Attackers Aren’t Slowing Down. |
Credential abuse, AI at scale, ransomware in the supply chain, legacy protocol gaps, and even a chatbot selling a coin that doesn’t exist are shaping this week’s threat landscape.
Read past newsletters here. |
|
|
Here’s what you need to know: |
|
|
Stolen Credentials Expose 1.2M French Bank Accounts |
Stolen civil servant credentials enabled unauthorized access to France’s national bank registry, exposing data tied to about 1.2 million accounts. Operated by the French tax authority, FICOBA does not store balances but links individuals to bank accounts, including IBANs, names, addresses, and sometimes tax IDs. |
The investigation into the incident is ongoing.
Adopt phishing-resistant MFA, strict least-privilege access, behavioral monitoring, and tested credential-compromise response plans to quickly detect, contain, and limit the impact of stolen credentials. |
AWS Finds AI-Powered Threat Actor Hits 600+ FortiGate Devices |
AWS Threat Intelligence found a financially motivated actor used commercial generative AI tools to compromise more than 600 FortiGate devices across 55 countries.
The campaign scanned for exposed management ports and exploited weak, single-factor credentials, then downloaded configuration files with VPN credentials, admin passwords, and network data to enable lateral movement, including AD reconnaissance and DCSync attacks. Backup systems like Veeam were also targeted, highlighting how AI enables unsophisticated actors to scale basic tradecraft.
Remove public access to management interfaces, enforce MFA and strong credential hygiene, segment and monitor critical systems, and regularly test incident response plans to contain AI-scaled credential abuse before it spreads.
|
Semiconductor Supplier Advantest Hit by Suspected Ransomware Attack |
A key global semiconductor supplier disclosed a suspected ransomware attack after detecting unusual network activity on February 15.
Advantest, which employs about 7,600 people and generates more than $5 billion annually, said an unauthorized party may have accessed parts of its network and deployed ransomware, potentially affecting customer or employee data. The investigation into the attack is ongoing.
Isolate infected systems, enforce MFA and least-privilege access, harden AD, deploy behavioral EDR, secure remote access, and maintain tested immutable backups to contain ransomware and ensure swift recovery.
|
|
|
If attackers hit with ransomware today, what happens? |
|
|
Yesterday's Pulse Check Results |
If sensitive data started leaking right now… |
|
|
Security Tools You Can Use |
|
|
Apache Flags Tomcat Access Control Flaw |
Apache disclosed a low-severity vulnerability that allows access control bypass in Tomcat under specific configurations involving legacy HTTP/0.9 requests.
The flaw affects Tomcat 9.x, 10.1.x, and 11.x and allows access to restricted content in specific configurations due to improper handling of malformed HEAD requests, though it does not enable authentication bypass or remote code execution. |
A patch has been released for the issue.
Patch to the latest version, validate security constraints, block legacy HTTP/0.9 at the edge, enforce method allowlisting, and monitor for anomalous request patterns to prevent access control bypass. |
Fake Gemini Bot Pushes Google Coin Scam |
Researchers uncovered a fake Google Coin presale site using a counterfeit Gemini AI chatbot to pressure users into sending cryptocurrency. The bot mimicked Google branding and promised 7x returns despite there being no official cryptocurrency.
This campaign reflects a broader surge in AI-driven impersonation scams, with $17 billion lost to crypto fraud in 2025 and impersonation tactics up 1,400% year over year. Block and monitor lookalike crypto domains, and train users to verify token launches through official corporate channels — not chatbot claims or presale countdowns. |
|
|
How Resilient Is Your Organization to Ransomware? |
Ransomware attacks continue to disrupt organizations of every size, with attackers targeting backups, exploiting stolen credentials, and moving laterally at speed. As AI accelerates and scales attack campaigns, strong foundational security controls are more critical than ever to reduce operational disruption and financial loss. |
How to strengthen your ransomware defenses: |
- Implement layered ransomware protection with immutable backups, network segmentation, and least-privilege access controls to limit spread and ensure clean recovery points.
-
Enforce phishing-resistant MFA and deploy EDR plus ransomware protection and removal tools to detect, block, and contain encryption activity early.
- Regularly test incident response plans through tabletop exercises to validate rapid containment, eradication, and full operational recovery.
|
Ransomware resilience depends on layered defenses that strengthen access controls, secure backups, and regularly test response plans to reduce downtime and improve recovery outcomes. |
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
