This week’s cybersecurity news cycle brought a mix of government breaches, vendor policy shifts, and law enforcement actions against ransomware and cybercrime operators.

DHS network breached

An unidentified threat actor compromised the Homeland Security Information Network (HSIN), a sensitive but unclassified system used by federal, state, and private-sector partners for interagency communication. A damage assessment from the DHS Office of Intelligence and Analysis found that attackers targeted servers and SharePoint infrastructure. The department isolated the affected network and launched a forensic investigation, but says there is no evidence classified networks were impacted.

Adobe accelerates patch cadence

Adobe announced it will now publish security bulletins and critical patch disclosures twice a month, on the second and fourth Tuesdays, citing adversaries’ growing use of AI to rapidly discover vulnerabilities. The change is intended to shrink the window attackers have between public disclosure and active exploitation.

Canada disrupts ransomware and criminal networks

Canada’s Communications Security Establishment (CSE) disclosed it actively hacked into the infrastructure of ransomware operations, drug trafficking networks, and extremist organizations over the past year under its foreign cyber operations mandate. CSE said the effort disrupted command-and-control infrastructure and degraded the technical capabilities of the targeted criminal syndicates.

Ransomware affiliate pleads guilty

Karen Serobovich Vardanyan, a 34-year-old Armenian national extradited to the US last year, pleaded guilty to conspiracy and computer fraud charges tied to Ryuk ransomware attacks. Prosecutors say Vardanyan and his accomplices collected more than $15 million in ransom payments; he has agreed to pay $1.1 million in restitution.

New malware and threat actor activity

  • QuimaRAT v2.0: a subscription-based remote access trojan advertised on dark web forums, supporting Windows, macOS, and Linux with fileless payload execution and lifetime access priced at $1,200.
  • TeamPCP: the FBI warned this cybercrime group trojanized development tools including Trivy, KICS, LiteLLM, and the Telnyx Python SDK to deploy credential-harvesting implants and run extortion campaigns using stolen cloud tokens and Kubernetes secrets.
  • IRIS C2: an investigation identified this purported offensive security firm as a front tied to Jacob Wohl and Jack Burkman, offering phone-hacking services without evident government contracts.

Other notable developments

AssuranceAmerica disclosed a breach affecting nearly 7 million people, exposing names, contact information, and driver’s license numbers. A researcher disclosed a since-patched sandbox escape vulnerability dubbed WriteOut in Writer AI that allowed cross-tenant data access. The NSA revived its Tailored Access Operations (TAO) branding for its network exploitation unit. Abnormal AI publicly rejected a trademark infringement lawsuit filed by Anthropic.