[EMEA] Group-IB researchers documented a Linux cryptomining campaign that abused trusted administrative access, altered Pluggable Authentication Modules and deployed a self-unlinking XMRig implant to conceal activity across compromised hosts. Examiners should preserve authentication configuration, process memory, shell history, deleted-file metadata and package changes before remediation, because the reported anti-forensic techniques were intended to disrupt timeline reconstruction and obscure both persistence and the original access path (Source: Group-IB, 30-07-2026).

[AMER] Analog Devices told US regulators that unauthorised actors accessed company systems and removed files, while operations continued and external specialists and law enforcement supported the investigation. The filing leaves the affected repositories and information categories under assessment, requiring investigators to correlate identity, endpoint, cloud-storage and transfer records while separating this intrusion from a second cybersecurity matter that the company said was not believed to be connected (Source: US Securities and Exchange Commission, 27-07-2026).

[AMER] State and federal investigators examined coordinated intrusions affecting more than 30 Minnesota community water systems, where automated controls were disrupted but water quality and safety were reported as unaffected. Reporting showed differing levels of confidence over Iranian involvement, so attribution remains unconfirmed and should depend on preserved controller configurations, remote-access logs, malware samples, network flows and common infrastructure rather than resemblance to earlier activity alone (Source: Associated Press, 31-07-2026).

[EMEA] UK authorities investigated unauthorised access to Department for Education and Police National Legal Database systems, with the education department confirming exposure of approximately 607,000 records rather than 607,000 distinct people. Available reporting broadly corroborated the record count but repeated official and criminal-group claims about scope, making service-desk logs, application audit trails, administrator activity and verified data samples essential for establishing which records were accessed, copied or merely enumerated (Source: The Guardian, 29-07-2026).

[APAC] Townsville Christian College disclosed that an attacker obtained remote administrative access, encrypted systems and may have viewed personal, health and financial information, although its investigation found no evidence of bulk data removal. The school’s statement therefore supports confirmed encryption and potential exposure, not confirmed mass exfiltration, and investigators must distinguish opened, staged and transferred files through remote-access records, endpoint artefacts, file metadata and external monitoring (Source: Townsville Bulletin, 31-07-2026).

[EMEA] Angola’s largest telecommunications operator, Unitel, reported that a cyberattack disrupted voice, mobile-data and internet services nationwide shortly before its planned stock-market debut, with restoration work continuing across the network. Public reporting confirmed substantial service disruption but did not establish the attacker or intrusion method, so investigators need signalling, identity, network-management and supplier telemetry to reconstruct entry, lateral movement and the relationship between technical failures and customer-facing outages (Source: The Record, 29-07-2026).

[AMER] Cisco disclosed active exploitation of CVE-2026-20316, a static-credential weakness in Secure Firewall Management Center that could permit unauthorised access as a low-privileged built-in user. Because exploitation affects a security-management platform, defenders should preserve authentication logs, API activity, configuration revisions and managed-device audit records before applying updates, then examine whether the initial account was used to alter policies, access sensitive data or establish persistence elsewhere (Source: Cisco, 29-07-2026).

[APAC] Amazon attributed compromises of four JavaScript packages in the npm ecosystem to the North Korea-linked Sapphire Sleet group, describing a developer-focused open-source supply-chain operation. The attribution is Amazon’s assessment rather than an independently established fact, and investigators should preserve package publication histories, maintainer-account access, build provenance, dependency lockfiles and downstream installation records to determine when malicious versions entered software pipelines and which environments actually executed them (Source: Amazon Web Services, 29-07-2026).

[APAC] Singapore Police arrested two Malaysian men after Cyber Command investigators linked them to government-official impersonation scams involving the collection of cash and valuables from victims. The investigation illustrates how digital communications, victim-device records, payment instructions, border movements and physical handovers must be correlated to identify operational roles, while preserving provenance between platform evidence, financial intelligence, surveillance material and exhibits recovered during arrest (Source: Singapore Police Force, 30-07-2026).

[AMER] US prosecutors charged an Oregon corrections officer with cyberstalking after alleging that he created false social-media profiles and used them to publish degrading claims about a former partner. Investigators in cases of this kind must preserve account-registration data, login histories, device artefacts, platform returns and content chronology, linking online identities to a person without relying solely on profile names or screenshots whose origin and completeness cannot be independently demonstrated (Source: US Department of Justice, 30-07-2026).

[AMER] The US Federal Trade Commission, Utah and California sued Hims & Hers, alleging that sensitive health information was shared with advertising platforms despite privacy assurances and that subscription practices were misleading. The allegations place technical evidence at the centre of regulatory scrutiny, requiring auditable consent records, tag-management configurations, server-side event logs and documented data flows to show what information was transmitted, to whom and under which user state (Source: Federal Trade Commission, 29-07-2026).

[AMER] Canada’s Cyber Centre issued an advisory covering newly corrected PHP vulnerabilities and urged administrators to review affected versions and apply available updates. Although the notice did not claim exploitation, organisations should retain version inventories, deployment histories, web-server logs and application traces so that later discovery of abuse can be scoped against the precise period of exposure rather than inferred from current patch status alone (Source: Canadian Centre for Cyber Security, 30-07-2026).