Major Incidents or Breaches

  • BridgePay, a major U.S. payment gateway provider, confirmed a ransomware attack that caused significant outages across its services. The incident began on Friday and resulted in key systems being taken offline.
  • Moltbook, a social network for AI agents, exposed personal data belonging to real users. The exposure was not limited to AI-generated content but included sensitive information about actual individuals.

Newly Discovered Vulnerabilities

  • Organizations have been urged to replace discontinued edge devices following reports that unsupported hardware is being actively targeted by state-sponsored threat actors. The US government has highlighted ongoing attacks exploiting vulnerabilities in these obsolete devices.

Notable Threat Actor Activity

  • A state-aligned cyberespionage group tracked as TGR-STA-1030/UNC6619 has conducted “Shadow Campaigns,” targeting government infrastructure in 155 countries. The operation is global in scale and focused on espionage objectives.
  • German federal agencies (BfV and BSI) issued a joint advisory regarding a phishing campaign using the Signal messaging app. The campaign specifically targets politicians, military personnel, and journalists in Germany.

Trends, Tools, or Tactics of Interest

  • OpenClaw (formerly Moltbot/Clawdbot) has integrated VirusTotal scanning into its ClawHub skill marketplace, scanning uploaded skills for malicious content.
  • A new open-source tool named Tirith has been released to detect and block homoglyph (imposter) attacks in command-line environments by analyzing URLs in typed commands and preventing the execution of suspicious commands.