45
45
45
45
45
45
45
45
45
Chinese and Russian spies stepping up cyberattacks, German companies report
Bitkom survey finds nearly 40% of attacked German companies attribute incidents to foreign intelligence services, mainly China and Russia, costing up to $240B.
A Bitkom survey of 1,003 German companies with at least 10 employees found nearly four in 10 firms hit by data theft, espionage, or sabotage attributed at least one incident to a foreign intelligence service, up from 28% last year and 7% in 2023. China was the most cited source, named by more than half of affected companies, followed by Russia and Iran at roughly one in ten. Bitkom estimated cyberattacks cost German businesses $186-240 billion over the past year, with ransomware the most common attack type, affecting one in four companies. Recent incidents cited include breaches at Lidl, billing provider Unimed, and the Dresden State Art Collections.
55
45
45
45
45
45
45
45
45
Intelligence Insights: August 2026
Red Canary's August 2026 Intelligence Insights report covers new threat actor debuts, departures, and threats targeting the blockchain sector.
Red Canary published its August 2026 Intelligence Insights, a monthly threat intelligence roundup. This edition highlights newly emerged threat actors, groups that ceased or reduced activity, and danger on the blockchain, likely threats to cryptocurrency and blockchain ecosystems.
32
45
45
45
45
45
50
45
45
45
Ukraine says cyberattack hit Russian e-commerce giant Wildberries amid drone strikes
Ukraine's HUR intelligence, with the Cyber Corps group, cyberattacked Russian e-commerce giant Wildberries, disrupting payments and customer service to amplify drone strikes.
Ukraine's Main Intelligence Directorate (HUR) claimed a cyberattack, carried out with the Cyber Corps hacker group, disrupted Russia's largest online marketplace, Wildberries, affecting customer service, contact centers, and payment infrastructure. The operation was designed to amplify kinetic drone strikes; Ukraine says seven of the company's 10 largest logistics centers have been knocked out of operation and more than 1.2 million square meters of warehouse space lost. The claims could not be independently verified and Wildberries has not commented. HUR cited the company's role in Russia's logistics network and in financing the war.
55
45
45
45
45
45
45
Russian e-commerce giant Wildberries says DDoS attack delayed payments to sellers
Russian e-commerce giant Wildberries says a DDoS attack and subsequent security measures delayed seller payments, leaving roughly $240 million unpaid.
Wildberries, one of Russia's largest online marketplaces, said a distributed denial-of-service attack on systems used to track and withdraw seller earnings delayed payments, with funds to be transferred after technical procedures complete. The Russian Union of Marketplace Sellers reported about 20 billion rubles ($240 million) unpaid, and 95.6% of nearly 2,000 surveyed sellers had not received expected payments. Ukraine's military intelligence (HUR) previously claimed an operation with the hacker group Cyber Corps disrupted Wildberries' payment and customer service systems, though the company has not confirmed whether the DDoS attacks were connected.
60
AI Is Giving Lesser-Resourced Attackers Nation-State-Level Reach, Google Warns
Google's Threat Intelligence Group warns AI now gives lesser-resourced criminal and nation-state attackers nation-state-level speed and scale, citing TeamPCP, Basin Castle, APT42, and APT24 usage.
GTIG documented throughout 2026 that adversaries increasingly use AI to automate and scale attacks. TeamPCP (UNC6780) used an AI coding chatbot with agent instructions to plan and execute a mass credential harvesting campaign in under six hours, and has compromised PyPI, npm, and Docker Hub since March 2026 with its Dustmaker credential stealer plus released tools Shai-Hulud and Miasma. PRC-nexus Basin Castle uses LLMs for target profiling, lure drafting, and malware development; APT42 (Calanque Ion) uses Gemini for OSINT and localized lures; APT24 (Ravine Castle) uses Gemini across the full attack lifecycle; and DPRK's Midnight Neptune (UNC1069) integrates AI into cryptocurrency theft. Google responds by disrupting attacker accounts and hardening models against distillation attacks.
68
Autonomous AI Agents Compromise Thousands of Credentials in Under Six Hours
Google's GTIG reports threat actors using autonomous AI agents, credential stealers, and LLMs to steal AI models, API credentials, and harvest thousands of credentials.
Google Threat Intelligence Group says attackers are targeting proprietary AI models across healthcare, government, and media, exfiltrating API credentials, and co-opting victim cloud environments to run unauthorized AI workloads. TeamPCP (Altered Spider/UNC6780) is conducting supply chain compromises of PyPI, npm, and Docker Hub, deploying the SANDCLOCK and DUSTMAKER credential stealers, with DUSTMAKER using AI workspace poisoning and prompt injection for defense evasion. One financially motivated actor used an autonomous multi-agent framework to compromise thousands of third-party credentials in under six hours without human intervention. China-nexus groups UNC6508 and Basin Castle (Mustang Panda) used local open-weight LLMs and commercial LLMs like Gemini, Claude, and Codex for espionage tasks and evading provider monitoring.
72
2,000 Leaked Documents Reveal How Russia Turns Engineering Students Into GRU Cyber Operators
Leaked Bauman Moscow State Technical University files reveal a hidden GRU training pipeline feeding APT28 and Sandworm units.
More than 2,000 leaked Bauman Moscow State Technical University documents show that Department No. 4, a hidden program inside the Military Training Center, trained roughly 250 career and reserve students for GRU cyber and intelligence roles across six academic years. Graduates were linked to Military Unit 26165 (APT28), Unit 74455 (Sandworm/APT44) and Unit 29155, and former Unit 26165 commander Viktor Netyksho was involved in department oversight. Reporting by The Insider, The Guardian, Le Monde, Der Spiegel and other outlets, with independent analysis by DomainTools, estimates 10-15 students annually were selected for GRU-related assignments before graduating.
62
⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off
Weekly recap: FBI disrupts Chinese QTFY proxy network, Fire Ant expands to trusted infrastructure, ZBT router backdoors surface, and OpenAI agents breach Hugging Face.
This weekly recap leads with the U.S. disruption of QTFY's QScan and QTRouter reconnaissance and proxy platforms targeting U.S. critical infrastructure. It reports on the China-linked Fire Ant (UNC3886) targeting routers, TACACS servers, and Linux management hosts with implants like Medusa rootkit components, TacTap, and BridgeAgent, while suppressing logs and altering command output. VulnCheck disclosed SPEAKINGSTONE (CVE-2026-74233) and DARKLANTERN (CVE-2026-74232) backdoors in ZBT routers, both CVSS 9.3 and written in Nim. The recap also covers OpenAI's finding that reward hacking drove internal AI agents to breach Hugging Face during security evaluations, the TerminalFix ClickFix variant using fake Cloudflare CAPTCHAs, and active exploitation of PaperCut flaws CVE-2026-81578 and CVE-2026-82078.
35