Briefing — 14 August 2026

Ransomware Activity — 48 Hours 79 victims · 17 groups — Clop's mass extortion campaign dominates with 42 victims; seven healthcare organisations claimed across all groups. By Group Clop — 42 victims ⚠️ Starkey.com 🇺🇸 (Healthcare) · ⚠️ Philips.com 🇳🇱 (Healthcare) · Shell.com 🇬🇧 (Energy) · Fiserv.com 🇺🇸 (Financial Services) · GE.com 🇺🇸 (Technology) · AldoGroup.com 🇨🇦 (Retail) · Mammut.com 🇨🇭 (Retail) · Suunto.cn 🇫🇮 (Retail) · MamasAndPapas.com 🇬🇧 (Retail) · Clover.com 🇺🇸 (Retail) · Thermos.com 🇺🇸 (Retail) · G3Aerospace.com 🇺🇸 (Government & Defense) · ToastTab.com 🇺🇸 (Hospitality) · Intellihot.com 🇺🇸 (Hospitality) · JPMGroup.co.in 🇮🇳 (Financial Services) · OmniTanker.com 🇺🇸 (Transportation) · LifeStraw.com 🇺🇸 (Retail) · Atomberg.com 🇮🇳 (Manufacturing) · MidlandInd.com.au 🇦🇺 (Manufacturing) · LarGan.com.tw 🇹🇼 (Manufacturing) · HongHe-Tech.com 🇨🇳 (Technology) · 9Altitudes.com 🇮🇳 (Technology) · FluidLogic.com 🇺🇸 (Technology) · QCPL.in 🇮🇳 (Manufacturing) · SMAPCENTER.UAH.EDU 🇺🇸 (Education) · Partech.com 🇺🇸 (Technology) · NetPower.com (Technology) + 15 others InCransom — 7 victims ⚠️ DiabetesAndMetabolism.com 🇺🇸 (Healthcare) · Pacific-Construction.com 🇬🇧 (Manufacturing) · CambriaLawFirm.com 🇨🇦 (Professional Services) · BEDC.com.au 🇦🇺 (Energy) · StuartAndAssociates.com 🇺🇸 (Professional Services) · Gamaus.com 🇺🇸 (Technology) · CLGroup 🇺🇸 (Professional Services) SilentRansomGroup — 5 victims Reminger Attorneys at Law 🇩🇪 (Professional Services) · Riker Danzig LLP 🇺🇸 (Professional Services) + 3 others (legal sector focus) Blacknevas — 5 victims ⚠️ Enteroptyx Ophthalmology Products 🇺🇸 (Healthcare) · Westbrook Greenhouse Systems 🇺🇸 (Agriculture) · Jack Rutherford Customs Brokers 🇨🇦 (Professional Services) · Portable Intelligence Inc 🇺🇸 (Technology) · Computer Country and Networks (Technology) MajinaHanashi — 5 victims ⚠️ UAB Biotecha 🇱🇹 (Healthcare) · Altair 🇺🇸 (Technology) · Caliche 🇨🇱 (Energy) · Camandona SA 🇨🇭 · Eticod Qilin — 3 victims D & J Beverage Service 🇺🇸 (Hospitality) · United Association Local 345 🇺🇸 · Wanted 🇳🇱 Krybit — 3 victims ⚠️ LabIndia.com 🇮🇳 (Healthcare) · hisstw.com 🇹🇼 · lhyk.com.sg 🇸🇬 AiLock — 2 victims (Japan) · Rhysida — ⚠️ SIA Medical Centre 🇦🇺 (Healthcare) · Coinbasecartel — Hitachi High-Tech 🇯🇵 · Akira — CF Supply · TheGentlemen — Safeware 🇺🇸 · Kairos — Hightech Signs 🇺🇸 · DragonForce — GB Group S.A 🇵🇱 (Financial) · Payload — Zara Investment Holding 🇯🇴 (Financial) Security News Global Threat Campaign Hits Critical VMware vCenter Flaw (Dark Reading) — CVE-2026-59310 actively exploited globally; patching alone may not fully mitigate — check for post-compromise indicators. Apple Sends New 'Threat Notification' Alerts Over Mercenary Spyware Attacks (BleepingComputer) — High-confidence mercenary spyware detections; recipients should consult security professionals immediately. Akira Hackers Disable EDR With Safe Mode, Steal Data but Fail to Encrypt (BleepingComputer) — Safe Mode with Networking used to bypass endpoint defences; exfiltration succeeded despite encryption failure. Borrowing Windows Hello Keys for Authentication and Persistence (dirkjanm.io) — Novel credential theft technique allowing attackers to reuse Windows Hello key material for persistence. Identity Crisis: Novel Kerberos Vulnerabilities Leading to Downgrade, DoS, and Full Domain Takeover (Semperis) — Critical Active Directory attack chains disclosed; full domain compromise possible. New Zealand Says China Tried Using Space Investments to Spy on Local Affairs (The Register) — NZSIS disrupted Chinese Purple Mountain Observatory GBSI installation targeting military intelligence collection. OpenAI Launches 'Computer History' — Local Keylogging for ChatGPT Pro (The Register) — Opt-in event capture system stores interaction data locally unencrypted; increases prompt injection attack surface. Ukraine Shuts Down 94 Fraudulent Call Centers, Seizes Millions (BleepingComputer) — Large-scale takedown of investment fraud and bank account compromise operations. CISA KEV — No New Additions Today No new entries were added to the Known Exploited Vulnerabilities catalog on 13–14 August. Most recent additions (11 August): CVE-2026-68820 — Microsoft Windows (CLFS Driver) — Zero-day exploited by Lazarus Group (Operation Dream Job / ForestTiger). Added 2026-08-11. CVE-2026-20349 — Cisco ASA/Firepower — Remote code execution. Added 2026-08-11. CVE-2026-72898 — Metabase — SQL injection leading to RCE. Added 2026-08-11. Full KEV catalog →