Briefing — 17 August 2026

Ransomware Activity — 48 Hours 44 victims · 13 groups — Qilin dominates with 16 victims across 8 countries. Direwolf adds 2 US healthcare targets; LockBit5 hits a German energy utility. By Group Qilin — 16 victims Teikoku USA 🇺🇸 (Manufacturing) · AGUNSA 🇨🇱 (Transportation) · Coface 🇮🇹 (Financial Services) · Spoonful of Comfort 🇺🇸 (Hospitality) · Mulino Padano 🇮🇹 (Agriculture) · MOSAID Technologies 🇨🇦 (Technology) · INVENSITY 🇩🇪 (Technology) · Megawide 🇵🇭 (Manufacturing) · Desatera Sdn Bhd 🇲🇾 · Loescher editore 🇮🇹 (Education) · Botek 🇩🇪 (Manufacturing) · Zanichelli 🇮🇹 (Education) · Arnall Golden Gregory 🇺🇸 (Professional Services) · ASCII Group 🇯🇵 (Technology) · Double H Equipment 🇺🇸 (Manufacturing) · WEBA Meubelen 🇧🇪 (Retail) Direwolf — 5 victims DXS International 🇬🇧 (Technology) · ⚠️ PayrHealth 🇺🇸 (Healthcare) · ⚠️ Colla Health 🇺🇸 (Healthcare) · TOTVS 🇧🇷 (Technology) · AAM:HOA Management 🇺🇸 (Professional Services) MedusaLocker — 5 victims Twal Family IT Lab (Technology) · All Parts Dry Cleaning 🇬🇧 (Retail) · Idex Group 🇩🇪 (Technology) · Bija Industrie 🇫🇷 (Manufacturing) · Thecourierguy 🇿🇦 (Transportation) LockBit5 — 5 victims tecosim.com 🇩🇪 (Technology) · ⚠️ vgrn.de 🇩🇪 (Energy & Utilities) · agricolagalbusera.it 🇮🇹 (Agriculture) · dupouy-associes.fr 🇫🇷 (Professional Services) · actua.fr 🇫🇷 (Professional Services) xpl0itrs — 3 victims · Blackwater — 2 · Panzer — 2 · Emperador, Helix, ms13089, Orova, SpaceBears, Barracuda — 1 each Security News SafePal data breach: 39,798 customers' data for sale (BleepingComputer) — Order info including names, addresses and emails stolen and now being sold; second crypto hardware wallet breach this week. Large-scale DDoS disrupted Threema secure messaging (BleepingComputer) — Attack caused significant outages to the encrypted messaging service used by European government organisations. AmnesiaStealer macOS malware: live browser session hijacking via ClickFix (BleepingComputer) — Rust-based stealer adds remote browser control, bypassing MFA by operating in authenticated sessions. Wireshark 4.6.8 released — 28 vulnerabilities patched (SANS ISC) — Routine but important update for the network analysis tool. Microsoft blames AI bug-finders for delayed Exchange CU (The Register) — AI tooling surfacing more issues than team can clear; no new ship date confirmed. Chinese GLM-5.3 claims superior vulnerability discovery vs US models (The Register) — AI offensive capability now an explicit US-China competitive benchmark. Ordinary WiFi signals used to image people through walls (Slashdot) — Passive sensing identifies individuals within seconds using consumer-grade router signals; significant privacy implications. CISA KEV — No New Additions Last entries: 11 August 2026 — CVE-2026-68820 (Windows kernel, Lazarus), CVE-2026-20349 (Cisco ASA), CVE-2026-72898 (Metabase RCE). View the full CISA KEV catalogue →