After a temporary slowdown in global ransomware attacks, cybercriminal gangs are increasingly targeting Europe, making the EU their preferred hunting ground. The region's organizations and their supply chain partners are now facing a surge in attacks, as ransomware operators shift their focus to exploit what they see as a lucrative and vulnerable new market.

AI has dramatically accelerated the exploit timeline, turning new vulnerabilities into working attacks in hours rather than weeks, forcing security teams to move beyond traditional patch-and-pentest cycles. A webinar scheduled for June 24th will address how organizations can validate exposures in real-time, combining automated penetration testing with exposure validation to make evidence-based security decisions. The focus is on proving which vulnerabilities attackers could actually exploit right now, rather than relying solely on severity scores or testing only the systems that automated tools can safely reach.

LastPass and BeyondTrust are among over a dozen cybersecurity firms affected by a breach at competitive intelligence platform Klue, where attackers used a compromised credential to generate OAuth tokens and access customers' Salesforce instances. The threat actor known as Icarus used automated scripts to exfiltrate business contact information and customer relationship management data, though companies emphasize their core products and services weren't compromised. Salesforce and Gong have since disabled the Klue integration, but researchers estimate numerous other Klue customers were likely impacted and have yet to come forward.

Cybersecurity firm Novee has uncovered a critical class of vulnerabilities dubbed Cordyceps that exposes millions of repositories to complete takeover through flawed CI/CD workflows. The security defects, found in GitHub Actions and similar systems, allow unauthenticated attackers to hijack developer workflows, forge approvals, and steal credentials, with confirmed impacts on major projects from Microsoft, Google, Apache, Cloudflare, and the Python Software Foundation. Novee warns that AI-driven code generation has accelerated the spread of these insecure patterns, with hundreds of repositories confirmed fully exploitable in a single scan, potentially affecting thousands of downstream organizations that depend on these compromised repositories.

A threat actor known as Woodgnat has been deploying a new remote access trojan called Mistic RAT in attacks against organizations across education, insurance, IT, and professional services sectors. The group functions as an initial access broker with ties to multiple ransomware families including Qilin, Black Basta, and Akira, casting a wide net to identify victims they can sell network access to. The attacks often use social engineering tactics through compromised WordPress sites and fake IT-support lures via Microsoft Teams to trick victims into executing malicious PowerShell commands.

Agentic AI systems in cybersecurity face a critical challenge: they can only make decisions as good as the context they're given, yet they operate with confidence and speed even when that context is incomplete or wrong. As security teams increasingly turn to AI agents to handle the growing volume of automated attacks, there's a fundamental risk that these systems will make catastrophic decisions at machine speed, shutting down critical infrastructure or mishandling threats because they lack proper understanding of business priorities and changing environments. The key concern is that unlike traditional board decisions with audit trails, organizations are accepting AI-driven security intelligence and automated responses without visibility into the reasoning, essentially trusting black-box systems that aren't yet mature enough for fully autonomous operation.

The US cybersecurity agency CISA is warning that attackers are actively exploiting three critical vulnerabilities in Ubiquiti UniFi OS devices, all rated with perfect 10 out of 10 severity scores. The flaws, which include an authentication bypass and command injection vulnerability, were reportedly exploited as zero-days before being patched last month, with users reporting automated attacks that created rogue administrator accounts. CISA has added these vulnerabilities to its Known Exploited Vulnerabilities catalog and is requiring federal agencies to patch them within three days, noting that compromised UniFi devices could allow attackers to move deeper into enterprise networks.

Nathan Austad has been sentenced to 18 months in prison for his role in a 2022 credential-stuffing attack on DraftKings, where hackers used stolen login credentials to access over 60,000 accounts and steal approximately $600,000 from 1,600 users. Austad also ran a website selling compromised accounts and had about $465,000 in cryptocurrency from his criminal activities. He is the third person sentenced in the case, joining two accomplices who previously received 18 and 30-month prison terms, and must pay $1.8 million in restitution.

Cybersecurity firm XM Cyber has demonstrated a technique that allows a standard macOS user without administrative privileges to silently disable enterprise endpoint security tools like EDR and MDM agents without triggering alerts. The attack chains together known macOS behaviors, including exploiting kernel code-signing trust cache persistence and injecting malicious payloads into application files, to impersonate trusted components and invoke privileged system functions. The technique was successfully used against CrowdStrike Falcon Sensor, Kandji MDM, and a third unnamed vendor, prompting patches and bug bounty payments, while the researcher plans to release an open source tool called XPC Hunter to help identify similar vulnerabilities across macOS applications.

The Department of Justice has seized a Huione Cloud account linked to cyber scam money laundering operations. While specific details about the scope and nature of the investigation weren't provided in the brief announcement, the action represents continued government efforts to crack down on cryptocurrency and digital platform-based financial crimes connected to overseas cyber fraud schemes.