AI Fuels Phishing, Ransomware Surges; EU Digital Sovereignty Threatened

New research from Cofense reveals that modern phishing campaigns are dynamically adapting payloads based on the victim's operating system and device. Upon clicking a malicious link, the attacker's infrastructure analyzes the browser's user-agent string to determine the OS (Windows, macOS, mobile) and delivers a tailored payload, such as an .exe for Windows or a .dmg for macOS. This technique, leveraging T1592 (Gather Victim Host Information), significantly increases the likelihood of successful compromise by ensuring compatibility, moving beyond generic 'spray-and-pray' tactics. This makes attacks harder to detect and raises the overall threat level of phishing.

The national campaign against ransomware now explicitly includes Northamptonshire Police, further emphasizing its widespread nature. New details highlight the devastating impact on SMEs, including potential business closure and broader economic ripple effects, as stated by Detective Sergeant Andrew Shears. The guidance is expanded to include strong passwords and MFA, and it clarifies that while paying a ransom is not illegal in the UK, it is strongly discouraged due to funding criminal activity and potential penalties if paid to sanctioned entities.

New research by SOCRadar has established a direct operational link between the FortiBleed credential harvesting campaign and the INC and Lynx ransomware groups. An operator with access to FortiBleed's infrastructure was found managing negotiation panels for both ransomware gangs, confirming that credentials stolen from over 430,000 FortiGate firewalls have directly facilitated at least 12 ransomware deployments. This discovery elevates the threat, proving FortiBleed is not just an access broker but a direct pipeline for active ransomware attacks, significantly increasing the risk for compromised organizations.

New reports from Dutch intelligence (MIVD, AIVD), amplified by the FBI and CISA, confirm the ongoing Russian campaign targeting Signal users. Attackers use specific lures like 'mandatory 2FA' or 'data recovery' to trick users into revealing their 30-digit backup keys. The update clarifies that compromised keys grant access to the last 45 days of message history and remain valid until backups are disabled and re-enabled. The U.S. State Department has offered a reward for information on UNC5792, underscoring the threat's severity. New 'Hunting Hints' provide patterns for detection, and refined response protocols advise immediately disabling and re-enabling backups to invalidate compromised keys.