Nation-State Cyber Threats

Flat white line-art of an opened envelope linked to a mailbox with a looping arrow around a keyhole, on a teal background — Exchange CVE-2026-42897.

Vulnerabilities

Max-Severity Microsoft Exchange CVE-2026-42897 Actively Exploited by Laundry Bear

Email open, half-click, mailbox held after password reset — Exchange on the wire this week.

Flat white line-art of an AI model driving a hands-off control panel, on a deep-teal background — Unit 42's Chinese-speaking autonomous-AI cyberattack disclosure.

Artificial Intelligence (AI)

Chinese-Speaking Threat Actor Runs Autonomous AI-Model Cyberattacks — Unit 42

Three autonomous-agent events in July — Unit 42's disclosure lands this week, this time attributed to a Chinese-speaking threat actor.

Flat white line-art of a folded memo document beside a water tower, on a deep teal background — the leaked memo tying the Minnesota water attacks to Iran.

Critical Infrastructure

Leaked Memo Confirms Iran Attribution for Minnesota Water Utility Attacks

From suspected attribution to a leaked internal memo — the Minnesota water attribution firms up this week.

Flat white line-art of three key-shaped drivers feeding one control panel, on a deep teal background — SilverFox's three-driver BYOVD chain and ValleyRAT.

Nation-State Cyber Threats

SilverFox Deploys 3-Driver BYOVD Chain and ValleyRAT Against Japanese Manufacturer

Three vulnerable drivers, one payload — SilverFox on the wire this week.

Flat white line-art of a water tower linked to a control dial, on a teal background — the Minnesota water-system cyberattack.

Critical Infrastructure

30+ Minnesota Water Systems Hit in Coordinated Cyberattack — Iran-Linked CyberAv3ngers Suspected

Thirty water plants, one offline, one memo — the Minnesota attack scope lands this week.

Flat white line-art of a robot at an open terminal beside a government building, on a teal background — Hermes AI agent in the Thai Finance Ministry case.

Artificial Intelligence (AI)

Hermes Autonomous Agent in "YOLO Mode" Named in Thai Ministry of Finance Espionage

Now with a name and a mode — the Thai Finance Ministry attribution lands this week.

Flat white line-art of an open back door linked by one line to a distant relay node, on a teal background — the NightLedger backdoor.

Nation-State Cyber Threats

Iran-Linked Nimbus Manticore Deploys NightLedger Backdoor Across Middle East, Africa, South Asia

New backdoor, familiar actor — the Iran-linked group tracked as Nimbus Manticore has a fresh toolset, and Kaspersky's write-up of NightLedger lands this week.

Flat white line-art of an autonomous agent working a console alone beside a government finance building, on a teal background — AI-agent espionage.

Artificial Intelligence (AI)

Hackers Used Autonomous AI Agent to Target Thailand Finance Ministry, Researchers Say

Ten days after Hugging Face — the second autonomous-agent cyber event lands this week.

Flat white line-art of a large envelope linked to a shield and a webmail window, on a cobalt-blue background — the NCSC-led Russian Zimbra zero-click alert.

Nation-State Cyber Threats

UK NCSC and Partners Publish International Alert on Russian State-Supported Zero-Click Zimbra Zero-Day Campaign

A year-long Russian state-supported zero-click Zimbra campaign, exposed this week by NCSC UK and partners across some 16 nations — a defender review for any organization still running unpatched Zimbra.

Editorial illustration of a diplomatic training portal with a long shadow and a lifted file, marking South Korea's nine-month diplomatic-academy breach.

Data Breaches

South Korea's Foreign Ministry Confirms Nine-Month Breach of Diplomatic Training System

A nine-month South Korean foreign-ministry breach — allied foreign-ministry defender posture review this week.

Editorial illustration of an IP security camera turned toward supply trucks, marking the AIVD/MIVD warning on Russian camera-hijacking across NATO and Ukraine.

Nation-State Cyber Threats

AIVD and MIVD Warn Russian Intelligence Hijacks IP Cameras Across NATO States and Ukraine to Track Military Logistics

A Dutch intelligence advisory raises the stakes on Russian camera-hijacking activity — critical-infrastructure defender teams review IP-camera posture this week.

Editorial illustration of a fake CAPTCHA checkbox tagged with a state emblem over a map of Ukraine, marking CERT-UA naming Sandworm subgroup UAC-0145.

Nation-State Cyber Threats

CERT-UA Names Sandworm Subgroup UAC-0145 Behind ClickFix CAPTCHA Campaign Against Ukrainian Devices

CERT-UA names UAC-0145 as the Sandworm sub-cluster behind the ClickFix CAPTCHA activity against Ukrainian devices - a GRU-affiliated crew, and defender awareness for Ukraine-adjacent teams this weekend.

See all