Hospital de la Santa Creu i Sant Pau (Spain) reported a ransomware incident attributed to thegentlemen, potentially disrupting hospital operations and services. As a major Barcelona academic medical center with extensive research and clinical trial activity, any such impact would affect healthcare delivery across Spain. #Spain

Rotamac Inc. (rotamac.ca) in Canada was reportedly targeted by ransomware by threat actor thegentlemen, impacting operations tied to its industrial equipment distribution and e-commerce services. The incident affected the victim in #Canada

Mandurah State Emergency Service (mandurahses.org.au) in Australia is reported as being targeted by ransomware linked to the threat actor thegentlemen, disrupting operations for a volunteer emergency rescue unit providing 24/7/365 services in WA. The incident claim implicates Australian systems and services, with potential impact on the organization’s responders and cadet support activities. #Australia

WOOSHIN SAFETY SYSTEMS CO LTD (KR) reported a ransomware incident attributed to the threat actor “thegentlemen,” impacting its wooshinsys.co.kr and related online assets. The claim indicates disruption to operations and services in South Korea. #SouthKorea

Storm ransomware targeted Step By Step, Inc. (US-based nonprofit human services organization) disrupting community-based support services across residential, behavioral health, autism, and in-home programs for individuals with intellectual and physical disabilities and related needs. The incident impacted United States #UnitedStates

Thegentlemen ransomware group compromised Zelham (zelham.com) and targeted systems of the U.S. hospitality renovation general contractor, seeking to extort through data theft and disruption. Zelham, Inc., headquartered in Boise, Idaho, with operations across multiple U.S. states, was affected in #unitedstates

MI5 has warned that more than 100 U.K.-linked academics may have helped China’s Ministry of State Security strengthen its intelligence capabilities through research funded by CGTRI, which the agency assesses is a front company for the MSS. The alert urges U.K. institutions to review collaborations with CGTRI and warns that continued...

Warlock, also known as Gold Salem, Longlegs, and Storm-2603, is still exploiting Microsoft SharePoint vulnerabilities to attack organizations in Portuguese- and Spanish-speaking countries across Europe, Africa, and Latin America. The group has targeted critical infrastructure, government, and education sectors while using web shells, BYOVD, legitimate tools, and SYSVOL staging to disable...

A suspected ShinyHunters member known as "Rey," identified as Saif al-Din Khader, has reportedly been detained in Jordan and is now cooperating with the FBI and other law enforcement agencies. The reported arrest comes amid intensified action against ShinyHunters following claims of an FBI breach, as the group’s infrastructure appeared to go offline even while a new data leak site later surfaced. #ShinyHunters #SaifalDinKhader #Rey #FBI #Jordanianauthorities

Wallstreet ransomware reportedly targeted St. Francis Healthcare Systems of Hawaiʻi, a Catholic, nonprofit healthcare organization serving Hawaiʻi families since 1927, disrupting operations and access to critical systems. The impacted country(s) is #UnitedStates.

Wallstreet ransomware actors claim they compromised the Saudi network of the China Railway Construction Corporation Saudi Branch / Sama Construction consortium, targeting the main contractor work for the Jeddah Central Stadium for FIFA World Cup 2034 in Saudi Arabia. They report exfiltrating 17 TB and 1.5M files, including contract, dispute/suspension documentation, IFC design files, supplier bid data, and personal data for 150,000+ employees. #SaudiArabia

Allied Machine & Engineering, a US precision cutting tool manufacturer, reported a ransomware incident attributed to the Storm threat actor. The company, headquartered in Dover, Ohio, produces advanced holemaking and finishing tooling for metalworking industries and was impacted in the United States. #UnitedStates

At the Global Anti-Scam Summit America, Gen’s scam research lead discussed moving beyond general warnings to help people recognize manipulation and make…

Genesis Credit Management in the US reported a ransomware incident attributed to the qilin threat actor, resulting in disruption of its systems and data availability. The impacted country is: #UnitedStates

Precon Marine Inc, a diversified marine contractor specializing in heavy marine construction and advanced subsea services, reported a ransomware incident allegedly carried out by threat actor netrunner. The attack resulted in disruption to the company’s operations, with impact limited to the affected country/entities. #countryname

doxx.net has raised $38 million in a Series A round led by Andreessen Horowitz to expand its Agentic Defined Networking platform for humans and AI agents. The platform combines private, serverless networking with DNS-level threat protection to block malicious destinations, phishing sites, and malware before connections are made. #doxxnet #AndreessenHorowitz #AgenticDefinedNetworking...

Fortra has patched eight vulnerabilities in Core Privileged Access Manager (BoKS), including three critical flaws that could lead to authentication bypass, command injection, and remote memory corruption. The issues affect BoKS Manager deployments, with notable risks tied to Active Directory service account management and network-accessible interfaces such as BCC and WSI....

Cybersecurity is evolving to keep pace with cloud expansion, AI, distributed systems, and the growing complexity of modern digital environments. The report shows how organizations are shifting toward continuous visibility, stronger identity control, faster remediation, and unified protection across identities, endpoints, cloud, and connected devices. #KeeperSecurity #Cribl #Automox #Nisos #SurfAI #AdaptiveSecurity...

Storm ransomware claimed it targeted States Industries, a privately held US hardwood plywood and veneer panel manufacturer based in Eugene, Oregon. The company’s operations, products, and employees were impacted, with the claim ending in #UnitedStates

Aware, Inc. (US) reports a ransomware incident associated with the threat actor “thegentlemen,” impacting its biometrics identity verification SaaS operations and related workflows. The alleged intrusion is linked to the company’s online presence and the incident is reported in the United States. #UnitedStates

A dataset allegedly linked to the Royal Belgian Football Association is being offered for sale by the actor “RedStone,” with claims of 346,685 unique names and extensive records on players, referees, clubs, and officials. If authentic, the exposed data could enable phishing, impersonation, and other social-engineering attacks against people connected to...

Aqua Nautilus describes Koske, a Linux cryptomining malware campaign that uses image-embedded payloads, persistence mechanisms and a userland rootkit…

Nightspire ransomware targeted Forma Therapeutics Holdings, Inc. in the US, compromising clinical trial and statistical data along with electronic lab notebooks, research IP, drug discovery and pipeline information, and biological/genomic data. Impacted country: #UnitedStates

Spirals ransomware claimed it compromised Seven Seas Group, a GB-based global maritime services provider specializing in ship supplies, stores, spare parts, and technical maritime brands. The victim’s disruption is attributed to the attack’s effects in #UnitedKingdom

Settra ransomware impacted www.windor.com, encrypting files including “Windor Supply & Manufacturing, Inc. PROLOGUE Sales representative Mark Brewster, on D…”. The victim’s systems were compromised with data/availability harm, affecting #countryname

Autonomous AI weapons are no longer theoretical, and the war in Ukraine shows how they can independently navigate, identify, and strike targets with minimal human control. The article urges governments to set clear international red lines, accountability rules, and protections for civilians before these systems become normalized in future conflicts. #Nvidia #JetsonOrin #Zaporizhzhia #Ukraine #Russia #InternationalCommitteeoftheRedCross #UnitedNations #ICAS #GCRAI

Thai Lion Air in Thailand was targeted by ransomware attributed to the qilin threat actor, resulting in disruption to business operations through unauthorized encryption of files. The incident impacted systems in #Thailand

Sports Events365 in the UK was targeted by the qilin ransomware threat actor, resulting in encrypted files and disruption of operations. The incident impacted the United Kingdom #UnitedKingdom

A listing attributed to Syrv4x claims to offer data tied to CNAM, including 882,918 records and fields such as names, dates and locations of birth, and internal student IDs. If genuine, the dataset could enable phishing, impersonation, and identity fraud against students and other individuals connected to CNAM. #Syrv4x #CNAM #ConservatoireNationaldesArtsetMétiers...

A threat listing claims to sell data tied to Morocco’s Ministry of Investment, Convergence and Evaluation of Public Policies (MICEPP), alleging more than 150,000 folders and records on over 50,000 investors. The unverified dataset is said to include administrative documents, authorization files, national ID-related data, and information on Moroccan companies and...

A threat actor named Syrv4x claims to be offering a free dataset tied to FMG Sales & Marketing, with 10,343 records in a 7 MB file. If authentic, the data could include contact details, birth information, addresses, and a field labeled numSecurite that may contain French social security identifiers. #FMGSalesMarketing #Syrv4x...

A threat actor using the handle "888" claims to be selling a one-time dataset tied to Explorest, a U.S.-based travel and photography platform, with 263,900 unique users reportedly affected. The alleged data spans 2017–2026 and includes names, email addresses, password-related values, countries, and device tokens. #Explorest #888...

A listing by the actor Syrv4x claims to offer a FitnessBoutique customer dataset containing 1,960,466 records and 3.5 GB of data for $750, negotiable. If authentic, the data could expose customer contact details and account-related information, but the claim remains unverified. #FitnessBoutique #Syrv4x #fitnessboutiquefr...

Two new congressional bills show that bipartisan backlash against AI-powered ALPR cameras has intensified, putting Flock and other license plate reader companies under growing political pressure. Lawmakers and privacy advocates argue the systems enable mass surveillance and abuse, while Flock says the technology needs guardrails, oversight, and support for public safety....

A ransomware attack has temporarily shut down the computer systems of Vicksburg, Mississippi, affecting utility payments but not emergency services. The city is working with the FBI, DHS, state officials, and private cybersecurity experts to investigate whether any personal or confidential information was accessed. #Vicksburg #FBI #DepartmentofHomelandSecurity...

A California federal judge dismissed a lawsuit brought by El Faro journalists whose phones were targeted with Pegasus spyware, ruling the case lacked jurisdiction in California. The Knight First Amendment Institute said Pegasus was used against Carlos Dada and colleagues at least 226 times, and it plans to appeal the decision....

Microsoft tracked a fake software download campaign that impersonated trusted vendors and pushed malicious installers, with the activity mainly affecting multinational organizations’ China-based operations and Chinese-speaking users. The investigation linked the campaign to patterns consistent with prior Silver Fox fake software activity and uncovered multiple domain, subdomain, IP, and email-connected artifacts, including malicious domains such as oijfwe[.]net and ai-claude[.]com[.]cn. #SilverFox #oijfwe #ai-claude

Rapid7 analyzed BPFDoor, BPF Rekoobe, and AVERAT samples that disguise themselves to match telecom and appliance environments, using port 25, BPF socket filters, and fileless staging to evade detection. The campaign affected South Korean, Taiwanese, and ShareTech/SpamSniper-related systems, including mail-security appliances, NAS devices, DVRs, and other edge infrastructure. #BPFDoor #BPFRekoobe #AVERAT #ShareTech #SpamSniper #ChunghwaTelecom

Paessolucoes, a Brazilian IT company (paessolucoes.com.br) in Campo Mourão, Paraná, was targeted by the Panzer ransomware threat actor. The attack resulted in disruption and potential data exposure, impacting operations in #Brazil

rhysida ransomware claims to have compromised Electro Heat Sweden AB in Sweden (SE) by exfiltrating 1,723,527 files totaling 2.55 TB, including SolidWorks CAD intellectual property and critical engineering and business records such as Visma/SCPS accounting and payroll databases. The group further alleges theft of legally sensitive documents, employee passport and visa data, and signed contracts/acceptance certificates. #Sweden

Socket uncovered a cluster of VS Code theme extensions spanning the Visual Studio Marketplace and Open VSX, including two confirmed malicious extensions and a high-confidence link to GlassWorm. The investigation found obfuscated JavaScript loaders, a Windows batch downloader, Solana transaction-memo dead drops, and shared Git history linking extensions such as Aurora Nocturne Night Theme, Coca-Cola Christmas, Aurora Borealis Studio Theme, and Cosmic Nebula Themes. #GlassWorm #AuroraNocturneNightTheme #CocaColaChristmas #AuroraBorealisStudioTheme #CosmicNebulaThemes

Beyond Gravity, a federally owned aerospace supplier, has disclosed a targeted cyberattack after detecting malicious activity in its IT environment on August 12. The company is working with the Federal Office for Cybersecurity and Mandiant, while forensic investigations and security measures continue. #BeyondGravity #Mandiant #FederalOfficeforCybersecurity #Ruag

GitLab has fixed a critical AI Gateway flaw, tracked as CVE-2026-90970, that could let a logged-in user with Duo Agent Platform access execute arbitrary commands under certain conditions. Organizations hosting their own gateway should update immediately to the patched versions 19.2.4, 19.3.2, or 19.4.1. #GitLab #CVE-2026-90970 #DuoAgentPlatform...

A China-nexus threat actor tracked as UAT-11587 has targeted government and policy organizations across Asia and Syria using a new Rust-based Windows backdoor called Antino. The campaign relies on spear-phishing, spoofed identities, and Microsoft 365-based command-and-control through Outlook and OneDrive to deliver multi-stage malware and evade detection. #UAT11587 #Antino #Microsoft365 #Outlook...

Dell has released updates for multiple critical flaws in Dell Container Storage Modules (CSM) that could let attackers bypass authentication, steal credentials, and gain administrative or root access across storage infrastructure and Kubernetes clusters. The issues affect CSM versions prior to 1.17.0 and are fixed in 1.18.0, with Dell urging customers...

Frontline Education is warning school districts about a data breach after attackers abused a vulnerability in a third-party application to access parts of its environment and steal employee data, including Social Security numbers. The company says it remediated the flaw, involved law enforcement, and is offering credit monitoring and identity protection to impacted individuals while notifying districts and regulators. #FrontlineEducation #TransUnion

Warlock, a China-linked ransomware group, targeted multiple organizations including a water utility, telecom provider, regional government body, and a university by exploiting SharePoint vulnerabilities for initial access. The attackers used ToolShell flaws, deployed an EDR-killing tool, and staged Warlock ransomware across compromised networks before launching encryption. #Warlock #ToolShell #Longlegs #K7RKScan #MicrosoftSharePoint

GitLab has warned customers to urgently patch CVE-2026-90970, a critical AI Gateway vulnerability that could let authenticated attackers with basic privileges escape the sandbox and execute arbitrary commands on vulnerable self-hosted instances. The company released fixed versions for GitLab Self-Hosted AI Gateway users and said hosted GitLab AI Gateway customers are already protected, following its recent patching of CVE-2026-85706. #GitLab #CVE-2026-90970 #CVE-2026-85706 #CISA

The U.S. Treasury has sanctioned eight members of Tren de Aragua for their roles in ATM jackpotting attacks that stole millions of dollars from U.S. financial institutions. Authorities say the gang used malware such as Ploutus to force ATMs to dispense cash, and the case has led to major U.S. enforcement actions against TdA-linked networks. #TrenDeAragua #Prometheus #Ploutus #OFAC #FBI