Latest cybersecurity reporting from selected sources.

Also, Russian Signal Phishing, Iran-Linked Malware, Breaches in Spain and FranceThis week, Tycoon 2FA, Trio-Tech, messaging app spying and a ransomware broker sentenced. Iran-linked hackers. Mazda disclosed a breach. Oracle patched a flaw. North Korean actors weaponized VS Code, a Spanish port ransomware attack, a French teacher data breach and a healthcare firm victim surge.

Also: CISA Protocol Concerns, AI Agents Push Past Cybersecurity ControlsIn this week's panel, four ISMG editors unpacked the cyber dimensions of the Stryker attack amid the escalating Iran-Israel-U.S. tensions, the growing controversy around CISA leadership and alleged protocol breaches, and a new set of concerns related to AI agents bypassing security controls.

Medical Device Manufacturer Hack Was Likely OpportunisticAn Iranian cyberattack on medical device maker Stryker's internal IT environment does not appear to affect connected products used by the company's healthcare clients. But an outage of Stryker's electronic ordering system could lead to supply chain issues for its customers.

Healthcare Hit Shows Symbols Matter as Iran Shifts Focus to Economic DamageCybersecurity experts say that the Handala "hacktivist" group that claimed credit for attacks against two American firms on Wednesday is run by the Iranian government. The shift to destructive cyberattacks parallels Iran's attempt to inflict greater economic damage on the United States and allies.

Experts Warn of DDoS, Ransomware, Proxy And Other Attacks on Health SectorThe escalating conflict emerging from the U.S. and Israel military strikes this weekend on Iran, which killed the country's top leadership and crippled its internet connectivity, could erupt into cyberattacks against the healthcare sector by Iranian sympathizers and proxies, experts warn.

Geopolitical Conflict Involving Iran, Israel, US Ripe for Attacks on SectorGovernment authorities are warning of increased risk of Iranian cyber and related threats against healthcare and public health sector organizations - including ransomware, distributed denial-of-service and other attacks related to that nation's escalated conflicts with Israel and the U.S.

Cybersecurity and intelligence agencies from Australia, Canada, and the U.S. have warned about a year-long campaign undertaken by Iranian cyber actors to infiltrate critical infrastructure organizations via brute-force attacks

The ongoing campaign targets multiple critical infrastructure sectors, including healthcare, government, information technology, engineering, and energy

An Iran-based hacking group known as Pioneer Kitten is breaching defense, education, finance, and healthcare organizations across the United States and working with affiliates of several ransomware operations to extort the victims. [...]

The prolific APT repeatedly compromised targets in healthcare, manufacturing, and government with new lightweight downloaders that blend into network traffic for evasion.

The Iranian threat actor known as Charming Kiten has been linked to a new wave of attacks targeting different entities in Brazil, Israel, and the U.A.E. using a previously undocumented backdoor named Sponsor

If you get email from 'Samantha Wolf', congrats: you're important enough to make a decent target An Iranian cyber espionage gang with ties to the Islamic Revolutionary Guard Corps has learned new methods and phishing techniques, and aimed them at a wider set of targets – including politicians, government officials, critical infrastructure and medical researchers – according to email security vendor Proofpoint.…

A suspected Iranian threat activity cluster has been linked to attacks aimed at Israeli shipping, government, energy, and healthcare organizations as part of an espionage-focused campaign that commenced in late 2020

A suspected Iranian threat actor known as UNC3890 is gathering intel that could be used for kinetic strikes against global shipping targets.