AI insurgency, identity crisis rising

CybersecurityHQ weekly analysis

Welcome reader to your CybersecurityHQ report

Brought to you by:

🏄‍♀️ Upwind Security – Real-time cloud security that connects runtime to build-time to stop threats and boost DevSecOps productivity

🔧 Endor Labs – Application security for the software development revolution, from ancient C++ code to bazel monorepos, and everything in between

🧠 Ridge Security – The AI-powered offensive security validation platform

Forwarded this email? Join 70,000 weekly readers by signing up now.

—

Get annual access to our deep dives, weekly cyber intel podcast report, premium content, AI Resume Builder, and more — all for just $299. Corporate plans are now available too.

This Week in Cybersecurity: AI-Driven Chaos, Identity Heist Epidemic, and Geopolitical Cyber Assault

This week's events reveal a stark reality: digital fortresses are not just under siege, they're being outmaneuvered. The fusion of generative AI, identity exploitation, and geopolitical targeting has accelerated beyond legacy security capacity. Compromise timelines have shrunk from days to hours. This isn't an AI arms race, it's an AI insurgency, demanding a radical shift in defense.

Five Defining Threat Vectors

→ Ramnit Malware Invades ICS
Ramnit, once a banking trojan, now infiltrates Operational Technology (OT) networks. Its modularity, evasion, and credential harvesting signal a deliberate shift to bridge IT and OT, endangering industrial control systems (ICS).

Implication: The IT-OT wall has collapsed, turning financial malware into a cyber-physical safety risk.

Action: Deploy protocol-aware anomaly detection in ICS. Run breach simulations assuming IT malware hits OT endpoints. Enforce microsegmentation to isolate tiers.

→ Salesforce Vishing Attacks Weaponize Trust
Google-flagged UNC6040 impersonates Salesforce support, using fake Data Loader apps for backdoors and lateral movement via SaaS integrations.

Implication: SaaS platforms are launchpads for hybrid attacks, exploiting trust in support processes.

Action: Block unverified third-party app installs in Salesforce, Google Workspace. Use app behavior analytics to detect anomalies. Train CX teams on vishing with simulations from KnowBe4.

→ The North Face Credential Stuffing Hits 100K+
Over 100,000 North Face accounts fell to credential stuffing, fueled by AI tools correlating 184M+ leaked passwords. Retail, finance, and SaaS face relentless attacks.

Implication: AI-accelerated credential attacks are a tier-1 threat to consumer ecosystems.

Action: Enforce FIDO2 authentication on portals. Deploy behavioral biometrics for session anomalies. Audit credential reuse weekly via Have I Been Pwned.

→ Ransomware Surge Targets Critical Sectors
Ransomware like DragonForce and Play cripples healthcare and critical orgs, leaking sensitive data.

Implication: Persistent attacks disrupt operations and demand robust recovery.

Action: Prioritize off-site backups, test restoration weekly, and deploy endpoint detection to block ransomware.

→ Zero-Day Exploits Hit Broad Targets
Chrome, VPN, and WordPress (CVSS 10.0) zero-days are actively exploited, risking remote workers and web platforms.

Implication: Unpatched systems expose users to rapid compromise.

Action: Accelerate patch management, monitor exploit code via GreyNoise, and adopt zero-trust for access control.

Critical Developments

→ Google Zero-Day in Chrome Exploited: A second Q2 Chrome zero-day triggered an emergency patch, with active exploits targeting users.

→ ASUS Router Backdoor Campaign: 9,000+ routers hit via a patched bug, exposing unpatched consumer devices.

→ vBulletin Exploited Again: Fresh exploits hit the legacy forum platform, a supply chain weak link.

→ Victoria's Secret Breach Delays Earnings: Sensitive system exposure forced a deferral, disrupting operations.

→ Ransomware Surge: DragonForce exploits SimpleHelp for ransomware; Play hits 900 victims, including critical orgs.

→ Microsoft and CrowdStrike Threat Actor Glossary: A unified taxonomy aids cross-industry threat intelligence amid attribution chaos.

Key Metrics This Week

→ AI-Driven Scans: 36,000 per second

→ Passwords Exposed: 184M+ in plain text

→ Ransomware Victims: 900 orgs hit by Play

→ Compromised Devices: 9,000+ ASUS routers backdoored

→ Geopolitical Impact: 60% of orgs' cyber strategies affected

Insight: These numbers show the scale and speed of threats, urging immediate action.

Strategic Guidance for Cybersecurity Leaders

→ AI Security Starts with Scope Control: Box AI agents, limit tasks, and monitor with sandboxing APIs. Treat generative agents as potential rogue code near critical systems.

→ Identity Must Become Dynamic: Static credentials are obsolete. Use session risk scoring, continuous re-authentication, and biometric-verbal fusion for high-risk actions.

→ Decouple Trust from Communication Channels: Voice, SMS, and video are spoofable. Embed trust in out-of-band systems for verification.

→ Security is a Data Problem: Unify EDR, NDR, IAM, and SaaS logs into AI-driven platforms for streaming inference, not batch analytics.

→ Geopolitics is Cyber Risk: China's APT41 targets SAP, SQL Server across Asia, Brazil; China-Russia cyber ties grow. Meta disrupts influence ops in Romania, Azerbaijan, Taiwan. Suspected nation-state actors hit ConnectWise. If your supply chain spans Taiwan, Ukraine, Brazil, U.S., or Eastern Europe, you're a target.

Action: Map supply chain risks, subscribe to CISA and threat intel feeds, and simulate APT scenarios for critical assets.

Australia mandates ransomware payment reporting, while U.S. DoJ seizes cybercrime domains. Breaches at Victoria's Secret and Cartier trigger data protection scrutiny.

Implication: Non-compliance risks fines, reputational loss amid rising attacks.

Action: Align with GDPR, CCPA, and local laws; log ransomware incidents for reporting; consult legal teams for audits.

Toolbox for the AI Insurgency

→ Anomaly Detection: Nozomi Networks and Dragos for ICS; GreyNoise for exploit tracking.

→ Identity Security: Okta for risk scoring; YubiKey for FIDO2; BioCatch for biometrics.

→ Unified Analytics: Splunk for real-time logs; Databricks for AI-driven inference.

→ Incident Response: CrowdStrike for endpoints; Zscaler for zero-trust access.

Approach: Prioritize cloud-native, scalable tools. Test integration in 48 hours to match attack speed.

Market Signal: Security's Next Consolidation Wave

→ Zero Networks Raises $55M: Microsegmentation shrinks attack surfaces, a winning bet.

→ ThreatSpike $14M Series A: UK's ThreatSpike shifts endpoint security to continuous behavioral modeling.

→ Unbound Raises $4M: Seed funding fuels AI-safe APIs, sandboxing, and data provenance.

→ Salesforce Acquires Moonhub: Salesforce buys Moonhub, a startup building AI tools for hiring, boosting secure talent management and insider threat prevention.

→ Leidos Boosts Cyber Arsenal: Leidos buys Kudu Dynamics, a cybersecurity firm specializing in vulnerability research and cyber-electronic warfare, for $300M to bolster AI-driven threat detection and defense capabilities.

→ CACI Secures Intelligence Contracts: CACI lands $640M in contracts, fueling intelligence-driven cyber operations for government and critical sectors.

Final Signal: You're Not Behind, You're Blind

Adversaries are inside, leveraging zero-friction AI attacks. Perimeters are illusions, dashboards breed overconfidence, and detection lags. Winners won't be the best protected, they'll be the most adaptive, architecting real-time, human-centric, geopolitically aware security.

Leadership Imperative

Assume breach, design for speed, and treat trust as radioactive. In a world where attackers see all and defenders see only logs, blend AI defenses, dynamic identity, and unified data to outpace the insurgency.

CybersecurityHQ: This Week's Reports Derived from Technical Research Papers and Briefings

🔒 Pro subscriber-only 🔒

  1. Developing cost-effective budgeting strategies for quantum technology–induced regulatory transformations 👉 Read the report

  2. Using predictive modeling to map cybersecurity breach cascades in enterprise network infrastructures 👉 Read the report

  3. Mapping and mitigating interdependent cybersecurity risks in complex technology ecosystems 👉 Read the report

And more inside - check out the full list here.

Cyber Intel Brief: Key Insights from Leading Security Podcasts

This is what you missed in this week’s Cyber Intel Report sourced from top cybersecurity podcasts and webinars, if you haven’t upgraded your membership: critical insights, expert takes, and the latest threats unpacked. Don’t let this slip by—upgrade today to get the full scoop!

⤷ SentinelOne outage reveals fragile XDR dependence across 13,000 organizations

⤷ Australia mandates ransomware payment disclosures—global compliance trends to follow

⤷ Deepfake audio spoofs executives in real-time to bypass financial approvals

⤷ AI hiring pipelines face legal backlash as Workday hit with resume bias lawsuit

And more insights in this week’s full CISO briefing.

Interesting Read

U.S. Rebrands AI Safety Institute, Shifts to National Security Focus

On June 3, 2025, the U.S. government rebranded the AI Safety Institute as the Center for AI Standards and Innovation (CAISI), marking a sharp pivot from general AI risk mitigation to prioritizing national security threats. The revamped center will focus on cyber, biosecurity, chemical weapon risks, and foreign influence, particularly from adversarial AI systems like those from China.

The move reflects a broader policy shift toward deregulation and accelerated AI adoption, including controversial support for coal-powered data centers and a proposed 10-year moratorium on state-level AI laws. For CISOs, this signals a regulatory environment in flux, with less oversight, faster innovation, and growing reliance on security teams to self-govern AI risk exposure.

Fresh From the Field: Security Resources You Can Use

Title

Publisher

Focus

Direct Access Link

Exposing the Impact of GenAI for Cybercrime: An Investigation into the Dark Side

University of Cincinnati

Generative AI, Cybercrime, Technological Amplification

Read Report

Securing the Future of Agentic AI: Governance, Cybersecurity, and Privacy Considerations

Office of the CISO, Google Cloud

AI Governance, Cybersecurity, Privacy

Read Blog Post

Navigating the Evolving Cybersecurity Landscape: Threats, Trends, and Strategic Response

Cybersec Europe

Geopolitics, Threat Intelligence, Cyber Strategy

Read Blog Post

Social Media Highlights

SIEM-GenAI-Runbook | Sandy Dunn

📕 Sharing SIEM Runbook for GenAI Incident Investigation Prompt Injection Attempt, Sensitive Data Leak via Model Output, Abnormal Usage or Model Abuse, Toxic/Harmful Content Generation, API Key Misuse, Model Misconfiguration / Drift Detection 🏓 Tabletops turn theory into action! Drills sharpen skills before a real incident, practice matters! Thomas Roccia Jerry Craft Marco Figueroa Francis Odum Rachel James Bryan Nakayama Christophe Parisel #IncidentResponse #SecurityRunbook #AIRedTeaming

www.linkedin.com/posts/sandydunnciso_siem-genai-runbook-activity-7336009481044037632-zTgg?

How security categories are merging and blurring | Rom Carmel 🚀 

I recently gave a session to the new cohort of employees at Apono- something I do regularly to help us all stay aligned on how we see the industry evolving. As part of it, I built out a venn diagram that maps out how security categories have shifted over the past couple of years. It’s a simplified, two-dimensional view- not scientific or exhaustive, and based on my own perspective, but it reflects a pattern we’re seeing more and more: categories that once stood apart are starting to merge, and the boundaries between them are becoming increasingly blurred. Take CIEM. Not long ago, it wasn’t obvious whether it belonged under IAM or Security. Today, it’s become a standard part of the security stack- and in many cases, fully integrated into CNAPP. The acquisition of companies like Ermetic and others helped make that transition more concrete. Or look at CDR. It used to feel like a category in search of a home. That changed when companies like Wiz acquired players like Gem Security and brought CDR into the CNAPP ecosystem as well. Then there’s DSPM- one of the fastest-moving categories we’ve seen in recent years. What started as a niche is now being pulled into SaaS security, CNAPP, and/or a broader data security category. We’re seeing both product integration and M&A activity that reflect this shift. Let's take DLP traditionally on the intersection of data and security, and we are seeing SASE companies like Zscaler pursuing that category as well as the expansion of what started as DSPM to include DLP as well with the acquisition of companies like Trail Security recently by Cyera. These aren’t just trends on a chart- they point to real changes in how buyers think, where companies are investing, and what the future of security might look like. However, the diagram I shared is based on what we’ve seen in 2023 and 2024. The 2025 version is already in the works. Some patterns are becoming clearer. Others are still wide open. And a few categories… well, they just don’t seem to fit anywhere- and I'd be curious to hear where you'd add them. So here’s what I’m curious about: If you were mapping this out yourself- what would you draw differently? Seen any examples that challenge what I’ve shown? This is just my personal view (reflecting mostly 2024) - I’d really love to hear how you see the shifts, the overlaps, and the gaps. Michael Dolinsky Tamar Bar-Ilan Nadav Zingerman Arie Zilberstein Pramod Gosavi Manoj Apte Neil MacDonald Francis Odum Simon | 29 comments on LinkedIn

www.linkedin.com/posts/romcarmel_i-recently-gave-a-session-to-the-new-cohort-activity-7333072574785961984-ZJwU

Stay safe, stay secure.

The CybersecurityHQ Team

Reply

or to participate.