This edition examines digital evidence triage, suspected espionage at NATO headquarters, exposed cloud databases, ransomware claims, software supply-chain controls, Windchill exploitation, deepfake-enabled stalking, organised digital-arrest fraud and expanded AI analysis of criminal records. The investigative focus is on preservation, provenance, attribution, timeline reconstruction and the need to distinguish verified evidence from uncorroborated claims across jurisdictions and platforms during complex investigations.

Investigators tracked ShinyHunters-linked franchise data theft affecting 7-Eleven systems while French authorities expanded BreachForums attribution efforts. Telecom espionage activity using the Showboat Linux backdoor targeted Central Asian providers, and Europol dismantled the criminal First VPN service. Microsoft addressed actively exploited Defender vulnerabilities as NIST advanced manufacturing recovery guidance and software supply-chain assurance discussions for public and private sector investigators globally.

Investigators tracked deepfake risks in UK councils, cloud-based exfiltration through Cloudflare endpoints, and alleged cyber-slavery recruitment tied to Cambodian scam compounds. GitHub confirmed repository exposure after a poisoned package compromise, while NIST advanced software provenance guidance and UK authorities expanded financial tracing against livestreamed child exploitation networks. Education-sector breach claims and AI-driven vulnerability research further shaped this reporting cycle globally.