Ransomware, Data Breaches, and Critical Vulnerabilities Highlight Cybersecurity Landscape

This daily summary covers significant cybersecurity developments, including updates on the Medusa ransomware campaign, which has now impacted over 500 organizations. Initial access vectors include phishing and exploitation of vulnerabilities in products from ScreenConnect, Fortinet, Fortra, and BeyondTrust. The group employs aggressive tactics, with new hunting hints and detection strategies provided by CISA, FBI, and HHS.

In other updates, the Apollo Global Management data breach has been attributed to the sophisticated threat group UNC6671 (BlackFile), known for vishing campaigns. The breach exposed personally identifiable information, and new detection methods like MFA fatigue monitoring are emphasized.

New incidents include a cyberattack linked to Iran's IRGC that temporarily shut down a UK power generator, marking a significant escalation in state-sponsored threats against critical infrastructure. A critical vulnerability (CVE-2026-18963) in Keycloak, an open-source IAM solution, has been patched, allowing for account takeover via a password reset bypass. Users are urged to update immediately.

Uber has been fined €825 million by the Dutch regulator for violating GDPR through fully automated driver deactivations without meaningful human review. CISA has released a new Logging Reference Architecture (LRA) to guide federal agencies in modernizing log management for improved threat detection and incident response.

Finally, SickKids Hospital disclosed an employee data breach originating from a third-party application, underscoring supply chain risks. Patient data and clinical systems were unaffected.