Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

From a fast-scaling ransomware operator to a Russian state-sponsored espionage group now experimenting with LLM-powered malware, and a data extortion collective that has weathered arrests without slowing down, these three threat actors span the full spectrum of financially and geopolitically motivated cybercrime. CYJAX breaks down what each group does, why they matter, and what security teams should know.

Let’s catch up on the more interesting vulnerability disclosures and cyber security news gathered from articles across the web this week. This is what we have been reading about on our coffee break! Always worrying (for the dependent companies) when such a large consultancy takes a hit.

Most security providers can describe what they should be able to do. Fewer can demonstrate what they actually see, track, and respond to in live environments. That distinction matters more now than it did even a year ago. Attack surfaces have expanded beyond users and endpoints into machine identities, autonomous systems, and internet-facing infrastructure rapidly. At the same time, detection claims have become broader (often without a corresponding increase in observable capability).

Credential sprawl has long been an issue IT and security teams have had to grapple with, and solutions like single-sign-on (SSO) have never been able to contain it completely. Now, AI is accelerating the problem. AI agents need access to credentials at an unprecedented scale, leaving IT and security teams struggling even more to ensure that every credential, across every department, is secure.

Black Hat is where the security industry gathers to compare notes on what works. In recent years, supply chain attacks have been a recurring topic, and the 2026 Verizon Data Breach Investigations Report shows security teams are struggling to find a solution. According to the report, third-party involvement increased by 60% over the last year and now accounts for 48% of all breaches.

Your environment probably already looks like this. Active Directory on-prem, a couple of cloud accounts, SaaS apps the business adopted faster than security could review them, remote laptops, service accounts nobody wants to touch, and a SIEM full of logs that don't yet add up to control. That's where most first Zero Trust projects begin.

GitGuardian is now live on the Kiro Powers marketplace. Install the Power once, and Kiro's agent scans for exposed secrets automatically every time it writes or modifies code that handles credentials.

Artificial intelligence is transforming cybersecurity, and Managed Service Providers (MSPs) are at the forefront of that evolution. That's why we're launching the WatchGuard AI Innovation Challenge, an opportunity for MSPs to share ideas for AI agents and automations that help security teams work smarter, operate more efficiently, and better protect their customers.

BitRAT is a potent and versatile Remote Access Trojan (RAT) commonly sold on underground forums. Its popularity stems from a robust feature set and an emphasis on stealth, allowing it to evade detection by hiding command-and-control (C2) communications over seemingly benign protocols. This makes traditional detection methods more challenging. By examining the subtle artifacts it leaves behind, even in encrypted traffic, defenders can expose these elusive threats.