← Cybersecurity Headlines
Cybersecurity Headlines
First AI ransomware, AdaptHealth suffers cyberattack, UK cyber plan delayed
00:08:02
Loading summary
Transcript3 lines
- [00:00]
A
From the CISO series. It's Cybersecurity Headlines
- [00:07]
B
these are the cybersecurity headlines for Monday, July 6, 2026. I'm Steve Prentiss. Jade Paffer Ransomware used AI agent to automate entire attack Researchers at SYSDIG have identified what they believe to be the first documented case of a ransomware operation conducted entirely by a large language model agent. The ransomware, named Jade Puffer, used an autonomous AI agent for reconnaissance on the target, to steal credentials, to move laterally, establish persistence, escalate privileges, and to encrypt data. It also adapted to failures during the intrusion, much like a human operator would handle obstacles, and also adapted in real time, retrying failed steps within refined parameters in one sequence. It went from a failed login to a working fix in 31 seconds. Jade Puffer gained initial access to the target by exploiting a CVE numbered unauthenticated remote code execution vulnerability in Langflow, a popular open source framework used for building LLM applications. Adapt Health suffers Cyber attack Representatives from the provider of home medical equipment and related services said in a notification to the securities and Exchange Commission on Thursday that attackers accessed internal patient management systems, document storage platforms and external electronic health record system portals. This was done through a third party contractor which unwittingly gave the cybercriminals access to the company's cloud environment. Adapt Health has not yet specified whether an extortion demand was made, nor whether one was paid. No cybercrime group has yet claimed responsibility. Disruption of NetNut proxy network cuts off millions of infected devices A coordinated effort that included Google, the FBI, Lumen Technologies, the Shadow Server foundation and some other industry partners has successfully brought down the residential proxy network that allowed access to millions of compromised Android devices, including smart TVs and streaming boxes. Also known as POPA, the NetNut botnet allowed cybercriminals and espionage groups to hide behind legitimate home Internet addresses when launching attacks. Google expects the disruption to further impact the proxy industry due to its robust white labeling reseller program that powers many other residential proxy services. UK's National Cyber Action Plan launch delayed by political leadership crisis the UK government's planned strategy for defending its economy against state backed and criminal hacking. The National Cyber Action Plan has been delayed again, this time due to the resignation of Prime Minister Keir Starmer today. Monday was the intended publication day of the plan. Despite this most recent delay, one part of the launch is still expected to proceed being a collection of FTSE 350 companies that plan to sign the government's cyber resilience Pledge a voluntary commitment to improve their digital defenses. This is due to happen tomorrow. Huge thanks to our sponsor Vanta. Your team just added its 67th AI tool and unfortunately also your 67th security blind spot. The good news? Vanta Agent works like a GRC engineer in the background, finding every app your team uses, scoring the risk and drafting fixes for you. Vanta is the platform used by over 16,000 fast moving companies like Ramp, Cursor and Harvey who are shaping the future with AI and staying ahead of AI risk. Get started today at Vanta.com headlines that is V A N T A dot com headlines Spyware found on phone of European Parliament member involved in spyware probe A phone belonging to Stelius Kologhlu, a member of the European Parliament from 2015 to 2024, had apparently been targeted and infected with Pegasus spyware multiple times during his tenure on the parliamentary committee probing the technology's misuse. This according to a report released Friday by Citizen Lab. The infections occurred in October 2022 and again in March 2023, the researchers said. This was at the time that a committee named pega, which included Kologhlu, was conducting sensitive work related to its planned recommendations for tackling rampant abuse of commercial spyware in Europe. Kologhlu has said he believes the Greek government is responsible for the hacks. However, Citizen Lab says it has no indications that this is true. Another critical and exploited Oracle defect detected According to the threat intelligence firm Defused, a cybercriminal group conducted the exploit on Saturday within the payments processing feature of Oracle E business suite. The researchers said this could mark the early stages of a potentially broader campaign. Simo Kohonen, founder and CEO of Defused, said six instances of exploitation were spotted during a two hour window on its honeypots. The exploit acts on a CVE numbered vulnerability that has a 9.8 severity rating. Oracle disclosed and patched it in late May and warned that exploitation complexity is low. Canadian Anonymous hacker jailed over Texas GOP cyber attack following up on a story we covered In April of 2025, Aubrey Cottle, a Canadian hacker associated with the hacktivist group Anonymous, has now been sentenced to 18 months in prison. Involvement in a cyber attack on the Texas Republican Party's website in September 2021. The 39 year old from Oshawa, Ontario, near Toronto, pleaded guilty to defacing the website, exfiltrating data from a Texas GOP server and publishing the data online. US government entity pays $1 million in data theft, extortion case an intriguing story from the community driven organization. Ransomware ISAC details efforts by a US Government entity that paid a criminal gang named Kairos K A I R O s about $1 million to keep stolen files from being leaked. The report is based on a leaked negotiation chat and a blockchain trail that the payment left. Although Kairos does not name its victim, the clues, including file names, suggest Union County, Ohio, which suffered a ransomware attack in May of 2025. Neither the county nor Kairos has confirmed the connection. A link to a more detailed summary of this story is available in the show Notes to this episode. If you have some thoughts on the news from today or about this show in general, please be sure to reach out to us@feedbackisoseries.com we would love to hear from you, Steve I'm Steve Prentiss reporting for the CISO series.
- [07:47]
A
Cybersecurity headlines are available every weekday. Head to CISoseries.com for the full stories behind the headlines.