Rhysida Ransomware Hits Berlin City Government — 5.79 TB Stolen
The Rhysida ransomware group claimed responsibility for breaching Berlin's city administration and exfiltrating approximately 5.79 terabytes of sensitive data. Stolen records include government documents, legal files, financial data, HR records, and infrastructure plans. Berlin officials declined to pay the ransom and handed the investigation to law enforcement.
Ransomware groups increasingly combine encryption with data theft (called "double extortion") to maximize pressure on victims. Even if a city restores its systems from backup, the threat to publicly release 5.79 TB of sensitive data creates additional leverage. This connects to the CIA Triad — Rhysida attacked all three: Confidentiality (stolen data), Integrity (tampered files), and Availability (encrypted systems). (CompTIA Tech+ / Security+: Threats, Attacks, and Vulnerabilities)
SonicWall SMA1000 Chained Zero-Days — CVSS 10.0 — Actively Exploited
Two chained zero-day vulnerabilities in SonicWall SMA1000 remote-access appliances were disclosed and are being actively exploited. The first flaw (CVE-2026-83548) is a Server-Side Request Forgery (SSRF) bug scored CVSS 10.0 — the highest possible. Chained with an OS command injection flaw (CVE-2026-83549, CVSS 7.8), attackers can execute commands on the device without any credentials. CISA added both to its Known Exploited Vulnerabilities catalog with a federal patching deadline of September 5.
A CVSS score of 10.0 is the highest possible rating — the vulnerability is trivially exploitable with maximum impact. "Chained" vulnerabilities combine two separate bugs to achieve an attack neither could accomplish alone. SSRF allows an attacker to make a server send requests on their behalf, bypassing firewalls. The 3-day federal remediation deadline reflects how urgently governments treat actively exploited flaws. (CompTIA Security+: Vulnerabilities and Mitigations)
McKesson Healthcare Breached via Vishing — ShinyHunters Claims 284M Records
The ShinyHunters threat group used voice phishing (vishing) — phone calls impersonating IT support staff — to trick a McKesson employee into revealing Okta SSO credentials, bypassing multi-factor authentication. With those credentials, attackers accessed Salesforce and Snowflake cloud environments and exfiltrated approximately 1 TB of data containing 284 million records, including patient names, prescription history, and billing data. The group demanded over $55 million in ransom.
This attack used no malware and exploited no software vulnerability — it was pure social engineering. Vishing exploits human trust, not technology. Even with MFA enabled, an attacker who convinces a target to hand over a temporary code can bypass it. This is why security awareness training matters as much as technical controls. Healthcare records are especially valuable because unlike passwords, they cannot be changed. (CompTIA Tech+ / Security+: Social Engineering Techniques)
APT28 (Russia) Deploys HOOKEDGE Backdoor Against European Organizations
Russian state-sponsored hacking group APT28 — also known as Fancy Bear and BlueDelta — deployed a custom lightweight backdoor called HOOKEDGE targeting governmental, diplomatic, and defense-manufacturing organizations in Romania, Spain, and Turkey. The group distributed macro-enabled Word documents via spearphishing emails impersonating Spanish diplomatic communications. Once installed, HOOKEDGE established persistence via scheduled tasks and used Microsoft Edge browser traffic to camouflage its command-and-control communications.
APT28 is attributed to Russia's GRU military intelligence and is one of the most well-documented nation-state actors. This campaign uses classic spearphishing (targeted phishing) and living-off-the-land techniques — using legitimate tools like Microsoft Edge to hide malicious traffic from security tools. Nation-state actors prioritize stealth and persistence over speed, making them harder to detect than criminal groups. (CompTIA Security+: Threat Intelligence, Indicators of Compromise)
Fire Ant Compromises Cisco IOS XR Routers — Hidden Tunnels, Log Tampering
Nation-state threat actor "Fire Ant" was found to have compromised Cisco IOS XR enterprise routers at multiple organizations, establishing hidden GRE tunnels invisible in running configurations, capturing live network traffic across physical interfaces, deploying custom rootkits, and manipulating TACACS authentication logs to erase evidence of intrusion. Researchers from Sygnia noted attackers used compromised routers as a "bridge" to reach other connected critical infrastructure.
Network routers are high-value targets because they see all traffic passing through an organization. Compromising a router gives attackers a persistent foothold that survives reboots and evades endpoint security tools, which only monitor computers — not network devices. This attack also demonstrates log tampering as a defense evasion technique. Always monitor your network infrastructure, not just endpoints. (CompTIA Security+: Network Security, Monitoring and Incident Response)
Aesto Health AWS Breach Exposes 9.5 Million People's Records
Attackers breached Aesto Health's Amazon Web Services cloud infrastructure and exfiltrated personal and health-related data belonging to more than 9.5 million individuals — one of the largest healthcare data exposures of 2026. Aesto Health confirmed the unauthorized access affected records stored in AWS S3 buckets. The full scope of stolen data, including names, dates of birth, and health records, is still being assessed.
Cloud storage breaches often result from misconfigured S3 buckets — storage containers left publicly accessible by mistake — or stolen access keys. Healthcare data is protected by HIPAA in the US, meaning Aesto Health faces serious legal consequences. Organizations moving to the cloud must understand the shared responsibility model: the cloud provider secures the infrastructure, but the customer is responsible for securing their own data and configurations. (CompTIA Tech+: Cloud Concepts and Security)
PaperCut Print Software Zero-Days Exploited — Unauthenticated Remote Code Execution
Two chained vulnerabilities in PaperCut NG and PaperCut MF — popular print management software used by schools, hospitals, and enterprises — allow unauthenticated attackers to remotely execute code on internet-facing servers. CVE-2026-81578 allows unauthorized access to the web management interface; CVE-2026-82078 chains that access into arbitrary code execution. Initial patches were bypassed, forcing PaperCut to release Emergency Patch Release 3. CISA set a September 14 remediation deadline.
Print management software is widely overlooked in security audits — yet it runs on servers with broad network access. This is an example of a neglected attack surface. "Unauthenticated RCE" means an attacker needs no username or password to exploit the flaw from the internet. The fact that the first patch was bypassed shows why patch validation testing is essential before declaring an issue resolved. Schools run PaperCut too — this one's personal. (CompTIA Security+: Vulnerability Management)
QTFY Chinese State Group Disrupted After Targeting NASA, DOE, Federal Reserve & Senate
A joint FBI and Department of Justice operation disrupted the infrastructure of QTFY, a Chinese state-sponsored contractor linked to China's Ministry of State Security. The group had conducted intrusion campaigns against NASA, the Department of Energy, the Federal Reserve, and the US Senate. QTFY used custom tools called QScan (an IoT scanning platform) and QTRouter (a network obfuscation system) to identify targets and mask malicious traffic.
Nation-state actors often use private contractors to conduct espionage while maintaining plausible deniability — the contractor takes the risk, the government gets the intelligence. Targeting the Federal Reserve and Senate suggests long-term intelligence gathering rather than immediate disruption. The use of IoT scanning tools demonstrates how attackers conduct reconnaissance before striking. Disrupting infrastructure (vs. arresting individuals abroad) is a key US counter-operation technique. (CompTIA Security+: Threat Intelligence, Nation-State Actors)
Aurora Ransomware Uses Cursor AI Agent to Attack VMware ESXi Environments
The Aurora ransomware group used the Cursor AI coding agent as a technical assistant during active intrusions across ten victim organizations. Operators used the AI for reconnaissance, Active Directory mapping, and exploitation of VMware ESXi virtualization servers. Their custom Linux encryptor targeted virtual machine disk files while intentionally preserving hypervisor boot capability so administrators would immediately see ransom demands upon login. Research by Gambit Security and CloudSEK confirmed the AI-assisted workflow began in April 2026.
This is one of the first confirmed cases of commercial AI tools assisting ransomware operations. AI doesn't replace human attackers — it lowers the skill barrier, letting less technical operators conduct more sophisticated attacks faster. VMware ESXi is targeted because one successful attack encrypts all virtual machines on the host simultaneously. This is a preview of how AI will reshape the threat landscape. (CompTIA Security+: Emerging Threats, Ransomware)
GitSpawn: Malicious Git Repos Trigger Code Execution in AI Coding Agents
Security researchers at Manifold Security disclosed "GitSpawn" — a class of vulnerabilities affecting AI coding agents including Claude Code, OpenAI Codex, Cursor, Grok Build, and others. Malicious Git repository configurations using the core.fsmonitor setting can trigger arbitrary code execution on a developer's machine the moment the AI agent opens a project — before any user interaction. The attack exposes SSH keys, API tokens, credentials, and source code. Several tools remained unpatched at publication.
This is a supply chain attack targeting developers. Attackers don't need to compromise a developer's machine directly — they hide malicious configurations in a git repo and wait for developers to clone it. AI coding agents make this worse because they automatically run git commands when opening a project, before the user can review anything. As AI tools become more powerful and autonomous, they also become more attractive attack surfaces. Always trust but verify code from unknown sources. (CompTIA Security+: Supply Chain Vulnerabilities, Application Security)
A software flaw that is unknown to the vendor and has no available patch. Attackers who discover zero-days can exploit them before any defense exists. The name comes from "zero days" of warning for defenders.
A ransomware technique where attackers both encrypt victim data AND steal a copy, threatening to publish it publicly if the ransom isn't paid. This removes the option of simply restoring from backup to avoid payment.
A social engineering attack conducted over the phone or voice call, where the attacker impersonates a trusted person (IT helpdesk, bank, government agency) to trick the victim into revealing credentials or performing actions.
Common Vulnerability Scoring System — a standardized 0–10 scale for rating vulnerability severity. Scores 9–10 are Critical, 7–8.9 are High, 4–6.9 are Medium, and 0–3.9 are Low. A CVSS 10.0 is the worst possible rating.
Hidden software installed by an attacker that provides covert, ongoing remote access to a compromised system. Backdoors survive reboots and are designed to be difficult to detect, enabling long-term espionage or control.
A hacking group sponsored or directed by a government. Nation-state actors typically have large budgets, advanced tools, and long-term strategic goals such as espionage and sabotage. Examples: APT28 (Russia), QTFY (China).
An attack that targets software, hardware, or services used by an organization rather than attacking the organization directly. By compromising a trusted tool or vendor, attackers can reach many downstream victims at once.
A class of vulnerability allowing an attacker to run arbitrary commands or programs on a remote system without physical access. RCE is among the most severe vulnerability types because it gives an attacker full control of the target.
// All source URLs verified via direct fetch — week of Sep 1–7, 2026
- [1]Boston Institute of Analytics — "Cybersecurity This Week: Aug 29 – Sep 4, 2026" (Berlin ransomware, Aesto Health, Fire Ant, Manchester Airports)
- [2]DieSec — "Top 5 Cybersecurity News Stories, September 4, 2026" (SonicWall, McKesson/ShinyHunters, JFrog, GitSpawn)
- [3]GBHackers — "Russian APT28-Linked Hackers Deploy HOOKEDGE Backdoor"
- [4]GBHackers — "Aurora Ransomware Hackers Use Cursor AI Agent for ESXi Attacks"
- [5]GBHackers — "New Panzer Ransomware Hits 16 Victims Across 11 Countries"
- [6]GBHackers — "CISA Flags Multiple PaperCut NG/MF Flaws Exploited in the Wild"
- [7]GBHackers — "GitSpawn Flaw Enables Arbitrary Code Execution in Claude Code, Codex, Cursor, and Grok"
- [8]CyberSecurityNews — "Hackers Compromise Cisco Routers to Spy on Networks and Reach Critical Infrastructure"
- [9]CYFIRMA — "Weekly Intelligence Report — 04 Sep 2026" (QTFY Chinese state group)