CISA is urging organizations to harden their internet-accessible Fortinet devices in response to a large-scale credential theft campaign that likely impacts over 86,000 firewalls and VPNs.

Referred to as FortiBleed, the campaign was flagged earlier this week. SOCRadar initially warned of over 30,000 compromised Fortinet devices potentially exposing enterprise networks to hacking, and has since updated that figure to 86,000.

“Discovered in June 2026, the operation has produced a verified database of over 86,644 confirmed working credentials across 194 countries, all collected from internet-facing Fortinet infrastructure,” the company says.

The hackers have compiled a database of usernames and passwords, tested using automated scripts. Some credentials were likely compromised in previous incidents, but never rotated.

Security researcher Kevin Beaumont, together with Hudson Rock, worked with some of the impacted organizations and verified that the logins are valid and fairly recent.

“The data comprises roughly 50% of all Fortinet firewall devices facing the internet, based on polling from Shodan,” Beaumont says.

According to security researcher Bob Diachenko, the campaign has been orchestrated by a Russian-speaking threat actor and at least four organizations have been fully compromised.

“They intercept SSL VPN authentication, crack hashes on a 45-GPU cluster managed via Hashtopolis, and pivot into internal Active Directory environments,” Diachenko says.

The attackers are estimated to have executed roughly 1.16 billion credential attempts targeting more than 320,000 FortiGate targets, as well as 2.1 billion brute-force attempts against over 160,000 MSSQL servers.

According to Hudson Rock, the campaign has hit thousands of organizations, “including major government entities and critical infrastructure providers”.

Cybersecurity firm Huntress too has confirmed the broad reach of the campaign: “While the overall campaign is massive, Huntress has cross-referenced the listed IP addresses against their own data corpus and identified 845 partner organizations specifically impacted by this credential dump.”

On Thursday, CISA issued an alert on FortiBleed, urging Fortinet customers to take hardening actions: terminate active sessions and reset credentials, ensure they use Password-Based Key Derivation Function 2 (PBKDF2) algorithm to store admin logins, review logs to identify suspicious activity, enable phishing-resistant MFA, and lock down management access to reduce the attack surface.

Related: Chinese Cybercrime Group in Spotlight for Record Campaign Pace

Related: Over 500 Organizations Hit in Years-Long Phishing Campaign

Related: Palo Alto Zero-Day Exploited in Campaign Bearing Hallmarks of Chinese State Hacking

Related: Microsoft Warns of Sophisticated Phishing Campaign Targeting US Organizations

https://www.securityweek.com/fortibleed-86000-fortinet-device-credentials-compromised/

Security firm Sentinel One has a deeper dive into CVE-2025-20701 here.

Heinze and Steinmetz said last year that the full chain of attacks gave attackers the ability to do other malicious things, including retrieving call history and contacts, and even calling arbitrary numbers. Many of those capabilities are dependent on the specific devices being paired, since the functionality built into them differs from platform to platform.

Devices affected by the Airoha vulnerabilities are by no means alone. In January, researchers disclosed WhisperPair, a series of vulnerabilities that allows an attacker to hijack Bluetooth devices connected through Google Fast Pair, a proprietary protocol belonging to the company. Besides eavesdropping, attackers can exploit the WhisperPair flaws to geolocate devices. The vulnerabilities affect more than a dozen devices from 10 manufacturers, including Sony, Nothing, JBL, OnePlus, and Google itself.

There are few, if any, reports of Bluetooth vulnerabilities like these being actively exploited in the wild. The complexity of such attacks is often high, and an attacker has to continually stay within Bluetooth range of a target while utilizing the exploit. People who think they may be targeted by such attacks should turn off Bluetooth in devices whenever they’re not needed, and remain aware of the risks when Bluetooth is enabled.

https://arstechnica.com/apple/2026/06/apple-patches-high-severity-eavesdropping-vulnerability-in-beats-studio-buds/

Well hey y’all. I just got hooked up with this space to somewhat-routinely write about vulnerabilities, cybersecurity, and infosec history. I’m currently at runZero, where I’m the vice president of security research, which basically means that I spend most of my time hanging around with some incredibly bright and devoted people who are also cunning and shrewd. We’re all dedicated to the notion that it is, in fact, possible to secure networks by being smart and creative with your approaches to exposure management.

I’m so excited to be writing here, and you might expect me to go on and on about CVE identified vulnerabilities, and the CVE program itself. After all, I’m on the CVE board, and was most recently section chief for the KEV at CISA, and I’ve spent a fair amount of my career managing patch schedules, writing exploits and Metasploit modules, and detecting novel attacks on the network (so I often blather on Mastodon and Bluesky about CVEs).

But you’d be wrong! While I believe that CVEs are an important, even foundational, component of any modern security program (and I will explore aspects of individual CVEs and the program in the future), I’m not convinced that we should be totally infatuated with exploits and bugs. After four decades of personally responding to (and occasionally causing) cybersecurity incidents, it’s become clear to me that most people run into trouble not because they forgot to patch some critical internal database, but because the networking deck is stacked against the defenders.

TTRPGs and Predicting The Future

I remember in 1989 at DunDraCon, my first exposure to Cyberpunk 2020 by Mike Pondsmith and published by R. Talsorian. (You’ve probably heard of the multiplayer online game, Cyberpunk 2077; this pencil-and-paper table-top role playing game is that game’s direct ancestor.) Anyway, I saw the upcoming second edition being playtested during the conference, and me, being a teenage hacker, immediately gravitated toward the more fully-fledged “Netrunner” character class. We had a good time; the combat simulation was a lot more chaotic and swift than D&D, the cybernetic and neurological upgrades were way cooler than spells and potions, and of course, the theme of dystopian end-stage capitalism was infinitely attractive in a grim way.

Anyway, after playing a session, I was offered a comment card. Remember, this was the 80s, point-to-point networking reigned supreme, and to get anything done, you had to first figure out how to negotiate the handshake, puzzle out the protocol, and basically learn every operating system from scratch. So, my feedback was along the lines of, “I really liked the simulated hacking system, but it seems just a little too simplified and straight-forward. It’s unrealistic that in the future, nuclear power plants and banks would all be on the same networks that are known to be shot through with hackers and gangsters.”

Oh, how wrong I was.

Universal Connectivity Is Great Except When It Isn’t

Fast forward to today, and there are just so many things that can go wrong when trying to secure a normal TCP/IP network, along with all the servers, desktops, clouds, phones, hypervisors and operational technology (OT) that’s been patched in. I’d argue that the first, fundamental problem defenders run into is the fact that planet Earth has settled on the whole “IP” part of TCP/IP.  After all, the “I” stands for Internet, so given a long enough timeline, virtually everything that talks IP will end up exposed and reachable on the internet, and that’s both the coolest thing about TCP/IP, and its ultimate Achilles’ heel.

Recent events underline this fundamental flaw of modern networking when it comes to security. The 2026 M-Trends report from Google plays up the idea that “exploits represented the most frequently observed initial infection vector in 2025,” since exploited vulnerabilities account for 32% of all initial access vectors. That sounds like a lot!

Of course, the unspoken inverse of this stat is that 68% – over two-thirds – of all the rest of initial access attacks do not rely on technical vulnerability exploitation. The reason for this, of course, is because everything is reachable with enough ingenuity, time, and luck.

But what about Zero-Trust?

Security professionals have long known that the boundaries between internal and external networks are at best notional, defining today’s intrusion defense strategies. For about 15 years, “zero-trust” has been an aspirational end-state: identity and authorization bundled into every network transaction, regardless of origin. However, this path is often blocked by legacy systems that “can’t” be managed this way. Worse, even when CTOs and CISOs get comfortable with their carefully structured boundaries, someone invariably bridges a printer from the IT to the OT network, and shadow-IT hijinks ensue from there.

The standards chosen for TCP/IP are incredible in their interoperability, allowing systems to communicate freely, and routers actively bypass damaged connections, even when these broken connections are intentional blocks. While this fundamental interconnectivity is great for innovation and industry and commerce and entertainment and art and all that, it’s an absolute, quantifiable disaster for security.

The network itself is actively working against the idea that only some of these computers should be able to talk to some of these other computers, automatically and intelligently, without physically closing circuits or swapping cables. It’s no wonder that most breaches today can be traced back to an errant bridge here, or a misclicked email there, rather than a failure to patch.

Securing any enterprise is profoundly difficult due to these fundamental forces, giving hackers, criminals, and spies a seemingly permanent advantage in gaining and keeping access, no exploits required.

Going forward, I’ll be taking up some SecurityWeek column-inches to pursue all these side quests, like tracking end-of-life trends, investigating OT/IT convergence, and the so-called “Layer 8” human-centric issues of cybersecurity. And yes, expect the occasional indulgence in deep-dives on particularly interesting sets of technical software vulnerabilities, CVE-identified or otherwise.

https://www.securityweek.com/no-exploits-required/

Israeli cybersecurity startup Dream today announced raising $260 million in a new funding round that brings the company’s valuation to $3 billion.

The company’s latest investment round was co-led by Bicycle Capital and Group 11, with additional support from Antler, Bain Capital Ventures, Tru Arrow Partners, and other investors. To date, the firm has raised over $410 million.

Founded in 2023, Dream has offices in Tel Aviv, Vienna, and Abu Dhabi, and plans to use the fresh funds to accelerate the deployment of its platform across Europe, the Middle East, Asia, and the Americas.

The company was founded by Shalev Hulio, former CEO and founder of the controversial spyware maker NSO Group; Sebastian Kurz, former Prime Minister of Austria; and cybersecurity expert and entrepreneur Gil Dolev, who serves as Dream’s CTO.

The startup has built three sovereign AI and national cyber defense platforms: Sphere, which defends against nation-state cyber threats; Hero, an autonomous AI security researcher hunting for vulnerabilities and exposures; and Atlas, which connects fragmented national data.

Sphere delivers a national cyber defense system that combines AI-driven detection and response with cyber intelligence, attack path analysis, digital twin technology, and exposure management.

Hero autonomously searches for security defects and attack paths, and reasons like an attacker to prevent sophisticated cyber threats, continuously stress-testing defenses.

Atlas, Dream’s sovereign AI platform, allows governments to transform national data into structured knowledge, deploy mission-specific AI agents and models, and gain actionable insights within secure environments they control.

“Every nation has data. Few can protect it. Fewer can use it. Sovereign AI is the key. We built Dream to help governments secure their information, transform it into knowledge, and convert that knowledge into national capability. The future of a nation should never depend on technology it does not control,” said CEO Hulio.

Related: Magnitude Emerges From Stealth Mode With $10 Million in Funding

Related: Endpoint Security Startup Ent Emerges From Stealth With $100 Million Seed Round

Related: NewCore Emerges From Stealth Mode With $66 Million in Funding

Related: Cyera Raises $600 Million at $12 Billion Valuation

https://www.securityweek.com/dream-raises-260-million-at-3-billion-valuation/

Atlassian and Splunk on Wednesday announced patches for multiple vulnerabilities in their products, including critical-severity flaws.

Splunk resolved a critical issue in AI Toolkit that could allow authenticated attackers with admin roles to execute arbitrary OS commands on the host the Splunk Enterprise instance runs on.

“The vulnerability is possible because of an unsafe shell execution pattern in the btool configuration helper, which constructs OS command strings from dynamic parameters without disabling shell interpretation,” Splunk explains.

Tracked as CVE-2026-20266 (CVSS score of 9.1), the security defect was addressed in Splunk AI Toolkit version 5.7.4. If upgrading is not possible, Splunk recommends uninstalling the AI Toolkit as a mitigation.

The update also addresses CVE-2026-20265, a medium-severity information disclosure bug caused by an insecure default domain allowlist. An attacker holding the admin or power role could cause the AI Toolkit to make outbound HTTP requests to attacker-controlled servers, leading to data exfiltration.

Atlassian published 100 security bulletins that address dozens of security defects across Bamboo Data Center and Server, Bitbucket Data Center and Server, Confluence Data Center and Server, Crowd Data Center and Server, Fisheye/Crucible, Jira Data Center and Server, and Jira Service Management Data Center and Server.

All the weaknesses resolved with the fresh security updates appear to affect third-party dependencies used in Atlassian’s products.

These include critical-severity issues in Axios (CVE-2026-42043, CVE-2026-40175, and CVE-2026-42264), Apache Tomcat (CVE-2026-41293, CVE-2026-43512, CVE-2026-41293, CVE-2026-43515, and CVE-2026-43515), and Netty (CVE-2026-42584).

Users are advised to update to a patched version of the affected Atlassian products as soon as possible.

Related: Critical Command Execution Vulnerability Patched in Cisco ISE

Related: F5 Patches Critical, High-Severity NGINX Vulnerabilities

Related: Microsoft Working on Patch for ‘RoguePlanet’ Zero-Day

Related: 3 Recently Patched Fortinet FortiSandbox Vulnerabilities in Hacker Crosshairs

https://www.securityweek.com/atlassian-splunk-patch-critical-vulnerabilities/

Hudson Rock said the attackers went on to “actively intercept SSL VPN authentication hashes and crack them using a massive, dedicated 45-GPU cluster managed via Hashtopolis.” From there, they used the GPU cluster to crack the hashes, meaning to try massive combinations of plain-text passwords until they found the right one. These passwords allowed the threat actors to move laterally to compromise Active Directory environments and other centralized authentication systems.

“This aggressive methodology has led to severe, real-world consequences,” Hudson Rock said. “Diachenko’s research confirmed full network compromises at multiple organizations across Japan, Taiwan, Vietnam, Iraq, and Turkey. Most alarmingly, this includes a Turkish NATO defense contractor from which classified defense documents were successfully exfiltrated by the group.”

In the interview, Diachenko put it more succinctly. “The scale is the sophistication,” he said.

The scale didn’t stop there. The attackers used the massive cluster to run a” feedback-driven, 12-level recursive system.” In other words, there wasn’t a single flat dictionary run. Password candidates came from custom dictionaries with as many as eight words, common keyboard patterns, and cracking rules. Each one looped back with each step. When guesses were successful, the passwords were fed back as seeds to generate still more candidates. In other words, the cracking techniques improved with each successful guess.

“They were quite innovative on that,” the researcher said.

The innovation contrasts sharply with the operational security of the attackers, who left artifacts on the server they used. In hacker circles, such moves are considered amateur mistakes.

Hudson Rock said that the top countries where compromised devices were found were India, the US, Taiwan, Mexico, Turkey, and Thailand. The top industries affected were IT services, construction materials, telecommunications, construction and engineering, industrial equipment, and financial services. Other organizations whose data appeared in the database included: Foxconn, Samsung, Comcast, Siemens, PwC, and Accenture. Hudson Rock said that the database listed thousands of others, including major government agencies and critical infrastructure providers.

Firewalls have long been a favorite network entry point for hackers. These devices accept connections from the outside Internet, sit at the perimeter of a network, and have access to valuable resources deep inside.

The links above list a number of steps Fortinet firewall users should take to ensure their networks are secure. Given that the data has been available to cybercriminals and potentially other threat actors who, like Diachenko, found it, the risk is substantial.

https://arstechnica.com/security/2026/06/massive-breach-spills-credentials-for-thousands-of-sensitive-networks/

Giu 16, 2026 Giancarlo Calzetta Eventi, In evidenza, News, Prodotto, RSS 0

---

Sebbene il numero di casi d’uso nel nostro Paese sia ancora molto basso, le previsioni di tutti gli esperti dicono che gli agenti AI diventeranno i veri “operati” dell’automazione dei processi in azienda. Il problema è che chi dovrà gestirne la sicurezza non ha ancora l’esperienza necessaria per farsi un quadro chiaro di come questi opereranno in concreto sulla rete interna, su quella esterna e sui client. Questa carenza di visione complica enormemente la creazione di una infrastruttura di sicurezza efficace.

In particolare, governare e proteggere un numero crescente di agenti AI autonomi che operano in modo indipendente, accedono ai dati aziendali e prendono decisioni alla velocità delle macchine pone una serie di sfide che è bene affrontare insieme a chi ha già avuto modo di sperimentare con casi reali, in ambiti complessi.

A questo proposito, Zscaler ha annunciato una serie di innovazioni che estendono le funzionalità della piattaforma Zero Trust Exchange alla protezione dell’ecosistema Agentic AI con l’obiettivo di offrire quella che l’azienda definisce la prima piattaforma Zero Trust completa progettata specificamente per la nuova generazione di agenti intelligenti.

L’Agentic AI cambia le regole della sicurezza

Durante la sessione europea del loro evento annuale Zenith Live, tenutasi a Vienna, Zscaler ha condiviso la sua visione sull’evoluzione dell’AI che, a suo dire, sta introducendo complessità che le architetture di sicurezza tradizionali non sono state progettate per gestire. Gli agenti autonomi non si limitano infatti a eseguire istruzioni ricevute dagli utenti, ma possono generare task, creare subagenti, accedere a servizi, utilizzare credenziali e interagire con applicazioni e dati aziendali senza un intervento umano diretto.

Questo scenario genera nuove problematiche in termini di visibilità, governance e controllo degli accessi, rendendo più difficile comprendere quali agenti stiano operando, quali dati utilizzino e quali azioni siano autorizzati a compiere. Parallelamente, la crescente integrazione dell’AI nei processi di sviluppo software espone endpoint e workstation a plugin, estensioni e strumenti potenzialmente malevoli che molte soluzioni di sicurezza tradizionali non sono attualmente in grado di individuare efficacemente.

AI Broker: controllo sulle comunicazioni tra agenti

Una delle principali novità presentate dall’azienda è Zscaler AI Broker, una soluzione progettata per proteggere le comunicazioni tra agenti AI attraverso broker MCP (Model Context Protocol) e framework Agent-to-Agent.

Il sistema introduce un Agent Registry integrato che consente alle aziende di ottenere una visibilità dettagliata sulle risorse accessibili da ciascun agente e di applicare controlli granulari sugli accessi. L’obiettivo è evitare che gli agenti possano espandere autonomamente i propri privilegi o accedere a informazioni non necessarie per l’esecuzione delle attività assegnate.

Endpoint AI Security amplia la protezione sui dispositivi

Accanto al broker per gli agenti, Zscaler ha introdotto Endpoint AI Security, una soluzione che estende la protezione fino ai dispositivi utilizzati dai dipendenti. La piattaforma è progettata per individuare minacce nascoste all’interno di browser, estensioni, plugin e strumenti AI installati localmente, componenti che spesso sfuggono alle tradizionali piattaforme di Endpoint Detection and Response. L’approccio consente di applicare policy coerenti tra cloud ed endpoint, offrendo una visione unificata dei rischi legati all’utilizzo dell’intelligenza artificiale all’interno dell’organizzazione.

AI Access Graph punta sulla governance dei dati

Un altro tassello fondamentale della strategia presentata a Vienna è rappresentato da Zscaler AI Access Graph, una tecnologia sviluppata a partire dall’acquisizione di Symmetry Systems. La soluzione crea una mappatura delle relazioni tra identità, applicazioni, modelli AI e fonti dati, consentendo alle organizzazioni di comprendere in modo più accurato chi accede alle informazioni, attraverso quali agenti e per quali finalità.

L’integrazione con Zero Trust Exchange permette di applicare controlli più rigorosi, ridurre gli accessi non necessari e tracciare in tempo reale la lineage dei dati lungo l’intero percorso, dalla sorgente fino all’utilizzo da parte degli agenti AI. Considerato che i requisiti normativi diventano sempre più stringenti, la capacità di ricostruire i flussi informativi potrebbe diventare uno degli elementi chiave per la governance dell’intelligenza artificiale.

Più visibilità sugli asset AI e oltre 250 applicazioni GenAI monitorate

Le novità annunciate includono anche un importante aggiornamento di Zscaler AI Protect, la piattaforma introdotta all’inizio del 2026 per la protezione degli ambienti AI. Sul fronte dell’asset management, la soluzione amplia le capacità di discovery permettendo di individuare AI integrate nelle applicazioni SaaS, server MCP presenti nei cloud pubblici e rischi nascosti nei codebase agentici attraverso attività di scansione del codice. La visibilità viene inoltre estesa alle attività AI che avvengono direttamente sugli endpoint aziendali.

Particolarmente interessante è il rafforzamento delle funzionalità di Secure Access to AI, che ora consentono di estrarre e analizzare i prompt provenienti da oltre 250 applicazioni GenAI, offrendo una visione completa delle conversazioni e supportando le Compliance API di Anthropic e OpenAI. L’azienda introduce inoltre guardrail basati sull’intento dell’intera conversazione e non sul singolo prompt, un approccio che mira a ridurre i tentativi di aggiramento delle policy attraverso sequenze di richieste apparentemente innocue.

Sicurezza dell’AI lungo tutto il ciclo di vita

L’ultima area di innovazione riguarda la protezione delle applicazioni AI durante l’intero ciclo di vita. Le nuove funzionalità comprendono attività di AI red teaming dedicate ai server MCP, servizi di prompt hardening e strumenti di conformità basati su heat map che aiutano le organizzazioni a identificare le aree più esposte dal punto di vista della governance. L’obiettivo è quello di integrare la sicurezza fin dalle fasi iniziali di sviluppo e distribuzione delle applicazioni AI, evitando che i controlli vengano aggiunti solo successivamente quando i sistemi sono già operativi.

La strategia presentata da Zscaler evidenzia come a fianco della protezione dell’utente serva trovare spazio per la protezione degli agenti AI. Con l’aumento delle identità non umane, delle comunicazioni agent-to-agent e dei workflow automatizzati, le aziende avranno bisogno di strumenti in grado di garantire visibilità, controllo e governance su un ecosistema sempre più distribuito per riuscire a evitare intrusioni e garantire la governance richiesta dalle normative più recenti.

---

• agent-to-agent security, agentic AI, AI Access Graph, AI Broker, AI Protect, cybersecurity AI, Endpoint AI Security, governance AI, identità non umane, MCP security, sicurezza agenti AI, sicurezza enterprise, Zero Trust Exchange, zscaler

---

---

https://www.securityinfo.it/2026/06/16/zscaler-porta-la-zero-trust-nellera-degli-agenti-ai/?utm_source=rss&utm_medium=rss&utm_campaign=zscaler-porta-la-zero-trust-nellera-degli-agenti-ai

@import url(‘https://fonts.googleapis.com/css2?family=Nunito+Sans:ital,opsz,wght@0,6..12,400;0,6..12,500;0,6..12,600;0,6..12,700;1,6..12,400;1,6..12,500;1,6..12,600;1,6..12,700&family=Nunito:ital,wght@0,400;0,500;0,600;0,700;1,400;1,500;1,600;1,700&display=swap’); @import url(‘https://fonts.googleapis.com/css2?family=Handlee&display=swap’); h3 { font-weight: bold; font-size: 18px; color: #404144; } figure { padding: 4px; margin: auto; } figcaption { color: #404144; Nunito Sans’, Arial, sans-serif; font-size: 14px; padding: 10px; text-align: left; } .highlight { padding: 3%; border-top: 8px solid #207BBC; border-bottom: 3px solid #207BBC; width: 100%; Nunito Sans’,Arial,sans-serif; font-size: 15px; background-color: #EAF1F7; margin-top: 25px; margin-bottom: 25px; } .pqFull { display: block; border-width: 2px 0; border-style: solid; border-color: #404144; padding: 1.5em 0 0.5em; margin: 1.5em 0; position: relative; Handlee”, Arial, sans-serif; font-size: 20px; text-align: center; color: #0067A6; } .pqFull:before { content: ‘\275D’; position: absolute; top: -.10em; left: 50%; transform: translate(-50%, -50%); background: #fff; width: 4rem; height: 2rem; color: #666; text-align: center; } .pqFull:after { content: “\2013 \2003” attr(cite); display: block; text-align: center; font-size: 18px; color: #404144; }
.w3-container:after, .w3-container:before, .w3-row:after, .w3-row:before { content: “”; display: table; clear: both } .w3-container { padding: 5px; } .w3-col, .w3-half, .w3-third, .w3-twothird, .w3-threequarter, .w3-quarter { float: left; width: 100% } @media (min-width:601px) { .w3-col.m1 { width: 8.33333% } .w3-col.m2 { width: 16.66666% } .w3-col.m3, .w3-quarter { width: 24.99999% } .w3-col.m4, .w3-third { width: 33.33333% } .w3-col.m5 { width: 41.66666% } .w3-col.m6, .w3-half { width: 49.99999% } .w3-col.m7 { width: 58.33333% } .w3-col.m8, .w3-twothird { width: 66.66666% } .w3-col.m9, .w3-threequarter { width: 74.99999% } .w3-col.m10 { width: 83.33333% } .w3-col.m11 { width: 91.66666% } .w3-col.m12 { width: 99.99999% } } .w3-row-padding, .w3-row-padding>.w3-half, .w3-row-padding>.w3-third, .w3-row-padding>.w3-twothird, .w3-row-padding>.w3-threequarter, .w3-row-padding>.w3-quarter, .w3-row-padding>.w3-col { padding: 0 8px }

Geopolitical conflict is no longer confined to land, sea or air. Today, it unfolds silently across networks, servers and endpoints. Governments, critical infrastructure operators, and private enterprises are increasingly targeted by cyber operations designed to disrupt services, steal sensitive data, or undermine national stability.

Unlike traditional warfare, cyberwarfare does not require armies crossing borders. A coordinated attack launched from anywhere in the world can disrupt supply chains, shut down utilities, or expose millions of customer records within minutes. From ransomware attacks on healthcare systems to disruptions in logistics and satellite communications, organizations across sectors have faced outages, financial loss, and reputational damage. As organizations digitize operations and connect critical systems to the internet, the line between national security and enterprise cybersecurity continues to blur.

The Rise of Cyberwarfare

According to the European Union Agency for Cybersecurity’s 2025 Threat Landscape report, the global cyberthreat environment is shaped primarily by state-nexus actors and organized cybercriminal groups, with increasing convergence in their tools, tactics, and objectives alongside the growing professionalization of cybercrime and its alignment with geopolitical dynamics.

Critical infrastructure sectors, such as energy, transportation, finance, and telecommunications, have emerged as primary targets for these attacks. Disruptions in these areas can trigger significant economic damage and widespread societal impact, making them especially attractive to threat actors.

In 2026, geopolitical dynamics continue to be the leading influence on cyber risk strategies. According to the World Economic Forum, 64% of organizations now factor geopolitically driven cyberthreats into their security strategies, while 23% of public sector organizations report insufficient cyber resilience capabilities.

Why Enterprises are in the Crosshairs

Enterprises are no longer incidental casualties; they are deliberate targets in cyberwarfare. Organizations that run cloud platforms, digital services, supply chains, and communication infrastructure sit at the core of modern economies, making them high-impact points of disruption.

Recent developments have already validated this shift toward physical targeting of enterprise infrastructure. In early 2026, drone strikes on commercial cloud data centers in the Middle East caused structural damage and triggered widespread service disruptions across dependent digital services. These incidents marked one of the first clear instances of data centers being directly targeted in kinetic conflict, highlighting their growing role as strategic assets. The outages extended beyond the immediate blast radius, affecting critical sectors reliant on cloud infrastructure and exposing how modern conflict increasingly focuses on the core infrastructure of the digital economy.

This strategy is not limited to physical attacks. Supply chain compromises further amplify impact by exploiting trust at scale. By infiltrating a trusted enterprise platform, attackers can scale their reach exponentially across downstream organizations. Incidents such as the Sunburst supply chain attack demonstrated how deeply embedded trust relationships can be exploited, turning widely used software into vectors for national security compromise.

The use of disruptive malware in enterprise environments highlights the potential for even broader operational fallout. Wiper malware outbreaks mimicking NotPetya have crippled global shipping, manufacturing, and commerce, disrupting essential supplies and proving that the consequences extend far beyond the initial target.

What makes these attacks particularly effective is the structure of modern enterprises themselves. Deep interdependencies, reliance on shared platforms, legacy systems, and limited visibility across complex environments create ideal conditions for attackers to move quickly, amplify impact, and align cyber operations with broader geopolitical objectives.

Cybersecurity Priorities in a Geopolitically Volatile Time

As cyberwarfare becomes a permanent feature of the geopolitical landscape, organizations must rethink how they approach security. Cybersecurity can no longer be treated solely as an IT function; it must be embedded into enterprise risk management and business strategy.

Adopt a risk-based security approach: Align cybersecurity priorities with business-critical assets and evolving threat landscapes to focus efforts where impact is highest.

Ensure leadership and board-level alignment: Make cybersecurity a strategic priority with clear governance, executive ownership, and regular oversight at the leadership level.

Strengthen identity, endpoints, and visibility: Enforce least-privilege access, strong authentication, and continuous monitoring while securing endpoints and leveraging threat logs for faster detection and response.

Promote a security-first culture: Build organization-wide awareness through regular training, ensuring employees act as the first line of defense.

Enhance resilience through testing and response readiness: Continuously test defenses, maintain robust incident response plans, and ensure rapid recovery to minimize disruption.

As cyberwarfare becomes a permanent feature of the geopolitical landscape, organizations must rethink how they approach security.

Preparing for Sustained Digital Conflict

Cyberwar is no longer a distant, theoretical threat; it is an active and evolving reality shaping how nations and businesses operate. In a world where attacks can be swift, borderless, and strategically motivated, preparedness becomes a competitive advantage. Organizations that embed security into their core strategy by anticipating risks, strengthening resilience, and fostering a culture of vigilance will be far better positioned to withstand and recover from disruption.

Ultimately, the question is no longer if enterprises will be impacted by cyber conflict but when. Those that act now will not only defend against emerging threats but also build the trust and reliability required to thrive in an increasingly volatile digital landscape.

https://www.securitymagazine.com/articles/102371-cyberwar-at-the-front-line-why-enterprises-must-prepare-for-digital-conflict

Danish pharmaceutical firm Novo Nordisk announced it faced a data breach related to clinical trials, releasing notification letters to both patients and healthcare providers (HCPs) involved. According to the statement, a threat actor gained access to a limited number of the company’s internal IT systems, which included access to certain personal data. 

What Data Is Compromised?

Patient risk is somewhat reduced, as the exfiltrated patient data was deidentified. 

“Pseudonymized clinical trial data can create a false sense of comfort, but it could have been worse,” comments John Bruggeman, vCISO at CBTS. “The risk is that with life sciences, the context around the data matters. Trial participation city or state, treatment area, demographics that were not anonymized, and research attributes can become sensitive when combined with other sources. Attackers do not need a complete patient profile to create harm. Thankfully though patient PII was not disclosed, so in today’s environment I’ll take that as a win.”

However, this doesn’t mean the incident is absent of risk. 

Ross Filipek, CISO at Corsica Technologies, explains, “A breach involving clinical trial data creates a different kind of risk than a typical consumer data incident. Novo Nordisk says the exposed information was not tied directly to names, which is good. It also said no usable identifiers were obtained, which lowers the immediate risk. However, health data can still carry long-term value when it is combined with other stolen information. Even when an ePHI breach does not include patient names, attackers may try to reverse-engineer identities by pairing details like birth date, postal code, or gender with outside data sources.

“For patients, the immediate danger may be limited. The bigger concern is what happens later. Attackers can use partial medical details to build convincing phishing messages, impersonate trusted organizations, or pressure people with information that feels deeply personal. That is especially concerning in healthcare, where trust is already fragile.

“There is also a downstream business risk. Clinical trials depend on confidence from patients, providers, regulators, and research partners. Even a limited breach can create hesitation. If attackers had dwell time inside the environment, the concern shifts from data exposure to data integrity. A pharmaceutical or healthcare organization may need to determine whether research data was altered, whether regulatory obligations were triggered, and whether any intellectual property was exposed. Active trials could also face delays while the incident is investigated. Healthcare organizations need strong visibility into sensitive data, tighter access controls, and active monitoring before a contained incident becomes a broader trust problem.”

Affected patient data includes: 

• Patient IDs (consisting of a random alphanumeric string)
• Trial participation information
• Sex 
• Year of birth
• Lifestyle factors (such as BMI, smoking, etc.) 
• Biomarkers 
• Health/immunogenicity data

Affected HCP data includes: 

• Name and registration number 
• Email address
• Phone number 
• WhatsApp information 
• Office location

While patients may be at a slightly lower risk, especially when compared to other healthcare breaches, experts warn the HCPs could be at risk of targeted attacks. 

Bruggeman states, “Attackers can use information stolen from Novo Nordisk to target the doctors helping to bring valuable medical research to drug makers. Now attackers can make a message feel credible, even professional, given the contact details that were compromised. Imagine a doctor involved getting a message from an attacker about a trial update that is in fact fake? Or request documents, or payments, or a medical portal password reset when the attacker has enough context.”

Was This Breach Corporate Espionage? 

“There are markers to this case which suggest the possibility of corporate espionage,” asserts Joseph Perry, Cybersecurity Researcher and Advanced Services Lead at Arcova. “Novo Nordisk’s intellectual property are fabulously valuable, the accessed patient information is related to ongoing clinical trials, and based on the patient letter and hcp letter it appears the threat actor’s purpose was data exfiltration (as opposed to, e.g., ransomware). Overall, based on available information, the incursion appears to be relatively limited and, at this point, contained. However, given that the discovery and containment appear to have happened after the external copying of data, there’s an open question as to whether this was contained before or after complete mission success. 

“In general, this flows with a broadening trend in cybercrime. For years, we’ve discussed the commodification of certain attacker flows (e.g., the rise of Initial Access Brokers) and the move to platforms and monolithic providers. What that all boils down to, what we’re seeing, is the ongoing professionalization of cybercrime. We don’t have any evidence as to who the attacker was, nor do we have proof of their motivation. But if the hints we’re seeing in public disclosure pan out, and this does turn out to be an act of corporate espionage, that would be yet another example of cybercrime’s mainstreaming. The calculation is simple enough; if the risk of discovery is small relative to the potential profit, at least some unscrupulous folks will attempt to leverage cybercrime as a business tactic.” 

https://www.securitymagazine.com/articles/102370-breaking-down-the-novo-nordisk-data-breach

The Office of the Maine Attorney General has removed its public-facing data breach database due to abuse of the reporting system. According to the office’s statement, two companies are known to be affected by false reports of data breaches. The false reports have since been removed from the database. 

The two companies known to be impacted by fraudulent filings are Discord and VRChat. 

“After conversations with VRChat, one of two affected companies, it has become clear that the reported data breaches were hoaxes submitted by an unknown entity unrelated to either company,” the office’s statement reads. 

The false report against Discord claimed 10 million individuals were affected by a breach. 

The fake data breach report against VRChat claimed 2.4 million users were impacted by a data breach, exposing information such as usernames, email addresses, subscription statuses, login histories, and user IDs for connected platforms.

The office states it has no knowledge of any legitimate data breach claims against either Discord or VRChat. 

“We are reviewing our procedures to make this abuse less likely in the future while preserving the public availability of such information,” the office states. “The public-facing database will remain offline until then.” 

Organizations that need to submit a data breach report can continue to do so through the office’s online reporting service. 

https://www.securitymagazine.com/articles/102369-maine-data-breach-reporting-portal-abused-taken-offline