Cyber experts have urged users of Palo Alto Networks' GlobalProtect VPN to patch immediately amidst active exploitation of an upgraded security flaw.

A flaw in the popular VPN service, tracked as CVE-2026-0257, could allow attackers to bypass authentication and establish an unauthorized connection.

The vulnerability primarily affects the GlobalProtect portal and gateway for Palo Alto Networks’ PAN-OS software, and carries a CVSS score of 7.8, rating it as ‘high’ in severity.

Notably, this rating follows an upgrade, with the flaw having previously been given a ‘medium’ severity rating. Palo Alto announced the upgrade late last week amidst reports that the flaw was now being exploited in the wild.

“Palo Alto Networks has become aware of limited exploit attempts on unpatched PAN-OS devices without mitigations applied,” the company said in an advisory.

Analysis by Rapid7 shows threat actors have been exploiting the vulnerability since mid-May across several waves of attacks.

“Rapid7 MDR identified successful exploitation across numerous customers; however, we did not observe any indication of successful lateral movement from the devices,” researchers said.

“The earliest date for observed exploitation was May 17, 2026. As of May 29, 2026, this vulnerability has been added to the CISA KEV.”

Rapid7 noted that customers compromised in this wave of attacks had Cloud Authentication Service (CAS) disabled. Others, meanwhile, had GlobalProtect portal or gateway authentication override cookies enabled.

A patch has been issued for customers running affected appliances, according to Palo Alto.

Similarly, administrators are advised to turn off authentication override features to mitigate potential exploitation.

Qilin ransomware involved in GlobalProtect attacks

Analysis by Arctic Wolf Labs suggests attacks on GlobalProtect customers could be the work of the Qilin ransomware group or affiliates. Indeed, researchers detected Qilin ransomware during several instances across June, highlighting a range of tell-tale signs.

“Post-exploitation tradecraft varies across intrusions, from rapid encryption-only operations to full double extortion, possibly suggesting multiple affiliates operating under the Qilin ransomware as a service (RaaS) umbrella,” the company said.

Dray Agha, senior manager for Huntress’ security operations center, said these attacks highlight the growing threats posed to VPNs and firewalls.

"The exploitation of this GlobalProtect vulnerability by the Qilin ransomware gang demonstrates that perimeter defences are prime targets,” he said.

“When threat actors can bypass VPN authentication, they are walking through the digital front door with a master key. The grace period for patching critical edge devices has practically vanished, and they must be the patching priority for all organizations".

FOLLOW US ON SOCIAL MEDIA

Cybersecurity experts have issued an alert amid reports that hackers accessed login credentials belonging to UK government officials and Foreign Office staff.

The credentials, which are reportedly being sold on the dark web, were exposed as part of the ongoing FortiBleed attack campaign.

FortiBleed targets internet-facing Fortinet VPN and firewalls, and is believed to have affected more than 70,000 devices spanning 194 countries since it was first uncovered last month.

Analysis from SOCRadar, for example, identified a vast database containing login credentials. The threat intelligence firm has since attributed FortiBleed to the Lynx/INC ransomware group.

While this database was believed to have been limited to basic usernames and passwords, reports from The Telegraph suggest some exposed details include privileged Fortinet credentials.

Volodymyr Diachenko, a security researcher who first uncovered the threat campaign, told the publication these credentials could give bad actors access to the Foreign Office’s “core networks” along with other government departments.

Some Foreign Office credentials are now being sold on the dark web, according to reports, going for up to £40,000.

Arctic Wolf CISO Adam Marrè warned that the incident could create a domino effect, impacting other government departments and also local authorities and public services.

According to The Telegraph, credentials at NHS trusts, energy companies, and local councils were also hosted in the illicit database.

“This major breach of email accounts of UK government officials and overseas Foreign Office workers is the latest development in the ongoing FortiBleed attack,” he said.

“While it may be tempting to think this is a simple credential-stuffing operation, our threat team found the threat actors have built a highly sophisticated and repeatable credential factory,” he said.

Marrè noted that analysis of the incident conducted by Arctic Wolf shows threat actors appear to have been using automated tools to harvest logins and target gateways at “exponential speed and volume”.

“This means while today it’s the Foreign Office which has been affected, the risk to every organization has increased exponentially.”

Back and forth on FortiBleed

The discovery of the FortiBleed sparked somewhat of a back and forth between Fortinet and security researchers last month. After threat intelligence firm Hudson Rock published a blog detailing the campaign, Fortinet disputed some of its claims.

Fortinet told ITPro at the time that the exposed credentials weren’t the result of a fresh breach, insisting that those following best practices were safe from exposure.

"Fortinet is aware of a reported third-party credential-harvesting campaign targeting Fortinet firewalls and VPN gateways. We are committed to safeguarding our customers, and we diligently and continuously monitor threat actor darknet activity,” a spokesperson for the company said.

“Based on our initial analysis, the data involved is likely a resharing of data from previous incidents, as well as brute forcing of credentials, and not related to any current incident or advisory."

Hudson Rock, meanwhile, said the campaign went “beyond simply credential reuse,” highlighting that hundreds of organizations are thought to have been affected.

FOLLOW US ON SOCIAL MEDIA

Criminals are posing as Interpol cyber crime investigators to target small businesses across Europe, Asia, the Middle East, and North America.

According to new research from Bitdefender, the phishing messages claim to contain evidence that the recipients are carrying out suspicious activity, pressuring them into opening a password-protected archive.

"Based on information that has come to our attention, there may be activities involving accounts, systems or services associated with your organization that warrant further examination. We have obtained information and video material that may assist in your assessment of the matter," the emails read.

"We recommend conducting an internal review to determine whether any unauthorized, suspicious or potentially fraudulent activities have occurred. Prompt attention to such matters may help mitigate potential financial operational, reputational or regulatory risks."

Upon opening the link, recipients are directed to a Proton Drive-hosted file that delivers a ransomware payload hidden within multiple archive layers. Once executed, researchers said the malware seeks to encrypt files across available drives and presents victims with a ransom message.

The campaign is targeting organizations across multiple industries, including food and agriculture, legal services, pharmaceuticals, media, technology, and finance.

The ransomware is relatively simple, according to Bitdefender researchers. The code contains hardcoded values, including the password used during encryption and decryption, and lacks many of the features typically associated with large ransomware operations.

Interestingly, victims are instructed to contact the attackers through a Tox chat channel to negotiate a ransom, rather than through the more usual dedicated negotiation portal or victim site.

This, researchers noted, is another indication that this is likely a custom-built operation, perhaps assembled using publicly available code and tools rather than the work of an established ransomware group.

What small businesses need to know

Javvad Malik, Lead CISO advisor at KnowBe4, said that impersonating Interpol – or law enforcement in general – is specifically designed to trigger a “rapid emotional response” and dupe victims into ignoring red flags.

"What is interesting about this campaign is that it targets small business,” he said. “These are often understaffed and have no security or even IT expertise on hand, so it's not difficult to see why people would easily fall victim to these kinds of attacks."

Bitdefender has warned small businesses to be on the alert, urging them to verify all unsolicited correspondence by reaching out through official channels to confirm whether the communication is legitimate.

"One of the biggest red flags in this campaign is the delivery method itself," researchers said. "While the attackers impersonate Interpol, legitimate law enforcement agencies don't send unsolicited emails containing Proton Drive links to password-protected files and ask organizations to review alleged evidence of wrongdoing."

They should treat password-protected archives with caution, especially when the password is included in the email. Showing file extensions on Windows devices will make it easier to spot executables masquerading as videos or documents, and multi-factor authentication (MFA) should be used wherever possible.

Elsewhere, the company urged small businesses to ensure staff are trained to help spot tell-tale signs that communications are fraudulent.

"Small businesses are often viewed as easier targets than large enterprises," the researchers warned.

"Many operate without dedicated IT teams or cybersecurity staff. Security responsibilities are often shared among employees who already wear multiple hats, and limited budgets can make it difficult to invest in advanced security measures or ongoing training."

FOLLOW US ON SOCIAL MEDIA

In the age of AI, perimeter defense alone is no longer enough. Traditional methods for securing IT estates are horribly vulnerable to increasingly sophisticated AI tools, leading to a rapid degradation of many organizations’ defenses.

On a global scale, in April, the news broke of Claude Mythos’ limited release and the danger it could pose to cybersecurity worldwide. The hyper-powerful AI model rapidly uncovered flaws and vulnerabilities in defense systems that had lain dormant for years, threatening the integrity of banking systems, energy networks, and more.

In the UK, more than three-quarters of UK businesses have suffered a cyber incident in the past year. What’s more, 43% of UK IT decision-makers identified AI-powered attacks as the single biggest risk they face over the next 12 months, ahead of traditional threats such as ransomware, phishing, and data breaches.

Turning lemons into lemonade

Clearly, there’s plenty of cause for concern here – the challenge is significant, and the potential damage could reach far beyond companies’ bottom lines. But that doesn’t mean the IT industry should throw up its hands and accept the inevitable. Rather, the rapid growth in AI-driven breaches is a sign that a new approach is needed.

For managed service providers (MSPs) in particular, the evolving threat of AI presents a business opportunity rather than just another security burden. As customers seek to handle cloud patching complexity, regional compliance differences, and increasingly automated attacks, MSPs that can unify security, operations, and automation in a single offering will be best placed to improve service quality and usability – and so unlock increased profitability.

This isn’t wishful thinking: organizations are making plans to invest in technology that can help them tackle the AI challenge. AI and advanced threat preparedness is the top spending commitment for UK organizations over the next 12 to 24 months, cited by 41% of 1,500 IT decisionmakers ManageEngine recently surveyed.

Simpler, faster

There is also a growing gap between how quickly organizations detect incidents and how long it takes them to recover, which is where MSPs can provide real value. The majority (94%) of UK organizations detect incidents within 24 hours, and nearly half recover within 10 days. However, 26% said recovery can extend beyond 10 days, with a smaller proportion taking more than 20 days.

In response to that inefficiency, MSPs can help by reducing tool sprawl, standardising workflows, responding quickly to incident reports, and packaging up more resilient service tiers. Clients will pay for this kind of rationalisation and streamlining, providing, as it does, a crucial way to reduce the time between a security incident and a successful resolution.

Putting operational tech at the center

MSPs can also provide value in the battle against AI-driven cyberattacks by including operational technology (OT) in the development of security systems as a priority rather than an afterthought. OT is becoming part of the managed risk surface and requires the same disciplined approach MSPs already apply to IT – not least because OT software may traditionally have been seen as ‘lower-risk’, and therefore less diligently patched.

Again, the core benefit MSPs can provide clients with here is acting as the single point of contact that draws together oversight of all potential vulnerabilities. As organizations’ digital estates become ever more complex, applying security policies and automations to OT as well as back-office apps and systems can be a major headache.

MSPs with expertise across the board can not only build a unified policy to defend the entire attack surface – they can also radically simplify day-to-day management for client IT teams.

AI is turning the threat of cyber attack into a many-armed monster, hitting harder and in more places than ever before. In the face of this ramped-up threat, MSPs are uniquely placed to offer a unified, simplified service – and in that sense, the rise of AI breaches could be a real business opportunity.

Network Rail is fighting off millions of cyber attacks every month, according to new research, as experts warn of a rising tide of threats facing public services.

Freedom of information (FoI) requests show the organization blocked over 7.1 million malicious emails between December 2025 and March this year.

Of the 7,129,314 email attacks blocked by Network Rail, 331,352 were phishing emails, 1,412 were malware-laden emails, 2,066,392 were spam emails, and 4,730,158 were edge blocked emails.

This all adds up to an average of more than 800,000 attacks per day, including around 37,000 phishing attempts.

“With so many people in the UK depending on public transport for their daily lives, a successful cyber attack could cause significant disruption, such as potentially stopping people from getting to work," warned Simon Edwards, CEO of SE Labs.

"Therefore, it’s vital that our public sector organizations have a dedicated cyber strategy put in place and ensure rigorous testing to identify any security holes and keep hackers at bay.”

Just last week, two members of the hacking group known as Scattered Spider pleaded guilty over their involvement in an attack on Transport for London (TfL) systems.

The attack forced all 28,000 employees to attend a TfL office for a password reset and led to a reported £29 million in losses and recovery costs.

"As we've seen from the recent Scattered Spider convictions, hacking groups have the transport network firmly in their sights. A single successful cyber attack on the rail network could drive Britain to a halt, operationally and economically," said Graeme Stewart, head of public sector at Check Point.

"The transport network is also a treasure trove of personal and financial data, something unscrupulous criminals are eager to get their hands on. That’s why it's vital that our roads, rail and aviation systems are fully protected with the latest cyber defenses to keep hackers locked out."

What happened with the Network Rail cyber attack?

In 2024, Network Rail suffered a cyber attack on its WiFi systems that saw commuters who logged in at affected stations receive information pertaining to terrorist attacks in Europe, as well as a message stating “we love you Europe”.

The attack is believed to have taken place through a third-party service provider, Telent, which managed Network Rail's WiFi services.

More recently, train operator LNER said a cyber attack had led to unauthorized access to files managed by an unnamed third-party supplier.

Travel networks, particularly rail services, are among the top targets for cyber criminals and state-sponsored groups due to the critical role they play in the British economy, according to research conducted last year.

The UK's Department for Science, Innovation and Technology (DSIT) released a report from KPMG that concluded a major attack on the rail network could cost £1.8 billion for a one-week period of disruption.

The direct financial cost to Network Rail would, it concluded, cost around £123 million, with the cost to passengers due to delays adding up to about £281.3 million.

Notably, the impact on Gross Value Added (GVA) could be as much as £1.397 billion, representing approximately 2.8% of the UK’s weekly GDP and 0.05% of annual GDP.

FOLLOW US ON SOCIAL MEDIA

Two young men have pleaded guilty to offenses under the Computer Misuse Act following a cyber attack on Transport for London (TfL) that caused months of disruption and millions in damages.

Thalha Jubair, 20, from East London, and Owen Flowers, 18, from Walsall in the West Midlands, were arrested following raids by the National Crime Agency (NCA) and City of London Police in September 2025.

The duo are alleged members of the notorious Scattered Spider cyber crime collective, believed to be responsible for a string of attacks in recent years. The group claimed responsibility for attacks on UK retailers Marks & Spencer and the Cooperative Group, as well as MGM Resorts in the United States.

“The profile of offenders like Flowers and Jubair demonstrates the increasing threat from cyber criminals based in the UK and other English-speaking countries, epitomised by Scattered Spider," said Paul Foster, deputy director of the National Crime Agency and head of the NCA National Cyber Crime Unit.

Flowers was first arrested in September 2024, at which point NCA officers found evidence that the networks of US healthcare companies SSM Health Care Corporation and Sutter Health had also been infiltrated and damaged.

Investigators found a number of devices at Flowers' home, including laptops, tower computers, hard drives, and USB sticks. One Acer laptop contained a screenshot showing network connectivity to TfL infrastructure.

Flowers had also accessed an online platform selling credentials compromised in previous cyber attacks and data breaches.

Notably, the laptop contained a number of videos that Flowers had recorded, which showed Jubair accessing TfL systems during the attack. At the same time, the pair were messaging each other over Telegram, as well as communicating via an online work collaboration tool.

What happened with the TfL cyber attack?

TfL’s network was infiltrated at the beginning of September 2024, forcing all 28,000 employees to attend a TfL office for a password reset. The cyber attack caused widespread disruption for the rail operator.

Data from TfL’s Oyster refunds system was accessed while its customer refund system was also affected. Elsewhere, the attack shut down the Oyster photocard application system for children and young people.

Around 10 million people are believed to have been affected by the attack, making it one of the UK’s most devastating cyber attacks to date.

Jubair and Flowers are due to be sentenced at Woolwich Crown Court on 16 July.

A lengthy investigation

Foster said the trial is the culmination of a “lengthy, highly complex and painstaking investigation” and hailed law enforcement colleagues for their role in apprehending the duo.

“The perseverance and meticulousness of our officers, and the work of our partner organizations, meant that Jubair and Flowers had no option other than to plead guilty and take responsibility for their offending," he commented.

“Cyber crime may appear faceless and distant compared to other crime types, but the infiltration of TfL’s systems shows it has real-world consequences and impacts hugely on the public. The attack caused millions of pounds in losses to a key part of the UK’s critical national infrastructure, and was a significant inconvenience for customers."

The NCA is urging victims of cyber crime to use the government’s Cyber Incident Signposting Site for direction on which agencies they should report incidents to.

“Today’s result would not have been possible if TfL had not engaged with law enforcement early, so I would urge any other organization to please do the same in such circumstances," said Foster.

The rise of youth hackers

Upon their arrest in September 2025, Jubair and Flowers were both teenagers, prompting concerns about a potential wave of youth-related cyber crime. As ITPro reported at the time, cybersecurity experts described the incident as a “wake up call” for law enforcement, educators, and society at large.

Anna Chung, principal researcher for EMEA at Palo Alto Networks, said these incidents highlight a failure to “properly engage a generation growing up in a digital-first world”.

“Young people don’t usually turn to online mischief out of malice - it’s often down to a mixture of boredom, technical skills, and a lack of boundaries,” she told ITPro at the time.

So what’s the solution? Chung urged schools and parents to make a concerted effort toward teaching digital ethics, making this a “part of core education”. This, she noted, could be crucial to preventing future incidents.

Chung’s warning over teen hackers is by no means the first, or likely last, that we’ll hear about in coming years.

Indeed, the UK’s Information Commissioner’s Office (ICO) published a report last year which highlighted a spate of cybersecurity incidents at schools across the country, with students bypassing network security controls and gaining access to management systems.

Nipping these types of activities in the bud are crucial, the ICO warned, largely as they have the potential to evolve into more nefarious activities.

FOLLOW US ON SOCIAL MEDIA

More than three-quarters of utilities organizations were hit by cyber attacks involving outdated software or unavailable patches on legacy equipment over the last year.

At 77%, it was the most common type of cyber incident facing the sector, according to Bridewell's Cyber Security in Critical National Infrastructure Report 2026.

And the most common effect was IT disruption or outages, affecting 47% of organizations, despite the fact that 99% of respondents described themselves as resilient after their worst cyber attack.

A further 42% said incidents had resulted in increased cybersecurity spending, while 35% experienced data loss, 34% reported revenue loss, and 32% suffered disruption to production or services.

Supply chain attacks take the longest to respond to, at 9.9 hours on average, followed by data theft or disclosure at 8.4 hours and unauthorised access at 7.6 hours.

The utilities sector is particularly hampered by the need to secure ageing operational technology and infrastructure that weren't designed to withstand modern cyber threats, as critical assets can't be updated or taken offline as easily as traditional IT environments.

"Many of the systems underpinning essential utilities services were designed to operate for decades in environments that were never intended to be connected to modern digital networks," said Sam Thornton, COO at Bridewell.

Beyond legacy infrastructure, phishing and business email compromise remain widespread, affecting 76% of utilities organizations in the past year. Malware affected almost as many, at 74%, while more than seven-in-ten experienced unauthorized system access.

The main concern for utilities organizations is data protection and privacy, cited by 46% of survey respondents. Managing AI-related cyber risk and the ability to quickly detect incidents were close behind, reflecting growing concerns around emerging technologies and increasingly sophisticated attacks.

Utilities organizations are also unconfident when it comes to data breach notification requirements, cited by 42%, cybersecurity measures for data protection at 39%, and third-party due diligence at 38%.

And regulation is now the primary driver of cyber security maturity within the utilities sector, cited by 36% of respondents - ahead of both the evolving threat landscape and customer demand for improved security, and highlighting the growing influence of frameworks and compliance obligations on cyber security investment and decision-making.

"As utilities providers continue to modernize and connect operational systems, managing the gap between legacy infrastructure and modern security requirements is becoming one of the sector's biggest cybersecurity challenges," said Thornton.

Bridewell recommends that utilities organizations improve the visibility of assets across both IT and operational technology environments to identify unmanaged or vulnerable systems.

They should prioritize patch management and vulnerability remediation based on operational risk and criticality, conduct regular incident response exercises to ensure teams can respond effectively during a live cyber incident and strengthen monitoring and detection capabilities to reduce the time taken to identify and contain threats.

They should also review third-party and supply chain security arrangements to ensure critical partners meet appropriate security standards.

"In the utilities sector, the consequences of a cyber attack extend far beyond IT," said Thornton. "When critical systems are disrupted, the impact can be felt by customers, communities and the wider economy, making cyber resilience a business-critical priority."

The overwhelming majority of cyber attacks on critical infrastructure are coming from hostile states, the UK's cyber chief has warned.

Speaking at the Royal United Services Institute's (RUSI) Annual Security Lecture, Richard Horne, CEO of the National Cyber Security Centre (NCSC), said the organization had handled more than 200 cyber incidents affecting the UK's critical national infrastructure and its supporting ecosystem over the last year. Around 75% were believed to be linked to state actors, particularly Russia, China, and Iran.

"We know that adversaries are prepositioning today, establishing footholds within technology that underpins critical national infrastructure that could enable rapid exploitation, to cause mass disruption in a time of conflict," he said.

"The highest profile example of this was a campaign often referred to as Volt Typhoon against largely US critical national infrastructure, which was attributed in 2024. And we are seeing our critical infrastructure being targeted, regularly finding and stopping breaches, before their intent becomes clear."

Horne broke the threat down into 'near', 'mid,' and 'far' spaces, with the far space representing the adversary's home turf, systems, tooling, and networks. Here, he said, the UK and its allies bring pressure to bear through intelligence collection, sanctions, law enforcement action , and offensive cyber operations to disrupt and degrade their capability at source.

In the mid space, efforts are concentrated on hardening cloud, technology, and telecommunications infrastructure, and by disrupting adversary positions within those environments.

"The reality is much of this space is in private hands," he said. "Which means success here demands genuine collaboration between government and private sector, which is at the heart of our approach in the NCSC."

But, he said, it's the near space – the defense and resilience of the organizations and systems being targeted – where most action is probably required. The rise of AI is an important factor here, he said.

"Recent developments of frontier AI models have demonstrated their effectiveness at finding inherent vulnerabilities in the technology we rely on," he said.

"Our latest assessment shows that by 2028, it is highly likely that AI-Cyber capabilities will be used by attackers against known vulnerabilities in legacy technology in our critical national infrastructure."

British organizations should take note, said James Neilson, SVP of global at OPSWAT.

"The daily scale of hostile activity against the UK is vast, and until the NCSC revealed those figures, the threat and danger facing critical infrastructure was far greater than most businesses realized," he said.

"Many organizations neglect to secure data that moves in and out of their OT networks. By controlling data flows and scanning files in transit, organizations can detect and neutralise hidden malicious payloads before they infiltrate critical systems."

Horne called on organizations to strengthen cyber resilience by focusing on three core capabilities: understanding their exposure to threats, building stronger defences based on proven security fundamentals, and ensuring they can continue operating and recover quickly after an attack.

"By making our environment harder for adversaries to operate in, and engaging in the contest better, we can play an important part in altering potential adversaries' options and deterring conflict," he said.

Cyber criminals are exploiting AI hype to impersonate the branding of AI platforms such as ChatGPT, Microsoft Copilot, DeepSeek, and Anthropic’s Claude, according to new research.

Microsoft Threat Intelligence said it's observed an uptick in phishing, malvertising, and search engine optimization (SEO)-driven attacks that ultimately lead to credential theft, financial fraud, or malware infection.

Campaigns focus on highly anticipated launches or emerging trends, using tried-and-tested tactics such as urgency-driven messaging, abuse of trusted services, and multi-stage redirection chains that require user interaction to evade detection.

"While traditional lures like invoices, payment notifications, or delivery alerts remain effective and continue to be widely used, AI-themed lures reflect a shift in social engineering that is likely to persist as a long-term tactic used by threat actors, from cyber criminal groups to nation states," the company warned.

ChatGPT users in the crosshairs

In one example, Microsoft said it had observed a ChatGPT-themed phishing attack delivering malicious URLs which led to phishing pages that collected credit card and personal information such as names and addresses.

The emails used the sender display name ChatGPT and the subject line: “To ensure your ChatGPT Plus continues to work – please update your payment method”.

This phishing activity, which consisted of 4,500 emails sent to targets in South Africa, was part of a broader campaign using similar themes and infrastructure that delivered as many as 100,000 emails on a single day to targets in Switzerland, Austria, and South Africa.

Microsoft noted the campaign affected a broad range of industries, including higher education and professional services.

Thousands targeted in a Claude-themed phishing attack

In another example, security experts spotted a phishing campaign impersonating Anthropic-branded services to target users with account-related lures tied to the Claude AI platform.

The campaign sent phishing emails to targets across more than 2,000 organizations, mainly in the US, UK, and India.

"The campaign used enforcement-themed messaging claiming that the recipient’s account was in violation of acceptable use policies and required immediate action," the company noted.

"The emails impersonated Anthropic’s popular AI service Claude using the display names Anthropic Teams and Anthropic PBC, masquerading as legitimate account-related communications. Subject lines followed a consistent structure of 'Claude Appeal Request' combined with date elements."

DeepSeek malvertising is a growing threat

Other examples included malvertising campaigns that use AI-themed terms such as 'Awesome AI Windows Plugin' and 'Flux Pro AI' in social engineering lures, and fake DeepSeek V4 installers on GitHub that delivered Vidar Stealer.

"Within hours of DeepSeek previewing their latest version, V4, attackers created a fake GitHub organization and repository. They copied real branding and benchmark data, added AI and SEO-search-friendly content, and pushed malicious archives that looked like installers," explained John Bruggeman, vCISO at CBTS.

"What the attacker did was not particularly exotic, but it was well timed and convincingly packaged. A user searching for the newest model could very easily end up in the wrong place, especially because the malicious repository showed up in GitHub, Google, Bing, or AI-assisted search results. The search results added legitimacy to the malware."

Remain vigilant

To counter these rising threats, Microsoft advised customers to configure automatic attack disruption in Microsoft Defender XDR, enforce multi-factor authentication (MFA) on all accounts, use the Microsoft Authenticator app for passkeys and MFA, and scope conditional access policies to strengthen privileged accounts with phishing-resistant MFA.

Other tips included:

• Enabling Zero-hour auto purge (ZAP) in Office 365
• Configuring Microsoft Defender for Office 365 Safe Links
• Invest in ‘advanced’ anti-phishing solutions

"The companies that have a handle on AI governance (policies and procedures) well will be the ones that make safe AI use easy, risky AI use visible, and malicious activity hard to ignore. That means publishing a clear list of approved tools, blocking obvious lookalike domains and very recently registered domains can help stop this kind of threat," said Bruggeman.

"Monitoring suspicious downloads and sign-ins, and training employees on the AI-themed lures should also be done right now - don't think that generic phishing examples from five years ago are going to cut it today."

FOLLOW US ON SOCIAL MEDIA

Cybersecurity professionals are less likely to trust a boss who's never been through the mill of managing a major security incident.

Data from antivirus vendor Sophos suggests that CISOs have a one-in-four chance of losing their jobs after an attack. But new research from ISC2 shows that three-quarters of security professionals reckon leaders are more credible if they've already led their organization through a major cyber incident – regardless of how things turned out. Just 9% disagreed.

Overall, the survey revealed that the most trusted security leaders are those who create confidence through transparency, consistency, and an ability to align security priorities with business outcomes. Those who can keep calm and carry on, demonstrating decisive leadership under pressure, are far more likely to earn lasting credibility with their teams and across the enterprise.

Unfortunately, though, cybersecurity bosses don't generally seem to be managing this.

Only 34% of cybersecurity professionals said they were very confident in their current cybersecurity upper leadership, with 15% extremely confident. Three-in-ten said they had moderate confidence, 15% were only slightly confident, and 6% said they had no confidence in their cybersecurity leaders at all.

Security staff are particularly keen on leaders who can communicate risk to senior leadership and boards, with 95% of respondents reckoning this as very important.

Other big pluses included a strategic and long-term cybersecurity vision, along with the ability to effectively work with senior leadership and boards to secure budget, and being transparent about decisions and actions.

Decision-making under pressure, building and leading high-performing teams, and technical cybersecurity expertise were all very important to more than eight-in-ten – more so than actual technical cybersecurity expertise, at 75%.

"The most important trait in a cybersecurity leader is the ability to align security strategy with business goals while earning trust through clear judgment, communication, and accountability," noted one respondent.

Bosses wanting to earn their staff's respect, said ISC2, need to be transparent about risks, priorities, and challenges. "Teams and executives are more likely to trust leaders who provide realistic assessments rather than overly optimistic narratives," the researchers said.

Keeping calm and carrying on in high-pressure incidents or periods of change also boosts a security leader's reputation, while there's much greater trust when leaders manage to create an environment where teams feel supported, heard, and accountable.

Strong cybersecurity leaders invest time in understanding business objectives and collaborating across departments, helping position security as an enabler rather than a blocker.

"For leaders who now find themselves in an environment where cybersecurity risk impacts every part of the organization, it is the ones who communicate clearly, empower their teams and demonstrate calm, decisive leadership under pressure that are far more likely to earn lasting credibility with their teams and across the enterprise," the researchers said.

"Ultimately, the most successful cybersecurity leaders are not simply those who protect systems and data, but those who create trust in their leadership when it matters most."

Cyber attacks are typically associated with data theft and extortion, but another threat can cause just as much damage. As geopolitical tensions rise across the globe, state-sponsored adversaries are preferring to hide in systems, going unnoticed for months or years after the initial compromise.

To perform these so-called living off the land (LotL) attacks, attackers are weaponizing legitimate software and infrastructure to lie in wait. This trend is seeing tactics shift away from data breaches to more sophisticated espionage and disruptive operations, according to a new report from Cloudflare.

Why are LotL attacks growing right now, and how should firms respond to this threat?

Living off the land attacks: long-term campaigns

Cyber attacks usually take advantage of security weaknesses. However, living off the land attacks are different: They are growing in response to organizations strengthening their overall cybersecurity posture, Tony Fergusson, CISO in residence at Zscaler tells ITPro. “Organizations have made significant progress in their ability to detect threats and patch systems more effectively. Consequently, adversaries are being forced to be more stealthy to exploit data, and they’re doing this by leveraging legitimate tools and processes.”

With living off the land attacks, attackers deliberately avoid drawing attention to themselves by using existing and trusted tools and websites, rather than exploiting a zero-day flaw or introducing malware, says Fergusson. “They stay under the radar, blending in seamlessly with legitimate user activity, and mimic everyday operations so their presence goes unnoticed.”

Cloudflare’s 2026 threat report describes a shift away from brute force entry towards high-trust exploitation, with adversaries actively targeting legitimate SaaS, IaaS, and PaaS tools such as Google Calendar, Dropbox and GitHub to camouflage malicious actions within normal enterprise activity.

This isn’t surprising, says Razvan Ionescu, head of offensive security services at Pentest-Tools.com. He describes how his team “consistently finds that organizations have invested heavily in signature-based detection and perimeter controls”. Yet the monitoring of legitimate administrative tooling, endpoint management platforms, cloud management consoles and scripting environments “remains thin”.

State-sponsored and highly-targeted

Living off the land attacks suit a certain type of adversary. The technique is especially attractive to “state-sponsored and highly-targeted threat actors”, according to Dana Simberkoff, chief risk privacy and information security officer at AvePoint.

Rather than seeking immediate financial gain, attackers are aiming for espionage, strategic positioning and in some cases, preparation for future disruption. “Living off the land tactics allow these adversaries to maintain access over long periods without drawing attention,” Simberkoff explains.

Living off the land attacks allow nation states to collect strategic intelligence across diplomatic, military, economic, or technological targets, says Tracey Hannan-Jones, consulting director for information security at UBDS Digital. “By using pre-positioning, attackers gain access to critical systems, so disruption can be triggered during geopolitical tensions.”

Supply chain attacks, seeing adversaries compromising vendors to reach downstream targets, are “easy leverage”, warns Hannan-Jones.

Cloudflare’s report tracked four primary nation state adversaries over the past year: Russia, China, North Korea, and Iran. Each group approaches living off the land attacks differently based on its operational goals, Ionescu tells ITPro.

For example, China appears to have shifted from bulk data theft towards targeting legitimate cloud infrastructure for longer-term pre-positioning, with groups such as FrumpyToad using Google Calendar for command-and-control communication.

“The goal is to create a resilient architecture that remains nearly invisible to standard perimeter defences,” says Ionescu. “Rather than trying to exfiltrate data today, these attackers are establishing persistent footholds now to use during a future geopolitical event.”

Living off the land attacks: businesses most at risk

Certain businesses are more at risk from living off the land attacks than others – especially in critical sectors and those holding data valuable to nation state adversaries.

Organizations with complex digital environments are particularly exposed, says Simberkoff. “Cloud-first enterprises, regulated industries, critical infrastructure providers and companies embedded in large supply chains are at risk.”

The more identities, integrations and third party connections an organization has, the more opportunity attackers have to hide, warns Simberkoff. “Risk also increases for organizations that are strategically interesting to nation state actors, whether because of the data they hold or the role they play in a broader ecosystem.”

Government and defense are prime targets for living off the land attacks. “State actors look at pursuing intelligence and influence, accessing and stealing sensitive data, policy insight and information of geopolitical value, so they can use it against them,” says Hannan-Jones.

Stealthy with technology

Rapidly developing technology such as AI is adding to the risk, allowing attackers to perform increasingly stealthy attacks.

The current shift is subtle. AI is making attacks “more refined”, says Simberkoff. “Instead of fully autonomous attacks, we’re seeing AI used to support reconnaissance, targeting and decision making. This helps attackers understand environments faster and choose techniques that look the most legitimate.”

The result is activity that increasingly resembles normal administrative behavior, which makes detection much more difficult, she warns.

Attackers can use AI to rapidly analyze public information such as organization charts, job postings, technical blogs, vendor documentation and leaked credentials and infer likely tech stacks and access paths, according to Hannan-Jones. “This improves the precision of initial access attempts and reduces the need for noisy trial-and-error.”

How to protect your business from living off the land attacks

Living off the land attacks are a concern, but there are some steps firms can take to boost their security.

Rather than trying to prevent compromise entirely, Simberkoff recommends focusing on “detecting misuse and limiting impact”. She advocates strong identity governance, least privilege access and “detailed logging of administrative activity”.

Ionescu underscores the importance of “understanding your own blast radius”. “Before asking what you’d detect, ask what an attacker with compromised admin credentials to your endpoint management platform, your identity provider or your cloud management console could do,” Ionescu advises. Most organizations haven’t mapped that explicitly.”

The second priority is closing the gap between “what your monitoring covers” and “where attackers actually operate”, says Ionescu. “Effective reconnaissance from an attacker’s perspective focuses on maintaining OPSEC and blending into normal traffic patterns and avoiding detection at the earliest stages of the kill chain. Your detection logic needs to match that: Anomaly detection on administrative actions, not just signature matching on known bad payloads.”

Robust incident response is also key. Protecting your firm from living off the land attacks requires building operational playbooks for “quiet compromise”, says Hannan-Jones. “Many organizations will have playbooks for ransomware, but very few are prepared for stealthy pre-positioning. Define what ‘suspicious admin activity’ looks like in your environment and create response runbooks for identity compromise, token theft and privileged account misuse.”

The main risk from hospital cyber incidents is no longer data breaches or IT disruption – it's direct threats to care delivery.

According to a Black Book Research survey of 284 European hospital cybersecurity buyers, 82% rate their 2026 cyber attack concern as very high or extreme, while 74% believe their organization is likely or highly likely to face a major cyber event this year.

And, the researchers found, attacks are no longer viewed primarily as privacy events, compliance events, or IT disruptions – but as threats to the delivery of care.

"Europe's hospitals are operating in one of the most complex cyber-risk environments in the world: nationally connected health systems, public-sector capacity pressure, cross-border supplier ecosystems, aging infrastructure, accelerated cloud migration, strict regulatory accountability, and clinical operations that cannot go offline," said Doug Brown, founder of Black Book Research.

"Attackers know the pressure points. They are not only targeting data; they are targeting authentication, availability, recovery windows, third-party dependencies, and the fragile digital workflows that move patients through emergency departments, labs, imaging, pharmacy, theatres, ICUs, and discharge."

As a result, European hospital cybersecurity buying has shifted sharply from breach prevention toward clinical continuity. Two-thirds are investing in identity, IAM, PAM, SSO failover and break-glass access, and 57% in ransomware recovery, immutable backup, and read-only clinical access.

Just over half are looking to network segmentation, zero trust, and ZTNA, 46% to incident-response retainers and crisis-response services, and 45% to third-party supplier and vendor cyber-risk management. Meanwhile, 37% are investing in medical device/IoMT security, and 29% in cyber range, downtime simulation, and resilience exercise services.

However, while 78% of survey respondents said their board receives general cybersecurity risk updates, only 31% receive cyber-resilience metrics tied to clinical continuity.

Only a quarter reported a full clinical downtime simulation within the past 12 months, and 32% said their organization had never conducted a full clinical downtime simulation, had only completed tabletop activity, or did not know when the last exercise occurred.

Worryingly, while 59% of respondents said they were confident that their hospitals could operate safely for 24 hours without core Electronic Health Record (EHR) access, that figure fell to 32% at 48 hours and just 14% at 72 hours.

"The 72-hour number should disturb every hospital board and ministry-level health technology leader in Europe. A hospital that can improvise through the first day of downtime is not necessarily resilient," said Brown.

"By day two and day three, medication reconciliation, laboratory turnaround, radiology workflow, identity access, pharmacy verification, transfer coordination, discharge planning, and backlog reconciliation become patient-safety risks. Cyber resilience is now an operational medicine issue."

The health sector is an increasingly popular target for cyber criminals, thanks to its critical nature. And many attacks have led to problems delivering patient care, including a 2024 ransomware attack on NHS pathology provider Synnovis, and, more recently, an attack on medical technology firm Stryker being described by the firm as 'destructive, not ransomware'.

"In Europe, the cyber battleground has moved from the server room to the bedside," said Brown.

Attacks on operational technology (OT) are surging, according to new research, with industrial organizations the biggest target of ransomware in every single month over the last year.

According to a new analysis from cyber security firm NCC Group, in the 12 months to March 2026, industrial organizations experienced 2,073 ransomware attacks, accounting for 30% of all ransomware activity.

Manufacturers of capital goods such as machine equipment and infrastructure were particularly hard-hit, accounting for 1,192 attacks. Within this industry, machinery was the most-targeted sub-sector, with 442 attacks, followed by construction and engineering with 394.

“Our data shows that many organizations continue to prioritize IT security while underestimating the exposure of their operational environments," said Ray Robinson, OT director at NCC Group.

"When OT systems are disrupted, the impact goes far beyond data loss - production can halt, essential services can be disrupted, and in some cases, lives can be put at risk.”

Governments worldwide are growing increasingly concerned about the issue. In the UK, Network and Information Systems (NIS) Regulations require operators of essential services to put proportionate technical and organizational measures in place to manage cyber risk across both IT and OT environments.

Meanwhile, the Cybersecurity Act and sector-specific guidance cover OT governance, incident reporting, resilience, and supply-chain security.

“Regulators are increasingly clear that OT environments fall within scope of cyber resilience obligations, particularly where systems support essential services or public safety," said Katarina Sommer, global head of government affairs and analyst relations at NCC Group.

"Organizations that focus compliance efforts solely on IT risk are exposing themselves to operational, regulatory and safety consequences, so it’s key that organizations treat OT risks in the same way they approach IT security.”

Earlier this year, the National Cyber Security Centre (NCSC), along with US, Australian, Canadian, and European authorities, issued a new guide for OT owners and operators aimed at helping them integrate 12 security considerations into their procurement processes.

These include making sure that the product allows for security and safety logging, has strong authentication controls, protects data, is configured in a secure way by default, and is supported by established vulnerability management processes by the manufacturer.

“As cyber attackers increasingly target operational technology around the world, it has never been more vital for critical infrastructure operators to ensure security is baked into the systems they use," said Jonathon Ellison, NCSC director of national resilience and future technology.

State-backed hackers targeting operational technology

Many attacks on OT systems come from nation state-affiliated actors, with the US Office of the Director of National Intelligence warning in its 2026 Annual Threat Assessment of the US Intelligence Community that China, Russia, Iran, and North Korea will continue to target the sector.

US director of national intelligence, Tulsi Gabbard, said nation state-backed threat groups typically target these systems to collect intelligence, create options for future disruption, and also for financial gain.

"China and Russia present the most persistent and active threats and are continuing their R&D efforts. North Korea’s cyber program is sophisticated and agile," she said.

"In 2025 alone, North Korea’s cryptocurrency heists probably stole $2 billion which is helping to fund the regime, including further development of its strategic weapons programs."

Recent targets have included Jaguar Land Rover (JLR), US water and wastewater systems and electrical subsystems, and the Ukraine power grid.

FOLLOW US ON SOCIAL MEDIA

The parent company behind academic management tool Canvas has issued an apology over disruption caused by a recent cyber attack, which impacted hundreds of institutions.

In a blog post on 11 May, Steve Daly, CEO of Instructure, said the company plans to introduce sweeping changes in the wake of the breach, insisting that Canvas is “fully operational and remains safe to use”.

Daly added that Instructure will continue providing assistance and guidance for institutions affected by the cyber attack.

“Rebuilding trust takes time,” he said. “We’re going to earn it back through consistent action and honest communication. We’re in this for you and your community.”

The apology comes after hundreds of schools and universities across the UK, Canada, Australia, US, and New Zealand were disrupted by a cyber attack waged by the ShinyHunters threat group.

The cloud-based academic management system is used by more than 8,000 institutions globally and has around 30 million active users.

Instructure first detected a breach on 1 May, but told customers it had taken steps to contain the incident.

In an advisory at the time, CISO Steve Proud warned data, including names, email addresses, student ID numbers, and messages between users had been impacted - which Daly confirmed in his recent blog post.

“This incident involved unauthorized access to part of our environment. The data fields involved include information like usernames, email addresses, course names, enrolment information and messages,” Daly wrote.

“Core learning data”, which includes course content, credentials, and student submissions, was not compromised in the breach, he added.

Canvas Cyber attack escalation

While Proud noted that the incident had largely been contained, the incident was compounded when ShinyHunters waged a follow-up attack, which saw user login portals defaced with a ransom note.

ShinyHunters claims to have gained access to around 3.65TB of Instructure data during the attack, which includes upwards of 275 million records from over 8,800 institutions.

Analysis of ShinyHunters activity ranks it as one of the most notorious ransomware groups in recent years. The group has claimed responsibility for a slew of attacks on major organizations such as Salesforce, Ticketmaster, and AT&T.

According to Daly, the Canvas attack saw ShinyHunters exploit a support ticket vulnerability in its Free for Teacher environment. The company has moved swiftly to contain the breach.

“We temporarily disabled Free for Teacher while we complete a full security review,” he said. “We know that’s disruptive, and we didn’t make that call lightly. But keeping the entire Canvas platform secure has to come first.”

“We didn’t deliver”

In his blog post, Daly said Instructure will continue providing updates and apologized for the company’s communication throughout.

“Over the past few days, many of you dealt with real disruption,” he wrote. Stress on your teams. Missed moments in the classroom. Questions you couldn’t get answered.”

“You deserved more consistent communication from us, and we didn’t deliver,” Daly added. “I’m sorry for that.”

The attack on Canvas comes during a busy period for academic institutions, with students in the midst of exams.

A slew of reports have detailed significant disruption for students on both sides of the Atlantic over the last week, with BBC coverage noting that Mississippi State University was forced to postpone exams.

As ITPro reported, students at the University of Oxford were unable to access papers and were forced to email lecturers for documents and results.

FOLLOW US ON SOCIAL MEDIA

Universities across the world are still experiencing difficulties after a cyber attack on the Canvas academic platform caused widespread disruption for staff and students.

Canvas is a cloud-based academic management system developed by Instructure, and is used by more than 8,000 institutions globally and around 30 million active users.

Staff and students at universities in the US, Canada, Australia, and the UK were severely disrupted when the platform was breached, with a ransom note allegedly from the ShinyHunters threat group appearing on login portals.

A host of UK-based academic institutions, including the Universities of Birmingham, Oxford, and Edinburgh were among those impacted in the breach.

Sources told ITPro that operations at the University of Birmingham are back online in the wake of the incident. However, the University of Oxford has warned students and staff that Canvas remains offline, with no confirmed date of return.

ITPro approached both institutions for confirmation, but did not receive a response by time of publication.

What happened with the Canvas cyber attack?

Instructure initially confirmed a breach occurred on 1 May, but had taken steps to contain and remediate the incident. According to the company, data exposed in the incident is believed to include “certain identifying information”, such as:

• Names
• Email addresses
• Student ID numbers
• Messages between users

Instructure’s chief information security officer (CISO), Steve Proud, said the company found “no evidence that passwords, dates of birth, government identifiers, or financial information were involved”.

On 2 May, Proud noted that the incident had been largely contained. However, ShinyHunters reportedly breached the company in a follow-up attack, defacing Canvas login portals at hundreds of institutions.

Analysis of the incident by Halcyon noted that ShinyHunters injected an HTML file that altered login screens, displaying a warning that the group will publish stolen data on 12 May if the company fails to pay a ransom.

On its leak site, ShinyHunters claims to have gained access to a sizable amount of company data – spanning 275 million records from 8,809 institutions, amounting to 3.65TB.

ShinyHunters ranks among one of the most prolific ransomware groups in recent years, having claimed responsibility for large-scale attacks on Salesforce customers, as well as AT&T and Ticketmaster.

Researchers at Halcyon noted that the group does not employ encryption during attack, but instead operates under a “pay or leak” extortion model.

“The group maintains a loosely decentralized structure with operational overlap among Scattered Spider (UNC3944), LAPSUS$, and Scattered LAPSUS$ Shiny Hunters (SLSH),” researchers said in a blog post detailing the incident.

ITPro has approached Instructure for comment.

Critical timing for ShinyHunters

The attack on Canvas comes at a critical time for institutions globally, with students preparing for exam season.

According to reports from BBC News, Mississippi State University was forced to postpone exams on Friday due to the incident. A meteorology student told the broadcaster that students were nearing exam deadlines when the platform was taken down.

The university has been engaging with students via email and told students it was affected by a “nationwide security incident”.

Sources told ITPro that students at the University of Oxford have been experiencing similar difficulties, with some unable to access papers and having to email lecturers for attached documents.

Universities in a host of other US states, as well as in Canada, New Zealand, and Australia have also experienced significant disruption.

The University of Sydney, for example, told students that Canvas was unavailable on Friday and warned students not to log in.

FOLLOW US ON SOCIAL MEDIA

A fake Claude AI website is spreading a trojanized 'Claude‑Pro' Windows installer that secretly distributes a newly-identified backdoor.

The domain mimics the official site for Anthropic’s Claude AI tool, and visitors who download the ZIP archive are sent a copy of Claude that appears to install and runs as expected.

However, researchers at Malwarebytes found it deploys a PlugX-like malware chain, dubbed Beagle, that gives attackers remote access to the system.

The ZIP contains an MSI installer that installs to a path designed to mimic a legitimate Anthropic installation, complete with a reference to Squirrel, the update framework that real Electron-based applications like Claude use.

A tell-tale giveaway for developers is that this contains a misspelling: ‘Cluade’.

While the legitimate application runs in the foreground, the VBScript quietly copies three files from the SquirrelTemp directory into the Windows Startup folder.

"This is a textbook DLL sideloading attack, a technique catalogued by MITRE as T1574.002. NOVUpdate.exe is a legitimately signed G DATA antivirus updater. When it executes, it attempts to load a library called avk.dll from its own directory," researchers explained..

"Normally, this would be a genuine G DATA component, but here the attacker has substituted a malicious version. Signed sideloading hosts like this can complicate detection because the parent executable may appear benign to endpoint security tools.

Victims are kept in the dark, because after deploying the payload files, the VBScript writes a small batch file called ~del.vbs.bat that waits two seconds, then deletes both the original VBScript and the batch file itself.

"This means the dropper is gone from disk by the time a user or analyst goes looking for it. The only artifacts that persist are the sideloading files in the Startup folder and the running NOVUpdate.exe process," Malwarebytes said.

"The script also wraps the entire malicious payload section in an On Error Resume Next statement, silently swallowing any errors so that failures in the deployment do not produce visible error dialogs that might alert the victim."

What is DLL sideloading?

DLL sideloading is a technique favored by PlugX, a malware family that Sophos has been tracking for 14 years.

As the firm points out, PlugX has multiple variants and has been associated with several threat actor groups, meaning that attribution isn't clear-cut.

On top of this, ShadowPad, another backdoor employing DLL sideloading, has a number of code overlaps with PlugX, to the extent that it could be considered an evolution of it.

"Most of the techniques described here are relatively well known and have been seen before, from spoofing a legitimate installer website to side loading using a signed executable. Interestingly enough what is unusual is that it also installs a working copy of Claude which is rather large," said Max Gannon, cyber intelligence team manager at Cofense.

"The installation and usage of a program that is resource intensive can also help to disguise other ongoing background activity. The use of a legitimate program, cleanup utilities, running in memory, and persistence mechanisms all indicate that the threat actors distributing this malware intend it for long term persistence and use."

FOLLOW US ON SOCIAL MEDIA

From industrial robots to fitness trackers, Internet of Things (IoT) devices track real-time data to underpin smart systems and allow for data-driven decision-making.

From the most advanced applications, such as autonomous robots on factory floors, to thermostats, security cameras, and even network-connected printers, IoT devices are widespread and hugely beneficial to businesses.

But along with their benefits, IoT devices also introduce new risks by expanding an organization’s perimeter and acting as easy entry points for enterprise systems.

Once attackers compromise a vulnerable device, they can steadily and stealthily push further into an organization’s systems, bringing down critical infrastructure. Threat actors may also seek to take persistent control of IoT devices to form botnets.

An IoT botnet is a network of compromised IoT devices that attackers remotely manipulate to launch large-scale cyber attacks, typically in the form of distributed denial of service (DDoS) attacks.

In October 2025, Microsoft Azure was hit with a record-breaking multi-vector, cloud DDoS attack that peaked at 15.72 Tbps and 3.64 billion packets per second. It targeted a single edge device in Australia and was later linked to the Aisuru IoT botnet, notorious for exploiting compromised home routers and surveillance cameras. Although the threat was neutralized, the attack goes to show the scale at which endpoint devices can be weaponized. The campaigns are often strikingly fast and unprecedented.

True to form, the attacks carry on in 2026.

In January, RondoDox, a Linux-based IoT botnet, moved swiftly to exploit a critical remote code execution vulnerability in HPE OneView, launching over 40,000 automated attacks that targeted government, financial, and industrial systems. The rapid assault led the US Cybersecurity and Infrastructure Security Agency (CISA) to list the flaw as a known exploited vulnerability.

Cybersecurity firm Check Point’s investigation into the botnet’s activity revealed it operated from a single Dutch IP address, highlighting the sophisticated nature of the attack. In terms of attack frequency, the United States saw the largest number of attacks, followed by Australia, France, Germany, and Austria.

The month of January also saw the Kimwolf botnet, the Android variant of the Aisuru malware, grow to over two million infected hosts. Most infections stemmed from vulnerabilities in residential proxy networks, giving attackers access to devices on internal networks. Prime targets included Android TVs and streaming devices with exposed Android Debug Bridge (ADB) services.

Later in March, a new malware strain called KadNap made its presence felt. Identified by Black Lotus Labs, the threat research and operations unit at Lumen, KadNap infiltrated over 14,000 edge devices with the majority being Asus routers. KadNap’s threat lies in its ability to enlist infected devices in the Doppelgänger proxy service, providing bad actors with a means to execute anonymous DDoS campaigns.

Law enforcement activity and shifting attacks

Law enforcement takedowns of cyber groups are a recurring feature of the cybersecurity landscape and 2026 has been no exception to this rule. Agencies in the US, Germany‌, and Canada launched a coordinated action to quash a cluster of IoT botnets – Aisuru, KimWolf, JackSkid, and Mossad. Collectively, these botnets are estimated to have infected more than 3 million devices worldwide.

IoT attacks are relentless. They are, at best, a constant test of cyber vigilance.

Following the outbreak of the US-Iran war, Iranian hacking groups have shifted their focus to surveillance cameras with internet connectivity in Israel and other Middle Eastern countries, according to Check Point researchers.

“Starting February 28, we observed a spike in targeting of IP cameras in several countries in the Middle East including Israel, UAE, Qatar, Bahrain, Kuwait and Lebanon, while also similar activity occurred against Cyprus,” Check Point stated in its recent report.

“The attack infrastructure we track combines specific commercial VPN exit nodes (Mullvad, ProtonVPN, Surfshark, NordVPN) and virtual private servers (VPS), and is assessed to be employed by multiple Iran-nexus actors.”

How to secure devices on your network

For enterprises, IoT is part of a growing attack surface that calls for stronger safeguards. Device authentication, encryption, and DNS filtering are some practical measures you can take to limit exposure to IoT attacks.

Regularly patching software and firmware adds another layer of security by preventing hackers from taking advantage of known vulnerabilities. Opting out of non-essential, optional, or rarely-used online features further expands your devices’ safety net.

Your passwords, by far, matter more than any other security setting. Remember, it takes just one rogue IoT device to spread malware like wildfire. The risks keep multiplying – especially when your watch, phone, and desktop share the same network. Using a different password for each device and application is a simple yet impactful shield against credential-based attacks.

More devices than ever are now smart and connected. Keeping your security just as smart by proactively securing your edge devices is an imperative, not an optional test.

Microsoft has issued an alert over a large-scale credential theft campaign that uses lures centered around corporate codes of conduct.

The emails were related to internal compliance or regulatory issues, with display names such as 'Internal Regulatory COC', 'Workforce Communications', and 'Team Conduct Report'.

Subject lines included 'Internal case log issued under conduct policy' and 'Reminder: employer opened a non-compliance case log'.

The emails were sent using a legitimate email delivery service, likely originating from a cloud-hosted Windows virtual machine (VM).

The accusations and repeated time-bound action prompts created a sense of urgency, Microsoft researchers said. Similarly, the emails were based on polished, enterprise-style HTML templates with structured layouts and authenticity statements, making them appear more credible than most phishing emails.

The bodies of the messages claimed that a code of conduct review had been initiated, referenced organization-specific names embedded within the text, and instructed recipients to open a PDF attachment to see the materials of the case.

When clicked, users were first directed to one of two attacker-controlled domains - acceptable-use-policy-calendly[.]de or compliance-protectionoutlook[.]de.

The landing pages displayed a Cloudflare CAPTCHA, presented as checking that the user was coming 'from a valid session', and that likely served as a gating mechanism to impede automated analysis and sandbox detonation.

According to Microsoft, the attack chain ultimately led to a legitimate sign-in experience that formed part of an adversary in the middle (AiTM) phishing flow.

Unlike traditional credential harvesting, AiTM attacks intercept authentication traffic in real time, bypassing multifactor authentication (MFA).

As a result, the attackers were able to proxy the authentication session and capture authentication tokens that could provide immediate account access.

"Phishing campaigns continue to improve sophistication and refinement in blending social engineering, delivery and hosting infrastructure, and authentication abuse to remain effective against evolving security controls," the researchers warned.

What industries are affected?

Between 14 and 16 April this year, the Microsoft Defender Research team said it spotted a series of campaigns targeting more than 35,000 users across over 13,000 organizations in 26 countries. Most targets - 92% - were located in the US.

The campaign didn't focus on a single vertical but instead impacted a broad range of industries, most notably healthcare and life sciences (19%), financial services (18%), professional services (11%), and technology and software (11%).

Microsoft said organizations should review the recommended settings for Exchange Online Protection and Microsoft Defender for Office 365 to check for essential defenses and the ability to monitor and respond to threat activity. They should also invest in user awareness training and phishing simulations.

Enabling Zero-hour auto purge (ZAP) in Defender for Office 365 is advised to quarantine sent mail in response to newly acquired threat intelligence. Users are also urged to retroactively neutralize malicious phishing, spam, or malware messages that have already been delivered to mailboxes.

It's also worth manually checking for, and purging, unwanted emails containing URLs and/or Subject fields that are similar, but not identical, to those of known bad messages.

Organizations should enable password-less authentication methods or use authenticator apps, researchers said, and strengthen privileged accounts with phishing resistant MFA.

FOLLOW US ON SOCIAL MEDIA

North Korean hackers are targeting software developers in a new malware campaign that uses a fake interview process to steal cryptocurrency.

The campaign targets developers, especially those in the finance and technology industries, with profiles on freelance websites such as Upwork or Fiverr. It offers well-paid job opportunities and targets specific, high-value individuals.

It uses typosquatting or compromised legitimate npm repositories that victims are persuaded to inadvertently download and execute.

Researchers at the Sophos Counter Threat Unit have attributed the campaign to Nickel Alley, a threat group operating on behalf of the North Korean government.

"The group notoriously targets professionals in the technology sector by advertising fake job opportunities, deceiving prospective candidates through a fake job interview process, and ultimately delivering malware," the company said in an advisory.

As part of its attacks, Nickel Alley often creates a fake LinkedIn company page to build credibility, with a coordinating GitHub account for malware delivery.

The website homepage is generic and advertises 'tech talent' and managed service solutions. However, different domains are included on the LinkedIn company page and the GitHub account – which researchers noted shows inconsistency and lack of attention to detail.

Nickel Alley ramping up operations

The advisory from Sophos comes after a June 2025 X post warned of a campaign involving targeted emails promoting job opportunities at the fake Astra Byte Sync company.

The threat actors hadn't actually built the website at the time the emails were sent, meaning that the site simply displayed the hosting provider’s default page.

Over the last year, the group has used the popular ClickFix tactic to deliver PyLangGhost RAT malware via fake job skills assessment tasks.

This involved the attacker-controlled web interface presenting an error informing the victim that they must run a command locally to fix the issue – a command that instead initiated a series of actions leading to PyLangGhost RAT.

It previously used a GoLang-based version known as GoLangGhost RAT.

Meanwhile, in October, Sophos analysts uncovered a targeted attack where the threat actors convinced a victim to download, or clone, the content of a GitHub repository and execute the code locally using the 'npm install' and 'npm start' commands.

The GitHub account masquerades as a software development company specializing in full stack web development and blockchain solutions, and contains links to an 'official' company website and a fake LinkedIn company page.

While the main aim of these attacks appears to be cryptocurrency theft, Sophos said the threat group has also made it clear that it plans to use initial access for further supply chain compromise or corporate espionage.

"Additionally, the threat group has strategically selected follow-on payloads based on profiling victims’ system. Software developers, especially those in the finance and technology industries, are at elevated risk due to Nickel Alley’s targeting profile," Sophos warned.

"Organizations should monitor command execution and network traffic that spawns from Node.js processes, as it may indicate malware retrieval. As a general security practice, organizations should encourage employees to report suspicious unsolicited social media or email-based recruitment contact."

FOLLOW US ON SOCIAL MEDIA

Cyber criminals are shifting away from high-volume “spray and pray” threat campaigns toward more targeted attacks to “maximize impact against fewer victims”.

That’s according to new research from SonicWall, which recorded a 20% increase in the number of compromised organizations across the UK last year, even as broader ransomware volumes fell by 87%.

SonicWall noted that smaller businesses are among those most likely to be targeted in “big game hunting” ransomware campaigns. Figures published by the firm show ransomware was used in 88% of SMB breaches, for example.

That marks a stark contrast to larger enterprises, in which just 39% of cases involved ransomware.

“The UK data for 2025 highlights ransomware is evolving into Big Game Hunting,” said Spencer Starkey, executive VP for EMEA at SonicWall.

“On the surface, the 87% drop in overall attack volume might look like progress, but the reality is more alarming. More organisations are being successfully hit, and attackers are doing it with far greater precision."

Targeting “zombie tech”

SonicWall noted that threat actors are prioritizing attacks on organizations with less mature security environments, but also those operating on outdated infrastructure, or “zombie tech”.

Researchers highlighted a single decade-old vulnerability in Hikvision IP cameras accounted for 67 million attempted cyber attacks in the UK alone last year, representing 20% of all intrusion activities observed by the firm.

This single case underlines the risks posed to enterprises by vulnerabilities flying under the radar, according to SonicWall – and it comes at a time when flaws are being exploited at an even quicker pace.

Around 80% of IT leaders said they believe their organisation can detect a breach within eight hours, yet SonicWall findings show attackers can remain undetected for an average of around 181 days.

Automated threats are also growing, posing even bigger challenges for security teams. AI-enabled attacks increased by 89% in 2025, researchers noted, and bots are now generating 36,000 scans per second, scouring the web for potential vulnerabilities.

“Zombie Tech continues to haunt UK networks. We’re seeing millions of attacks tied to a single long-known vulnerability, alongside continued exploitation of issues first disclosed more than a decade ago,” Starkey said.

“Threats are becoming more sophisticated at the top end, while remaining highly exploitable at the base and organizations must address both.”

FOLLOW US ON SOCIAL MEDIA

Over the last few years, the threat from Iran-based cyberattacks has been quietly growing. The country was not previously seen as the most capable nation state, compared to its fellow CRINK adversaries, but when Israel and the US hit Iran with airstrikes at the end of February, along with cyber operations, the threat began to escalate.

At the start of March, the UK National Cyber Security Center (NCSC) issued a warning that there “is almost certainly a heightened risk of indirect cyber threat” for organizations who have a presence or supply chains in the Middle East.

Then in mid-March, a suspected Iran-linked cyberattack disrupted global systems at medical technology giant Stryker.

US-based security firm DigiCert has tracked 5,800 cyberattacks mounted by 50 different groups tied to Iran. So what’s the real threat to business in the US and UK during the current critical situation?

The current threat

From a tactical point of view, Iran’s plan is to “leverage global economic pain through any means”, according to Ian Thornton-Trump, CISO at Inversion6.

This includes cyber attacks to allow the regime to stay in power, he explains. “Iran aims to survive and extract concessions by weaponizing vulnerabilities in energy supply chains and chokepoints, with cyber operations as cost‑effective force multipliers.”

Adding to complexity, it isn’t always clear who is perpetrating attacks. Using proxies and cyber fronts helps Iran “maintain legal and attributional fog”, complicating retaliation and “keeping the country below thresholds that would unify great‑power opposition”, according to Thornton-Trump.

Handala – the group that claimed it had attacked Stryker in retaliation for US strikes – is widely regarded as a front for Iran's Ministry of Intelligence. In the March attack, the hacking collective claimed to have wiped more than 200,000 devices and forced Stryker to shut down offices in dozens of countries. This attack is relevant to businesses, experts say.

“We need to be alert to how it weaponised Microsoft Intune, the same legitimate device management tool in widespread use in UK business, to trigger mass remote wipes,” says Rob Anderson, head of reactive consulting services at Reliance Cyber.

Covert attacks

Wipers are a long-time tactic of Iran, and will continue to pose issues. But another thing to be aware of is how the nationwide internet outage since 28 February is impacting the cyber environment in Iran, according to the US Center for Strategic and International Studies.

The current blackout could “function as a defensive cyber tool for the regime to reduce the effectiveness of additional cyber intrusions and information operations from outside the country”, it said. At the same time, connectivity loss complicates attribution of future cyber incidents, obscuring whether disruptions originate from state-imposed controls or external cyberattacks.

Meanwhile, there is another immediate cyber threat from “the activation of long-standing access within Western networks”, according to Ruth Wandhofer, head of European markets at Blackwired.

For businesses across the globe, the real threat is “a long tail of proxy actors, diaspora hacktivists and pre-planted access that was quietly embedded in Western networks long before the first missile flew”, agrees Anderson. “These cells don't need Tehran online to act. Despite the blackout, approximately 60 hacktivist groups, including pro-Russian collectives activated outside Iran within days of the strikes.”

For years, Iranian-aligned actors have “quietly implanted malware, compromised credentials and maintained persistent footholds in sectors such as healthcare, logistics, aviation and energy”, Wandhofer says.

At the same time, Iran-linked hackers are still using traditional techniques such as wiper malware, phishing, credential theft and remote access tools. “But they are now deployed in coordinated campaigns – as seen in the Stryker attack,” says Wandhofer.

Iran could also ramp up its use of distributed denial of service (DDoS) attacks, which are not necessarily sophisticated, but can be disruptive.

Travis DeForge, director of cyber security at Abacus describes how Iran-linked adversaries could hit public sector and critical services with DDoS. “Not only is it extremely disruptive, they also get a big pay-off in propaganda value.”

Business targets for Iran-backed hackers

Any public sector or critical infrastructure organization is a target for Iran, as is any company with a presence in the Middle East, according to DeForge. “That can extend to obvious supply chain links,” he adds.

Energy, healthcare, defense supply chains and financial services top the list. US defense contractors, government vendors and businesses with Israeli ties face “the sharpest direct exposure”, says Anderson. “But critical infrastructure such as hospitals, ports, water plants and railways are squarely in scope too.”

Iran amplifies kinetic pressure by “probing for cascading failure in digitally-interconnected energy and trade systems”, says Thornton-Trump, “These include port operations and shipping lanes to refineries and grids, accelerating market panic and political pressure on its adversaries.”

OilRig and other Iran‑linked groups show a persistent focus on energy, finance, telecoms and supply‑chain infiltration techniques, according to Thornton-Trump. He says threat intelligence overviews show evolution towards “identity‑centric cloud intrusions, wipers, and psychological ops aligned to crises”.

Businesses throughout the UK and US are both at risk from Iran cyber-attacks. However, the US is “the primary target by some distance”, says Anderson. “It carries the vast majority of identified asset exposure, with healthcare and government the most affected sectors.”

The UK's risk is more indirect, but shouldn't be dismissed. “With Iranian actors going after cloud identity infrastructure, the supply chain risk travels fast and doesn't respect geography,” Anderson warns.

Protecting your business

The risk of attack is growing, but most firms can boost resilience by ensuring foundational security hygiene. “The to-do list isn't glamorous, but it is urgent,” according to Anderson. “Patch systems, keep firewalls current, enforce multi-factor authentication (MFA) and remove stale accounts. Scrutinise who holds privileged access to device management platforms such as Intune.”

With supply chains likely to be hit, the security of partner organizations must also be re-examined, with greater due diligence applied to third-party risk and access controls, according to DeForge.

As with any threat, businesses should “treat cyber conflict as a board-level operational risk”, says Wandhofer. Immediate priorities include “reducing reliance on legacy systems, improving patch management and addressing known vulnerabilities that attackers frequently exploit”, she says.

CISOs in energy, maritime, finance, and water should “assume targeted system probing during kinetic peaks,” says Thornton-Trump. He recommends MFA on remote access, removing publicly-exposed operational technology and eradicating default credentials, as well as ensuring segmentation and “immutable backups”.

Firms should have an incident response plan in place and expect identity‑centric intrusions from Iran-linked attackers such as APT 33 and 34, Thornton-Trump warns. “Harden cloud and identity and access management and monitor for wiper precursors and proxy‑linked information ops designed to induce panic.”

Oil and gas firm Zephyr Energy has reported that one of its US subsidiaries has suffered a cyber intrusion that allowed the attackers to siphon off hundreds of thousands of pounds.

The London-headquartered company said the incident saw a contractor payment diverted to an account controlled by threat actors. The company confirmed around £700,000 was lost in the incident.

"Upon discovery of the incident, the company immediately notified the relevant law enforcement authorities and is working with the corresponding banks and consultants to attempt to recover the diverted funds," the company said in a regulatory filing with the London Stock Exchange.

Zephyr noted that the incident has been contained and IT systems have been thoroughly assessed by a leading cybersecurity consultancy.

Operations and corporate activities are continuing as normal, but its own internal IT teams are keeping a close eye on company systems.

"While Zephyr uses industry standard practices in relation to its technology and payment systems, additional layers of security have been implemented as a result of this attack," it added.

"The company's board of directors can confirm that the company has more than sufficient working capital to ensure that this isolated matter will not impact the company's ability to perform its ongoing operations."

Zephyr Energy attack: What happened?

There's no information on how the attack actually took place, but it has all the hallmarks of a business email compromise (BEC) incident.

Via phishing campaigns, hackers typically gain access to email inboxes or accounting systems that enables them to change bank details during payment or invoice processing, in what's known as an adversary in the middle (AiTM) attack.

Earlier this year, Microsoft warned that AiTM campaigns targeting cloud collaboration platforms such as Microsoft SharePoint and OneDrive were on the rise.

The tech giant specifically highlighted energy companies among those at highest risk of targeting.

At the time, Microsoft’s Defender Research Team said attackers were abusing SharePoint file sharing services to deliver phishing payloads, and had succeeded in compromising a number of accounts.

In terms of mitigation, because the sign-in session is compromised, simply resetting passwords doesn't work. The company outlined a series of steps that organizations should take to mitigate risks, including:

• Using conditional access policies, especially risk-based access policies
• Implementing continuous access evaluation
• Investing in advanced anti-phishing solutions
• Continuous monitoring for suspicious or anomalous activities

FOLLOW US ON SOCIAL MEDIA

Hasbro has had to pull systems offline after a hacking incident hit the toy maker.

The corporate website for Hasbro continues to be offline, with the company saying it may take weeks to recover, though its wider operations remain open. The famous company's brands include Play-Doh, Monopoly, and Peppa Pig, among many others.

Hasbro has yet to respond to ITPro for comment, but told the BBC: "While this is an unfortunate incident, Hasbro's business operations remain open. We have taken swift action to protect our systems and data."

Further details about the nature of the incident, the criminals behind the attack, and whether customer data has been accessed have yet to be released, with Hasbro saying its investigation was ongoing and includes an external security company.

Hasbro hack: What happened?

In a filing yesterday with the US Securities and Exchange Commission, Hasbro said it spotted unauthorized access to its network on 28 March.

"Upon discovery, the Company promptly activated its security incident response protocols, implemented containment measures, including proactively taking certain systems offline, and launched an investigation with the assistance of third-party cybersecurity professionals," the company said in the filing.

Hasbro said its investigation was ongoing, and the full scope of the impact wasn't yet clear. As yet, Hasbro hasn't revealed whether customer data has been affected, but said it was working to "identify and review the files potentially impacted."

"The Hasbro incident is a clear reminder that global brands with expansive digital ecosystems are increasingly exposed, not just through customer platforms but across internal systems and supply chains," said Darren Williams, CEO of BlackFog.

Williams added that the biggest risk now is whether any data was stolen.

"For companies like Hasbro, the combination of customer data, licensing agreements, and intellectual property makes any stolen information highly valuable," he said.

Business continuity

Despite the corporate website remaining offline, the business continues to operate.

"The company has implemented and continues to implement business continuity plans to enable it to continue to take orders, ship product and conduct other key operations while it resolves this situation," Hasbro said in the filing.

"The need to run these interim measures may continue for several weeks before the situation is fully resolved and may result in some delays."

Trevor Dearing, director of critical infrastructure at Illumio, said it's clear that Hasbro had business continuity plans in place, letting operations stay up and running even when some systems are taken offline.

"Last year, we saw the significant impact on the retail industry when businesses have halted operations," Dearing added. "Unlike many organizations, Hasbro has shown that having the right protocols and preparations in place means that a cyber incident doesn’t have to be a disaster."

Dearing added: "Security today is about knowing that breaches are inevitable, but disasters are optional. We need to see more of this kind of resilience, where essential services remain operational while the root cause is investigated and resolved. This realization is key to maintaining trust and continuity during a cyber attack."

FOLLOW US ON SOCIAL MEDIA

Attackers have compromised the npm account of Axios and published malicious versions to spread remote access trojans (RATs) to millions of developers.

Axios is a JavaScript HTTP client and is one of the most popular packages on npm, with more than 100 million weekly downloads. It manages requests between clients, such as browsers or Node.js apps, and servers.

On Monday, two malicious updates, axios@1.14.1 and axios@0.30.3, were published, apparently through the compromise of the npm account of axios’ primary maintainer Jason Saayman.

The updates were identified almost immediately by several security firms and remained live for around two or three hours. The malicious versions introduce a dependency that executes during installation and deploys a cross‑platform remote access trojan (RAT) targeting macOS, Windows, and Linux.

The malware communicates with a command and control (C2) server to retrieve platform‑specific second‑stage payloads, researchers noted. After execution, it deletes itself and replaces its own package.json with a clean version to evade forensic detection.

According to StepSecurity, the malicious dependency was staged 18 hours in advance, with separate payloads pre-built for all three operating systems. Both release branches were poisoned within 39 minutes of each other.

StepSecurity added that within two seconds of npm install, the malware was already calling home to the attacker's server before npm had even finished resolving dependencies -– making this one of the most operationally-sophisticated supply chain attacks ever documented against a top-10 npm package.

Because there were no git tags, any manual audit of the GitHub repo would have failed to show anything was wrong.

Axios npm incident highlights supply chain dangers

Ilkka Turunen, field CTO at Sonatype, said the latest npm-related incident highlights the growing dangers faced by developers globally, with threat actors ramping up attacks.

“Attackers have figured out they don’t need to compromise the code people trust if they can compromise the trust around it," Turunen said.

"In this case, the malicious capability was introduced through a staged dependency and designed to erase its own tracks, which made the attack harder to spot and slower to understand. That’s not just malware — it shows a more deliberate and mature playbook."

Anyone who installed either version before the takedown should assume their system is compromised and is advised to immediately quarantine hosts, implement their full incident response playbook, and rotate all exposed secrets.

It's not known who is responsible for the compromise, although many researchers are throwing suspicion on a North Korean actor known as UNC1069 that focuses on stealing cryptocurrency via centralized exchanges (CEX), software developers at financial institutions, tech firms, and venture capital funds.

The supply chain attack marks the latest in a string of attempts to exploit trust in open source ecosystems, according to Upwind security researcher Avital Harel.

"The build pipeline is becoming the new frontline. Attackers know that if they can compromise the systems that build and distribute software, they can inherit trust at scale," Harel commented.

"Organizations should be looking much more closely at CI/CD systems, package dependencies, and developer environments, because that’s increasingly where attackers are placing their bets."

FOLLOW US ON SOCIAL MEDIA

A 26-year-old Russian citizen has been sentenced to 81 months in prison for his part in helping major cybercrime groups to extort tens of millions of dollars.

Aleksei Volkov was involved in dozens of ransomware attacks throughout the US, causing more than $9 million in actual losses and over $24 million in intended losses.

He assisted major cybercrime groups, including the Yanluowang ransomware group, charging up to $1,000 for access to business networks, as well as a percentage of the profits.

He had at least eight confirmed victims, two of which paid hackers a total of around $1.5 million to unlock their systems; Volkov's cut of this was more than $256,000.

Volkov operated as an initial access broker, gaining unauthorized access to computer networks and systems, and then selling it on to other cyber threat actors such as ransomware groups. These groups used that access to encrypt victims' data and then made ransom demands, to be paid in Bitcoin, of between $300,000 and $15 million.

"The conspirators demanded that the victims pay them a ransom in cryptocurrency – sometimes in the tens of millions of dollars – in exchange for restoring the victims' access to the data and promising not to publicly disclose the hack or release victims' stolen data on a 'leak' website," said the Department of Justice.

"In some cases, the victims paid the ransom, and in others the conspirators posted the victims' confidential data on the leak site. If the victims paid the ransom, Volkov received a share of the money."

Between July 2021 and November 2022, Volkov helped the Yanluowang ransomware gang with initial access and also launched distributed denial-of-service (DDoS) attacks. The victims included US banks, telecommunications companies, and engineering firms in Pennsylvania, California, Michigan, Illinois, Georgia, and Ohio.

The Yanluowang ransomware group was first spotted in October 2021 by Symantec's Threat Hunter Team, and had been operational since August that year. But the group disbanded at the end of 2022 when its leak site was hacked, and thousands of messages on the group's discussion channels were uploaded to a website.

After an investigation by the FBI, Volkov, also known as chubaka.kor, was arrested in Rome in January 2024, and extradited to the US. There, last November, he pleaded guilty to unlawful transfer of a means of identification, trafficking in access information, access device fraud, and aggravated identity theft, as well as two counts of computer fraud and conspiracy to commit money laundering.

He agreed to pay more than $9 million to his known victims to compensate them for their actual losses, and also to forfeit the equipment he used for his crimes.

The FBI has seized domains linked to Iranian cyber espionage activities, including those run by the group behind the Stryker attack.

Seized domains belonging to Handala – Handala-Hack and Handala-Redwanted – now feature notifications advising visitors that the sites have been seized by

The move by the FBI follows a highly disruptive attack by Handala on medical technology firm Stryker earlier this month.

Handala claimed to have wiped more than 200,000 systems, servers, and mobile devices, and to have extracted 50 terabytes of critical data.

Stryker develops a range of medical technology products, including surgical equipment, and has offices in 79 countries globally.

The incident had a particular impact on employees based in Ireland, according to reports, which represents one of the company’s largest innovation centers outside of the US.

The domain seizures follow a warning from CISA that organizations should harden their endpoint management system configurations in the wake of the Stryker attack.

Enterprises should use principles of least privilege when designing administrative roles, enforce phishing-resistant multi-factor authentication (MFA) and privileged access hygiene, the security agency noted.

Elsewhere, organizations were urged to configure access policies to require Multi Admin Approval in Microsoft Intune – software exploited by Handala during the Stryker attack.

Intensified cyber espionage campaigns

Handala is one of a number of “hacktivist” groups that have emerged in recent years, and has been active since at least 2023.

Threat intelligence reports on the group show it often utilizes “wiper” malware techniques to destroy company data – which it used during the attack on Stryker.

“The Handala Hacking Team is notable for employing a wide range of sophisticated tactics and techniques, including data theft, phishing extortion, website defacement, and destructive attacks leveraging custom wiper malware that targets Windows and Linux environments,” Cisco Talos and Splunk’s Threat Research Team said in a 2024 blog post.

FOLLOW US ON SOCIAL MEDIA

Cyber attackers are increasingly targeting critical national infrastructure (CNI), such as energy grids, water supply, or telco networks. Although the target may only be a small part of a country’s infrastructure network, the goal is often far more wide reaching and such attacks can pose a significant security risk.

National infrastructure comprises the essential elements, such as power, transport and water, that a country needs in order to function and ensure the well-being of the population. Examples include high-voltage power transmission cables, telecommunication networks, hospitals and transport hubs, such as airports.

A recent example of an infrastructure attack was the cyberattack against Collins’ ARINC cMUSE check-in and boarding software on Friday, 19 September 2025. As a consequence of the cyberattack, passengers were unable to board planes at several airports throughout Europe.

The ultimate goal of the attack was not taking down Collins Aerospace, but the widespread disruption that it caused. By disrupting the life of the civilian population, malicious actors are making people feel vulnerable, causing them to question the ability of the government to safely run the country.

“Cyber attacks can go in various directions to create unsecureness in a population, so that we don't trust the things that work all the time,” says Kim Larsen, chief information security officer at Keepit and a former delegate for the Danish government in NATO and EU cybersecurity committees.

“We've seen ships pulling anchors over cables in the Eastern Sea, and that is probably most likely to test infrastructure. We have also seen distributed denial of service attacks towards critical infrastructure; tax department and defense departments around Europe – that is probably to test how stable we are on the more physical side.”

Cyber attacks for widespread disruption

The attacks targeting national infrastructure are varied and multifaceted. While physical attacks on CNI could see malicious groups sever undersea internet cables or use drones to disrupt the airspace above airports, cyber attacks on CNI have often come in the form of DDoS attacks that cause a critical server to fail, or ransomware attacks such as the 2021 breach of Colonial Pipeline. In many ways, these attacks are an escalating arms race between the attackers and security teams.

In recent years, hackers have been exploiting the fact that more infrastructure has become either directly connected to the internet or indirectly linked to it in some way.

“We saw a lot of information gathering before the Ukraine war started, but when the attack went physical, cyber attacks lowered for quite a long time,” says Larsen. “It's now increasing again, and has been for quite a while with hybrid attacks.”

The anonymizing nature of the internet means that the identities of the attackers or where they are located may never be known for certain – unless the attackers come forward and reveal themselves. Most often it is state-sponsored hacking, with ransomware groups and other threat actors based in CRINK behind many advanced persistent threats (APTs).

“In the world of cyber it's always diffused, because you can hide yourself. I remember back in the day that there were a lot of attacks to critical infrastructure coming from an IP address in Beijing,” says Larsen.

“Well, if it's Chinese, they are probably more than clever enough to actually shadow their trace. On the other hand, sometimes an attack angle is to show who you are and that you're capable of doing something.”

The geopolitical sphere is currently rife with tensions due to the number of military actions taking place. Although the UK is not at war, neither is it at peace. The term ‘unpeace’ is sometimes used to describe a period of strife and dissension.

Almost all (95%) of CNI organizations in the UK experienced a cyber attack in 2024, according to cybersecurity firm Bridewell, with CNI respondents reporting low confidence in their ability to repel supply chain attacks. It’s hard to track the exact scale of attacks on CNI, as firms can be reluctant to publicly disclose incidents and when high-risk vulnerabilities are discovered, they may be kept private for reasons of national security.

It’s sometimes unclear whether critical national infrastructure is being disrupted due to cyber attacks or simply failures in the network. For example, a power cut might be due to a substation fault or a cyber attack. Initial reports of the blackouts in Spain and Portugal suggested they were caused by a cyber attack and Spanish authorities investigated the possibility. However, it was subsequently confirmed the incident occured due to a surge in voltage with which grid was unable to cope.

Ultimately, what infrastructure attacks are doing is causing disruption. When amplified by coverage on social media, this can have the secondary effect of destabilizing business operations and government.

Responding to the rising threat

The escalating cyber attacks against national infrastructure has driven the UK’s National Security Protection Agency (NSPA) to identify CNI in particular need of protection. These include telecommunications, emergency services, energy, healthcare, transportation and water. The National Cyber Security Centre (NCSC) is responsible for the cybersecurity of CNI.

The privatization of certain aspects of national infrastructure, such as telecommunication providers and water companies, adds a further regulatory complication. Information sharing and collaboration between organizations are vital in order to better protect national infrastructure against cyberattacks, and in some countries it’s possible to operate this as a more centralized operation than in others.

“Governments need to be transparent on the threats that they actually see, and to segment what is true, what is not true and what is serious,” says Larsen. “Then they can work with the industry on getting a solid cybersecurity trusted framework.”

A holistic approach to security, combining physical security with cybersecurity, creates a more robust security posture. For example, if high-voltage power-transmission cables are buried underground, then it is far more difficult for them to be physically interfered with.

Redundancy measures, either on-site or off-site, may be mandated for certain types of infrastructure. Any new national infrastructure including data centers needs a secure by design approach, with cybersecurity teams involved from the outset. Meanwhile, the security of existing infrastructure needs to be thoroughly tested and reviewed, with a risk-informed approach to enhancement of defenses if required.

Wars and heightened geopolitical tensions mean that cyber attacks against CNI are likely to become more frequent in the coming years. If threat actors succeed in causing major disruption to national infrastructure, the impacts will be felt widely. To mitigate against this, relevant organizations need to carry out risk assessments to highlight areas where improved security is needed.

With mitigations where required, and an appropriately robust security posture in place, cyber attacks against CNI will be less damaging. For new infrastructure projects, it is now more important than ever to consider physical and cybersecurity, and the interface between these, from the outset.

Security experts have warned that the cyber attack on Stryker signals a step change in politically-motivated attacks, with a particular focus on destruction rather than extortion.

Operations at the medical technology firm have been severely impacted in a cyber attack claimed by Iranian-linked threat group, Handala. The group claims to have wiped thousands of systems across the company’s global operations and stolen around 50 terabytes of data.

“In this operation, over 200,000 systems, servers, and mobile devices have been wiped and 50 terabytes of critical data have been extracted,” the group claimed in a statement online.

Stryker develops a range of products, including surgical equipment, neurotechnology, and orthopedic implants, with offices in 79 countries and over 50,000 employees worldwide.

The impact of the attack has been felt globally, with reports suggesting operations in Ireland have been severely disrupted.

Stryker employs around 4,000 employees in Cork, which the company describes as its “biggest innovation and manufacturing hub outside the US”.

"Nobody can work,” a source told the Irish Mirror. “The entire company has been brought to a standstill”

Stryker confirms attack

Stryker has confirmed it is dealing with “global network disruption” across its Microsoft environment, which is believed to be the entry point for the group.

One employee told BleepingComputer that staff have been ordered to remove work-related applications from personal devices, in particular the company portal for mobile device management software Microsoft Intune and Microsoft Teams.

Targeting of Microsoft products is a common tactic for Handala, which has been active since at least December 2023.

A 2024 threat intelligence report from Cisco Talos and Splunk’s Threat Research Team specifically highlighted the group’s activities on this front, typically using “wiper” malware to destroy company data.

“The Handala Hacking Team is notable for employing a wide range of sophisticated tactics and techniques, including data theft, phishing extortion, website defacement, and destructive attacks leveraging custom wiper malware that targets Windows and Linux environments,” the duo said in a blog post.

“The target matters”

Stryker noted in its statement that there’s “no indication of ransomware” involved in the attack. However, this aspect of the attack provides an insight into the underlying motivations, according to Huntress CISO Chris Henderson.

In this instance, the attack is “destructive, not ransomware” and is a politically-motivated attack aimed solely at causing widespread disruption.

“The target matters. Stryker manufactures critical medical devices used in operating rooms and ICUs worldwide,” Henderson said.

“When a supplier of this scale goes offline, it doesn't just impact their employees; it creates ripple effects across hospitals, surgical centers, and healthcare providers who depend on their equipment and support infrastructure.”

Skip Sorrells, Field CTO-CISO at Claroty, echoed Henderson’s comments, noting that even prior to the Iran conflict hacktivist activities have been ramping up globally.

Security agencies including CISA and the UK's National Cyber Security Centre (NCSC) have issued repeated warnings over the rise of hacktivist groups over the last two years.

In particular, pro-Russian hacktivist groups identified by the NCSC were found to be targeting local government agencies and critical infrastructure. Critical sectors like healthcare are now firmly in the crosshairs, according to Sorrells.

“Attacks like this unfortunately aren’t surprising,” he said. “Even before the latest geopolitical tensions, hacktivist activity targeting healthcare and other critical infrastructure had been steadily increasing, and that trend makes organizations like medical device manufacturers and hospitals more likely to be caught in the crossfire.”

FOLLOW US ON SOCIAL MEDIA

Phishing is a simple tactic, but it works. It’s therefore no surprise that phishing as a service (PhaaS) – which allows adversaries to perform the attacks at scale – is on the rise.

The number of known PhaaS kits doubled last year, according to new research. Across the year, 90% of high-volume phishing campaigns leveraged PhaaS kits, researchers at Barracuda found. The new kits are sophisticated, evasive and stealthy.

Which PhaaS kits should firms know about, and how can businesses avoid being caught out by phishing attacks?

PhaaS kits

The fast-growing availability of PhaaS kits gives cybercriminals with limited technical capabilities the means to breach companies. Using PhaaS kits, the volume of attacks adversaries are able to deliver is “astounding”, says Harry Mason, head of client services at Mason Infotech.

Of the notable kits now available, he calls out GhostFrame, which creates an invisible iframe on webpages to hide malicious activity. “By the time this was discovered in December, it had already been used in over a million attacks.”

Tycoon 2FA and Typhoon are also prominent examples of PhaaS. Other kits include Quantum Route Redirect, which steals Microsoft 365 credentials, and Whisper 2FA that steals multi-factor authentication (MFA) codes in real time.

Another prominent kit is Greatness, which targets Microsoft 365 credentials through adversary-in-the-middle techniques.

A new phishing kit named Spiderman, identified in December 2025, targets customers of major European banks. It works via fraudulent login pages that “perfectly mimic” legitimate financial institutions to steal login credentials, according to Matt Hull, global head of threat intelligence at NCC Group.

At the same time, an adversary-in-the-middle platform named Mamba 2FA has grown in popularity. Hull says Mamba 2FA has been on the rise since late 2023 and is noted for its operational efficiency.

Kevin Curran, IEEE senior member and professor of cybersecurity at Ulster University, highlights EvilProxy as a kit that bypasses MFA using reverse-proxy methods. “These platforms provide customer support for cybercriminals, as well as comprehensive dashboards, automated credential harvesting and real-time victim tracking,” he says.

The sale and distribution of PhaaS offerings typically takes place through Telegram channels and private groups, says Hull. “This allows PhaaS operators to share updates and set up user-friendly cryptocurrency payment systems using automated bots.”

Stealing credentials

PhaaS kits are primarily used to steal credentials and hijack authenticated sessions, allowing attackers to take over email, cloud and business systems. “While often framed as ‘email phishing’, the real impact is account compromise, which can lead to business email compromise, financial fraud, data theft – and in some cases ransomware access,” Hull says.

Increasingly, PhaaS is being deployed for initial access operations, where stolen credentials are sold to ransomware groups. “Alternatively, these credentials can be used to establish persistent access within corporate networks,” adds Curran.

MFA bypass has become a standard feature, with kits employing adversary-in-the-middle techniques to intercept one-time codes in real-time, he tells ITPro.

PhaaS is also becoming part of supply chain attacks, where compromised vendor credentials provide entry points into multiple downstream organizations, according to Curran. “Session hijacking capabilities allow attackers to maintain access even after passwords are changed.”

PhaaS targets

No one is immune from the cybercriminals harnessing PhaaS. Experts say phishing attacks can impact any firm, regardless of size.

There's a common misconception, especially among SMBs, that they’re “not big or important enough to be a phishing target”, says Christophe Tafani-Dereeper, staff cloud security researcher and advocate at Datadog. “But in our experience, phishing attacks are ubiquitous, targeting organizations at almost every level. Nearly everyone will receive one at some point.”

PhaaS kits are “indiscriminate by design”, agrees Curran. Yet he acknowledges that some sectors face an increased risk. For example, healthcare and professional services firms are prime targets due to their valuable data and transaction capabilities.

At the same time, the subscription model of PhaaS means attackers can maintain campaigns across multiple sectors simultaneously, testing social engineering approaches until they find a successful method. “Any organization with an online presence and valuable data or financial access is now within reach of these industrialised phishing operations,” Curran warns.

PhaaS evolution

In the future, phishing attacks will become even easier for criminals as PhaaS platforms are supercharged by technology such as AI.

Cybercriminals are already leveraging AI to hide their phishing websites, says Tafani-Dereeper. “When someone who's not a targeted victim visits the phishing website, they are shown a legitimate-looking page masquerading as a local business,” he explains. “We've seen dozens of variations across a large number of domains, which makes us believe this is tied to one or multiple PhaaS platforms.”

Further down the line, Curran predicts AI-generated content that adapts in real-time based on victim interactions. “This would be able to create convincing conversational phishing attempts via multiple channels simultaneously.”

He thinks deepfake technology will be used more widely, allowing attackers to impersonate individuals through voice and video with “alarming authenticity”.

In the PhaaS industry itself, Mason predicts the same kind of developments seen in SaaS markets: “An introduction of 'tiered' subscriptions for kits, better customer service and, in some areas, planned obsolescence to make the act of committing cybercrime more expensive.”

The business model could also shift towards profit sharing arrangements rather than subscriptions, aligning incentives between kit developers and attackers, he adds. “Integration with other criminal services such as automated money laundering and ransomware deployment will create comprehensive ‘attack-as-a-service’ ecosystems.”

Business action

Stealthy and sophisticated PhaaS kits pose a growing threat, but experts say the solution is fairly simple: a combination of technical and human-centric security measures.

As a foundational defense, Tafani-Dereeper recommends implementing “phishing-resistant authentication methods” in critical systems such as Microsoft 365 or Google Workspace.

For example, Microsoft Entra ID passkeys and Google Workspace passkeys will help to enhance security and “make the user experience more seamless”, he says.

Alongside this, regular employee training is essential. Rather than focusing on the area once a year, ongoing simulations using current PhaaS tactics should be used to build genuine recognition skills, Curran advises. “Ultimately, organizations must recognize that technical defences alone are insufficient against industrialised social engineering. Building a security-conscious culture is equally critical.”

Salesforce has issued a warning over an ongoing campaign targeting customers using misconfigured Experience Cloud platforms.

In an advisory last week, the CRM giant said a “known threat actor group” has been observed using a modified malicious version of the AuraInspector tool, which as part of the Salesforce Aura framework to identify security misconfigurations in Experience Cloud sites.

Originally developed by Mandiant, threat actors are using the open source tool to “perform mass scanning of public-facing Experience Cloud sites” and extract data.

“While the original Aura Inspector is limited to identifying vulnerable objects by probing API endpoints that these sites expose (specifically the /s/sfsites/aura endpoint), the actor has developed a custom version of the tool capable of going beyond identification to actually extract data — exploiting overly permissive guest user settings,” the company said.

Salesforce emphasized that the incident was not caused by a “vulnerability inherent to our platform”, but instead due to a customer-configured guest user setting.

This is because an exposed Salesforce Experience site accepts guest user profiles to provide access to publicly available data.

However, the company noted that misconfigured profiles with excessive permissions could allow a threat actor to “directly query Salesforce CRM objects” without logging in.

Charles Carmakal, CTO at Mandiant, said the company is aware of the AuraInspector misuse and is working with Salesforce to mitigate risks.

“We are aware of a threat actor attempting to identify misconfigurations within the Salesforce Experience Cloud instances,” he told ITPro.

“We are working closely with Salesforce and our customers to provide the necessary telemetry and detection rules to mitigate potential risk."

ShinyHunters claims responsibility

The “known threat actor group” cited by Salesforce appears to be ShinyHunters, with the group claiming responsibility for the attacks.

According to reports from The Register, the threat group claims to have stolen data from upwards of 400 websites and around 100 “essential high profile companies”.

Companies cited by the group included Snowflake, LastPass, Okta, AMD, and Salesforce. The group told the publication that the campaign has been ongoing “for several months now”.

What can Salesforce customers do?

In its advisory, Salesforce detailed a number of steps customers can take to mitigate potential risks, including:

• Enforcing a “least privilege” access model
• Conduct an audit of guest user permissions
• Set Org Wide Defaults to “Private”
• Switch off portal user visibility and site user visibility

Salesforce also advised customers to disable self-registration unless explicitly required. This is because guest data can be used to create portal accounts, thereby enabling “broader data access”.

“In addition to checking for unusual query volumes, review your Aura Event Monitoring logs for anomalous access patterns — such as queries targeting objects not intended to be public, unexpected spikes from unfamiliar IP addresses, or access outside normal business hours,” Salesforce said.

“If you suspect your environment may have been affected, contact Salesforce Support and complete the guest user audit steps outlined above rather than relying on log volume alone.”

FOLLOW US ON SOCIAL MEDIA

State-sponsored attackers are weaponizing legitimate software and infrastructure to lie in wait, shifting tactics away from data breaches to more sophisticated espionage and disruptive operations.

That's according to a new report from Cloudflare that walked through a series of attacks from Chinese hacks against Google Calendar to North Korean IT worker scams – including a tactic that makes use of AI.

In that attack, the hackers snuck past traditional perimeter defenses by finding credentials hidden in code using secret scanning tools, such as TruffleHog.

"Once these keys to the kingdom were harvested, the actor leveraged generative AI in real time to navigate unfamiliar, complex SaaS environments," the report said.

Examples like this underline how AI is supporting cyber crime operations, the report noted, making it easier for hackers to target legitimate tools and weaponize them against victims.

"The accessibility of generative AI large language models (LLMs) both increases unwitting user risk and significantly lowers the barrier to entry for highly effective operations," researchers said .

"Adversaries have moved beyond technically elegant code to 'offense by the system,' leveraging a victim’s own cloud, SaaS, and AI infrastructure to fund and scale missions."

Nation-state attackers shift tactics

Cloudflare said it has tracked four primary state actors over the last year, namely Russia, China, North Korea, and Iran. The security firm said it was seeing a blurring of strategic goals, with digital strikes increasingly backing up military actions in conflicts.

China, for example, has shifted away from bulk data theft to targeting legitimate infrastructure such as the cloud for longer-term compromises and strategic "pre positioning" tactics that are ideal for espionage and disruptive operations.

"By weaponizing legitimate enterprise ecosystems – such as FrumpyToad’s use of Google Calendar for C2 or PunyToad’s exploitation of F5 and VMware vCenter and ESXi – Beijing has created a resilient, living-off-the-cloud architecture that allows for rapid data exfiltration while remaining nearly invisible to standard perimeter defenses," the report noted.

Notorious Chinese state-backed hacker groups such as Salt Typhoon have employed living off the land techniques extensively over the last two years, most notably during attacks on US State National Guard networks and US congressional email systems.

Meanwhile, in Russia, groups like NastyShrew use "high-reputation cloud services" to mask their activities in order to continue targeting Ukrainian critical systems.

That includes tactical communication apps used by the Ukrainian military, and Cloudflare suggested that was "possibly in support of physical operations."

The rise of North Korean IT workers

Cloudflare has also observed what it calls the "industrialization" of a scheme run by North Korea in which AI and other tools are used to pose as American workers to get jobs as remote IT workers.

"These operatives infiltrate Western organizations by leveraging fraudulent identities and AI-driven deepfakes to bypass video interviews, ultimately funneling hundreds of millions of dollars in revenue back to the regime," the report notes.

Alongside using AI, threat actors often set up digital personas on LinkedIn and GitHub for more legitimacy – sometimes even "renting" the accounts of real American citizens.

Once employed, these North Korean workers use American-based "laptop farms" that are accessed via remote management and monitoring software from overseas.

As ITPro previously reported, the number of fake IT worker scams has surged over the last 18 months, prompting security agencies and the FBI to issue advisories on how to tackle the issue.

Cloudflare said it's possible to spot such behavior, however, and urged organizations to bolster identity checks.

"Despite these sophisticated tactics, several high-fidelity detection indicators have emerged, including 'impossible travel' login alerts, the presence of mouse-jiggling software, and specific video metadata micro-artifacts consistent with real-time deepfake rendering,” the company said.

Notably, Cloudflare advised shifting away from traditional perimeter defenses in favor of zero trust biometric verification and stricter geofencing for remote management tools.

FOLLOW US ON SOCIAL MEDIA

The UK National Cyber Security Centre (NCSC) has issued a warning that Russian-aligned hacktivist groups are targeting organizations. The alert describes how Russia-based adversaries including NoName057(16) have been attempting to disrupt operations, taking websites offline and disabling services.

The hacktivist groups are using distributed denial of service (DDoS) attacks – in which websites are flooded with traffic to take them offline – against governments as well as critical infrastructure firms across NATO member states and other European countries.

Why has this warning been issued and what can organizations do to boost their defenses in response?

Familiar name

NoName057(16) has been around since 2022, emerging shortly after Russia invaded Ukraine. Its self-declared mission is to counteract open hostility towards Russia, targeting NATO-aligned countries, says Darren Anstee, chief technology officer for security at NETSCOUT.

Renowned for widespread cyber operations and enabling like-minded individuals to disrupt online services on “an exceptionally large scale”, NoName057(16) has garnered notoriety for developing and distributing the DDoSia attack tool, Anstee tells ITPro.

Similar to many hacktivist collectives, NoName057(16) leverages a crowdsourced model, where it utilizes its DDoSia toolkit to mobilise thousands of volunteers via Telegram adds Jamie Collier, lead advisor, Europe at Google Threat Intelligence Group. This “fluid model” has led to challenges in disrupting its efforts, he says.

Indeed, the hacktivist collective shows no sign of slowing down, even after it was hunted by law enforcement. By consistently promoting its operations online, NoName057(16) has positioned itself as “one of the most visible and persistent hacktivist entities” – despite law enforcement action against the group, says Daniel dos Santos, senior, director, and head of research at Forescout.

He describes how Forescout analyzed a dataset of hacktivist attacks from 2024: “This single group was responsible for 90% of the activity we observed”.

Unlike other hacktivist groups that exhibit selective targeting strategies, NoName057(16) has adopted a “broad and high-frequency attack approach”, often carrying out multiple attacks a day across different industries and countries, says dos Santos. “Some attacks targeted the same organizations repeatedly, either due to their strategic value, or to demonstrate the group’s continued ability to inflict damage.”

The threat to organizations is “significant” because the group is “very successful with DDoS attacks”, says dos Santos. “These attacks often take websites offline for some time, disrupting businesses and affecting their customers.”

Inexperienced and technically unskilled

The threat from hacktivist groups such as NoName057(16) is quite different to that from other adversaries. The use of DDoS – especially as a primary operation – has historically been a key indicator that a group is inexperienced or technically unskilled, says Marley Smith, principal intelligence specialist at the World Ethical Data Foundation. “Even though they are targeting critical infrastructure, the organizations on the receiving end of these attacks are usually those with exposed assets, or those whose employees have poor security practices in place.”

However, “unskilled” in this context does not mean “unthreatening” or even “un-resourced”, says Smith. “It means the lead actors are not developing and refining their own bespoke malware. Instead, they are more likely to use a simpler, more user-friendly threat apparatus designed for a maximum impact-to-effort ratio.”

Taking this into account, the goal of these groups is to “drum up as much fear as possible”, or “cause a public outcry” in the hope that the bad press will “coerce governments to turn a blind eye to Russia’s crimes in the future”, Smith explains.

NoName057(16) is just one example of a pro-Russian hacktivist group. Others include Dienet, Overflame, Red Wolf Cyber and Server Killers, says Anstee. “These hacktivists operate not for financial gain, but to advance ideological goals, aiming to generate media coverage of successful attacks to raise the profile of their points of view.”

Mitigating Russian DDoS attacks

The threat is real and growing, especially for nations targeted by Russian hacktivist groups. The NCSC advises UK organizations and businesses to understand the services they run online and the potential weak points that might expose them to risk from DDoS style attacks. “It advises them to discuss risks and mitigations with their own upstream internet service providers or hosts and to ensure that services can be rapidly scaled to deal with sudden spikes in requests, or data received that can be indicative of an attack,” says Cian Heasley, principal consultant, Acumen Cyber.

Along with these mitigations and preparations, the NCSC recommends having an incident response plan in place covering business continuity in a DDoS attack scenario.

This is in addition to removing operational technology (OT) connections to the public internet; identifying public-facing assets and removing unintentional exposures. Meanwhile, firms should use strong passwords, apply principles of least privilege for remote access networks, segment IT and OT and maintain manual backups for systems, the NCSC advises.

It’s “an old adage”, but you can’t secure what you can’t see, says Anstee. “Comprehensive, consistent visibility across the network and application layers – for all infrastructures, whether on premises or in the cloud – allows cybersecurity teams to know what ‘normality’ looks like, so when there is an attack, they can more quickly identify where there’s an impact, and work out what should be done to ensure service continuity.”

In addition, Smith advises “avidly reading the news”. “Keep up-to-date on attacks in your country and industry, and on the vulnerabilities discovered in the applications you use. Actively engage with your employees and their habits to close the human-sized gap in your defenses.”

At the same time, organizations can obtain lists of known “bad internet addresses” associated with denial of service attacks online, or from their security providers, as well as lists of open proxy services that adversaries use to disguise where attacks are coming from, says Heasley. “These can be blocked at the firewall level or through access control lists so traffic never reaches servers that can be overwhelmed.”

In cases where attacks cannot be easily mitigated, geoblocking can be put in place, Heasley advises. “This would mean UK organizations only accept incoming connections from internet addresses that can be resolved to the UK itself, limiting potential malicious traffic while still allowing some national connectivity.”

Security agencies are warning that a maximum-severity flaw in Cisco Catalyst SD-WAN Controller has been exploited in the wild for years.

An advisory from CISA noted that threat actors have compromised SD-WANs to add a malicious rogue peer, allowing them to conduct a range of follow-on actions to achieve root access and maintain persistent access.

"Based on collaboration with international partners and CISA’s forensic analysis, the ease with which these vulnerabilities can be exploited demands immediate action from all federal agencies," said Madhu Gottumukkala, the acting director of the US Cybersecurity and Infrastructure Security Agency (CISA).

"We urge all entities to implement the measures outlined in this Emergency Directive without delay. CISA leadership and all (excepted) staff remain committed to fulfilling our mission while protecting the American people.”

Successful exploitation of CVE-2026-20127, which has a CVSS score of 10, could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account.

Using this account, an attacker could access NETCONF, allowing them to manipulate network configuration for the SD-WAN fabric.

Cisco Catalyst SD-WANs that have management interfaces exposed to the internet are at most risk of compromise.

"CISA’s guidance is a clear signal that adversaries are aiming for the control plane, not just individual endpoints. The vulnerability being discussed allows an attacker to reach sensitive management functions without going through normal access checks," said Nick Tausek, lead security automation architect at Swimlane.

"What makes this especially serious is how quickly a compromised management path can translate into broad influence over how sites connect, which routes are preferred, and what policies are enforced across networks."

Cisco Catalyst SD-WAN best practices

According to Cisco, the first thing to check for is any control connection peering event identified in Cisco Catalyst SD-WAN logs, as this may indicate an attempt at initial access via CVE-2026-20127.

All such peering events require manual validation to confirm their legitimacy, with particular focus on vManage peering types.

The company warned unauthorized peer connections may appear superficially normal but occur at unexpected times, originate from unrecognized IP addresses, or involve device types inconsistent with the environment's architecture.

Organizations should move quickly to inventory SD-WAN components, confirm which are internet-facing, and map all management access methods - web UI, SSH, NETCONF, APIs - including which networks and admin accounts can reach them, said Moshe Hassan, VP of research and innovation at Upwind.

Elsewhere, organizations are urged to restrict management access to known-good sources, Allowlisting trusted IPs/admin networks only, removing public exposure, and segmenting management interfaces behind VPN/jump hosts.

Unsolicited access to management ports and unusual management-plane traffic should be blocked.

"Patch exposed systems first, or block until you can. Prioritize patching any internet-reachable appliances immediately. If patching can’t happen fast enough, temporarily block management protocols from the internet, disable unused services, and deploy compensating controls (ACLs/IPS rules) until updates are in place," he said.

"Watch for unexpected new peers/devices in the SD-WAN fabric, suspicious changes to configuration or policy, anomalous admin activity, and unusual lateral connections within the management plane."

Cisco has published a hardening guide here.

FOLLOW US ON SOCIAL MEDIA

Enterprises are falling prey to cyber attacks largely due to lack of oversight, preventable errors, and poor identity controls, even as AI attacks become a reality.

This is according to Palo Alto Networks’ Global Incident Response Report 2026, produced by its Unit 42 cyber threat intelligence team, which sourced data from over 750 attacks reported to the organization between October 2024 and September 2025.

In the past year alone, researchers found weak identity controls played a meaningful role in 90% of cyber incidents, with attackers leaning on identity as the most reliable entry point and mechanism for lateral movement.

Indeed, in nearly two-thirds (65%) of cases attackers used identity-based attacks as the initial access point for enterprise systems, with 33% of attacks beginning with phishing and social engineering.

Within this subset of cases, session hijacking and MFA bypass techniques allowed threat actors to quickly access victims’ systems. Attackers also used tried-and-tested entry techniques including using previously stolen credentials (13%), brute force attacks (8%), and insider attacks (8%) to breach systems.

Researchers analyzed over 680,000 cloud identities and discovered that 99% of users, services, and roles had excessive permissions, enabling attackers to easily complete lateral movement through corporate networks after compromising an account.

Back to basics with identity security

Chris George, managing director EMEA at Unit 42, told ITPro that leaders must thoroughly examine their existing identity policies and to be “brilliant at the basics” to close these preventable gaps.

“What user accounts do you have? What is your password policy? How are you making sure that you're choosing non-brute-forceable passwords? How are you looking at the permissions?”

Mastering the basics may be the bare minimum for businesses, as the number of machine identities they have to manage balloon with the deployment of AI agents.

In October ITPro heard from Haider Pasha, EMEA CISO at Palo Alto Networks, who noted that agentic AI will seriously complicate identity security and requires rigorous oversight to be used safely.

George told ITPro that his team has observed over-provisioning of AI copilots, allowing attackers to obtain leaked information by crafting malicious prompts.

“[W]hen we get to the whole agentic side of things, and we've got AI agents that are going to be in their tens, hundreds of thousands, then if each single agent has got a connection to something and has got permission to do things, how are you managing the security around that?”

In the future, George said, threat actors may replicate the kind of ‘living off the land’ techniques we’re currently seeing used against mobile device management (MDM) tools and leaders must ensure their AI systems aren’t compromised.

But he added that even more sophisticated methods such as the malicious use of deepfakes rely on the age-old processes of business email compromise, for which we have established security protocols.

Incidents included in the report’s data cover a wide range of enterprises, including enterprises in the Fortune 500, government organizations, and SMBs, across over 50 countries.

The attack surface is widening

There’s evidence that attackers are widening the net in a bid to achieve greater success against victims, with 87% of intrusions found to involve attacks on two or more attack surfaces and 67% involving activity across three or more.

After identity, the most common attack surface was endpoints at 61% and network at 50%. Researchers found in nearly half (48%) of all investigations, browser activity was also targeted, an increase from the 44% measured in 2024.

For example, researchers cited an incident involving the ClickFix attack technique, in which threat actors used SEO poisoning to trick an employee at an international industrial firm to execute malicious code. The goal was to run malware in system memory, in order to install an infostealer on the employee’s work device.

Supply chain attacks are another severe risk for enterprises. Attackers are increasingly exploiting SaaS environments, which rely on a complex web of interdependencies and permissions linked by APIs and OAuth apps, as well as legitimate vendor tools and open source dependencies.

Almost a quarter (23%) of incidents tracked by researchers in 2025 involved SaaS applications, compared to just 6% in 2022, while 39% of command and control (C2) techniques linked directly to remote access tools with administrator privileges.

Addressing these vulnerabilities will mean taking stock of all systems, permissions, and interdependencies to build a holistic view of one’s attack surface. But George told ITPro that many organizations still struggle with simply cataloguing their systems, let alone protecting them.

“You see, actually, in conversations we've had with the board, they say ‘we didn't even know we had the affected system, because we just don't have it documented’.

“There's a concept of a CMDB – a configuration management database, a list of everything in the company that they own. I’ve very rarely seen anything that's been 100% complete and kept up to date.”

To start with, he said, leaders have to strategize where they can make the most impact in the short term and then think about more radical overhaul.

AI has become a force multiplier – for good and for ill

In addition to traditional attack methods, researchers found threat actors are increasingly using AI to enhance the speed and severity of attacks.

The report noted that AI, particularly models hosted on adversary infrastructure, has been used to discover unpatched vulnerabilities just 15 minutes after a CVE is published, as well as to reduce the manual work needed to run ransomware campaigns.

In lab tests conducted in 2025, Unit 42 was able to use AI to reduce time-to-exfiltration to just 25 minutes. In the real world, attackers are on a similar trajectory, having reduced the figure from 4.8 hours to just 72 minutes from 2024 to 2025.

AI is also used to improve grammar for phishing lures, as well as to produce attack strategies. This lines up with recent reports by other organizations such as Google Threat Intelligence Group, which recently found APTs are using public AI models to translate and localize social engineering messages.

To counter the threat, Palo Alto Networks recommended organizations deploy automated patching, AI-driven security detection and response tools, as well as better monitoring of API calls and internal AI use.

For example, George pointed to the 72 minutes it now takes attackers to move from initial access to data exfiltration – a time frame that can’t be countered without some form of automation.

With greater controls over AI deployment and a focus on leveraging its benefits to empower security teams, he argued that there’s clear hope for defenders.

“AI is, and it will, change the world – there is a huge amount of opportunity.

“But I could say that about every technological change throughout history and I think we should be taking lessons from all of those and refining our approach.”

The Chinese-backed hacking group known as Salt Typhoon has waged successful espionage campaigns against an array of organizations across Norway, according to the Norwegian Police Security Service.

No details have been published on which companies were targeted or how long the attackers were able to maintain access.

However, the report warned Chinese security and intelligence services are increasingly carrying out intelligence operations in Norway, including cyber operations and the collection of human intelligence.

"In 2026, China will collect intelligence, reconnoiter Norwegian digital infrastructure and threaten groups and individuals to prevent them from criticizing the Chinese Communist Party," the report reads.

"An increasing number of operations are likely to be carried out by commercial cybersecurity contractors and individuals who are not trained intelligence personnel but act on behalf of Chinese security and intelligence services."

Norwegian authorities warned any organizations holding sensitive information to be on the alert, particularly those operating in national infrastructure domains.

Salt Typhoon has mainly focused on targets in the US and Canada, but analysis shows the group is expanding operations globally. In September last year, the FBI warned the group had hit organizations in as many as 80 countries altogether.

The US Cybersecurity and Infrastructure Security Agency (CISA) said it was mainly targeting telecommunications, government, transportation, lodging, and military infrastructure networks.

Salt Typhoon typically targets large backbone routers of major telecommunications providers and network infrastructure companies, as well as provider edge (PE) and customer edge (CE) routers.

They also leverage compromised devices and trusted connections to pivot into other networks, modifying routers to maintain persistent, long-term access to networks.

Salt Typhoon is getting bolder

Pete Luban, Field CISO at AttackIQ, warned the group is becoming “more dangerous with each successful infiltration” and has established itself as a key adversary for national security agencies globally.

Salt Typhoon gained notoriety after compromising email systems belonging to “very senior” US political figures as part of an intelligence gathering campaign.

These long-running campaigns have become a hallmark of the group, which also managed to avoid detection in US National Guard networks for nearly a year.

"Continued access into internal systems allows threat actors to establish long-term surveillance and position themselves to carry out destructive attacks with little to no advanced warning," Luban said.

"However, breaches like these also deal indirect damage by undermining the security of intelligence sharing networks. If Salt Typhoon can sow seeds of doubt into these networks, it could force allies to limit or restrict information sharing, ultimately weakening collective security."

Organizations are advised to identify where vulnerabilities might exist in their infrastructure and mitigate them before threat actors can exploit them.

These networks should be segmented from internet-facing systems, while enforcement of zero-trust access controls can also help contain any damages caused by Salt Typhoon if defenses are breached.

The report also warned that Chinese intelligence services are recruiting Norwegian nationals to gain access to sensitive and classified information.

Often, those being recruited don't know they're working for Chinese intelligence, thinking they're employed by a think tank, an international company, a consultancy firm or similar.

"Sources are initially asked to provide non-public information in exchange for payment, such as details on the activities or plans of companies, public sector organisations of political institutions," it said.

FOLLOW US ON SOCIAL MEDIA

Google Threat Intelligence Group (GTIG) has identified a group with all the hallmarks of ShinyHunters using voice phishing (vishing) and fake credential harvesting websites to steal sensitive data.

In an advisory, the tech giant warned the group primarily gains access to corporate environments by obtaining single sign-on (SSO) credentials and multi-factor authentication (MFA) codes.

Once inside, the attackers target cloud-based SaaS applications to exfiltrate sensitive data and internal communications that they can use in subsequent extortion demands.

Google is currently tracking the activity under several threat clusters, including UNC6661, UNC6671, and UNC6240.

Last month, for example, UNC6661 pretended to be IT staff and called employees at targeted organisations, claiming that the company was updating MFA settings.

The threat actor then directed employees to victim-branded credential harvesting sites to capture credentials and MFA codes, with victims thereafter registering their own device for MFA.

According to Google, threat actors moved laterally through victim customer environments to exfiltrate data from various SaaS platforms.

While the attacks are targeted, analysis suggests that subsequent access is probably opportunistic, determined by the specific permissions and applications accessible via the individual compromised SSO session. Google stressed that the activity isn't the result of a security vulnerability in vendors' products or infrastructure.

"In some cases, they have appeared to target specific types of information. For example, the threat actors have conducted searches in cloud applications for documents containing specific text including 'poc', 'confidential', 'internal', 'proposal', 'salesforce', and 'vpn' or targeted personally identifiable information (PII) stored in Salesforce," researchers said.

"Additionally, UNC6661 may have targeted Slack data at some victims' environments, based on a claim made in a ShinyHunters-branded data leak site (DLS) entry."

Valuable intelligence

Cory Michal, CSO at AppOmni, praised the level of operational detail in the report, and particularly the volume and specificity of indicators of compromise that weren’t previously public.

This intelligence could prove vital for organizations that find themselves in the crosshairs moving forward, Michael noted.

“Publishing concrete domains, tooling names/artifacts, and workflow-level signals gives defenders something they can deploy immediately at scale (email/web filtering, OAuth/app controls, identity telemetry detections, and retro-hunting),” he said.

“It helps the ecosystem disrupt infrastructure and tradecraft faster by enabling consistent blocking and takedown actions across many organizations rather than each team rediscovering the same indicators in isolation.”

What can enterprises do to protect themselves?

Google has published guidance on hardening, logging, and detection against the threats.

Organizations responding to an active incident should focus on rapid containment steps, such as severing access to infrastructure environments, SaaS platforms, and the specific identity stores typically used for lateral movement and persistence.

Long-term defense, meanwhile, requires a transition toward phishing-resistant MFA, such as FIDO2 security keys or passkeys, which are more resistant to social engineering than push-based or SMS authentication.

“Companies should treat this as both a hunt and prevent problem: First, take the IoCs in the report and run them through your detection-and-response workflows (SIEM/SOAR, email security, web proxy/DNS, EDR, and SaaS audit logs) to identify any historical or active exposure," Michal added.

Michael added they should add continuous monitoring for look-alike domain registrations that incorporate their company name or common brands that they use for login, support, and HR.

"In many of these campaigns, those newly registered domains are a leading indicator, they show up before the first vishing call, so catching and blocking them early (and tightening your help desk/MFA enrollment controls in parallel) can meaningfully reduce the chance the intrusion ever gets to the “mass download and extortion” stage,” he said.

FOLLOW US ON SOCIAL MEDIA

Threat actors remained undetected for months and distributed malicious updates to Notepad++ users after breaching the popular text editor software, developers have revealed.

In a blog post, lead developer Don Ho said a preliminary investigation into the incident showed hackers went undetected for around six months, with those responsible believed to be a state-affiliated threat group.

“The incident began from June 2025. Multiple independent security researchers have assessed that the threat actor is likely a Chinese state-sponsored group, which would explain the highly selective targeting observed during the campaign,” he wrote.

Ho added that the “infrastructure-level compromise” allowed threat actors to “intercept and redirect update traffic”, with the source of the incident stemming from a hosting provider rather than vulnerabilities within the open source software itself.

“Traffic from certain targeted users was selectively redirected to attacker-controlled served malicious update manifests,” Ho explained.

The confirmation follows several weeks of speculation over a potential breach. In early December, security researcher Kevin Beaumont penned a blog post revealing he’d heard from three separate organizations who’d all experienced security incidents with Notepad++.

How Notepad++ was breached

According to Ho, details on the “exact technical mechanism” behind the breach are yet to be determined pending a comprehensive probe.

What we do know so far is that Notepad++ was operated through a shared hosting server and that the incident began in June 2025.

Through this compromised server, attackers were able to manipulate requests from WinGUp, Notepad++’s native updater tool. It’s from here that threat actors were able to redirect users to malicious servers.

The now-former hosting provider confirmed this shared server was compromised until 2 September 2025. Yet despite losing server access, attackers “maintained credentials to internal services” which enabled them to continue distributing malicious updates to users until 2 December.

“Remediation and security hardening” updates were completed by 2 December, according to Ho, which blocked further activity.

Who’s behind the Notepad++ breach?

A separate investigation by Rapid7 Labs attributed the breach to a Chinese APT group, Lotus Blossom.

According to researchers, the state-affiliated group has been active since 2009 and has a reputation for “targeted espionage campaigns” against organizations in Southeast Asia and Central America.

“Our investigation identified a security incident stemming from a sophisticated compromise of the infrastructure hosting Notepad++, which was subsequently used to deliver a previously undocumented custom backdoor, which we have dubbed Chrysalis,” the company noted in an advisory.

What users need to know

As Beaumont noted in his December blog post, Notepad++ issued an update to release version 8.8.8 in November. This patch aimed to “harden the Notepad++ Updater from being hijacked to deliver something… note Notepad++”.

While Beaumont advised users to confirm they’re running a version of the software from 8.8.8 or higher, developers have since urged users to ensure they’re running 8.9.1 or higher.

“I recommend downloading v8.9.1 (which includes the relevant security enhancement) and running the installer to update your Notepad++ manually,” Ho said.

“With these changes and reinforcements, I believe the situation has been fully resolved. Fingers crossed.”

In terms of indicators of compromise (IOCs), Ho noted in his blog post that there are none to share at present.

That doesn’t mean users are left complete in the dark, however. Rapid7’s advisory on the campaign does include IOCs for users who want to clarify whether devices have been targeted.

Cassius Edison, COO of Closed Door Security, said the severity of the breach is “hard to understate” and users should take immediate steps to establish if they’re impacted.

“It’s vital that users ensure their software is updated to the latest version, especially on systems connected to larger networks,” he said.

“The maintainer for Notepad++ has switched to a new host for updates, and has started to implement stricter verification of update binaries on the client side, which should hopefully mitigate any further hijacking attempts moving forward."

FOLLOW US ON SOCIAL MEDIA

The energy sector should be on the alert for a new multi‑stage adversary‑in‑the‑middle (AitM) campaign, Microsoft has warned.

Cloud collaboration platforms, particularly Microsoft SharePoint and OneDrive, are popular with threat actors thanks to their widespread presence in enterprise environments.

They offer built-in legitimacy, flexible file‑hosting capabilities, and authentication flows that attackers can take over and use to hide their presence.

This latest phishing and business email compromise (BEC) campaign, Microsoft said, abused SharePoint file sharing services to deliver phishing payloads. Emails with the subject line “NEW PROPOSAL – NDA” appeared legitimate, coming from a previously-compromised email address belonging to a trusted organization.

A number of user accounts have already been compromised, according to the Microsoft Defender Research team.

Victims clicking on a link included in the email were redirected to a fake login page, which collected their credentials. The attackers also altered inbox rules to mark all emails as "read", making their activity harder to detect.

They were then able to make use of trusted internal identities from the target to conduct large‑scale phishing attacks, both within the organization and externally, significantly expanding the scope of the campaign.

In one example, this phishing campaign involved more than 600 emails with a different phishing URL, which were sent to the compromised user’s contacts within and outside the organization, as well as distribution lists.

The attackers then made further efforts to avoid suspicion.

"The attacker read the emails from the recipients who raised questions regarding the authenticity of the phishing email and responded, possibly to falsely confirm that the email is legitimate," said the Microsoft team.

"The emails and responses were then deleted from the mailbox. These techniques are common in any BEC attacks and are intended to keep the victim unaware of the attacker’s operations, thus helping in persistence."

Tackling adversary-in-the-middle attacks

Microsoft highlighted the operational complexity of AiTM campaigns, saying that password resets alone are not enough to fix the problem.

Impacted organizations must, said the firm, make sure that they've revoked active session cookies, reversed the changes to MFA settings made by the attacker on the compromised user’s accounts and removed the altered inbox rules.

"While AiTM phishing attempts to circumvent MFA, implementation of MFA still remains an essential pillar in identity security and highly effective at stopping a wide variety of threats.

MFA is the reason that threat actors developed the AiTM session cookie theft technique in the first place," the team said.

The researchers also advised organizations to work with their identity provider to ensure security controls like MFA are in place.

They added: "Organizations should also consider complementing MFA with conditional access policies, where sign-in requests are evaluated using additional identity-driven signals like user or group membership, IP location information, and device status, among others."

FOLLOW US ON SOCIAL MEDIA

Pro-Russia hacktivists are targeting local government and critical infrastructure in the UK, the National Cyber Security Centre (NCSC) has warned.

In an advisory this week, the security agency issued an alert over increased DDoS attacks by state-aligned groups. These attacks are driven by ideology over Western support for Ukraine, rather than financial gain, and aren't directly controlled by the state.

"We continue to see Russian-aligned hacktivist groups targeting UK organizations, and although denial-of-service attacks may be technically simple, their impact can be significant," said NCSC director of national resilience Jonathon Ellison.

“By overwhelming important websites and online systems, these attacks can prevent people from accessing the essential services they depend on every day."

In particular, the NCSC cites the NoName057(16) group, active since March 2022, and operating mainly through Telegram channels. It uses GitHub, along with other websites and repositories, to host the proprietary DDoS tool, DDoSia, and to share tactics, techniques, and procedures (TTPs) with its followers.

NoName057(16) has carried out numerous attacks against government bodies and the private sector in countries perceived as hostile to Russian geopolitical interests, including frequent DDoS attempts against UK local authorities.

“NoName057(16) consistently targets organisations where availability is closely tied to public trust, particularly local government websites, civic services, and other public-facing infrastructure," said Christiaan Beek, senior director of threat intelligence and analytics at Rapid7.

"While the group presents itself as a grassroots hacktivist collective, the timing of its campaigns and the close alignment of its targeting with Russian geopolitical objectives mean we cannot rule out some level of state encouragement, coordination, or tacit approval."

Russian hacktivists are an ever-present threat

Russian hacktivism isn't a new problem. In 2023, the NCSC published an alert on the risk posed by state-aligned adversaries following the Russian invasion of Ukraine.

In December, alongside international partners, it co-sealed an advisory which called out pro-Russian hacktivist groups for targeting government and private sector entities.

The NCSC advises organizations to take preventative action – with the first steps being to discover weak points and look for help from upstream service providers.

To deal with attacks which can’t be handled upstream – or only once detected and blocked – they should make sure their service can rapidly scale.

Similarly, the agency said organizations should define a response plan, covering graceful degradation of services, dealing with changing tactics, retaining administrative access during an attack and having a scalable fallback plan for essential services.

Gary Barlet, public sector CTO at Illumio, welcomed the focus on mitigation as well as prevention.

"We need a new way of dealing with DoS attacks. For too long, we have focused solely on prevention, and this approach has not worked," he said.

"The NCSC’s advice signals a change by recommending that plans include retaining administrative access and implementing full-scale backup plans. However, there needs to be an entire mindset shift within critical infrastructure organizations to focus on prioritizing impact mitigation and maintaining service and operational uptime.”

FOLLOW US ON SOCIAL MEDIA

During 2025, the Scattered Spider hacking collective has been linked with numerous devastating attacks, including Marks and Spencer, Jaguar Land Rover and the Co-op.

Over the course of the year, Scattered Spider has also been impacted by multiple law enforcement takedowns but the organization keeps evolving and splintering off, despite this increased scrutiny. Later in 2025, it emerged that Scattered Spider collaborated with parallel threat groups ShinyHunters and LAPSUS$ to form a unified collective.

As Scattered Spider’s activities continue to ramp up, the collective’s changing tactics need to be on every businesses’ radar. Based on the group’s evolution in 2025, what can organizations expect in 2026?

Scattered Spider attacks throughout 2025

Throughout the year, Scattered Spider’s strategy has remained consistent: tricking help desks and employees into offering access, then jumping straight into cloud apps to steal sensitive data.

“Once they have the data, they use extortion to pressure companies into paying up,” Trend Micro’s Forward Threat Research team tells ITPro. “It is simple, it works, and they doubled down on it all year.”

Scattered Spider has evolved its focus over the course of the year. It kicked off 2025 by targeting software as a service (SaaS) platforms, with campaigns targeting Klaviyo and HubSpot using phishing infrastructure hosted on lookalike domains to harvest credentials from corporate users.

In April, it hit UK retailers, including Marks and Spencer, Harrods and the Co-op Group.

From May to June, Cartier and North Face, as well as Erie Insurance and Philadelphia Insurance also reported breaches consistent with Scattered Spider’s tactics.

After wreaking havoc on the retail and insurance sectors, the group quickly shifted to aviation. In June, Hawaii’s Hawaiian Airlines and Canada’s WestJet were attacked, while Australian airline Qantas reported a breach of a third-party contact center system. In July, the FBI publicly warned that Scattered Spider was targeting airlines with social engineering attacks.

The group tends to focus on one industry at a time, says Aniket Pachchhapur, cybersecurity consultant at GRC Solutions. “Scattered Spider consistently leverages help desk social engineering to penetrate whatever industry it targets. Over time, the group has gravitated toward high-value sectors with widely used outsourced IT services, but it adapts quickly to new targets as defenses stiffen.”

In all cases the group is known to use a "dual extortion" technique, first demanding a ransom. If that is not paid, they leak the data, says Jake Addison, SOC manager at Reliance Cyber.

Scattered Spider's rebrand

Rebranding is another favored tactic. If 2024 put Scattered Spider on the map, 2025 was the year it learned to reinvent itself, says Ed Williams, vice president of EMEA Consulting at Trustwave, a LevelBlue company.

Rather than disappearing, the group has evolved into a broader extortion ecosystem, now operating under the “Scattered LAPSUS$ Hunters” label. This umbrella identity combines elements of Scattered Spider, ShinyHunters and LAPSUS$, allowing multiple operators to “present a unified front when advantageous”, he says.

Scattered Spider and the wider cyber-criminal community, the Com, show how modern cyber crime has become “fluid, youth-driven and brand-agnostic”, says Rik Ferguson, VP of security intelligence at Forescout. “What we’re seeing now is not a single ‘gang’, but a loose collective that rebrands, regroups and recruits at speed, which is exactly what we observed in LAPSUS$ when we started tracking them back in 2022.”

The recent alignment with ShinyHunters and LAPSUS$ is “less a merger and more a reflection of how these crews swap members, tooling and tactics, while keeping the pressure on high-value targets”, according to Ferguson.

Law enforcement takedowns

With Scattered Spider’s attack radius surging, it’s no surprise law enforcement has stepped up in response. Arrests in the US and UK have been tied to some of the highest-profile attacks, and agencies have begun calling out the Com as a major emerging crime network.

Even so, these groups are “loose and flexible”, according to Trend Micro’s Forward Threat Research team: “Even when a few members get taken down, the overall operation keeps moving, almost like swapping players on a team, rather than shutting it down.”

In September 2025, Scattered Lapsus$ Hunters announced a temporary withdrawal from illicit activities on BreachForums, citing mounting law enforcement pressure and recent arrests as reasons for stepping back. However, in November 2025 the cybersecurity firm ReliaQuest observed Scattered Lapsus$ Hunters apparently targeting Zendesk users via a phishing campaign.

That same month, the group claimed responsibility for breaching over 200 companies via Gainsight integrations within Salesforce, per TechCrunch reporting.

Law enforcement takedowns have impacted the collective, but only at a surface level, says Williams. “Their public Telegram channels were removed at least a dozen times this year, yet they consistently rebuilt, often within hours. Instead of deterring activity, disruptions have actually amplified the collective’s reliance on spectacle.”

Scattered Spider continues to evolve

Through 2026, it is likely Scattered Spider will continue its methodology of either targeting companies within a particular sector, or focussing on a larger SaaS application such as Salesforce, says Addison.

From a tactics standpoint, the group has doubled down on social engineering, now at a greater scale, says Williams. Automated spear-phishing tools, some abusing services such as Google Voice, have enabled the threat group to “run high-volume identity harvesting campaigns with minimal manual effort”, he says.

Scattered Spider is also heightening its focus on insider access as a means to compromise networks, according to Addison. He cites the example of an attack on security company Crowdstrike, which dismissed an employee after screenshots of their work device were found posted on Telegram by the collective.

The group has talked about launching its own ransomware as a service this year, as well as floating the idea of an extortion as a service operation for any threat actors wishing to leverage the Scattered LAPSUS$ Hunters brand in their own attacks. “So we may see these being launched in 2026,” says Aiden Sinnot, principal threat researcher at Sophos.

As companies upgrade their security throughout 2026, identity and SaaS security should be a priority, according to Trend Micro’s Forward Threat Research team. “These attackers continue to prove they do not need advanced malware to break into critical environments.”

Taking this into account, stronger verification for help desk requests, phishing resistant MFA for admins and tight controls on third-party SaaS integrations will also go a long way. “And honestly, training people on how to handle suspicious phone calls or push spam is just as important,” Trend Micro’s researchers advise.

As part of IT help desk impersonation, Scattered Spider is known to install remote tools for access. Addison recommends that IT teams use as small a subset of trusted tools as possible, and ensure defenders are monitoring, alerting and blocking any others.

Scattered Spider is known to monitor communication platforms such as Teams and Slack, impersonating compromised user accounts to facilitate further information gathering. With this in mind, ensure that no sensitive data such as passwords is ever shared via these platforms, Addison advises. “And where possible video call people to verify that they are who they say.”

We’re just over a week into 2026 but already, enterprise cybersecurity teams will be hard at work repelling attacks – and business leaders will be worrying about the year ahead.

On the one hand, we’re told that AI tools are beginning to empower security teams to go further and faster. On the other, the use of AI by hackers to launch attacks also appears to be on the rise.

All of this is happening against a backdrop of rising geopolitical tensions and continual attacks by state-sponsored hacking groups against businesses. How will all this come together in 2026 and beyond?

In this episode, Jane and Rory are joined by Jamie Collier, lead advisor in Europe at Google Threat Intelligence Group, to explore the risks – both novel and ordinary – enterprises face in 2026.

Highlights

"I think one of the big reflections for me is just the extent to which threat actors are adapting to what I would call modern infrastructure. We think about the way that a lot of these traditional attacks have worked, we've seen that typical hack moving through the network, escalating privileges, etc. When we look towards defending cloud, SaaS, these sorts of spaces, it's a very different space, a lot more emphasis on identity and that is providing, effectively, a bypass to a lot of those complex threat operations where these threat actors can just really log in."

"The most obvious way that for actors are using AI is probably the most boring in terms of it's just different levels of automation of their attack life cycle. It's crafting phishing emails. It's conducting reconnaissance. I think that sort of goes without saying, and actually a lot of that is in areas we're not necessarily going to fully see, because they're going to be doing that with their own models, etc."

"There is a lot more to North Korea than just IT workers, right? We see also very big targeting of software developers, we see cryptocurrency remains a primary target, and I think given that their kind of dual objective of financial motivated operations and strategic intelligence gathering, it actually exposes a lot of organizations to all sorts of different types of North Korean threats that range from tailored targeting, to employment fraud, to initial access to cryptocurrency theft, ransomware, supply chain compromise."

Footnotes

• NCSC issues urgent warning over growing AI prompt injection risks – here’s what you need to know
• Cyber experts have been warning about AI-powered DDoS attacks – now they’re becoming a reality
• Salt Typhoon attack on US congressional email system ‘exposes how vulnerable core communications systems remain to nation-state actors’
• OpenAI says prompt injection attacks are a serious threat for AI browsers – and it’s a problem that’s ‘unlikely to ever be fully solved'
• OpenAI turns to red teamers to prevent malicious ChatGPT use as company warns future models could pose 'high' security risk
• A flaw in Google’s new Gemini CLI tool could’ve allowed hackers to exfiltrate data
• Google says you shouldn't worry about AI malware – but that won’t last long as hackers refine techniques
• North Korean IT workers: The growing threat
• North Korean hackers continue targeting developers in open source malware campaign - and experts say as many as 36,000 victims have been snared so far
• CRINK attacks: which nation state hackers will be the biggest threat in 2026?

Subscribe 

• Subscribe to The IT Pro Podcast on Apple Podcasts
• Subscribe to The IT Pro Podcast on Spotify
• Subscribe to the IT Pro newsletter
• Join us on LinkedIn

Chinese state-backed threat group Salt Typhoon is believed to have gained access to email systems used by US Congressional Committee staff.

According to reports from the Financial Times, the threat group is thought to have compromised accounts belonging to staff working on the House China Committee.

Aides working at the Foreign Affairs Committee, Armed Services Committee, and Intelligence Committee are also believed to have been impacted by the attacks.

Sources told the FT the incident was first discovered in December.

Exact details on the scope of the incident are yet to be confirmed. A person familiar with the matter told the publication it remains unclear whether the group fully accessed email communications.

Salt Typhoon has cyber agencies on alert

The campaign marks the latest in a string of attacks by Salt Typhoon on US government email systems and telecommunications networks.

A previous attack saw the threat group access and record telephone conversations of “very senior” American political figures, according to Anne Neuberger, deputy national security advisor for cyber and emerging technology under the Biden administration.

This particular campaign saw the group compromise major US telecoms companies, including Verizon, Lumen Technologies, and AT&T.

Salt Typhoon activities have escalated over the last three years, with security agencies on both sides of the Atlantic issuing repeated warnings about the threat posed by the group.

An advisory from the FBI in September noted the group had hit organizations in more than 80 countries as part of an “indiscriminate” hacking campaign.

In mid-2025, it was revealed the threat group also compromised US state National Guard networks. An investigation by the US Department of Defense (DoD) found hackers breached and laid low in compromised networks for almost a year.

The DoD warned the group may have accessed sensitive information pertaining to military and law enforcement operations.

“Deeply concerning” attacks

Benjamin Schilz, CEO at Wire, said the latest campaign “exposes how vulnerable core communications systems remain to nation-state actors”

“The Salt Typhoon espionage campaign highlights a sustained, state-backed assault on U.S. communications infrastructure by China’s Ministry of State Security,” he said.

“Regardless of whether lawmakers’ emails were accessed, the fact this activity went undetected for years is deeply concerning.

“Persistent access of this nature creates the potential to intercept unencrypted communications, including calls, messages, and voicemails across the U.S. population, posing a serious national security risk,” Schilz added.

FOLLOW US ON SOCIAL MEDIA

A London council has written to hundreds of thousands of residents to warn them that criminals may use details leaked via a cyber attack last year to target them for scams.

At the end of November, Kensington and Chelsea was one of a trio of west London councils that suffered an outage that was quickly attributed to a cyber attack.

A week later, the council confirmed that personal data was likely leaked, though it stressed it was only "historical data".

Now, a spokesperson for the council has said the attackers had "criminal intent", with the council's website adding that sensitive data and personal information that could impact residents had been accessed by the attackers.

Council leader Elizabeth Campbell said the "serious" breach required action from the council, with an update in the middle of December saying 100,000 households had already been contacted with warnings following the attack.

A spokesperson told ITPro the letters were sent out at the beginning of December, and the message references the attack of "two weeks ago".

"We decided to go out immediately and say to people this is what's happened, this data has been copied and it has been taken and you should be aware therefore you are at risk," she told the BBC.

Written warning

In a copy of the letter shared with ITPro by the council, recipients are advised to be wary of scam messages, check online accounts for unusual activity, and report any suspicious activity to the National Cyber Security Centre (NCSC).

"Like any local authority, it was always possible that our systems could come under attack and therefore we had invested significantly in our digital, data and technology services over many years," Campbell said in the letter.

"This meant that we had a cyber defence system that was able to spot this attack quickly and protect much of our infrastructure, and the infrastructure of others, as best as possible."

Campbell added: "Despite this, we do believe that some data has been copied and taken. It is important to say we still have access to this information, but it is possible a copy could end up in the public domain. As a priority we are checking if this contains any personal or financial details of residents, customers, and service users. This may take months and we will update residents at every step."

The council is now "going through all the documentation" to spot any specific risks and will contact individuals directly if affected, though it noted that work may take months.

Similarly, the local authority said it was checking which details in files may have been accessed, admitting that work may yield nothing, but said "we want to make sure we turn over every stone."

What happened

The attack began on the morning of 24 November, and was immediately spotted by staff at Kensington and Chelsea, who took steps to isolate systems.

A week later, that council admitted some data had been accessed, including sensitive information; however, it stressed the data wasn't encrypted by the attackers, such as in a ransomware attack, and therefore remained accessible to the council.

Hammersmith and Fulham Council and Westminster City Council were the other two local authorities hit by the outage, as the three organizations share some systems.

Hammersmith has said it so far appears its systems were not compromised, while Westminster earlier this month confirmed that "limited data" had been breached.

Keven Knight, CEO of Talion, told ITPro last year that councils are a prime target for cyber criminals, largely due to the scope of personal and financial information they hold on residents.

"This is the type of information that can’t be changed easily. This means it's now in the hands of a threat actor, and victims will be exposed to an increased risk of phishing," he said.

The Information Commissioner's Office (ICO) has been informed of the incident, and the Metropolitan Police and NCSC are investigating. So far, there's no indication who is behind the attack.

"The Met is leading an investigation and we are working alongside them with the national cyber security centre and the NCC Group," a spokesperson for Kensington and Chelsea council said.

"We are taking steps to work through the data in accordance with ICO and legal rules."

FOLLOW US ON SOCIAL MEDIA

A cyber criminal is claiming to have seized data from Florida-based engineering firm Pickett and Associates relating to three US utilities.

Pickett provides transmission and distribution power line design, aerial surveying, and LiDAR services to major utilities and mining firms across the US and the Caribbean.

The hacker in question is now offering around 139 GB of engineering data - 892 files - about Tampa Electric Company, Duke Energy Florida, and American Electric Power on a dark web forum.

There's an asking price of 6.5 bitcoin, or a little under $600,000.

The data is claimed to include more than 800 classified raw LiDAR point cloud files in .las format, ranging from 100 MB to 2 GB in size, along with full coverage of transmission line corridors and substations, including layers for bare earth, vegetation, conductors, and structure.

Also apparently up for sale are high-resolution orthophotos in .ecw format, microStation design files and PTC settings, large vegetation feature files in .xyz format and preserved folder structures from active projects.

"This dataset contains real, operational engineering data from active projects of major utilities and is suitable for infrastructure analysis, modelling, risk assessment of specialized research," the hacker said.

Tampa Electric Company has around 860,000 business and residential customers in West Central Florida, while Duke Energy Florida has about two million. American Electric Power, meanwhile, boasts nearly 5.6 million customers across 11 states.

ITPro approached Pickett and Associates for comment, but did not receive a response by time of publication.

German solar company data up for grabs

The same criminal is also offering what's claimed to be an internal database belonging to Hamburg, Germany-based solar energy firm Enerparc AG. The data is claimed to include information about solar projects in Spain’s Mallorca and Alicante regions.

According to research from Sophos, 67% of energy, oil or gas and utilities firms suffered a ransomware attack in 2024, up from 55% in 2020.

This time last year, TrustWave said that ransomware attacks targeting the energy and utilities sectors rose by 80% in 2024.

Energy firms are frequently targeted by hacktivists and nation state actors including Russia, China, Iran and North Korea, with China's Volt Typhoon hitting a number of power utilities in 2023.

All in all, US critical infrastructure operators reported almost 4,900 cybersecurity threats in 2024.

Critical industries in the crosshairs

According to recent research from security firm Kela, global ransomware attacks against critical industries rose by 34% in 2025.

The US was the most-affected country, accounting for 21% of global incidents, followed by Canada, Germany, the UK, and Italy.

"In critical industries, such disruptions can have national-level consequences, undermining essential operations and eroding public trust," commented Lin Levi, Kela threat intelligence team lead.

"To protect critical services, governments and critical industry sectors must prioritize proactive preventative measures and maintain continuous real-time monitoring to detect and respond to cyber threats."

FOLLOW US ON SOCIAL MEDIA

Russian-backed hacker groups are exploiting misconfigured edge devices – now preferring that tactic over hunting down traditional vulnerabilities to gain access to company networks.

That's according to an end-of-year report by Amazon Threat Intelligence, which included details of a nearly five-year-long campaign by Russian state-sponsored hackers that AWS said marked a pivot in tactics.

Now, the primary initial access vector has become misconfigured customer network edge devices, according to AWS Security CISO CJ Moses, with a decline in traditional vulnerability exploitation.

"This tactical adaptation enables the same operational outcomes, credential harvesting, and lateral movement into victim organizations’ online services and infrastructure, while reducing the actor’s exposure and resource expenditure," Moses noted in a post on the AWS security blog.

Amazon isn't the first to spot a shift to edge devices. Sophos noted in April that edge devices like firewalls and routers were the main initial attack vector for 30% of incidents last year, while governmental security agencies issued guidance about vulnerabilities in edge devices back in February.

Last year, Fortinet's FortiGate edge devices were exploited by China-backed hackers, and the FBI warned that Ubiquity EdgeRouters were targeted via a wide-ranging hacking campaign.

How the edge campaign unfolded

According to Amazon, hackers targeted enterprise routers, VPN concentrators and remote access gateways, network management appliances, and cloud-based project management systems, as well as collaboration and wiki platforms.

Moses said the evidence suggested that the hackers were using packet capture and traffic analysis to target network edge devices. This involves attackers compromising an edge device hosted on AWS, capturing packets to harvest credentials, and then using those to penetrate an organization's services or infrastructure, gaining access to wider systems.

AWS telemetry suggested the attackers maintained persistent connections, allowing for data to be stolen.

"Targeting the 'low-hanging fruit' of likely misconfigured customer devices with exposed management interfaces achieves the same strategic objectives [as vulnerability exploitation], which is persistent access to critical infrastructure networks and credential harvesting for accessing victim organizations’ online services," Moses added.

Notably, the company revealed those attacks included customer network edge devices hosted on AWS.

"This was not due to a weakness in AWS; these appear to be customer misconfigured devices. Network connection analysis shows actor-controlled IP addresses establishing persistent connections to compromised EC2 instances operating customers’ network appliance software," Moses noted.

That said, AWS did take action. For example, the cloud giant notified affected customers that they were compromised, fixed compromised EC2 instances, and alerted network alliance vendors.

"Through coordinated efforts, since our discovery of this activity, we have disrupted active threat actor operations and reduced the attack surface available to this threat activity subcluster," Moses added.

To protect edge devices against this style of attacks, organizations must secure and monitor their edge devices, Moses advised, keeping watch for unexpected packet capture files or utilities and enforcing strong authentication – in particular those working in the energy sector or critical national infrastructure.

A 'clear evolution in tactics'

This particular string of attacks dates back to 2021 and appears to be associated with Russia's Main Intelligence Directorate, Moses said.

Similarly, the campaign focused primarily on critical national infrastructure in the West, targeting the energy sector and its supply chain in particular.

Moses traced a timeline back to 2021's WatchGuard exploitation, saying that's when Amazon first spotted the hackers targeting misconfigured devices.

That continued in the next few years with misconfigured devices targeted alongside exploits such as the Confluence and Veeam flaws, but by 2025 the hackers' success with edge devices led to that taking centre stage with zero-day exploitation activity declining.

"The campaign demonstrates a clear evolution in tactics," Moses said.

FOLLOW US ON SOCIAL MEDIA

The UK government has confirmed reports that its Foreign Office was hacked – but won't say whether or not China was behind the operation.

Last week, the Sun reported that Chinese hacking group Storm 1849 had breached the UK Foreign, Commonwealth and Development Office (FCDO) in October and stolen tens of thousands of files — potentially including personal information including details about visa applicants.

Indeed, a separate report from Sky news suggested it was a Home Office system targeted, which was run by the FCDO.

A government spokesperson admitted the attack: "We have been working to investigate a cyber incident. We take the security of our systems and data extremely seriously."

Limited confirmation

A day later British trade department minister Chris Bryant confirmed the attack while speaking to various media outlets – but said he couldn't say who was behind the attack or whether China was involved.

"There certainly has been a hack," Bryant told Times Radio, according to Reuters. "I'm not able to say whether it is directly related to Chinese operatives, or indeed, the Chinese state."

Bryant told Sky News that the government became aware of the attack in October and didn't believe individual data had been accessed, adding it remained unclear who was behind the incident.

He suggested that the reporting around the hack was "a bit more speculation than accurate," accusing the Sun of "slightly over-egging the kind of details that are available at this stage."

However, Bryant also admitted that the government could share "remarkably little" about the incident despite investigating for several weeks. He did say that the "hole" was closed quickly, and that the attackers exploited a "technical issue", Sky noted.

Bryant added: "And we're fairly confident that there's a low risk of any individual actually being affected by this."

China or not?

The Sun report pinned the blame on China and the Storm 1849 hacking group, noting that it has been previously accused of targeting the UK government via attacks against MPs and the Electoral Commission.

In October, Prime Minister Starmer was forced to deny that his government was hoping to appease China, after a spying case involving the country was dropped. Earlier in December, Starmer admitted that China posed "national security threats" to the UK.

The Chinese embassy in the UK said via a spokesperson, per Sky News: "We strongly oppose such false accusations targeting China. China is a staunch defender of cybersecurity and one of the major victims of cyber espionage and attacks."

Attacks on the UK

The incident follows serious hacks against major British businesses and institutions, including the ransomware attack against the British Library in 2023 and major retailers M&S and Co-op this year. Jaguar Land Rover was also knocked offline, halting car production, following a cyber attack this year.

The public sector is particularly at risk, experts told ITPro last year, as lower budgets make it harder to fill security professional roles.

Indeed, industry experts have called for the government to increase its security budget amid the rise in attacks, in particular as hackers have started to target critical national infrastructure.

FOLLOW US ON SOCIAL MEDIA

Throughout 2025 nation state adversaries have carried out a large number of notable attacks, with incidents attributed to China, Russia, Iran and North Korea – also known as CRINK. In August, UK and US officials publicly linked three technology companies based in China with a global malicious cyber campaign targeting critical networks.

Russia is engaged in rampaging cyber attacks in Ukraine and abroad, hitting critical sectors such as energy as part of its geopolitical aims. Iran is becoming a more formidable adversary, while North Korean IT workers have been infiltrating an increasing number of firms in the US and Europe.

Going into 2026, the landscape is shifting slightly, so which of the CRINK attackers is the biggest threat to businesses?

China in the lead

Experts concur that China is a leading threat to UK and US businesses, but it might not pose the most pressing risk.

China represents the most “persistent, long-term threat” to western firms, says Philip Ingram, MBE, a former colonel in British military intelligence. This due to its “focus on harvesting as much data as it can, stealing IP and proprietary data via stealthy, long-dwell operations”, he says.

China-nexus operations aiming to influence its future ability to understand and manipulate western thinking “consistently surpasses the volume of other nations”, according to Ingram.

He paints a scary picture of China adversarial activity: “They are on a massive data harvesting mission, storing anything and everything they can find, in order to create a lake of data they can analyse when quantum computing challenges are overcome.”

However, this is a more long term risk. Russia presents the highest immediate threat of “catastrophic operational disruption for critical national infrastructure (CNI)”, Ingram adds.

At the same time, he warns, Iran-backed groups are growing more sophisticated, leveraging AI in social engineering and focusing on targets in the Middle East, Israel and the US and UK to support regional political objectives.

A relative threat

The threat posed by nation state adversaries is relative, based on the country and industry a firm operates in. “If you are in Ukraine and Eastern Europe, the biggest risk is Russia,” according to Ian Thornton-Trump, CISO at Inversion6.

“For US critical infrastructure, the biggest risk is China; if you’re an Iranian dissident, it’s the Iranian intelligence services and their surveillance capabilities: and if you have anything to do with Bitcoin it’s North Korea.”

While all firms can be a target of nation state attacks, a few sectors are at a more obvious risk. Organizations targeted by Chinese nation state activity include those within CNI such as energy and utilities, either directly, or indirectly via the supply chain, says Darrel Lang, cyber threat intelligence analyst at Bridewell “This serves the national objectives set by the Chinese Communist Party (CCP) to develop and assert domestic economic and technological dominance, where pre-positioned backdoor accesses are the primary objective. Theft of intellectual property is now secondary.”

On top of CNI and the supply chain, nation states are also targeting the AI ecosystem, says Ingram. Semiconductor manufacturers, AI model developers, and companies with large, proprietary training datasets are at risk from nation states and China-backed adversaries in particular, he warns.

This is likely to continue into 2026, with China continuing its successful “Typhoon” campaigns seeking to embarrass western governments and “take as much intellectual property as possible”, says Thornton-Trump.

At the moment, the Iranian regime is “confined to the home front” to focus on dissidents, Thornton-Trump says. Yet he thinks it’s probable the nation “will execute some large cyber-attacks” to “keep Hamas, Hezbollah and the Houthis in awe of the Regime”.

North Korea is still largely focused on money, specifically cryptocurrencies, says Thornton-Trump. He thinks 2026 will reveal the extent to which the IT supply chain has been compromised at a global level by the North Korean IT workers scheme – which famously impacted security firm KnowBe4 in 2024.

“Some researchers believe it’s been in place as early as 2014 and the amount of intellectual property stolen from IT companies could be extraordinary.”

Types of CRINK attacks

While nation state adversaries often focus on specific targets, there is no single tactic, technique and procedure (TTP) to look out for going into 2026, says Lang. “Chinese nation-state groups have demonstrated the capability to secure initial access via numerous methods, often tailored on the basis of prior reconnaissance activity,” he says.

However, key attack vectors that must be considered are supply chain compromise, SEO poisoning and exploits of public facing applications, Lang suggests. “These techniques enable low-noise approaches to a target network and a minimalist footprint from which they can conduct long-term actions on objectives.”

Often, the means of nation states gaining access are simple and well-trodden. Most recently, social engineering, in particular vishing, has been making a comeback, says Andy Swift, cybersecurity assurance technical director, Six Degrees. “Complexities of remote work and supply chains in the modern workplace have created space for this type of attack to thrive and a number of organizations are finding themselves without guidance or policy.”

The most important thing to understand is that nation state actors “generally don’t perform random attacks and will have specific objectives”, says Thornton -rump. “It could be anything from compromising endpoints to building a bot net for distributed denial of service (DDoS) attacks – or a specific goal for espionage purposes. It all comes down to detecting the attack, containing it, and pushing the threat actor out of the network.”

How to prepare for CRINK in 2026

While China seems to be shifting its tactics and ramping up, experts say 2026 could see much of the same from all nation states, with adversaries increasingly using technology such as AI to supercharge attacks. AI will help to increase speed, scale and believability, as well as supporting traditional human intelligence type operations, says Ingram.

With this in mind, Ingram advises getting the basics right, shoring up identity and access management and employing a zero trust mindset.

Thornton-Trump emphasizes the benefits of a threat intelligence program, alongside optimum detection capabilities. “If it’s likely you will need to go toe-to-toe with nation state adversaries, you have to gear-up – be able to detect initial compromise and quickly act,” he says. “The critical piece here is to have a very high signal-to-noise ratio to detect even subtle activity that could be an indication of compromise.”

Extermination, a term used for removing the various footholds adversaries may have in the network, is another step to take, adds Thornton-Trump.

“You need a well-resourced and trained threat hunting team with expertise in reverse engineering. CRINK is likely to possess never-seen-before malware capabilities so expect to discover things that are rare and unique. Facing off against nation state actors is probably the toughest job in cyber and bringing in outside help, such as law enforcement and even intelligence agencies, may need to be part of the response playbook.”

NHS software supplier DXS International has disclosed a cyber attack on its internal systems.

The company provides clinical support solutions for clinical commissioning groups, doctors, nurses and pharmacists as part of their workflow and during patient consultations.

Its products integrate with core NHS systems, and in some cases are hosted on the NHS’ Health and Social Care Network (HSCN).

The company says it supports around 10% of all NHS referrals in England. Its ExpertCare solution, for example, helps clinicians quickly understand prescription needs for cardiovascular diseases, and is used by around 2,000 GPs, overseeing the care of around 17 million patients.

In a filing with the London Stock Exchange, DXS International said it had discovered a security incident affecting its office servers in the early hours of Sunday, 14 December.

"Once discovered, the data security breach was immediately contained by means of a joint effort by DXS’s internal IT security teams in close cooperation with NHS England," said the firm.

"The Board has appointed an external cyber security specialist agency whose thorough investigations are underway to establish the nature and extent of the incident."

The company said there's been "minimal" impact on its services, with front-line clinical services unaffected and operational.

DXS has notified the relevant regulators, authorities, and law enforcement agencies, including the Information Commissioner's Office (ICO), and is fully cooperating with their investigations. It's also working with various NHS bodies

“We, along with the National Cyber Security Centre and law enforcement partners, are working with an NHS supplier who is investigating a cyber incident," an NHS England spokesperson told ITPro. “We are not aware of any patient services being impacted.”

DXS International the latest NHS supplier hit

Attacks on NHS suppliers are becoming increasingly common, with threat actors viewing third-party providers as a potentially lucrative source of data.

Earlier this year, Birmingham-based software provider Advanced Computer Software Group was handed a £3 million fine by the Information Commissioner's Office (ICO) for security failings that led to a ransomware attack on the NHS.

In another example, thousands of procedures were canceled at London hospitals after an attack on blood testing company Synnovis. The attack was claimed by Russian-speaking ransomware group Qilin.

Last month, the government proposed new laws to strengthen cybersecurity in public services, including the NHS.

Medium and large companies providing services like IT management, IT help desk support, and cybersecurity will be regulated for the first time, required to report incidents promptly, and implement more robust recovery plans.

As a result, critical suppliers such as those providing healthcare diagnostics to the NHS will have to meet tighter security requirements, and enforcement will be toughened up.

"The reforms will make fundamental updates to our approach to addressing the greatest risks and harms, such as new powers to designate critical suppliers," said national chief information security officer for health and care at the Department of Health and Social Care, Phil Huggins.

"Working with the healthcare sector, we can drive a step change in cyber maturity and help keep services available, protect data, and maintain trust in our systems in the face of an evolving threat landscape."

FOLLOW US ON SOCIAL MEDIA

Cybersecurity teams are facing a double edged sword of challenges and opportunities. On the one hand, AI tools offer a great deal of autonomous working and the promise of automating some of the more laborious tasks that a cybersecurity team has to undertake.

On the other hand, attackers are also using AI to launch large scale attacks such as sophisticated phishing campaigns and identity theft. To fight this threat, cybersecurity teams will need to unify data like never before and take advantage of as many new technologies and processes as they can.

How can they go about this? And what does a unified cybersecurity strategy really look like in 2026?

In this episode, Rory is joined by Mandy Andress, chief information security officer at Elastic, to explore how businesses can evolve their threat detection and security posture, as well as how AI is lowering the barrier to entry for attackers.

Highlights

"Of course, it all started with phishing messages. It used to be really easy to identify a phishing message, and AI was able to fix that and solve a lot of the language challenges and grammar and the punctuation challenges."

"So we talk about zero trust, we talk about least privilege, and none of those foundational elements have changed. I think in some cases, they've become even more critical, certainly least privileged, as you're looking at system accounts and and non-human identities and agents and really focusing on what they can and cannot do what they can and cannot access. From a threat actor perspective, those are our perfect lateral movement capabilities, 'let me be able to take over an agent and have it do what I want it to do' versus what it's potentially expected to be doing."

"We're starting to see augmenting of analysts, we're starting to see some autonomous workflows, but we're still taking the approach of how we have been looking at things and then adding on or expanding some capabilities. There will be a point in maybe five, seven years out that we are going to need to make a fundamental shift in our approach to continue to build and leverage all of the advantages that we would be able to have."

"The key way for success in today's environment is you need to understand what is happening. You need to have a very holistic, comprehensive view of both what is happening and what exists in your environment, and bringing in as much context, telemetry understanding as possible,

Footnotes

• In the age of AI threats, the future of security is unified
• AI-generated code is now the cause of one-in-five breaches – but developers and security leaders alike are convinced the technology will come good eventually
• AI-generated code risks: What CISOs need to know
• Agentic AI carries huge implications for security teams - here's what leaders should know
• The NCSC touts honeypots and ‘cyber deception’ tactics as the key to combating hackers — but they could ‘lead to a false sense of security’

Subscribe 

• Subscribe to The IT Pro Podcast on Apple Podcasts
• Subscribe to The IT Pro Podcast on Spotify
• Subscribe to the IT Pro newsletter
• Join us on LinkedIn

Cisco has issued a warning to customers after revealing China-linked hackers are exploiting a new high-severity zero day flaw in some security products.

Products targeted in the campaign include Cisco AsyncOS Software for Cisco Secure Email Gateway, formerly known as Cisco Email Security Appliance (ESA), and Cisco Secure Email and Web Manager, formerly known as Cisco Content Security Management Appliance (SMA).

Cisco Secure Email and Web Manager centralizes management and reporting functions across a number of Cisco ESAs and Web Security Appliances (WSAs), offering centralized services such as spam quarantine, policy management, reporting, tracking, and configuration management.

The currently unpatched vulnerability, tracked as CVE-2025-20393, has a CVSS score of 10.0.

Cisco said it became aware of the issue on December 10, and that the activity has been ongoing since at least late November. It's been hitting appliances with certain non-standard configurations that leave some ports open to the internet.

It's not known how many customers have been affected.

The attack involves a custom persistence mechanism that Cisco is tracking as “AquaShell”, along with additional tooling meant for reverse tunneling and purging logs.

"This attack allows the threat actors to execute arbitrary commands with root privileges on the underlying operating system of an affected appliance," the firm said.

"The ongoing investigation has revealed evidence of a persistence mechanism planted by the threat actors to maintain a degree of control over compromised appliances."

Cisco is attributing the attacks to a group tracked as UAT-9686, a Chinese-nexus advanced persistent threat (APT) actor.

"We have observed overlaps in tactics, techniques and procedures (TTPs), infrastructure, and victimology between UAT-9686 and other Chinese-nexus threat actors Talos tracks," said the company's Talos researchers.

"Tooling used by UAT-9686, such as AquaTunnel (aka ReverseSSH), also aligns with previously disclosed Chinese-nexus APT groups such as APT41 and UNC5174. Additionally, the tactic of using a custom-made web-based implant such as AquaShell is increasingly being adopted by highly sophisticated Chinese-nexus APTs."

How to mitigate AquaShell threats

AquaShell is a lightweight Python backdoor that is embedded into an existing file within a Python-based web server that can receive encoded commands and execute them in the system shell.

If customers identify an appliance as having the web management interface or the Spam Quarantine port exposed to and reachable from the internet, Cisco said it strongly recommends following a multi-step process to restore the appliance to a secure configuration, when possible.

If this can't be done, customers should contact Cisco's Technical Assistance Center to check whether the appliance has been compromised. If it has, rebuilding the appliances is, currently, the only way to eradicate the threat actor's persistence mechanism from the appliance.

Cisco also strongly recommends restricting access to the appliance and implementing robust access control mechanisms to make sure that ports are not exposed to unsecured networks.

FOLLOW US ON SOCIAL MEDIA