Misuse Concerns - Infosecurity Magazine
Copilot tricked into telling reseachers how to hack itself
Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps
Abnormal AI CEO Says the Age of AI Attacks Is Forcing a Rethink of Cybersecurity - Benzinga
OpenAI unveils ChatGPT for Teens with stronger guardrails to tackle safety risks | Reuters
Bots/Botnets
New Mirai-Based Linux Botnet ‘Evooo1Bot’ Turns Victims Into Proxies - Infosecurity Magazine
Botnets Based on the Notorious Mirai Code Continue to Emerge - Security Boulevard
Linux Botnet Evooo1Bot Expands Mirai Capabilities Beyond DDoS
Careers, Roles, Skills, Working in Cyber and Information Security
CISOs Break Their Silence in 'Declassified' Docuseries
A Realistic Path Into Remote Cybersecurity Jobs - DevX
Multiple Suicides Reported in US Cyber Operations Forces | Security Magazine
Cloud/SaaS
27M records allegedly stolen via misconfigured Microsoft portals | Cybernews
Hacker claims 3.6 million Azure account records stolen from major companies
Crook hawks millions of records allegedly plundered from corporate Azure tenants
New malware turns Microsoft 365 and Azure into its control center – Computerworld
Weak IAM affects up to 98% of cloud environments - Help Net Security
Max severity SAP Commerce Cloud flaw now targeted in attacks
TWINLOOT Abuses SharePoint and Teams to Steal Credentials and Move Across Networks
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
Attackers exploit patched macOS Screen Sharing flaw to deploy cryptominer - Help Net Security
Police bust cybercrime ring accused of stealing €30 million in four-day spree - Help Net Security
14,000 Trezor Customers Impacted by Data Breach at ShipMonk - SecurityWeek
SafePal data breach impacts 39,798 customers, stolen info for sale
Cyber Crime, Organised Crime & Criminal Actors
UK Fraud Cases Hit Record High - Infosecurity Magazine
No-Filter 'Kriminal' AI Platform Raises Cybercrime Concerns
Your polite reply to that text is worth $2 on the dark web | Malwarebytes
Ukraine shuts down 94 fraudulent call centers, seize millions in cash
2,000 Hacked WordPress Sites Were Secretly Running a Global Crime Ring - IT Security Guru
How Cybercriminals Are Weaponizing Frontier AI Models Like Grok
Microsoft starts removing WMIC tool used by cybercriminals
Data Breaches/Leaks
Infostealers Harvest 1.7 Billion Credentials in Six Months - Infosecurity Magazine
27M records allegedly stolen via misconfigured Microsoft portals | Cybernews
Hacker claims 3.6 million Azure account records stolen from major companies
Crook hawks millions of records allegedly plundered from corporate Azure tenants
Multiple organisations investigating fresh wave of Cl0p breaches | Computer Weekly
Philips and GE investigating Clop ransomware data theft claims
Over 1,000 Charities Hit by Beacon CRM Data Breach - SecurityWeek
Fortune 500 Companies Hit in Azure Data Theft Campaign - SecurityWeek
TWINLOOT Abuses SharePoint and Teams to Steal Credentials and Move Across Networks
Crypto wallet maker Trezor confirms 13,000 customers' details exposed in logistics breach
LiteLLM Supply-Chain Attack - Technology, Banking and Healthcare the Most Affected
153GB of stolen credentials surface after LiteLLM supply chain attack - Help Net Security
Trivy, Not LiteLLM Behind the 2,500 Org Compromise - SecurityWeek
European nation rocked by major hacker attack: “largest data leak in history” | Cybernews
One Attacker Has Scraped Both Salesforce and ServiceNow Portals Since 2025
Why Secrets Slip Through Every Layer of Your Security Stack - Security Boulevard
50,000 Stripe Secrets Leaked in Public Code
14,000 Trezor Customers Impacted by Data Breach at ShipMonk - SecurityWeek
Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps
NHS Blood and Transplant investigate data breach due to pager use - BBC News
RingCentral data breach exposed info of 1.6 million accounts
Chess.com Leak Exposes 7.3 Million Users — Evidence Points to Scraping
McDonald’s Employee Data Appears in Leak, Seller Claims 1.7M Records Stolen - Security Affairs
Google Confirms Gmail Was Not Breached After Reports of 183 Million Password Leak - gHacks Tech News
Scottish prosecutors cast eye over leaky supplier after staff data exposed
Healthtech firm CareCloud data breach impacts 3.7 million patients
SafePal data breach impacts 39,798 customers, stolen info for sale
Scottish Govt Suffers Potentially Widening Data Breach
Hackers Expose Data of 1.2 Million Heights Finance Customers
Sakura Internet hack exposes data of up to 1.36 million accounts
Data/Digital Sovereignty
Denial of Service/DoS/DDoS
Linux Botnet Evooo1Bot Expands Mirai Capabilities Beyond DDoS
Why connectivity and cybersecurity can't be treated separately
Large-scale DDoS attacks disrupted Threema secure messaging service
Fraud, Scams and Financial Crime
UK Fraud Cases Hit Record High - Infosecurity Magazine
AI is making fraud harder to spot and identity harder to prove - Help Net Security
Fake Evidence: How Generative AI Is Changing Fraud
Your polite reply to that text is worth $2 on the dark web | Malwarebytes
Ukraine shuts down 94 fraudulent call centers, seize millions in cash
Police bust cybercrime ring accused of stealing €30 million in four-day spree - Help Net Security
Hackers arrested over €30M bank fraud exploiting service provider flaw
How Hackers Target Your Retirement Savings | Kiplinger
Banks look for fraud signals in customer behavior - Help Net Security
Identity and Access Management
Weak IAM affects up to 98% of cloud environments - Help Net Security
Microsoft Urges Organizations to Move Beyond Active Directory
Insider Risk and Insider Threats
Tech contractor for Brightly Software sentenced to 2 years in prison for insider attack | CyberScoop
Prison for data analyst who tried to extort $2.5 million from his employer
Internet of Things – IoT
Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies
Botnets Based on the Notorious Mirai Code Continue to Emerge - Security Boulevard
Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P
Meta's Ray-Bans are being banned from pubs, restaurants, and theatres
Law Enforcement Action and Take Downs
Police bust cybercrime ring accused of stealing €30 million in four-day spree - Help Net Security
Ukrainian police raid 94 fraudulent call centers, seize $2 million - Help Net Security
Hackers arrested over €30M bank fraud exploiting service provider flaw
Tech contractor for Brightly Software sentenced to 2 years in prison for insider attack | CyberScoop
Prison for data analyst who tried to extort $2.5 million from his employer
Linux and Open Source
Linux Botnet Evooo1Bot Expands Mirai Capabilities Beyond DDoS
Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies
Malware
Infostealers Harvest 1.7 Billion Credentials in Six Months - Infosecurity Magazine
New malware turns Microsoft 365 and Azure into its control center – Computerworld
MaaS Campaign Combines ClickFix, ErrTraffic and Cruciferra - Infosecurity Magazine
New Mirai-Based Linux Botnet ‘Evooo1Bot’ Turns Victims Into Proxies - Infosecurity Magazine
Attackers exploit patched macOS Screen Sharing flaw to deploy cryptominer - Help Net Security
Turf War Between Claude Agents Leads to Self-Replicating Malware
Novel macOS Infostealer AmnesiaStealer Spread via ClickFix - Infosecurity Magazine
Fake Chrome update pop-ups may be spreading malware
ChainDrop worm crawls into npm supply chain, evades standard defenses
Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic
New macOS malware turns stolen browsers into attacker-controlled sessions | CSO Online
Microsoft Tracks MacSync Stealer by Its Behavior, Not Its Domains
Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth
Grandoreiro Resurfaces in Mexico With New DLL Sideloading Campaign - Infosecurity Magazine
SilkParasite Threatens Central Asian Orgs With Flurry of RATs
Misinformation, Disinformation and Propaganda
Russia’s information warfare after 2022
Researchers publish tool to rate disinformation defense
Mobile
Your polite reply to that text is worth $2 on the dark web | Malwarebytes
WindRelay Android Malware Turns Victims' Phones Into NFC Relays for Payment Fraud
Apple sends new ‘Threat Notification’ alerts over mercenary spyware attacks
Models, Frameworks and Standards
17 draft Cyber Resilience Act standards are open for comment - Help Net Security
Passwords, Credential Stuffing & Brute Force Attacks
Password spraying attacks surge 155x as hackers exploit MFA gaps
TWINLOOT Abuses SharePoint and Teams to Steal Credentials and Move Across Networks
Why Secrets Slip Through Every Layer of Your Security Stack - Security Boulevard
Google Confirms Gmail Was Not Breached After Reports of 183 Million Password Leak - gHacks Tech News
Regulations, Fines and Legislation
Donald Trump empowers US private companies to conduct cyber-attacks | Donald Trump | The Guardian
A bold new strategy or a dangerous precedent? Experts are divided on Trump's memo. | CyberScoop
As warfare becomes engineering, the era of the digital mercenary dawns - Defense One
US courts will start publishing how often the government uses spyware | TechCrunch
17 draft Cyber Resilience Act standards are open for comment - Help Net Security
EU introduces strict new security rules for VPNs with the help of industry giants | TechRadar
Multiple Suicides Reported in US Cyber Operations Forces | Security Magazine
Software Supply Chain
ChainDrop worm crawls into npm supply chain, evades standard defenses
Supply Chain and Third Parties
Over 1,000 Charities Hit by Beacon CRM Data Breach - SecurityWeek
Crypto wallet maker Trezor confirms 13,000 customers' details exposed in logistics breach
LiteLLM Supply-Chain Attack - Technology, Banking and Healthcare the Most Affected
153GB of stolen credentials surface after LiteLLM supply chain attack - Help Net Security
Trivy, Not LiteLLM Behind the 2,500 Org Compromise - SecurityWeek
Scottish prosecutors cast eye over leaky supplier after staff data exposed
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
Russia’s information warfare after 2022
Researchers publish tool to rate disinformation defense
Non-Nuclear Military AI and the Risk of Misperception for a Nuclear War – CESRAN International
China
Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth
Storm-1175 Replaces Medusa With New StormEncryptor Ransomware
Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk-Derived Ransomware
Researchers Link Suspected Chinese APT to Hack-for-Hire Operations - Infosecurity Magazine
T-Mobile Cyber Team Physically Cuts Cable to Remove Chinese Hackers From Network
Russia
Russia’s information warfare after 2022
Hacking group claims mass data theft from Shell, Philips, GE, Fiserv and dozens of others | Reuters
North Korea
Iran
Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic
What we know about the alleged Iranian hacks on US water utilities | TechCrunch
Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence
Apple Warns Users in 110 Countries They May Be Targets of Mercenary Spyware
Researchers Link Suspected Chinese APT to Hack-for-Hire Operations - Infosecurity Magazine
US courts will start publishing how often the government uses spyware | TechCrunch
Tools and Controls
Your Security Appliances Are the Attack Surface - Security Boulevard
Governance Gap: AI Accountability Crisis
Anthropic sees AI risks rising, no plan to release stronger "Model 2"
The 80% Problem: Why AI resilience is more important than ever - IT Security Guru
The New Currency Of Cybersecurity Is Speed, But Only If The Fix Doesn’t Break Production
Weak IAM affects up to 98% of cloud environments - Help Net Security
Irregular says ‘human oversight’ responsible for AI sandbox escape incidents | CyberScoop
Citizen developers are becoming a security problem | perspective | MSSP Alert
Akira Ransomware Uses Safe Mode to Bypass EDR
Microsoft smothers malware by tracking behavior instead of blocking domains | TechRadar
Microsoft Urges Organizations to Move Beyond Active Directory
Researchers say OpenAI revoked their access to limited cyber program | TechCrunch
ChatGPT’s new feature could give infostealers a map of your Mac activity - Help Net Security
Windows 11’s strongest security defenses can be bypassed without a screwdriver - Help Net Security
AI-Driven Vulnerability Surge Breaks the Traditional Patching Model - SecurityWeek
EU introduces strict new security rules for VPNs with the help of industry giants | TechRadar
Banks look for fraud signals in customer behavior - Help Net Security
Other News
Your Security Appliances Are the Attack Surface - Security Boulevard
Stealthy Attacks: How To Protect Your Business | SC Media UK
Windows 11’s strongest security defenses can be bypassed without a screwdriver - Help Net Security
Swiss financial regulator warns over rising cyber attacks and AI risks - SWI swissinfo.ch
Ireland's presidency puts a cyber target on our back
AI, Security, and Rising Service Expectations Are Redefining Trust Between MSPs and Their Clients
Vulnerability Management
The New Currency Of Cybersecurity Is Speed, But Only If The Fix Doesn’t Break Production
Most people never update their networking equipment, and cybercriminals know it
8,539 reasons to rethink how vulnerabilities get patched - Help Net Security
Amid AI-Driven Bug-Hunt Tsunami, NIST Looks to … AI
How to reduce cybersecurity backlogs and fix vulnerability debt | CSO Online
AI-Driven Vulnerability Surge Breaks the Traditional Patching Model - SecurityWeek
Windows Server 2022 reaches end of mainstream support in 60 days
Vulnerabilities
Microsoft totally breaks Windows Defender virus scans in trying to fix a 0-day flaw - Neowin
CISA: Windows Task Host flaw now exploited by ransomware gangs
Critical RCE flaw in Windows IKE Extension now actively exploited
Microsoft Rolls Out 22 Fresh Security Patches - SecurityWeek
Microsoft Entra ID Flaw (CVSS 10.0) Exploited in Wild, Allows Remote Code Execution
Critical Citrix NetScaler Flaw Lets Remote Attackers Bypass Authentication Without Credentials
Max severity SAP Commerce Cloud flaw now targeted in attacks
Critical SAP Commerce Cloud Vulnerability Exploited 3 Days After Disclosure - SecurityWeek
Apple plugs image-processing hole ripe for spyware abuse
Dozens of WebKit Vulnerabilities Patched With Fresh macOS, iOS Security Updates - SecurityWeek
Attackers exploit patched macOS Screen Sharing flaw to deploy cryptominer - Help Net Security
Apple's iOS 26.6.1 patches 29 security flaws - here's why you'll want to install it | ZDNET
Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation
Apple just patched a critical macOS flaw that let hackers break in without a password | TechSpot
Atlassian, Splunk Patch Dozens of Critical, High-Severity Vulnerabilities - SecurityWeek
Cisco Patches Critical Crosswork, Secure Workload Vulnerabilities - SecurityWeek
Hackers Exploiting Unpatched GeoServer Zero-Day - SecurityWeek
Chrome, Firefox Updates Patch Dozens of Vulnerabilities - SecurityWeek
Google Fixes Two Critical Chrome Flaws in WebGL and Dawn — Update Your Browser
Firefox 154 fixes 58 security bugs, adds Nvidia GeForce Now streaming | PCWorld
Hackers Target Zimbra Servers in Active Exploitation Campaign - SecurityWeek
Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution
Isolated-vm Flaw Lets Sandboxed JavaScript Escape to Host for Potential RCE
MLflow Vulnerability Exploited for Cloud Credential Theft - SecurityWeek
N-able Bug Exposes Password Vault Master Keys
943 Patches Rolled Out With Oracle's August 2026 Security Update - SecurityWeek
Atlassian, Splunk Patch Dozens of Critical, High-Severity Vulnerabilities - SecurityWeek
CISA Urges Immediate Patching of Exploited TrueConf Vulnerabilities - SecurityWeek
UNISOC Modem Flaw Enables Remote Code Execution via Video Calls - Infosecurity Magazine
Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk-Derived Ransomware
Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads
WordPress Plugin Flaw Exposes 40,000 Sites to Admin Takeover - Infosecurity Magazine
300,000 WordPress Sites Potentially Exposed to Hacking Due to Form Plugin Flaw - SecurityWeek
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
Automotive
Construction
Critical National Infrastructure (CNI)
Defence & Space
Education & Academia
Energy & Utilities
Estate Agencies
Financial Services
FinTech
Food & Agriculture
Gaming & Gambling
Government & Public Sector (including Law Enforcement)
Health/Medical/Pharma
Hotels & Hospitality
Insurance
Legal
Manufacturing
Maritime & Shipping
Oil, Gas & Mining
OT, ICS, IIoT, SCADA & Cyber-Physical Systems
Retail & eCommerce
Small and Medium Sized Businesses (SMBs)
Startups
Telecoms
Third Sector & Charities
Transport & Aviation
Web3
Contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to external articles are provided for general interest and awareness only. Linking to or reposting external content does not constitute endorsement of or by any organisation, service, or product. We do not control and are not responsible for the content, security, or availability of external websites or links. Full credit is given to the original authors and sources. E&OE.