Several organizations across various sectors have recently reported cyberattacks and data breaches, while security researchers have detailed new vulnerabilities and emerging threat trends, including the use of AI in cyberespionage.
Colombia’s Ministry of Justice confirmed a ransomware attack that encrypted some files within its technology infrastructure, disrupting public services related to illicit-drug monitoring and legal processes. The ministry stated that no data theft was detected. Separately, MyDr, Poland’s primary healthcare platform, experienced a data breach potentially affecting nearly 19 million citizens. Attackers claimed to possess 2.5TB of information and provided a senior politician’s identification details, phone numbers, and prescriptions as proof.
Levi Strauss & Co. reported a cyberattack where social engineering tactics compromised three employee devices, leading to the theft of corporate information. Preliminary findings suggest no consumer data was accessed or copied. IEH Corporation, a US defense and aerospace component manufacturer, confirmed a phishing compromise of an employee’s Microsoft 365 mailbox. Attackers used a fraudulent document-sharing link to steal credentials, potentially exposing customer communications, purchase orders, engineering documents, and export-controlled technical information.
In the realm of AI threats, researchers uncovered a suspected China-linked campaign that utilized autonomous AI agents against Taiwanese government systems. This operation reportedly mapped 21 systems, compromised 85 accounts, and obtained 2,500 personnel records before expanding to a nuclear safety organization and seven energy sector companies. Additionally, North Korea-linked Kimsuky is reportedly building an offline AI environment to support phishing, intelligence analysis, and malware development, combining locally hosted language models with document retrieval, code resources, and transcription capabilities. Researchers also found that encrypted reasoning blocks used by OpenAI, Anthropic, and Google APIs could be replayed across sessions, recovering hundreds of sensitive artifacts like API keys, passwords, and authentication tokens from published agent logs.
Microsoft released its August Patch Tuesday security updates, addressing 421 vulnerabilities across various products, including 42 critical flaws. Among these was CVE-2026-68820, an actively exploited Windows Ancillary Function Driver for WinSock vulnerability that allows local attackers to gain SYSTEM privileges. Apple issued patches for CVE-2026-65400, a critical macOS Screen Sharing authentication vulnerability with a CVSS score of 9.8, which allows network attackers to authenticate without valid credentials. Active exploitation of this flaw against internet-exposed systems has led to root access and the deployment of Monero cryptocurrency miners. Adobe fixed CVE-2026-71362, a critical authentication vulnerability in Adobe Commerce and Magento Open Source, which attackers began exploiting shortly after public disclosure, enabling unauthorized session switching and potential account takeover. Zoom addressed three critical vulnerabilities in Zoom Workplace, including CVE-2026-53413, which could enable remote code execution during a meeting without participant interaction, affecting annotation functionality. Fixed releases include versions 7.0.6 and 7.1.5 for fast-track users.
A new wave of the Lazarus-linked Operation Dream Job has been exposed, targeting defense organizations in Europe, India, and Brazil. Attackers used fraudulent job opportunities and trojanized PDF software to deploy malware, exploiting the Windows zero-day CVE-2026-68820 to obtain SYSTEM privileges and disable security visibility.
Ransomware activity saw a 33% year-over-year increase in Q2 2026, with 2,139 publicly reported victims and an expansion to 93 active groups. Leaked communications indicated that the ransomware group "The Gentlemen" is using AI coding assistants to accelerate the development of operational tooling. Organizations experienced an average of 2,336 weekly cyberattacks during July 2026, a 16% year-over-year increase, with generative AI usage continuing to expose corporate information through high-risk prompts submitted to external AI services.
Finally, a China-linked Jewelbug campaign was revealed, using XG-Web for espionage against government and military organizations while also engaging in cryptocurrency fraud. This operation collected approximately 580,000 browser cookies, thousands of credentials, and 2,300 emails through compromised web infrastructure and malicious cryptocurrency services.
