Major Incidents or Breaches

  • Japanese tech company Advantest disclosed a ransomware attack impacting its corporate network, with ongoing investigation into potential compromise of customer and employee data.
  • The University of Mississippi Medical Center (UMMC) closed all statewide clinics following a ransomware attack.
  • A data breach at the French bank registry affected 1.2 million accounts, as confirmed by the French Ministry of Finance.
  • PayPal notified customers of a data breach caused by a software error in a loan application, which exposed sensitive personal information, including Social Security numbers, for nearly six months.
  • Age verification vendor Persona was found to have left its frontend exposed, enabling access to extensive identity and watchlist screening processes behind a basic age check.
  • Attackers leveraged Facebook ads to distribute fake Windows 11 downloads, which delivered password-stealing malware targeting credentials and cryptocurrency wallets.

Newly Discovered Vulnerabilities

  • A critical remote code execution (RCE) vulnerability (CVE-2026-1731) in BeyondTrust Remote Support and Privileged Remote Access products is being actively exploited, including in ransomware attacks. Threat actors have used the flaw to deploy web shells, backdoors, and exfiltrate data. CISA has updated its Known Exploited Vulnerabilities (KEV) catalog accordingly.
  • Researchers identified a new toolset used by threat actors to scan for React2Shell exposures, targeting high-value networks for exploitation.
  • A surge in vulnerabilities affecting industrial control systems (ICS) has been reported, increasing risks to operational technology environments.

Notable Threat Actor Activity

  • A supply chain attack on the open-source Cline CLI (version 2.3.0) resulted in the deployment of OpenClaw, an autonomous AI agent, onto developer systems.
  • The ClickFix campaign is abusing compromised legitimate websites to deliver a previously undocumented remote access trojan (MIMICRAT), facilitating remote access and control.
  • The FBI reported a surge in ATM jackpotting attacks across the US, with over 1,900 incidents since 2020 and $20 million stolen in 2025. The Ploutus malware, active for over a decade, remains a primary tool.
  • A Ukrainian national was sentenced in the US to five years in prison for facilitating North Korea’s fraudulent IT worker scheme, which involved supplying stolen identities to infiltrate US companies.
  • Japanese-language phishing campaigns continue to target users, indicating ongoing localized social engineering efforts.

Trends, Tools, or Tactics of Interest

  • Outbound email security incidents in Microsoft 365 environments remain prevalent, with 91% of organizations affected, primarily due to human error.
  • Threat actors are increasingly exploiting AI-powered agents and manipulating them to bypass security policies and guardrails, as evidenced by incidents involving Microsoft Copilot and other AI models.
  • The shift-left approach in software development has led to increased security risks, as speed and automation in CI pipelines often override security checks, according to analysis of public container images.
  • The use of Facebook ads as a vector for malware distribution is increasing, with attackers disguising malicious payloads as legitimate software downloads.
  • Latin America’s slow pace of cybersecurity upgrades is creating opportunities for initial access brokers and ransomware gangs.
  • Metadata in official documents, such as PDF files related to sensitive government projects, continues to expose information about authors and contributors.

Regulatory or Policy Developments Affecting the Security Industry

  • Insurers and regulators are placing increased emphasis on identity posture when assessing cyber risk, with “identity cyber scores” emerging as a new metric influencing cyber insurance policies.
  • The European Parliament has enacted a ban on certain uses of AI, reflecting a growing regulatory focus on artificial intelligence in security contexts.
  • The US Department of Homeland Security is pursuing a unified biometric search platform for faces and fingerprints, while reducing centralized privacy reviews and limits on facial recognition technology.
  • NIST announced a breakthrough in quantum technology with the development of a chip capable of producing single photons, potentially broadening access to quantum key distribution (QKD) for organizations.