US Water Systems Get Cyber Boost From New Senate Bill and ‘Water Watch Center’

US lawmakers and cybersecurity leaders are moving in parallel to strengthen defenses for the nation’s water systems, with the Water Cyber Shield Act expanding federal oversight and funding. At the same time, the Water Watch Center is bringing managed security services and threat intelligence to small utilities that are often least...

hendryadrian.com

Corma Raises $60 Million for Defensive Cybersecurity AI Model

Corma has emerged from stealth with $60 million in seed funding to build an AI foundation model purpose-built for defensive cybersecurity. The Tel Aviv and San Francisco-based startup says its agents analyze security telemetry to detect subtle threats, adapt to enterprise environments, and stop multi-stage intrusions. #Corma #OpenAI #Anthropic...

hendryadrian.com

2,500+ Companies and 434,000 CI/CD Pipelines Exposed in the Largest AI Supply Chain Breach of 2026

CloudSEK says Team PCP leveraged a compromised security toolchain to push malicious LiteLLM releases in March 2026, creating a large supply-chain exposure across AI infrastructure and CI/CD environments. The incident potentially exposed cloud credentials, repository tokens, Kubernetes secrets, and AI provider keys at thousands of organizations, while FBI FLASH-20260702-01 warns the stolen access may still be weaponized. #TeamPCP #LiteLLM #Trivy #FBI FLASH-20260702-01

hendryadrian.com

US and South Korea warn of Gunra ransomware targeting govt agencies

U.S. and South Korean agencies warned that Gunra ransomware is targeting government and critical infrastructure organizations worldwide, using Conti-based code, Fortinet firewall exploits, and other access flaws to spread across Windows and Linux systems. The advisory also notes Gunra’s shift to a ransomware-as-a-service model, its recruitment of initial access brokers, and possible links to Lazarus Group. #Gunra #Conti #Fortinet #FortiOS #FortiProxy #LazarusGroup

hendryadrian.com

Ransom! Merge (AUG-2026)

Merge, a US-based victim, reported a ransomware incident attributed to the direwolf threat actor, resulting in financial impact. The impacted country is #UnitedStates

hendryadrian.com

Ransom! Statista GmbH (AUG-2026)

Direwolf ransomware claimed an attack on Statista GmbH in Germany, targeting its data collection and internet portal operations. The incident resulted in unauthorized access and disruption of services in Germany. #Germany

hendryadrian.com

Ransom! Quironsalud (AUG-2026)

Quironsalud in Spain, a network of Hospitals & Physicians Clinics, was targeted by the direwolf ransomware threat actor. The attack resulted in disruption to healthcare operations and access to critical systems, impacting Hospitals & Physicians Clinics in #Spain

hendryadrian.com

Cybercrime in Upper Austria Disrupts Workers’ Chamber Systems

The Upper Austrian Chamber of Labour was hit by a cyberattack that disrupted its email servers and telephone system, causing ongoing service limitations. Authorities say the attacker has not yet been identified and that no data was stolen. #ArbeiterkammerOberösterreich

hendryadrian.com

Ransomware Attack Disrupts Doors and HVAC at Winnipeg Health Sciences Centre

Winnipeg’s Health Sciences Centre was hit by a ransomware attack that disrupted building maintenance systems, including door access, heating, ventilation, and air-conditioning. Patient care and clinical operations were not affected, but the incident prompted an investigation amid prior warnings about the hospital’s cybersecurity. #HealthSciencesCentre #Winnipeg #Manitoba

hendryadrian.com

Ransom! Leafwell (AUG-2026)

Leafwell, a US healthcare provider, reported a ransomware incident involving Hospitals & Physicians Clinics attributed to the direwolf threat actor. The attack impacted healthcare operations and data access, affecting the United States #UnitedStates

hendryadrian.com

Ransom! FREYWILLE (AUG-2026)

The ransomware claim targets FREYWILLE in Austria, allegedly by the aurora threat actor, compromising 142+ employee files including salary statements, social security numbers (ELDA), employment contracts across 24 countries, and identity and benefits documentation. It also claims theft of FREYWILLE trade secrets such as 2025 product costing data and enamel color recipe formulations, plus legal and incident records tied to lawsuits and prior attacks affecting #Austria.

hendryadrian.com

Ransom! Chat Jur,ídico (AUG-2026)

Chat Jurídico in Brazil (BR) reported a ransomware incident impacting the Law Firms & Legal Services sector, attributed to the direwolf threat actor. The attackers’ activity resulted in encrypted and disrupted services for the organization in Brazil #Brazil

hendryadrian.com

New StormEncryptor ransomware used by former Medusa affiliate

Microsoft says the threat actor Storm-1175, previously linked to Medusa ransomware, is now deploying a new ransomware strain called StormEncryptor after likely exploiting CVE-2026-18577 in N-central. The malware appends the .encrypted extension, drops a ransom note named !!!README_FIRST!!!.txt, and threatens to leak stolen data if victims do not pay within three days. #Storm-1175 #StormEncryptor #CVE-2026-18577 #N-central #Medusa

hendryadrian.com

Mozilla Issues New Firefox GPG Key Following Exposure

Mozilla issued a new GPG signing subkey for some Firefox and Thunderbird artifacts after the previous key was accidentally exposed in a private GitHub repository. The company revoked the exposed key, found no evidence of unauthorized access, and said most users do not need to take action unless they manually verify...

hendryadrian.com

BdThemes Supply Chain Attack Poisons JSON to Create Rogue WordPress Admins

Cybersecurity researchers uncovered a supply chain compromise at BdThemes that poisoned remote JSON data used by several WordPress plugins, leading WordPress to temporarily disable downloads pending review. The attack leveraged the Biggopti component to trigger XSS in wp-admin, enabling rogue administrator creation, web shell deployment, and persistent backdoor access. #BdThemes #WordPress...

hendryadrian.com

The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications

Aeternum is a C++ botnet loader that moves command-and-control operations onto the Polygon blockchain, using smart contracts and RPC queries to retrieve encrypted or plaintext instructions. The investigation also links Aeternum to a Telegram-based Python malware family and a blended payload set involving XWorm RAT and the XMRig miner, while highlighting...

hendryadrian.com

Ransom! LT Group / Fortune Tobacco Corp (AUG-2026)

Deadlock ransomware activity targeted LT Group / Fortune Tobacco Corp in the Philippines (PH), where 14,836 files totaling 27 GB were allegedly compromised after the victim ignored extortion messages for 72 hours. The attackers leaked samples including passport (MRZ) data, PNB/Holco USD bank statements, BIR/eFPS credentials, and promissory notes tied to Eton Properties (PHP 2.53B debt), with the impact disclosed as “Full leak: August 18.” #Philippines

hendryadrian.com

Ransom! Consolidated Medical Practices of Memphis (AUG-2026)

Genesis ransomware targeted Consolidated Medical Practices of Memphis, a healthcare organization in the US, causing disruption to critical medical operations. The impacted country is #UnitedStates

hendryadrian.com

Ransom! Interim HealthCare (Oklahoma and Tulsa) (AUG-2026)

Genesis ransomware impacted Interim HealthCare (Oklahoma and Tulsa), disrupting operations for an elderly care services provider in the United States. The attack highlights the risks facing healthcare organizations and their patients while services remain under strain. #UnitedStates

hendryadrian.com

Argentina's National Identity Registry Allegedly Leaked, 48 Million Citizen Records With Home Addresses Offered

An actor using the name GordonFreeman claims to be selling a 15.7GB database from RENAPER, Argentina’s national identity registry, allegedly containing 48 million citizen records. The sample reportedly includes DNI numbers, home addresses, phone numbers, and even children’s data, but the claim remains unverified. #RENAPER #GordonFreeman #Argentina #DNI...

hendryadrian.com

Hackers breached a small Polish energy plant via private APN last year

Hackers used a private APN and a compromised FortiGate/VPN path to move laterally into a second CHP plant in Poland, where they shut down a steam turbine and process-water treatment system. CERT Polska says this was the first known real-world cyberattack to enter an OT network through a private APN, and it recommends treating such networks as untrusted and enforcing client isolation and strict access controls. #CERTPolska #FortiGate #WAGO #Teltonika #Siemens #Moxa #Electrum

hendryadrian.com

BdThemes plugins supply-chain hack creates rogue WordPress admins

A threat actor compromised BdThemes’ upstream infrastructure and poisoned a remote JSON feed, using the attack to create rogue administrator accounts on WordPress sites. The incident affected several BdThemes plugins, including Element Pack, and has been linked by researchers to a broader supply-chain campaign. #BdThemes #ElementPack #Wordfence #Sigmative #Biggop Library

hendryadrian.com

OpenAI releases ChatGPT 5.6 Cyber, but it's only for approved users

OpenAI has introduced GPT 5.6 Cyber, a specialized model for vulnerability research, penetration testing, and incident response, but it is only available through selected partners and security vendors. The company is offering Daybreak Blue and Daybreak Red through its Daybreak Access program to help defenders find, validate, and fix serious security flaws faster. #OpenAI #GPT56Cyber #DaybreakAccess

hendryadrian.com

Technical Analysis of Lucid Stealer : Execution, Capabilities, and C2 Infrastructure

Lucid Stealer is a Node.js SEA-based information-stealing malware that hides its payload with encryption, obfuscation, false certificate-like data, and UAC bypass behavior while collecting browser credentials, wallet data, Discord tokens, screenshots, and keystrokes. It uses PowerShell, a malicious Node.js native module, and WebSocket/HTTP POST communication to contact lucidstealer[.]one, with the analysis also noting shared infrastructure containing AsyncRAT and promotion through a Telegram channel. #LucidStealer #Nodejs #AsyncRAT #Telegram

hendryadrian.com

Ransom! Interim HealthCare (AUG-2026)

Interim HealthCare in the United States reported a ransomware incident in which the genesis threat actor encrypted critical systems and disrupted operations. The healthcare organization providing elderly care services was affected in the #UnitedStates

hendryadrian.com

Ransom! BigSpark (AUG-2026)

BigSpark, in AI, was targeted by the direwolf ransomware group, disrupting Business Services through unauthorized encryption and extortion. The incident impacted AI #AI

hendryadrian.com

Ransom! Cleaver-Brooks (AUG-2026)

Cleaver-Brooks in the US reported a major data breach at a leading industrial manufacturer attributed to the anubis ransomware threat actor. The incident involved unauthorized access and encryption demands that resulted in significant data exposure. #UnitedStates

hendryadrian.com

OpenAI says Daybreak will expand to offer specialized cyber services 

OpenAI expanded its Daybreak program with new frontier model variants for defensive cybersecurity and advanced red-teaming. The company also launched a partnership program with 16 major cybersecurity providers, including IBM, CrowdStrike, Palo Alto Networks, Cisco, Cloudflare, and Sophos, to help defenders find, validate, and fix serious vulnerabilities faster. #OpenAI #Daybreak #DaybreakBlue #DaybreakRed #GPT5_6_Cyber #IBM #CrowdStrike #PaloAltoNetworks #Cisco #Cloudflare #Sophos

hendryadrian.com

CNCMachineRMS: The Undocumented RAT At the End of a BabaDeda Chain

A loader chain starting from a ClickFix lure abuses signed IBM SPSS IDE, decoy DLLs, and EnumTimeFormatsEx to deliver the BabaDeda stage and the CNCMachineRMS remote administration implant. CNCMachineRMS uses custom scripting, a unified config/C2 container, and multiple stealth features to provide shell access, file management, screen capture, persistence, and local account backdoor capabilities. #ClickFix #IBMSPSSIDE #WinWrapIDE #BabaDeda #CNCMachineRMS

hendryadrian.com

Ransom! HIGEN MOTOR(critical data) (AUG-2026)

qilin ransomware targeted HIGEN MOTOR, encrypting critical data in South Korea. The incident was attributed to the threat actor qilin in KR, #SouthKorea

hendryadrian.com