Hackers hiding in plain sight.

This section covers recent activities of various cyber threat actors. The Medusa ransomware group has compromised over 500 U.S. critical infrastructure organizations since 2021, highlighting the evolution of Medusa from a closed operation to a ransomware-as-a-service model. The DOJ has charged 17 Iranian nationals involved in a long-standing hacking campaign targeting U.S. government agencies, universities, and international organizations, stealing vast amounts of research and intellectual property. The Klopp ransomware group has exploited a critical vulnerability in PTC's platforms, affecting companies like Shell and Philips, with ongoing investigations into potential breaches. Additionally, active exploitation of vulnerabilities in Microsoft, VMware, and Apple products underscores the urgent need for patching and security updates.

Researchers have uncovered 'TwinLoot', a Python-based malware that uses Microsoft 365 services like SharePoint and Teams to covertly exchange commands and data, beginning with fake support calls. This malware also employs a counterfeit Windows lock screen to harvest passwords, demonstrating sophisticated concealment techniques. The threat highlights the growing sophistication of malware leveraging cloud services for command and control, emphasizing the importance of monitoring unusual activity in enterprise cloud environments.

Maria Vermazis reports on Ukraine's recent strike on a Russian space center in Samara, targeting Russia's rocket and satellite infrastructure, including the RASFET satellite constellation used for communications. This attack marks a strategic move against Russia’s space-based assets and disruption of their plans to establish satellite networks akin to Starlink, which is a significant development in the intersection of space and cyber warfare with geopolitical implications.

The FDA is seeking public feedback to regulate generative AI-enabled medical devices, considering risks like hallucinations, model drift, and cybersecurity concerns. Meanwhile, researchers have demonstrated that some expired VISA contactless cards can still be used for payments due to cryptographic vulnerabilities, raising concerns about payment security and the need for improved protocols. The situation underscores the evolving regulatory landscape and security risks associated with AI and contactless payment technologies.

A former contractor at Brightley software was sentenced to prison after attempting to extort his employer using stolen data, demanding millions in cryptocurrency and threatening to leak sensitive information. This case illustrates the ongoing insider threat challenge and the importance of monitoring privileged access, especially during employee departures, to prevent malicious actions from insiders.

At Black Hat USA 2026, Brian Vecci, Field CTO at Varonis, discusses the transformative impact of AI on cybersecurity. He emphasizes that current AI systems are only using a small fraction of enterprise data but will increasingly connect and leverage all data securely. Vecci highlights the importance of context—privacy, security, access control, and behavior—when deploying AI agents to ensure safety and effectiveness. He advocates for automation driven by comprehensive telemetry, data classification, and behavioral insights to securely harness AI’s potential.

Investigators report that cargo theft targeting AI data center equipment is becoming more violent and sophisticated, involving cyber-enabled fraud, forged identities, and automotive chases. These thefts reflect the high value of AI hardware and the need for deploying advanced physical security measures such as GPS tracking, identity verification, and license plate monitoring. Protecting AI infrastructure now resembles guarding a high-security vault on wheels, confronting both cyber and physical threats.