CyrusOne, LLC. in the US reported a ransomware extortion claim by shinyhunters, stating they refused a $13 million demand and faced a 24-hour deadline. The attackers alleged theft of 12.9 million Salesforce records plus substantial SharePoint files and sensitive business, employee, and security documentation, warning of data leakage if demands were not met. #UnitedStates
Westwing Group SE in Germany was targeted by ransomware attributed to the coinbasecartel threat actor. The incident impacted operations in #Germany.
Genesis ransomware impacted Hospitality Health ER in Longview, United States, disrupting operations across a healthcare organization in the US. #UnitedStates
![Cybersecurity News | Daily Recap [22 Aug 2026]](https://www.hendryadrian.com/tweet/image/DailyRecap.png "Cybersecurity News | Daily Recap [22 Aug 2026]")
Daily Recap, this cycle highlighted multiple malware and defense-bypass threads, including trojanized npm packages dropping the RedC2 4.0 Linux backdoor and a Microsoft Teams campaign delivering SynkLoader, alongside research showing Microsoft Defender’s driver could be weaponized during boot to delete security components. It also covered cloud and privacy risks such as leaked AWS keys enabling full control of corporate accounts, encrypted AI prompts bypassing safety guardrails in Grok and Gemini, and major breach or policy updates affecting U.S. Bank, Apollo, and SickKids.
#RedC2 #RedC2_4_0 #SynkLoader #MicrosoftTeams #AWS #Grok #Gemini #U.S._Bank #Apollo #SickKids
Euroflora srl in Italy reported a ransomware incident attributed to the qilin threat actor, resulting in disruption of its operations. The impacted country(s) is #Italy
In the US, ADT.com, a security company providing home security systems, cameras, alarms, and home automation services, was claimed as a target by LockBit 5 ransomware. The attackers leveraged the incident to extort victims and disrupt operations, resulting in data and service impacts within the #UnitedStates
S.E.M.P. s.r.l. in IT was targeted by the qilin ransomware actor, resulting in disruption and potential encryption of files. The incident is reported to have impacted #Italy
Douglas County Sheriff’s Office was hit by a serious cyber incident that forced its online services offline and is now being described as suspicious activity. Officials are withholding details about possible data exposure and response costs, saying disclosure could jeopardize public safety and involve confidential records. #DouglasCountySheriff #DouglasCounty
The xpl0itrs cybercriminal group claims to have breached Gruppo Spaggiari Parma and stolen 6.1 TB of data from more than 3,000 schools in Italy. The alleged leak includes students’ and teachers’ personal, medical, identity, and contact information, highlighting the risks of centralized education platforms. #xpl0itrs #GruppoSpaggiariParma #Italy
Global Go in Peru reported a ransomware incident attributed to the killsec threat actor, resulting in disruption and suspected encryption of impacted systems. #Peru
ToxicPanda Android malware has evolved into a more capable threat, expanding its targeting to 349 apps and adding 167 remote commands while using VPN permissions to block Google Play traffic and install its payload. Zimperium says ToxicPanda 2.0 is spread via Amazon AWS-hosted buckets, abuses Accessibility Services and Wireless ADB for shell access, and uses overlays and fake screens to steal PINs and credentials across 16 countries. #ToxicPanda #Zimperium #GooglePlay #WirelessADB #AmazonAWS
Black Cat Engineering & Construction WLL, located in QA, was targeted by the Qilin ransomware group, which deployed malware to encrypt files and disrupt operations. The attack affected QA #Qatar
Difor in Chile was hit by ransomware attributed to the qilin threat actor, with the specific details of the claim remaining unspecified (N/A). The attackers’ activity impacted #Chile
Ransomware attributed to the qilin threat actor targeted Clear Align in the United States, resulting in disruption and demands for ransom. The incident involved encrypted systems and data access impact on affected operations in the US. #UnitedStates
Brazil-based Mobilemed, which provides a cloud-based PACS platform for radiologists and diagnostic imaging centers, was impacted by ransomware activity attributed to the kazu threat actor. #Brazil