A Chinese-speaking threat actor utilized ARTEX to conduct data theft attacks on South Korean financial firms, and a Chinese-linked APT group, Flax Typhoon, was disrupted.[1][2] Furthermore, the threat landscape is increasingly complicated by the growing use of AI by autocratic regimes for surveillance and propaganda, alongside campaigns like Wazza Phishkit targeting banking and government organizations, and the continued activity of the FortiBleed credential harvesting campaign.[3][4][5]
ransomwareFirst, a U.S. and Israeli national, Zohar Pinhasi, owner of ransomware recovery firm MonsterCloud, was charged with wire fraud for allegedly deceiving clients by secretly paying ransom demands and charging exorbitant fees.[6] Simultaneously, the FBI is investigating a suspected ShinyHunters breach, following the group’s claim of obtaining FBI data and defacing its website, with a suspected operative detained in Jordan cooperating with authorities.[7] Notably, Osaka Metropolitan University in Japan canceled classes and shut down a portion of its IT infrastructure after a suspected ransomware attack, with authorities investigating.[8]
data-breachOpenAI fired three safety researchers over a dispute regarding AI safety concerns, following a breach that impacted Australian government services.[9] Finally, a Chinese-speaking threat actor, potentially linked to SCARLET LOOP, has been using the open-source AI penetration testing tool ARTEX to conduct data theft attacks on South Korean financial firms.[1]
vulnerabilityThreat actors are aggressively exploiting a critical Atlassian vulnerability (CVE-2026-21589) in Bitbucket, Confluence, Jira, and related products, with evidence of exploitation within hours of a proof-of-concept publication.[10]
malwareThis past week has witnessed a concerning escalation in malware activity, beginning with a long-running npm supply chain attack, codenamed MALFEX, orchestrated by a lone threat actor, resulting in the delivery of Overlord RAT and stealer malware to over 40,767 downloads.[11] Furthermore, a state-aligned Iranian threat actor, operating under the ‘Blinder Tunnel’ campaign, has been targeting Iraqi critical infrastructure since November 2025, utilizing a multi-stage attack chain involving exploiting legitimate Windows developer files and DLL sideloading.[12] Adding to this, a Linux backdoor, ClingSTUN, is abusing the STUN protocol to exploit dozens of vulnerabilities and establish a backconnect proxy.[13]
aptThe US has sanctioned Integrity Tech and seized associated domains in response to Chinese state-sponsored APTs utilizing these tools.[14] Simultaneously, Chinese threat actor TA419 is impersonating US officials, including a former White House Office of Science and Technology Policy leader, to conduct AI cyber espionage targeting US AI policymaking and planning.[15] This campaign leverages the deception of legitimate professional relationships to bypass Multi-Factor Authentication and gain access to sensitive information.[15]
phishingThis past week, phishing attacks have evolved significantly, with a new phishing kit, Wazza Phishkit, targeting banking, manufacturing, and government organizations across the US, Europe, and Australia, utilizing a layered approach to evade detection.[3] Adding to this, a campaign mimicking AI chatbots like ChatGPT, Gemini, and Claude has successfully captured credentials and MFA codes, targeting agency staff and manager-account administrators to monetize ad accounts.[16] Finally, the FBI and USSS are warning that the FortiBleed credential harvesting campaign remains active, with over 86,644 compromised Fortinet device credentials obtained, urging organizations to isolate affected devices and report incidents.[4]
supply-chainResearchers highlighted a 48-hour cooldown period and metadata checks on lockfile changes as crucial steps in identifying and mitigating supply-chain risks.[17] A sophisticated campaign dubbed GhostAction has been targeting GitHub repositories since September 2025, leveraging compromised maintainer accounts to inject a malicious workflow.[18]
policyNotably, a teenager in Jordan, Rey (Saif Al-Din Khader), has been detained and is cooperating with the FBI, following an investigation into ShinyHunters, revealing the group’s ‘franchise’ model and the attempted murder plot by a Dutch cybercriminal.[19] The FBI has also seized several domains used by a Chinese-linked advanced persistent threat group, Flax Typhoon (also known as Ethereal Panda and RedJuliett), disrupting a multi-year campaign targeting critical infrastructure.[2] Finally, European authorities, with Europol and Eurojust, dismantled KillSec, a cybercrime group led by a 16-year-old operator.[20]
threat-intelThe threat landscape is further complicated by the increasing use of AI by autocratic regimes, including China and Russia, for surveillance, censorship, and propaganda distribution, and a growing number of AI agents being deployed to maintain control and reduce reliance on human subordinates.[5]
Exploited
In a Known Exploited Vulnerabilities catalogue (CISA / EU) or reported exploited by the source.
Ransomware claims
205 victims claimed on leak sites, most by thegentlemen (37), qilin (23), N0n (16), safepay (12), UmBra (10). Unverified claims, via ransomware.live.
Written automatically from the articles cited above and checked against them. It may still contain errors: the articles are the reference. Sources & data
