AI Cyberattacks Escalate, Critical Infrastructure Targeted Globally

Critical Vulnerabilities and Active Exploitation:

• Coldcard Wallet Flaw Leads to Over $100M Bitcoin Theft: A firmware vulnerability in specific Coinkite Coldcard wallet models (MK2, MK3, MK4, Q, and MK5) has been confirmed to allow attackers to derive seed phrases without physical access. This flaw, stemming from a March 2021 integration error, has led to the theft of over $100 million in Bitcoin. Users of affected models are strongly advised to migrate their funds to new, patched wallets.
• Autonomous AI Cyberattacks Shift from Theory to Reality: A new report confirms a peak in ransomware attacks in July 2026, with 'JADEPUFFER' identified as the first known fully autonomous AI-driven ransomware agent. This agent can independently execute the entire attack lifecycle, significantly increasing attack speed and scale. This development validates earlier warnings about AI threats and necessitates urgent advancements in automated defense strategies.

New Threats and Incidents Targeting Key Sectors:

• Boston Scientific Suffers Global Disruption from Major Cyberattack: Medical device manufacturer Boston Scientific has experienced a significant cyberattack, causing a global network outage and disrupting business operations, including order processing and shipping. The incident, detected on August 25, 2026, highlights the growing risks to the healthcare supply chain. The company is working with third-party experts to restore systems, but a recovery timeline is unknown.
• ATF Confirms Major Incident After Qilin Ransomware Breach Claim: The U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) has confirmed a 'major' cybersecurity incident following a claim by the Qilin ransomware gang. The breach was contained to a standalone computer system holding information on criminal investigation targets and was not connected to the ATF's main network. The Qilin group is a prolific Ransomware-as-a-Service operation.

Government Actions and Geopolitical Cyber Activity:

• US Seizes Chinese Hacking Platforms Targeting Critical Infrastructure: The U.S. Department of Justice and FBI have seized domains used by a Chinese state-sponsored hacking group, 'QTFY', to operate malicious platforms ('QScan' and 'QTRouter'). These tools were used in a campaign targeting U.S. critical infrastructure, including NASA and defense contractors, by infecting IoT devices and using them as an obfuscation network.
• US Sanctions Iranian MOIS Hackers for Critical Infrastructure Attacks: The U.S. Department of the Treasury has sanctioned Iranian nationals affiliated with Iran's Ministry of Intelligence and Security (MOIS) for widespread attacks on U.S. critical infrastructure, government offices, and defense contractors. The targeted group engages in state-sponsored espionage and financially motivated theft, including cryptocurrency theft. The sanctions aim to disrupt the economic support for these activities.