Author: Staff Writer

Quick Takeaways A cyberattack has caused significant disruption at Mackay Sugar in Australia, halting operations at key mills and suspending harvesting, highlighting vulnerabilities in the interlinked food and agriculture supply chain. The company is collaborating with cybersecurity experts and authorities to investigate the incident and restore normal operations, while implementing interim measures to sustain critical functions. The attack threatens around 1,300 farms supplying Mackay Sugar, raising concerns about substantial economic and regional impacts if the outage continues. The incident underscores the increasing cyber threats faced by the agriculture sector, with sophisticated, persistent attacks from both nation-states and cybercriminals targeting operational…

Essential Insights Threat actors leverage initial access brokers (IABs) and traffic distribution systems (TDS), such as TAG-124, to facilitate ransomware infections like Interlock, Vanille Tempest, and Rhysida through phishing, trojanized installers, and redirection attacks. Attack campaigns frequently use ClickFix-style phishing and malware-laden downloads from fake websites to deploy backdoors (e.g., Supper, Endico, Broomstick), enabling subsequent ransomware deployment. In March 2026, Interlock exploited CVE-2026-20131 to compromise network edge devices, showcasing their ability to target critical infrastructure for initial entry. Threat, Attack Techniques, and Targets Interlock and Rhysida are part of the ransomware ecosystem. Attackers often use initial access brokers (IABs) to…

Fast Facts Researchers warn that cybercriminal group ShinyHunters exploited an unpatched Oracle PeopleSoft zero-day vulnerability (CVE-2026-35273) to potentially infiltrate over 100 organizations, mainly in higher education. The attacks, dating back to May 27, involved remote code execution, with the vulnerability allowing unauthenticated attackers to takeover affected servers; Oracle has not yet released a fix. Google Threat Intelligence alerted numerous organizations about vulnerable endpoints, but the exact number of compromised victims remains unknown, and the campaign is ongoing, including extortion activities. The incident follows a pattern of similar attacks targeting Oracle software, notably a Clop ransomware exploit in Oracle E-Business Suite…

Summary Points OnyxC2 is a sophisticated, low-cost malware-as-a-service tool priced at $250/month, capable of secretly stealing credentials from over 210 applications and browser extensions, including 2FA and crypto wallets. It employs advanced evasion techniques, such as code mutation, assembly-level obfuscation, and encrypted data exfiltration, achieving a claimed 99% detection evasion rate and remaining largely undetected on platforms like VirusTotal. The malware spreads via fake installer packages mimicking legitimate software, using DLL sideloading with encrypted payloads that bypass automated antivirus scanning. Beyond credential theft, OnyxC2 provides remote control features like keylogging, screenshots, and anonymous traffic routing, making it a comprehensive toolkit…

Summary Points Google has filed a landmark lawsuit against the China-based “Outsider Enterprise,” accusing it of weaponizing its Gemini AI platform to facilitate large-scale phishing attacks targeting U.S. consumers, marking the first legal action of its kind against AI-enabled cybercrime. The cybercriminal network operates as a sophisticated phishing-as-a-service (PhaaS) platform, using Telegram channels and a library of over 290 templates to quickly create convincing scam websites impersonating trusted brands such as Google, YouTube, and financial institutions. The operation dramatically amplified its impact by encouraging members to use Gemini AI to generate malicious code for phishing sites, transforming Google’s generative AI…

Top Highlights Team Cymru expands its Asia-Pacific and Japan operations, establishing Sydney as the regional hub to enhance cybersecurity threat intelligence and regional support. The expansion aims to meet rising demand from APJ organizations for visibility into adversary infrastructure, enabling earlier detection and proactive threat disruption. The Sydney hub will serve as the main coordination point for customer engagement, threat intelligence delivery, and partner enablement across Australia, New Zealand, and the wider APJ region. This move aligns with increased regional focus on cyber resilience, critical infrastructure defense, and public-private collaboration to combat sophisticated cyber threats. Key Challenge Team Cymru recently…

Fast Facts Anthropic’s new Claude Mythos 5 and Fable 5 models enhance frontier AI capabilities but pose ongoing security risks, requiring continued vigilance and preparation. Mythos’ advanced vulnerability exploitation abilities led to targeted safety measures like Project Glasswing, restricting access and monitoring usage to prevent misuse. Experts agree Mythos remains a significant threat, but current safeguards, including classifiers and testing, make jailbreaks difficult—though not impossible. Overall cybersecurity guidance for organizations stays consistent: reinforce fundamental defenses, adjust risk management strategies, and prepare for increased AI-driven attack volumes. New Models Maintain Existing Security Concerns The release of Anthropic’s latest models, Claude Fable…

Fast Facts AI-driven phishing now accounts for 86% of attacks, using personalized content, spoofed emails, QR codes, and multimodal channels like messaging and calendar invites to evade detection. There is a surge in link-based and deepfake attacks, including false Microsoft Teams calls, with a 41% rise in targeted link exploits within collaboration platforms. Attackers are increasingly targeting AI models and supply chains, with threats like model poisoning and employee-level insider threats via “malgents” on the rise. Threat, Attack Techniques, and Targets Threat actors are expanding their focus beyond email inboxes in phishing attacks. They now use generative AI to create…

Quick Takeaways Authorities dismantled the “AudiA6” cryptocurrency laundering network, which processed over EUR 336 million from 2022 to 2025, serving as a key financial backbone for ransomware and cybercriminal groups. The operation involved multiple international agencies and led to arrests, confiscation of servers, closure of domains, and freezing of cryptocurrency assets worth hundreds of thousands of euros. “AudiA6” operated as a professional, high-speed laundering service on underground forums, enabling criminals to convert stolen crypto into “clean” funds within an hour while evading detection through complex transaction chains. The takedown highlights the expanding professionalism of crypto laundering services, although authorities warn…

Essential Insights The MoU emphasizes threat intelligence sharing to better detect and respond to cyber threats between Oman and Kuwait. It aims to enhance incident response and protect critical infrastructure against cyber attacks. The agreement paves the way for collaborative efforts in AI-driven cyber defense and unified security standards across the GCC, reducing regional vulnerabilities. Threats, Attack Techniques, and Targets Kuwait and Oman signed a new cybersecurity agreement to improve their security cooperation. The goal is to share threat intelligence and work together on cyber defense. They want to better respond to cyber incidents and protect critical infrastructure. This agreement…