This DFM 48h News Roundup covers AI-driven ransomware, browser data leakage, OAuth abuse, Mustang Panda activity, ransomware claims, SharePoint exploitation, Scattered Spider extradition, Japanese cybercrime enforcement, and policy developments from NIST and the European Parliament. The focus is digital investigations, evidential readiness, cross-platform artefacts, and the operational challenge of proving what happened.

Investigators tracked ShinyHunters-linked franchise data theft affecting 7-Eleven systems while French authorities expanded BreachForums attribution efforts. Telecom espionage activity using the Showboat Linux backdoor targeted Central Asian providers, and Europol dismantled the criminal First VPN service. Microsoft addressed actively exploited Defender vulnerabilities as NIST advanced manufacturing recovery guidance and software supply-chain assurance discussions for public and private sector investigators globally.

Investigators tracked deepfake risks in UK councils, cloud-based exfiltration through Cloudflare endpoints, and alleged cyber-slavery recruitment tied to Cambodian scam compounds. GitHub confirmed repository exposure after a poisoned package compromise, while NIST advanced software provenance guidance and UK authorities expanded financial tracing against livestreamed child exploitation networks. Education-sector breach claims and AI-driven vulnerability research further shaped this reporting cycle globally.

Investigators examined ShinyHunters activity affecting Canvas education platforms, UK police charged suspects linked to a cryptocurrency fraud scheme, and researchers warned that Dirty Frag Linux vulnerabilities may already be exploited INTERPOL coordinated pharmaceutical marketplace seizures across 90 jurisdictions while US prosecutors secured sentences in a DPRK remote IT worker case Australia’s ACSC also warned of active cPanel and WHM exploitation.

Investigations this cycle examined exposed military training records, a trojanised DAEMON Tools software supply-chain compromise, and exploitation targeting PAN-OS captive portals. Authorities also detailed North Korean remote IT worker fraud operations and database deletion offences, while Queensland schools assessed fallout from stolen student records linked to the QLearn environment. NIST additionally updated guidance covering positioning, navigation and timing cybersecurity risks.