---

📋 EXECUTIVE SUMMARY

---

📊 METRICS & INTELLIGENCE

Metric	This Week	What It Means
Total Disclosed Victims	103	Fifth straight week between 97 and 107 — sustained tempo, not a spike
Active Threat Actors	27	Steady, but one actor now claims more than a third of all activity
Akira's Share	37 (36%)	Largest single-actor concentration since The Gentlemen's April 6 surge
US-Based Victims	52 (50.5%)	Above half for the second straight week
Healthcare Hits	12	Fifth consecutive elevated week — see trendline below
Legal Sector Hits	18	Highest legal count since the April 20 surge

Germany (7), UK (6), Canada (5), and Spain (4) followed the US, with the remainder spread across 20+ countries.

---

🚨 ACTIVE CAMPAIGNS

What it does: Google Ads showing claude.ai as the destination URL lead instead to attacker-controlled pages with step-by-step instructions to install macOS malware. In parallel, a fake "OpenAI Privacy Filter" repository reached Hugging Face's trending list, distributing a Windows infostealer (malware that harvests saved passwords, browser cookies, and session tokens) to anyone who cloned it.

Why it matters: Credential theft and browser-session hijacking are the immediate payoff; ransomware staging is the downstream risk. One infected employee equals access to email, cloud storage, and any internal systems that share that login.

Source: BleepingComputer (Claude), BleepingComputer (Hugging Face)

What it does: Attackers replaced the legitimate installers on jdownloader.org with trojanized versions carrying a Python-based RAT (remote access trojan — software that gives the attacker full keyboard-and-mouse control of an infected computer). Users who downloaded the popular file-management tool over the compromise window received malware delivered through the vendor's own site.

Why it matters: This is the nightmare scenario for any organization that lets employees install their own software. Full remote access typically chains into file theft, keylogging, credential harvesting, and ransomware deployment. If you don't control software installation, you can't control this risk.

Source: BleepingComputer

What happened: ShinyHunters — the group behind the Snowflake/Anodot supply-chain breach we covered April 13, the ADT and Udemy vishing breaches from April 27, and the Instructure/Canvas claim from May 4 — listed education publisher Houghton Mifflin Harcourt on its leak site May 9 with a May 12 deadline. A separate ShinyHunters post on May 8 referenced an unspecified "global incident" without naming a victim; the context is unclear and the claim is not independently verified.

Why it matters: The pattern is now the news. ShinyHunters has appeared in four of our last five issues, each time with a different victim and a different attack chain — third-party SaaS abuse, vishing-to-SSO, large-scale ed-tech theft, and now education publishing. The group is operating as a steady disclosure engine, not running a single campaign. If you license content, training materials, or any data from HMH, treat employee email addresses tied to those accounts as exposed and rotate any application keys you provisioned.

Source: RansomLook.io, Ransomware.live (May 8–9 listings)

---

✅ JUST DO THIS

Why now: The Claude AI malvertising campaign is running this week, and the same playbook covers JDownloader and the Hugging Face repo. All three rely on an employee Googling for software and clicking the first ad-marked result. Removing that one click — by policy, by training, or by browser configuration — breaks all three attacks at step one, before any malware lands on disk.

Platform	Steps
Microsoft 365	Microsoft Defender for Endpoint → Settings → Web content filtering → block the "Ads" category. Or push Edge policy AdsSettingForIntrusiveAdsSites = 2 via Intune.
Google Workspace	Admin Console → Chrome Enterprise → Policies → set AdsSettingForIntrusiveAdsSites to Block. Roll out to the organizational unit that includes general staff.
Other / no MDM (mobile device management)	Send one message to all staff this week: "When downloading software, type the vendor URL directly. Never click sponsored or ad-marked results, and never run a 'how-to-install' page from a search ad." Five minutes, zero cost.

Verify it worked: Search "Claude download" in Chrome or Edge on a managed machine. Sponsored results should either be absent or display a warning before the click resolves.

---

🎯 THREAT ACTOR SPOTLIGHT

Why this group, this week: Qilin held or shared the volume lead in every issue from April 13 through May 4 — that streak broke this week. Akira posted more than triple any other actor and concentrated its activity on the businesses least likely to have a dedicated IT or security function: law firms, small medical and dental practices, industrial suppliers, and regional retailers.

Target profile: SMB-heavy. Twenty-nine of Akira's 37 victims this week were US-based, with smaller clusters across Germany, Canada, Italy, and Spain. Total claimed exfiltration exceeds 1,200 GB, with a single 260 GB claim against a California CPA firm and a 90 GB claim against a Canadian dental practice.

What's distinctive: Akira's posts itemize the stolen data type by name — court files, police reports, client Social Security numbers, death certificates, passport scans, patient records. The victim sees in plain text exactly what was taken before any negotiation begins.

Known TTPs — tactics, techniques, and procedures (plain English):

• Initial access via VPN credential compromise, particularly Cisco VPN endpoints that don't enforce multi-factor authentication (MFA — requiring a second verification step beyond the password).
• Lateral movement on valid credentials, using Active Directory enumeration (the attacker maps who has permission to do what across the network before escalating).
• Double extortion: encrypts files locally and threatens to publish the exfiltrated data on the leak site if the ransom isn't paid.

Defensive Priorities:

#	Action	Plain English
1	Enforce MFA on every VPN and remote-access account	No password-only logins, especially on Cisco VPN, RDP, or any browser-based remote desktop tool
2	Audit domain admin accounts	Check who has "keys to everything" and remove anyone who doesn't need it
3	Segment backup infrastructure	Keep backups on a system that's not reachable from your main network — and test restoring this quarter

---

🏭 SECTOR TARGETING

Legal & Professional Services — 18 victims 🏪

Threat actors: Akira (7), Qilin (3), Inc Ransom (3), Genesis (2), Pear (1), plus two smaller crews.

Notable incidents: Lindabury, Lopez Law (Florida), Prescott & Holden, Elia Law Firm, Newman & Marquez, Law Offices of James C. Shields, Langenberg Strubberg Arand & King (accounting).

Data exposed: Court files, client SSNs, police reports, death certificates, NDAs, accounting records. Akira's posts call out these document types by name across multiple victims, signaling deliberate extortion pressure.

Healthcare — 12 victims 🏪

Threat actors: Akira (5), Genesis (2), Sinobi (1), Everest (1), plus three smaller crews.

Notable incidents: CarePoint Health (US), The American Board of Preventive Medicine (US), Neurotrials Research (US), Greenwoods Dental Centre (Canada, 90 GB claimed by Akira), Réseau Radiologique Romand (Switzerland), Accent Dental Center (US), MN Health Insurance Network (US), Rehab Clinics Group (UK).

Data exposed: Patient PII, medical records, payment details, insurance information.

Manufacturing / Industrial — 11 victims 🏭

Threat actors: Akira (2), Qilin (2), The Gentlemen (2), Ailock (1), Lynx (1), plus three others.

Notable incidents: Accretech America (precision equipment), CSB Energy Technology (batteries), KUPER (woodworking machinery), Zojirushi (appliances), Turbo International.

Construction — 9 victims 🏢

Threat actors: Qilin (3), Akira (2), DragonForce (1), Leak Bazaar (1), plus two others.

Notable incidents: CF Evans Construction, DL Cohen Construction, Wayne Brothers, CCD Interiors, R L Larson Excavating.

---

🏪 SMB REALITY CHECK

If you're under 50 employees with no dedicated IT staff, here's what actually matters this week:

The AI-tool malvertising wave is your biggest risk this week, not because you are specifically targeted but because your employees Google software downloads exactly like everyone else does. Three separate campaigns in seven days — Claude AI, Hugging Face, JDownloader — all rely on the same click. One in-person or Slack message to the team telling them to type vendor URLs directly and skip the ads is free, takes five minutes, and breaks all three.

If you run a law firm, a medical or dental practice, or any business that holds sensitive third-party records, this week's data puts your sector center-stage. The Akira posts make it clear: a small firm with the right data is worth a dedicated campaign. The callback rule from our April 27 issue — verify every credential or MFA reset by calling the employee back at the number HR has on file — still applies and costs nothing. If you didn't put it in place then, this is the week.

Your Stack, Your Actions:

If You Use...	Do This	Time
Any cloud email (Microsoft 365 / Google Workspace)	One message to staff: type vendor URLs for software; never click sponsored search results	5 min
Cisco VPN or any password-only remote access	Turn on MFA for every VPN account — the single most reliable defense against Akira's playbook	30–60 min
Any business with a help desk or IT vendor	Confirm the callback rule from our April 27 issue is in writing and known to staff	15 min

Safe to ignore this week: the NVIDIA GeForce NOW breach (Armenian users only, no SMB action), the RansomHouse listing of Trellix (a new claim about a vendor whose source-code incident we covered May 4; unverified follow-up), and the TDS Telecommunications listing (enterprise telecom; not SMB-actionable).

---

🔮 LOOKING AHEAD

Social Engineering Moves Off the Browser

Huntress documented a new technique this month — branded internally as "BackgroundFix" — where malware changes the victim's desktop wallpaper to display fake instructions that walk the user into running attacker-supplied commands. It's an evolution of the ClickFix pattern that hit through fake browser pop-ups last year, with one difference: a desktop background looks like part of the operating system, not a webpage, so the social-engineering prompt now lives somewhere the user implicitly trusts.

What to watch: Help-desk tickets about "strange instructions on my screen," unexpected wallpaper changes employees don't remember making, or any report of system-looking text asking the user to open a terminal or run a command. The earliest tell is usually the inconsistency — a user notices their wallpaper changed but doesn't remember changing it.

Bottom line: The "spot the typo" model of phishing training is finished. AI lures are clean, malvertising looks like the real vendor, and now social-engineering prompts live on the desktop itself. Update training to teach the behavioral signal — "your operating system will never ask you to run commands via your wallpaper, a browser pop-up, or a CAPTCHA" — not the surface cues that no longer exist.

---