This DFM 48h News Roundup covers AI-driven ransomware, browser data leakage, OAuth abuse, Mustang Panda activity, ransomware claims, SharePoint exploitation, Scattered Spider extradition, Japanese cybercrime enforcement, and policy developments from NIST and the European Parliament. The focus is digital investigations, evidential readiness, cross-platform artefacts, and the operational challenge of proving what happened.

University data breaches, long-term espionage activity, banking disruptions, critical enterprise vulnerabilities and major law-enforcement operations feature in this 48-hour roundup. Coverage includes the Nottingham University breach, PeopleSoft zero-day exploitation, cyberattacks affecting Iranian banks, active Splunk and Ivanti security risks, FBI-led disruption of phishing infrastructure, and new policy measures aimed at accelerating cyber resilience and evidence preservation.

Canvas breach investigations affecting universities, ransomware disruption at West Pharmaceutical and Foxconn, active exploitation of a critical cPanel vulnerability, and Europol’s latest cybercrime assessment headline this 48-hour roundup. Coverage also examines AI-assisted exploitation, leaked ransomware operator data, industrial control system security advisories, and evolving policy guidance on cyber resilience and frontier artificial intelligence.

Ransomware at ChipSoft disrupted Dutch hospitals, while Signature Healthcare diverted ambulances after a cyberattack. UK authorities linked router hijacking to a Russian military unit, and Northern Ireland schools faced network outages. Treasury launched crypto threat sharing, the NCA froze $12 million in scam proceeds, and NIST advanced AI risk guidance for critical infrastructure operators amid rising supplier and mobile exposure.

CISA, FBI and NSA warned that Iranian-linked actors are targeting internet-connected PLCs in U.S. critical infrastructure, while a Massachusetts hospital diverted ambulances after a cyberattack. Investigators tracked cloud data theft to abused authentication tokens after a SaaS integrator breach, and the DOJ disrupted a GRU-linked DNS hijacking botnet as NIST advanced an AI risk profile for critical infrastructure operators broadly.