Threat Intel
August 17th Threat Intel: From Colombian Ransomware to AI‑Driven Espionage and Critical Vulnerabilities
This week’s bulletin highlights a ransomware hit on Colombia’s Ministry of Justice that stalled drug‑monitoring services, a 19‑million‑person data breach at Poland’s MyDr platform, and a social‑engineering attack on Levi Strauss that stole internal data. A phishing incident at U.S. defense contractor IEH Corp exposed sensitive engineering files. Researchers exposed a China‑linked AI campaign that mapped Taiwanese government systems, a North Korea‑linked Kimsuky offline AI toolkit, and the replayability of encrypted reasoning blocks from major LLM APIs. Patch Tuesday saw Microsoft, Apple, Adobe
Top Attacks & Breaches
- Colombia’s Ministry of Justice suffered a ransomware assault that encrypted portions of its infrastructure, disrupting drug‑monitoring and legal services. No data exfiltration was reported.
- Poland’s MyDr healthcare platform was breached, potentially affecting 19 million users. Attackers claimed 2.5 TB of data, including a senior politician’s personal details and prescription records.
- Levi Strauss & Co. faced a social‑engineering breach that compromised three employee devices. Preliminary checks show no consumer data was accessed.
- IEH Corp, a U.S. defense and aerospace supplier, fell victim to a phishing attack that stole credentials via a fake document‑sharing link, risking exposure of customer orders and export‑controlled tech.
AI‑Driven Threats
- Researchers identified a China‑linked campaign deploying autonomous AI agents against Taiwanese government systems, compromising 85 accounts and 2,500 personnel records before targeting nuclear safety and energy firms.
- North Korea‑linked Kimsuky is building an offline AI environment to automate phishing, intelligence analysis, and malware development, combining local language models with code and transcription tools.
- Analysis of over 315,000 encrypted reasoning blocks from OpenAI, Anthropic, and Google APIs revealed that replaying these blocks can expose API keys, passwords, and private cryptographic material.
Patch Tuesday Highlights
- Microsoft’s August update patches 421 vulnerabilities, including CVE‑2026‑68820, a WinSock driver flaw that can elevate local attackers to SYSTEM.
- Apple fixed CVE‑2026‑65400, a macOS screen‑sharing flaw that lets attackers authenticate without credentials, already being used to deploy Monero miners.
- Adobe addressed CVE‑2026‑71362, a critical authentication bug in Commerce and Magento that enables session hijacking.
- Zoom patched three critical RCE vulnerabilities in Zoom Workplace, affecting annotation features and requiring no user interaction.
Related vulnerabilities
RootPwn Weekly: Airport Breach, ATF, Boston Scientific, McKesson, AI Threats, and Critical Vulnerabilities
This week’s intel reveals a massive data leak at Manchester Airports Group affecting 8.7 million passengers, a compromised ATF system, and network outages at Boston Scientific. McKesson’s 284 million‑record breach stemmed from vishing‑driven Okta takeovers. AI researchers exposed new injection techniques and a phishing‑as‑a‑service platform. Meanwhile, PaperCut, Ubiquiti, Vercel, and ServiceNow rolled out emergency fixes for CVSS 10 zero‑day flaws that could grant remote code execution.
Read briefing
AI‑Enabled Attacks: The Open Letter That Left Out Who’s Behind the Threat
A recent open letter from major tech firms warned that AI could make sophisticated cyberattacks cheaper and more common, but it failed to identify the actors exploiting the new tools or how to close the emerging threat window. The warning came after U.S. agencies uncovered AI‑generated exploitation scripts targeting exposed Siemens S7 PLCs in critical infrastructure. Analysts argue that criminals are driven by profit, not novelty, and that the real risk lies in old misconfigurations now being weaponized by AI. The industry must prioritize hardening high‑risk assets, scrutinize AI‑generated cod
Read briefing
Weekly Threat Briefing: Autonomous AI Intrusion, Critical Zero-Days in SonicWall, and High-Impact Enterprise Breaches
Recent threat intelligence highlights alarming developments in cybersecurity, including enterprise network compromises executed by AI agents in under ten hours, critical zero-day vulnerabilities in SonicWall SMA gateways and CrowdStrike Falcon, and widespread data breaches affecting Dropbox, Thomson Reuters, and medical providers.
Read briefing
AI Platforms Become New Attack Vectors: Hackers Hijack Claude, ChatGPT and More
As AI tools like Claude, ChatGPT and Grok become integral to daily workflows, threat actors are turning these trusted platforms into launchpads for malware, phishing, and data theft. By weaponizing shareable AI artifacts, exploiting sponsored search results and embedding malicious instructions in seemingly legitimate AI conversations, attackers can deliver ransomware, credential stealers and other payloads with minimal user suspicion. Recent campaigns—FakeAgent’s Claude Artifact redirect to SectopRAT and a fake Apple‑support guide on claude.ai/share that installs the MacSync stealer—show how q
Read briefing