Over the past 48 hours, responders tracked UK warnings on Russia-aligned DDoS activity, Ingram Micro’s disclosure affecting 42,000 people, and a brief hijack of Iranian state television feeds. Investigations detailed LinkedIn-delivered malware and Gemini prompt injection, while policymakers advanced EU cybersecurity reforms, new UK fraud reporting, and Singapore issued fresh vulnerability advisories impacting cloud deployments, broadcast resilience, and response planning.

Ransomware disrupted Sweden’s municipal IT and Pennsylvania’s Attorney General’s office, while attackers abused Velociraptor and VS Code tunnels for stealthy access. New threats include WhatsApp zero-click exploits, TamperedChef malvertising, Brokewell Android malware, and ScarCruft’s RokRAT espionage. Indian police dismantled trafficking-to-scam pipelines and online fraud rings, underscoring cybercrime’s human dimension alongside technical threats.

Salesforce OAuth token abuse, cloud-native ransomware, and NetScaler zero-day exploitation dominated the last 48 hours. Investigators tracked PRC router persistence, PlugX delivery, and major breaches at TransUnion and Nevada state services. Policy and law enforcement actions tightened around DPRK fraud and PRC laundering networks, while NIST issued new IoT behavior and control updates.

A 48-hour sweep of cyber developments highlights urgent Citrix NetScaler and Docker zero-days, ransomware hitting Nevada state services and Nissan’s design unit, and fresh AI threat vectors. DFIR teams gain new IR guidance, while ENISA takes charge of the EU Cyber Reserve. Cross-sector vigilance remains essential amid escalating threats.