DFM’s latest 48-hour roundup covers ransomware recovery updates, major platform breaches, and active exploitation alerts, alongside fraud investigations and law enforcement crackdowns. Policy signals include UK resilience legislation progress and rising phishing of public officials, while NIST advances AI-era security profiles. The edition also tracks consumer app exposure risks and third-party telemetry weaknesses shaping incident response.

Ransomware disrupted Sweden’s municipal IT and Pennsylvania’s Attorney General’s office, while attackers abused Velociraptor and VS Code tunnels for stealthy access. New threats include WhatsApp zero-click exploits, TamperedChef malvertising, Brokewell Android malware, and ScarCruft’s RokRAT espionage. Indian police dismantled trafficking-to-scam pipelines and online fraud rings, underscoring cybercrime’s human dimension alongside technical threats.

Salesforce OAuth token abuse, cloud-native ransomware, and NetScaler zero-day exploitation dominated the last 48 hours. Investigators tracked PRC router persistence, PlugX delivery, and major breaches at TransUnion and Nevada state services. Policy and law enforcement actions tightened around DPRK fraud and PRC laundering networks, while NIST issued new IoT behavior and control updates.

A 48-hour sweep of cyber developments highlights urgent Citrix NetScaler and Docker zero-days, ransomware hitting Nevada state services and Nissan’s design unit, and fresh AI threat vectors. DFIR teams gain new IR guidance, while ENISA takes charge of the EU Cyber Reserve. Cross-sector vigilance remains essential amid escalating threats.