Medusa Ransomware Evolves, Dahua Cameras Compromised, Quantum Grid Act Introduced

Today's cybersecurity digest highlights evolving threats and proactive defense measures. CISA and the FBI have updated their advisory on Medusa ransomware, detailing its increased use of legitimate RMM software like AnyDesk and Splashtop for persistence and lateral movement, alongside phishing for initial access. Encrypted files now bear the '.medusa' extension, and ransom notes are titled '!!!READ_ME_MEDUSA!!!.txt'. The advisory also expands targeted sectors to include Defense, Manufacturing, and Government.

In a significant device compromise, 'Operation CameraSwarm' has affected over 14,500 Dahua IP cameras and NVRs, utilizing brute-force attacks, known vulnerabilities, and abuse of Dahua's P2P cloud service. Meanwhile, a new espionage campaign, 'SilkParasite,' attributed with medium confidence to a China-nexus actor, targets Central Asian governments with spear-phishing and DLL sideloading, employing novel RATs like DriveSilkRAT that leverage Google Drive for C2.

On the legislative front, the bipartisan 'Quantum-GUARD Act of 2026' has been introduced in the U.S. to address future cybersecurity threats to the electric grid posed by quantum computing. The bill mandates studies on quantum risks and the establishment of a post-quantum cryptography testing environment.

Researchers have also demonstrated a proof-of-concept 'Zombie Card' attack that can enable expired Visa contactless cards for payment through a man-in-the-middle relay. In India, a campaign dubbed 'Operation ShadowRecruit' uses fake government job postings to spread the 'SheetAgent' RAT, which utilizes Google Sheets for resilient C2.

NIST has released new guidance for securing Building Automation and Control Systems (BACS), offering practical steps for resource-constrained operators. Separately, the 'Balonx Sistema' Phishing-as-a-Service platform is enabling widespread financial fraud against over 20 Mexican banks, employing real-time credential and 2FA interception and distributing an Android RAT. Finally, threat actors are increasingly exploiting enterprise collaboration tools like Microsoft Teams and Slack for phishing and malware delivery, with malicious activity quadrupling over the past year.