Security Intelligence for Real-World Decisions
← Back to Archive

RingCentral Breach Exposes 1.6M Accounts; Akira Ransomware Evades EDR via Safe Mode; Critical SAP Flaw Under Active Exploitation

Executive Summary

This week's intelligence highlights significant developments across multiple critical infrastructure sectors, with particular concern for communications, information technology, and enterprise systems. Key developments requiring immediate attention include:

  • Major Communications Breach: The ShinyHunters extortion group compromised RingCentral in July, exposing personal information from approximately 1.6 million accounts. This breach affects a widely-used enterprise communications platform with significant critical infrastructure customer base.
  • Active Exploitation of SAP Commerce Cloud: A maximum-severity remote code execution vulnerability in SAP Commerce Cloud is under active attack just three days after patch release, underscoring the shrinking window between disclosure and exploitation.
  • Ransomware TTP Evolution: The Akira ransomware group has developed a novel technique to reboot Windows systems into Safe Mode, effectively disabling endpoint detection and response (EDR) solutions before executing their payload.
  • Supply Chain Compromise Clarification: Analysis reveals that over 95% of the approximately 2,500 organizations affected in a recent supply chain incident were compromised through Trivy misconfigurations, not malicious LiteLLM packages as initially reported.
  • Energy Sector Alert: Shell has confirmed it is investigating a potential security incident following claims by the Clop ransomware gang of stealing 89GB of data from the oil giant.
  • Post-Quantum Cryptography Roadmap: Google Cloud has published its roadmap to full post-quantum cryptography readiness, with key milestones targeted for 2027-2028 and full readiness by 2029—a development with significant implications for long-term infrastructure security planning.

Threat Landscape

Nation-State Threat Actor Activities

  • Chinese APT 'Jewelbug' Linked to Hack-for-Hire Operations: Broadcom threat intelligence researchers have revealed connections between a known Chinese APT group and lucrative cryptocurrency fraud operations. This development suggests potential blurring of lines between state-sponsored espionage and financially-motivated cybercrime, complicating attribution and defense strategies. (Infosecurity Magazine)
  • North Korean IT Worker Infiltration: Reports indicate a North Korean IT worker successfully breached a federal agency, highlighting the persistent threat of insider access through fraudulent employment schemes. Organizations should review contractor vetting procedures. (SecurityWeek)
  • Mercenary Spyware Campaigns: Apple has issued new "Threat Notification" alerts to users targeted by mercenary spyware attacks. These sophisticated surveillance tools, typically deployed against high-value targets, represent ongoing threats to executives and personnel in critical infrastructure sectors. (Bleeping Computer)

Ransomware and Cybercriminal Developments

  • Akira Ransomware EDR Evasion: The Akira ransomware group has implemented a technique to reboot compromised Windows systems into Safe Mode before executing their payload. This approach effectively disables most EDR solutions, which do not load in Safe Mode, allowing attackers to encrypt systems without detection. Security teams should implement Safe Mode boot monitoring and consider BIOS/UEFI password protections. (CSO Online)
  • ExfilSquad Data Extortion Confirmed: Researchers have verified that the ExfilSquad extortion group possesses sensitive data stolen from at least 13 victim organizations. The group has published leaked datasets via torrents, indicating a shift toward public data exposure as a pressure tactic. (Infosecurity Magazine)
  • Clop Targets Energy Sector: Shell is investigating claims by the Clop ransomware gang of stealing 89GB of data. This continues Clop's pattern of targeting large enterprises and critical infrastructure operators. (Bleeping Computer)
  • International Bank Fraud Operation Disrupted: Four cybercriminals were arrested in Brazil and three charged in Europe for exploiting a service provider vulnerability to withdraw funds from financial institutions, resulting in over €30 million in losses. (Bleeping Computer)

Emerging Attack Vectors

  • GeoServer Zero-Day Under Active Exploitation: Hackers are actively exploiting an unpatched SQL injection vulnerability in GeoServer that can lead to remote code execution. Organizations using GeoServer for geospatial data management should implement immediate mitigations. (SecurityWeek)
  • 'City-Forum' Campaign Targets Enterprise SaaS: A new attack campaign dubbed 'City-Forum' is specifically targeting Salesforce and ServiceNow data, representing a significant threat to organizations relying on these platforms for critical business operations. (CSO Online)
  • Evooo1Bot Botnet Emerges: A new Mirai-based Linux botnet called 'Evooo1Bot' has been observed turning compromised edge devices into persistent proxies. The botnet features advanced capabilities beyond traditional Mirai variants, posing risks to IoT devices in critical infrastructure environments. (Infosecurity Magazine)
  • macOS Threats Intensify: Multiple macOS-focused threats emerged this week:
    • AmnesiaStealer: A Rust-based infostealer harvesting passwords, keychain data, and browser information, with novel remote browser control capabilities
    • Active exploitation of a macOS Screen Sharing authentication bypass vulnerability to deploy Monero cryptocurrency miners
    (SecurityWeek, Bleeping Computer)

Corporate Espionage Trends

  • Insider Threat Sophistication: Analysis indicates corporate espionage tactics have evolved significantly, with threat actors employing more sophisticated methods to infiltrate organizations and exfiltrate sensitive data. A former data analyst contractor was sentenced to two years in prison for a $2.5 million extortion scheme against his employer, Brightly Software, highlighting the persistent insider threat. (Security Magazine, Bleeping Computer)

Sector-Specific Analysis

Energy Sector

  • Shell Investigates Potential Breach: Oil giant Shell has confirmed it is investigating a potential security incident after the Clop ransomware gang claimed to have stolen 89GB of data. While details remain limited, energy sector organizations should review their exposure to similar attack vectors and ensure incident response plans are current. (Bleeping Computer)
  • Industrial Refrigeration Vulnerabilities: DEF CON presentations highlighted vulnerabilities in industrial refrigeration systems, which have applications across energy, food processing, and pharmaceutical sectors. Organizations operating such systems should assess their exposure and implement network segmentation. (SecurityWeek)

Communications & Information Technology

  • RingCentral Breach Affects 1.6 Million: The ShinyHunters extortion group compromised RingCentral in July, stealing personal information including names, addresses, email addresses, and phone numbers from approximately 1.6 million accounts. The breach notification service Have I Been Pwned has added the affected data. Organizations using RingCentral should:
    • Alert employees to potential phishing attempts using stolen data
    • Review account security settings and enable additional authentication factors
    • Monitor for credential stuffing attempts using exposed email addresses
    (Bleeping Computer, SecurityWeek)
  • Beacon CRM Breach Impacts 1,000+ Charities: Over 1,000 charitable organizations were affected by a data breach at Beacon CRM, caused by a compromised AWS access key exposed in publicly available JavaScript build artifacts. This incident highlights the risks of credential exposure in development artifacts. (SecurityWeek)
  • Trezor Customer Data Exposed: Approximately 14,000 Trezor cryptocurrency wallet customers had shipping information stolen in a breach at fulfillment partner ShipMonk, demonstrating third-party supply chain risks. (SecurityWeek)

Transportation Systems

  • Aviation Security Research: DEF CON presentations included research on hacking Boeing 737 systems, highlighting potential vulnerabilities in aviation systems. While specific details are limited, aviation sector security teams should monitor for published research and assess applicability to their environments. (SecurityWeek)
  • Transit Cybersecurity Framework Development: NIST's National Cybersecurity Center of Excellence continues development of the Transit Cybersecurity Framework Community Profile, with a webinar scheduled for September 1, 2026. Transit operators should engage with this initiative to shape sector-specific guidance. (NIST)

Healthcare & Public Health

  • HIPAA Security 2026 Initiative: HHS Office for Civil Rights and NIST are collaborating on "Safeguarding Health Information: Building Assurance through HIPAA Security 2026," with events scheduled for early September. Healthcare organizations should monitor for updated guidance that may affect compliance requirements. (NIST)
  • Record Data Breach Pace: Analysis indicates that if the current pace of data breaches continues, 2026 could set an annual record for the number of compromises. Healthcare organizations, historically among the most targeted sectors, should ensure incident response capabilities are adequately resourced. (Security Magazine)

Financial Services

  • International Bank Fraud Disrupted: Law enforcement arrested seven individuals across Brazil and Europe for exploiting a service provider vulnerability to steal over €30 million from financial institutions. This case demonstrates the importance of third-party risk management and the effectiveness of international law enforcement cooperation. (Bleeping Computer)
  • Chinese APT-Crypto Fraud Connection: The revealed connection between Chinese APT group 'Jewelbug' and cryptocurrency fraud operations suggests potential convergence of state-sponsored and financially-motivated threats targeting financial services. (Infosecurity Magazine)

Vulnerability & Mitigation Updates

Critical Vulnerabilities Requiring Immediate Attention

Vulnerability Severity Status Action Required
SAP Commerce Cloud RCE Maximum (Critical) Active Exploitation Patch immediately; monitor for indicators of compromise
GeoServer SQL Injection High Active Exploitation (Zero-Day) Implement WAF rules; restrict access; monitor for patches
macOS Screen Sharing Auth Bypass High Active Exploitation Apply available patches; disable Screen Sharing if not required

Notable Security Developments

  • Oracle Database Security Tool: Oracle has released a new database security tool available free for six months. Organizations should evaluate this tool for potential integration into their security monitoring capabilities. (CSO Online)
  • Supply Chain Compromise Clarification: Investigation reveals that the compromise affecting approximately 2,500 organizations was primarily caused by Trivy misconfigurations (over 95% of cases), not malicious LiteLLM packages as initially reported. Organizations should review their Trivy configurations and ensure proper access controls. (SecurityWeek)
  • Ad Tracking Transparency Tool: A new service has been launched to help users identify who is tracking them across websites and mobile applications. Security teams may find this useful for understanding data exposure risks. (KrebsOnSecurity)

Recommended Defensive Measures

  • EDR Safe Mode Protection: In response to Akira ransomware's Safe Mode evasion technique:
    • Implement monitoring for unexpected system reboots into Safe Mode
    • Configure BIOS/UEFI passwords to prevent unauthorized boot mode changes
    • Deploy solutions that maintain visibility during Safe Mode operations
    • Review and test incident response procedures for this scenario
  • AWS Credential Management: Following the Beacon CRM breach caused by exposed AWS keys:
    • Audit build artifacts and public repositories for exposed credentials
    • Implement automated secret scanning in CI/CD pipelines
    • Use short-lived credentials and IAM roles where possible
    • Enable AWS CloudTrail logging and monitor for anomalous API calls
  • macOS Security Hardening:
    • Apply all available security updates promptly
    • Disable Screen Sharing unless operationally required
    • Implement application allowlisting to prevent unauthorized software execution
    • Monitor for indicators of AmnesiaStealer and cryptomining activity

Resilience & Continuity Planning

Lessons Learned

  • Third-Party Risk Materialization: This week's incidents involving ShipMonk (Trezor), Beacon CRM (charities), and service provider exploitation (European banks) underscore the critical importance of third-party risk management. Organizations should:
    • Maintain comprehensive inventories of third-party relationships
    • Implement contractual security requirements and audit rights
    • Develop incident response procedures that account for third-party breaches
    • Consider data minimization strategies to limit exposure through partners
  • Patch Window Compression: The SAP Commerce Cloud vulnerability being exploited within three days of patch release demonstrates the continued compression of the window between disclosure and exploitation. Organizations must:
    • Implement processes for rapid patch deployment of critical vulnerabilities
    • Maintain compensating controls for situations where immediate patching is not possible
    • Ensure threat intelligence feeds are monitored for exploitation reports

Supply Chain Security

  • Development Artifact Security: The Beacon CRM breach, caused by AWS credentials exposed in JavaScript build artifacts, highlights the need for:
    • Automated scanning of build outputs for sensitive data
    • Separation of development and production credentials
    • Regular rotation of access keys and tokens
    • Security review of publicly accessible development resources
  • Trivy Configuration Review: Organizations using Trivy for container security scanning should review configurations following the revelation that misconfigurations, not malicious packages, caused the majority of recent compromises.

Cross-Sector Dependencies

  • Enterprise Communications Platforms: The RingCentral breach affecting 1.6 million accounts demonstrates the concentration risk when critical infrastructure organizations rely on shared communications platforms. Organizations should:
    • Assess dependencies on major SaaS communications providers
    • Develop contingency communications plans
    • Implement additional authentication and monitoring for critical communications
  • SaaS Platform Targeting: The 'City-Forum' campaign targeting Salesforce and ServiceNow data indicates increased threat actor focus on enterprise SaaS platforms that often contain sensitive operational data across multiple critical infrastructure sectors.

Regulatory & Policy Developments

Post-Quantum Cryptography Transition

  • Google Cloud Roadmap: Google Cloud has published its roadmap to full post-quantum cryptography (PQC) readiness, with key milestones:
    • 2027: Initial PQC algorithm deployment
    • 2028: Expanded PQC integration across services
    • 2029: Full PQC readiness
    Critical infrastructure operators should begin planning their own PQC transitions, particularly for systems protecting data with long-term sensitivity requirements. (SecurityWeek)

Healthcare Security Guidance

  • HIPAA Security 2026: HHS OCR and NIST are collaborating on updated HIPAA security guidance through the "Safeguarding Health Information: Building Assurance through HIPAA Security 2026" initiative. Healthcare organizations should monitor for updated requirements that may affect compliance obligations. (NIST)

AI Governance Developments

  • AI Nationalization Discussion: Security researcher Bruce Schneier and Nathan Sanders have published analysis in The Guardian discussing potential government intervention if markets reject major AI providers like OpenAI and Anthropic. This discussion has implications for critical infrastructure organizations increasingly dependent on AI capabilities. (Schneier on Security)
  • AI Content Watermarking: Anthropic has announced plans to implement watermarking for Claude's AI-generated text, which may have implications for content authenticity verification in critical infrastructure communications. (Bleeping Computer)

Strategic Security Positioning

  • Cybersecurity as Business Strategy: Industry analysis emphasizes the importance of CSOs positioning cybersecurity as a business growth enabler rather than solely a cost center. This approach may help secure resources for critical infrastructure protection initiatives. (CSO Online)
  • Security Backlog Management: Analysis suggests that cybersecurity backlogs should be treated as business process issues rather than purely security problems, potentially enabling more effective resource allocation for vulnerability remediation. (CSO Online)

Training & Resource Spotlight

Key Takeaways from Black Hat USA 2026

This week's Black Hat USA 2026 conference yielded several significant findings relevant to critical infrastructure protection:

  • Research on Boeing 737 system vulnerabilities
  • Industrial refrigeration system security weaknesses
  • Advanced persistent threat evolution and attribution challenges
  • Emerging defensive technologies and methodologies

Security teams should review published presentations and research for applicability to their environments. (CSO Online)

Small Business Cybersecurity Resources

  • NIST Foundational Practices Guide: NIST has published "Back to Basics: Foundational Cybersecurity Practices for Small Businesses," addressing the resource constraints faced by smaller organizations in the critical infrastructure supply chain. This guidance may be valuable for sharing with vendors and partners. (NIST)

Professional Development

  • LinkedIn Optimization for Security Professionals: Guidance on leveraging LinkedIn for security career development, noting that online presence often serves as an informal first impression with leadership. (Security Magazine)

Tools and Frameworks

  • Oracle Database Security Tool: Oracle's new database security tool is available free for six months, providing an opportunity for organizations to evaluate enhanced database monitoring capabilities. (CSO Online)
  • Ad Tracking Identification Service: A new service helps identify entities tracking users across websites and mobile applications, useful for understanding organizational data exposure. (KrebsOnSecurity)

Looking Ahead: Upcoming Events

Webinars and Virtual Events

Date Event Organization Focus Area
August 20, 2026 Back to Basics: Foundational Cybersecurity Practices for Small Businesses NIST Small Business Security
August 27, 2026 Mobile Driver's License Project Update NIST NCCoE Identity Management
September 1, 2026 Transit CSF Community Profile Webinar NIST NCCoE Transportation Security
September 2, 2026 Safeguarding Health Information: HIPAA Security 2026 HHS OCR / NIST Healthcare Security

Conferences and In-Person Events

  • LAcon V: Security researcher Bruce Schneier will be speaking, signing books, and participating in panel discussions. Date and location details available at lacon.org.

Threat Awareness Periods

  • Post-Conference Exploitation Window: Following Black Hat USA and DEF CON, organizations should anticipate increased exploitation attempts as newly disclosed vulnerabilities and techniques are weaponized by threat actors.
  • Back-to-School Period: Educational institutions and supporting infrastructure should maintain heightened awareness as the academic year begins, historically a period of increased targeting.
  • Labor Day Weekend (September 5-7, 2026): Holiday weekends traditionally see increased ransomware activity as threat actors exploit reduced staffing. Organizations should ensure incident response coverage and consider implementing additional monitoring.

Anticipated Developments

  • SAP Commerce Cloud Exploitation Expansion: Given active exploitation within three days of patch release, expect continued targeting of unpatched systems throughout the coming weeks.
  • Shell Incident Updates: Additional details regarding the Clop ransomware gang's claimed breach of Shell are anticipated as the investigation progresses.
  • Post-Quantum Cryptography Guidance: Following Google Cloud's roadmap announcement, expect additional guidance from NIST and sector-specific agencies on PQC transition planning.

This intelligence briefing is compiled from open-source reporting and is intended to support critical infrastructure protection efforts. Recipients are encouraged to share relevant information with appropriate stakeholders and report significant incidents through established channels.

Report Date: Saturday, August 15, 2026

Disclaimer

This briefing is generated using AI analysis of public news sources. Always verify critical information through authoritative sources before taking action.