Nation-State Cyber Threats
Iranian CHOSEN BRICK Surveillance Malware: Joint UK/US/Netherlands Advisory
Three intelligence agencies, one Iranian spyware toolkit, one Telegram channel. UK, US, Netherlands warn this week.
Artificial Intelligence (AI)
Anthropic's Fourth Claude Opus 4.6 Incident Arrives With a Threat Report on Multi-Actor AI Misuse
Anthropic's fourth Claude Opus 4.6 hacking incident landed this week beside a separate threat report mapping Russian espionage, a Chinese exploit foundry, and ShinyHunters crews. Two documents, one signal: AI is collapsing the gap between lone criminals and nation-states.
Nation-State Cyber Threats
Proofpoint Ties Four China-Linked APT Clusters to One BlueMoon Chrome and Windows Exploit Kit
Proofpoint says at least four espionage clusters, most with suspected China ties, adopted the same BlueMoon kit within a week, chaining Chrome and Windows zero-days. APT31 went first. Patching closes the door but does not evict what is already inside.
Nation-State Cyber Threats
CISA, NSA, and FBI Accuse Chinese AI Firms of Distilling Claude, GPT, Gemini, and Grok
Three US agencies, four frontier models, one industrial-scale distillation claim. A joint CISA, NSA, and FBI advisory says China-based AI firms covertly extracted billions of tokens to copy reasoning and coding capabilities from American models.
Spyware
Citizen Lab Confirms Pegasus and a New NoviSpy Variant on Serbian Activists' Phones
Citizen Lab and the SHARE Foundation confirmed Pegasus and a new NoviSpy variant on the phones of Serbian student activists. It is the first forensically confirmed Pegasus infection of 2026 and, the SHARE Foundation says, the biggest spyware wave in Serbia yet.
Nation-State Cyber Threats
ESET Names GuardBreaker: UAC-0099 Buried a Prompt to Stall AI Malware Analysis
ESET disclosed GuardBreaker, a technique where Russia-aligned UAC-0099 buried a refusal-triggering prompt inside a malicious script so AI-assisted analysis would balk. The defender lesson: any sample fed to a language model is prompt-injection input, not just code to be scanned.
Nation-State Cyber Threats
Fire Ant Expands From VMware Hypervisors to Cisco IOS XR Routers and TACACS Servers
Sygnia says the China-nexus espionage actor Fire Ant has pushed past VMware hypervisors into the network authentication and logging plane, compromising Cisco IOS XR routers, TACACS servers, and Linux management hosts to harvest credentials and suppress the telemetry defenders rely on.
Vulnerabilities & Patching
CISA Adds ownCloud Flaw CVE-2023-49105 to KEV After Philippine Nuclear Records Theft
CISA added a 2023 ownCloud flaw, CVE-2023-49105, to its Known Exploited Vulnerabilities catalog after a Chinese-speaking threat actor used it to steal nuclear records from a research body in the Philippines. Here is what ownCloud operators should verify now.
Nation-State Cyber Threats
US Treasury Sanctions Mabna Institute Hackers in Iran ‘Economic Onslaught’
The US Treasury sanctioned five Mabna Institute hackers and 30 crypto wallets under Operation Economic Outcast, an expansion of its Iran campaign that also names whole sectors and hands financial-services and crypto compliance teams an urgent screening job.
Industrial Control Systems (ICS)
Suspected Iran-Linked Hackers Shut a UK Power Plant for Four Days: A CNI Wake-Up Call
A suspected Iran-linked cyberattack kept a small UK power plant offline for four days in July 2026, the same month more than 30 US water utilities were hit. The government says the wider grid was never at risk. Here is what defenders should verify.
Supply Chain Attack
North Korean Hackers Tied to the Rust crates.io Supply-Chain Attack, Wiz Says
Wiz researchers linked the crates.io compromise of three Rust crates to recent North Korean supply-chain operations, pointing to command-and-control infrastructure shared with the Mastra and axios npm attacks. It is a strong lead built on overlap, not a confirmed verdict.
Nation-State Cyber Threats
Suspected China-Nexus APT Exploits a VMware vCenter Flaw to Plant Babuk-Derived Ransomware
Researchers attribute exploitation of VMware vCenter CVE-2026-59310, a CVSS 9.8 directory-traversal flaw in Broadcom's control plane, to a suspected China-nexus APT deploying Babuk-derived ransomware on ESXi hosts. Patching alone may not evict an established intruder.