Briefing — 12 August 2026

Ransomware Activity — 48 Hours 45 victims · 18 groups — 5 healthcare targets across two groups. By Group Direwolf — 11 victims (4 healthcare) ⚠️ Leafwell (US, Healthcare) · ⚠️ Health Carousel (PH, Healthcare) · ⚠️ Quironsalud (ES, Healthcare) · ⚠️ AliveCor (US, Healthcare) · BigSpark (AI) · Merge (US, Technology) · Chat Jurídico (BR, Professional Services) · Swyft Inc. (US, Technology) · Osmo Wallet (US, Financial Services) · Fondo (Financial Services) · Statista GmbH (DE, Professional Services) Qilin — 7 victims ⚠️ City of Winchester (US, Government) · HIGEN MOTOR (KR, Manufacturing) · Crown Group (PK) · Service Evaluation Concepts (US, Professional Services) · tommer construction (US, Manufacturing) · G.M.A. Grandi Marche Automobili (IT, Transportation) · B Wright Drywall (US, Manufacturing) Spacebears — 1 victim ⚠️ Elixi International SA (CH, Healthcare) Payload — 3 victims (new entrant) B&B Hydraulik (DE, Manufacturing) · Stücheli Architekten (CH, Professional Services) · Baya Technologies (Technology) Storm — 3 victims Southern Metals (US, Manufacturing) · TRP International (US) · Supportive Insurance Services (US, Financial Services) Global Secret Group — 3 victims Coggins Insurance Agency (US, Financial) · MACOFIN HELLAS (GR, Financial) · Cook Remodeling (US) Bravox — 2 victims ⚠️ Elettrica System (IT, Energy & Utilities) · Verona 83 (IT) Krybit — 2 victims kilpi-koskinen.fi (FI) · apsanet.com.ar (AR, Professional Services) Wallstreet — 2 victims Black Hills Bentonite (US, Manufacturing) · T.RAD North America (US, Technology) Unsafe — 2 victims Presentations.AI (US, Technology) · DECK APP TECHNOLOGIES (IN, Technology) Panzer — 2 victims Xpress Tech (Technology) · The Minor Food Group (TH, Agriculture & Food) Deadlock — 1 victim: LT Group / Fortune Tobacco Corp (PH, Manufacturing) Dragonforce — 1 victim: QPC Global (GB) Interlock — 1 victim: AngMar Companies (US) Aurora — 1 victim: FREYWILLE (AT, Retail) Anubis — 1 victim: Cleaver-Brooks (US, Manufacturing) Orova — 1 victim: Ganzhou Xinye Craft Co. (HK, Manufacturing) Genesis — 1 victim (US, redacted) Security News Microsoft Plugs Nearly 400 Security Holes (Krebs on Security) — August Patch Tuesday described as a "deluge"; one of the heaviest releases on record with 421 CVEs. 421 bugs in Microsoft's Patch Tuesday, and the Norks have already attacked one (The Register) — North Korean threat actors weaponised CVE-2026-68820 before the patch landed; active exploitation confirmed by Microsoft Threat Intelligence. Cisco Patches Firewall Zero-Day Exploited for DoS Attacks (SecurityWeek) — Cisco firewall zero-day actively exploited for denial-of-service now patched; separate ASA/FTD VPN flaw also exploited in the wild the same day. Sandworm targets IT pros with trojanised WireGuard VPN client (BleepingComputer) — Russia's GRU-linked Sandworm distributing a backdoored WireGuard installer via convincing fake download sites targeting IT professionals. Feds warn Gunra ransomware exploiting known bugs to hit critical infrastructure (The Register) — Gunra is exploiting Fortinet vulnerabilities and bypassing MFA; CISA advisory already published. DeadLock ransomware uses blockchain to resist infrastructure takedowns (BleepingComputer) — Group has moved victim recovery communications to blockchain infrastructure to eliminate centralised servers and complicate law enforcement action. Ransomware group hijacks hospital's Facebook page mid-attack (The Record) — Operators seized a US hospital system's official Facebook page to apply public pressure; healthcare providers need social media security in IR plans. Signal adds identity verification layer to prevent fake contact redirection (The Register) — New verification step prevents users being silently rerouted to an impersonator contact. Chrome rolls out device-bound session credentials against account takeovers (Ars Technica) — Potentially the most robust account takeover protection yet, binding sessions to the device to prevent cookie theft attacks. Fake Wi-Fi hotspot hits Delta flight carrying DEF CON attendees (Ars Technica) — Rogue hotspot appeared on a Las Vegas–departing flight; passengers connected before the deception was identified. Adform compromised in supply chain attack delivering crypto stealer (DoublePulsar) — Advertising platform Adform was breached and used to distribute a cryptocurrency stealer to downstream users. CISA KEV — Added 11 August 2026 CVE-2026-68820 — Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free. Allows local privilege escalation; exploited by DPRK-linked threat actors as a zero-day before today's patch. CVE-2026-20349 — Cisco Secure Firewall ASA and FTD Heap Inspection Vulnerability. Unauthenticated remote attacker can cause device reload (DoS). Actively exploited. CVE-2026-72898 — Metabase SQL Injection. Unauthenticated remote code execution granting administrator access to the Metabase instance. Actively exploited. Full KEV catalog →