Listen to today's episode on the APJONE.UK Daily Briefing podcast.
Ransomware Attacks (48h)
- krybit — 5 victims: South Africa (×2), Nigeria, France (local government), Mexico
- qilin — Wire Products, Saturday Evening Post, Commercial Furniture Interiors (US); Dienst Pack Systems (DE); Ceragres (CA)
- play — The Butcher Brothers, Sigma Plastics Group, Cambridge Management (US)
- CRPxO — Large Turkish cluster: Kuveyt Türk, Finansbank, Anadolubank, Turkish Airlines, Aselsan (defence); J&J and Hyundai also claimed (treat with skepticism)
- incransom — Quantinuum (US, quantum computing) ⚠️
- coinbasecartel — MIM Fertility (UK, healthcare) 🚨 + CEN/Cenelec (BE), M.B. Kahn Construction (US)
- shinyhunters — Alcon Inc. (CH, medical devices), Questel SAS (FR), Lumenis (IL, medical tech)
- thegentlemen — Philippine Savings Bank (PH)
- SilentRansomGroup — Moses & Singer law firm (US)
- Global Secret Group — Vernon & Waldrep (US)
Round Up Security News
- CaptiveCrunch: Midnight Blizzard Targets Travelers Worldwide — Russian APT running a global campaign using rogue captive portals to deliver malware and harvest credentials. Active now.
- Zero-Day CVE-2026-20245 in Cisco Catalyst SD-WAN Manager — Actively exploited against service provider SD-WAN infrastructure. Mandiant report available.
- ShinyHunters Targeting Education Sector via Oracle PeopleSoft Exploit — Active compromise and extortion campaign by UNC6240.
- China-Nexus UNC6508: Targeting US Medical AI & Defense Research — Sophisticated sustained campaign against medical and national defence institutions.
- Ongoing Targeted Campaign Against US Law Firms — Financially motivated data theft and extortion running Jan–May 2026. Mandiant tracked.
- Harvesting SSH Credentials: Honeypot Network Insights — Real-world SSH brute-force and credential harvesting patterns at scale.
- Rooting & Firmware Analysis: TP-Link TL-841N — Root access, firmware extraction, and persistent hardcoded credentials on a widely deployed consumer router.
Today's Picks
- worldmonitor — Open-source real-time global intelligence dashboard with AI-powered news aggregation and geopolitical monitoring.
- Exploits Were Never the Point — Essay arguing that technical exploitation is often a distraction from the true objectives of adversaries.