The Trump administration removed sanctions on three individuals tied to the Intellexa consortium behind the Predator surveillance tool, easing previous restrictions that barred them from doing business with the U.S. The move signals a potential shift in U.S. posture toward commercial spyware, raising compliance and supply chain risks for organizations that may inadvertently interact with vendors linked to surveillance abuses. Security teams should revisit vendor due diligence and export-control exposure in light of the reversal.
Source: The Register
Trump suggests U.S. cyber operations supported Venezuela strikes
President Trump indicated the U.S. used cyberattacks to “turn off the lights” in Venezuela during recent operations, with reports noting U.S. Cyber Command involvement in setting the stage. The public acknowledgement underscores how cyber effects are now tightly integrated with kinetic actions, raising questions over escalation, norms, and legal frameworks. Critical infrastructure defenders should expect adversaries to study and mimic these tactics.
Source: Politico
European Space Agency confirms breach as attackers claim 200 GB haul
The European Space Agency said science servers were compromised, while attackers claimed they stole 200 GB of data. Potential impacts include exposure of research assets, credentials, and partner integrations across ESA’s scientific ecosystems. Agencies and contractors should harden internet-facing services and review credential hygiene for research environments.
Source: Forbes
New Python-based VVS Stealer targets Discord tokens and credentials
Researchers detailed VVS Stealer, a Python information-stealer obfuscated with Pyarmor and sold on Telegram since at least April 2025. It focuses on siphoning Discord tokens and credentials, a trend that can enable account hijacking, social engineering, and lateral movement in gaming and developer communities. Organizations should monitor for Discord token exfiltration, harden endpoint controls, and restrict use of consumer IM on corporate devices.
Source: The Hacker News
Sedgwick discloses data breach after TridentLocker ransomware attack
Global claims management giant Sedgwick confirmed a cyber incident affecting its federal contractor unit after the TridentLocker group claimed theft of 3.4 GB of data. Given Sedgwick’s role in insurance and risk services, exposed information could enable targeted fraud, social engineering, or downstream identity abuse. Clients should watch for notification updates and implement fraud monitoring where possible.
Source: Security Affairs
Leak ties Chinese firm Knownsec to state-linked offensive operations
A leak allegedly exposes Chinese cybersecurity company Knownsec’s deeper involvement in state-linked offensive cyber activity and intelligence collection. The revelations highlight ongoing blurring between commercial security vendors and government-aligned operations, creating third-party and sanctions risk for international partners. Procurement and legal teams should reassess exposure to PRC-linked security providers.
Source: CyberNews
AI agents named 2026’s biggest insider threat
Palo Alto Networks’ security intelligence chief Wendi Whitmore warns that autonomous AI agents constitute the top insider risk this year. As organizations deploy agents with access to sensitive data and actions, gaps in identity, permissions, logging, and model safety can amplify impact. CISOs should prioritize agent access governance, containment, and prompt/action monitoring.
Source: The Register
You May Also Be Interested In...
Russia-linked Everest group demands ransom after Bolttech data theft
Resecurity says honeypot exposed ShinyHunters’ tactics against airlines and telecoms
New Zealand orders review into ManageMyHealth cyberattack impacting patient data