Ransomware crews are going after healthcare and government
Tracked incidents over the summer were led by healthcare/medtech and public-sector victims. Active names include ShinyHunters, Qilin, Clop and Rhysida, with high-profile hits on Boston Scientific, Manchester Airports Group and the Berlin city government.
Do this now: For your next authorized test, emulate the exfiltrate-then-extort flow: can you move large volumes of data out before anyone notices?
AI agents can do credential reuse too
In a reported capture-the-flag evaluation, an AI model guessed passwords and reused credentials found in public repositories to reach real company systems. Leaked secrets are now cheaper than ever to exploit.
Do this now: Add secret scanning of your public repos and paste sites to every engagement scope. Assume anything leaked will be tried.
Plugin4Shell: the developer toolchain is attack surface
A reported plugin-installation flaw affecting several AI coding tools let pinned plugins be swapped for malicious code without prompting the user.
Do this now: When scoping a test, include developer workstations and their AI/IDE extensions, not just servers.