Major Supply Chain Breaches at Rockstar Games and Dutch Hospitals; Regulators Scrutinize AI Cyber Risks

This update provides additional context on the Qilin ransomware group, noting its identification as the most active ransomware operation in March 2026. It elaborates on specific TTPs, including data exfiltration to cloud storage (T1041) and the use of valid accounts for privilege escalation and lateral movement (T1078). The report further emphasizes the potential for significant political damage and increased risks to personnel due to the threatened data leak, beyond just operational disruption. It also integrates additional D3FEND techniques for detection and mitigation strategies.

Top financial regulators in the UK (Bank of England, FCA, NCSC) and US (Treasury, Federal Reserve) are urgently assessing the systemic cybersecurity risks posed by Anthropic's 'Claude Mythos' AI. High-level meetings with major banks are underway to address potential widespread disruption to global financial IT infrastructure. This development highlights the dual-use nature of the AI, raising alarms about its potential weaponization and the need for new regulatory frameworks and defensive strategies to counter AI-powered cyber threats. The perceived threat has escalated to a point where it is considered a systemic risk to the global financial system.

CISA, alongside Check Point Research, has re-emphasized the active exploitation of CVE-2026-1340 in Ivanti EPMM, specifically impacting versions 12.5 through 12.7. This critical code injection flaw allows unauthenticated remote code execution. Given Ivanti products' history as targets for sophisticated threat actors, organizations are urged to patch immediately and assume potential compromise. New, detailed cyber observables for detection, including specific process monitoring and network traffic patterns, have been provided to aid in identifying and mitigating post-exploitation activity. The update reinforces the need for thorough compromise hunting.