---

📋 EXECUTIVE SUMMARY

---

📊 METRICS & INTELLIGENCE

Metric	This Week	What It Means
Total Disclosed Victims	97	Fourth straight week at this volume - a new normal, not a spike
ADT Records Exposed	5.5M (HIBP-verified)	Names, addresses, phone numbers; partial DOB/SSN in subset; ShinyHunters claims 10M+
Top Actor Share (Qilin)	26.8%	Sharpest single-actor dominance since The Gentlemen's April 6 surge
Healthcare Hits	9 (3rd elevated week)	Sector-wide pattern across six different actors - not one campaign
Manufacturing Hits	12	Steady targeting; supply-chain documents still the prize

US-based organizations accounted for 22 victims (22.7%); the remainder spread across 31+ countries, including Pakistan, Ghana, Serbia, Peru, Indonesia, Saudi Arabia, and Egypt.

---

🚨 ACTIVE CAMPAIGNS

What it does: An attacker calls an employee posing as IT support, walks them through a "verification" prompt, and captures their single sign-on (SSO) credentials - the master login that controls access to all of a user's connected business apps. ADT confirmed the entry point was an Okta SSO account; the attackers then pivoted into Salesforce and exfiltrated customer and corporate records. ADT detected the breach on April 20 and revoked access, but data was already gone. Udemy's leak (April 26) followed the same chain and includes names, addresses, phone numbers, and instructor payment details.

Why it matters: No malware, no software exploit. Every defensive tool you've bought - firewall, endpoint protection, MFA - gets bypassed by an employee who believes they're talking to IT. ADT explicitly confirmed customer security systems were NOT compromised, but the personal data exposure creates compound risk: attackers now know who has alarm systems, where they live, and how to reach them. If your business uses any cloud platform with employee logins (Salesforce, HubSpot, QuickBooks Online, Shopify), the attack chain works the same way.

Source: BleepingComputer (ADT, 5.5M), Have I Been Pwned (Udemy)

What it does: A previously unknown threat actor calling itself kittykatkrew compromised a public-facing web portal at the Arkansas State Crime Laboratory and dumped its contents. The leak includes active court case calendars with defendant names, the personnel directory of prosecutors and police officials, and contact information for forensic analysts. The specific entry vulnerability has not been disclosed publicly.

Why it matters: This is not a ransomware operation aiming for a payday - it's a data dump, full stop. The leaked data creates risk of witness intimidation, case tampering, and targeted social engineering against the named law enforcement personnel. For private-sector readers, the broader signal is the more important one: any organization with a public-facing portal that holds sensitive third-party data - law firms with client portals, medical practices with patient portals, accounting firms with tax document portals - has the same exposure. The attackers don't need ransomware leverage when the data alone is the prize.

Source: Dark Web Informer

What it does: Check Point researchers traced a Gentlemen ransomware attack back to a SystemBC proxy malware botnet - more than 1,570 corporate machines acting as relay points so attackers can route their traffic through trusted IPs and avoid geographic blocking. Once inside a victim, affiliates operate from a domain controller (the server that controls who can log into your entire network) with admin privileges and use Cobalt Strike alongside the proxy network for stealthy lateral movement.

Why it matters: Most SMBs detect intrusions by looking for traffic from suspicious foreign IPs. SystemBC defeats that - the attacker's traffic appears to come from a legitimate corporate machine somewhere else. Most affected hosts are in the US, UK, Germany, Australia, and Romania. If your firewall logs show outbound connections from any internal machine on unusual ports (especially 4001, 4002, 8080), investigate.

Source: BleepingComputer / Check Point Research

---

✅ JUST DO THIS

Why now: The ShinyHunters playbook works because no callback verification exists. The attacker calls IT pretending to be an employee or calls an employee pretending to be IT - and the request gets honored. A callback rule breaks the chain at step one. ADT, Udemy, and dozens of other ShinyHunters victims would have stopped this attack with one phone call to a number the attacker doesn't control.

Step	How
1. Write the rule	Any password reset, MFA reset, SSO unlock, or remote-access request gets verified by hanging up and calling the employee back at the number stored in HR records. No exceptions for executives, no exceptions for "urgent."
2. Document the numbers	Pull employee phone numbers from HR into a list IT can reference. Update quarterly. Use only company-recorded numbers - never one provided in the request itself.
3. Add a verbal code phrase	Pick a phrase real IT will use when initiating contact (something like "blue coffee Tuesday"). Share it at an all-hands - never by email. No phrase, no remote access.
4. Test it	Within two weeks, run a friendly mock: have someone outside IT call requesting an MFA reset without the code phrase. The drill is the proof.

Verify it worked: If your team grants the mock request, retrain. If they refuse and call back, you're protected.

---

🎯 THREAT ACTOR SPOTLIGHT

Why this group, this week: Qilin claimed more victims (26 to Eraleign's 11), but Qilin already runs a familiar playbook - covered in detail two weeks ago. Eraleign is doing something different. Where Qilin and DragonForce fight over the US and Western Europe, Eraleign concentrates on places with thinner cybersecurity press coverage and weaker breach-disclosure laws: Saudi Arabia, Egypt, Peru, Mexico, Indonesia, Ghana, Serbia, Eastern Europe.

Target profile: Insurance carriers, healthcare networks, petroleum and energy operators, consumer goods distributors. Mid-market organizations in regions where local-language phishing has high success rates and victims have fewer options for recourse.

Known patterns (plain English):

• Local-language lures: Phishing emails arrive in fluent Arabic, Spanish, Portuguese, or Indonesian - often quoting real industry events or holidays. AI translation has erased the typo cues.
• Disclosure arbitrage: Victims in countries without mandatory breach reporting are slower to publicly acknowledge attacks, giving Eraleign more time to leverage stolen data before defenses adapt.
• Cross-region targeting: A single week's victim list spans four continents. The group rotates geographies faster than most defenders can build region-specific intel.

Defensive Priorities:

#	Action	Plain English
1	Multilingual phishing training	If you have offices or staff in non-English regions, run phishing drills in their working language
2	Geographic login alerting	Set Microsoft 365 or Google Workspace to flag logins from unexpected countries
3	Backup verification	Confirm offline backups exist and that someone has actually tested restoring this quarter

---

🏭 SECTOR TARGETING

Manufacturing - 12 victims 🏭

Threat actors: DragonForce, Qilin, The Gentlemen, Krybit

Notable incidents: Heinrich Kopp GmbH (Germany, electrical components), AOTCO Metal Finishing (US), Wm. Sopko & Sons (US), Longwood Engineering (US), Muller Technology (industrial machinery), TokyoHosoKogyo (Japan, construction), Cofaco Textiles (Peru), Narteks Tekstil (Turkey)

Data exposed: Production specifications, supplier contracts, proprietary designs

Healthcare - 9 victims 🏪 SMB PRIORITY

Threat actors: Eraleign (APT73), Qilin, INC Ransom, The Gentlemen, M3RX, Beast, Medusa

Notable incidents: Walman Optical (US, EssilorLuxottica subsidiary), Medika Plaza (Indonesia), Reddy Cardiology (US), Lessard Dental (Canada), Mid Florida Dermatology & Plastic Surgery (US), Dillon Family Medicine (US), Airdrie Physiotherapy (Canada)

Why the persistence: Six different actors hitting healthcare in one week - three weeks running. That's not coordination, it's consensus. Small practices have HIPAA exposure that creates payment pressure, plus often-outdated practice-management systems.

Professional Services - 8 victims 🏢

Threat actors: DragonForce, Brain Cipher, Qilin, Eraleign, INC Ransom

Notable incidents: Delon Hampton Engineering (US), Bridgeway Consulting (UK - attackers claim 500GB; not independently verified), Woodfields Consultants (architecture), J.G. Petrucci (US, real estate development), TLC Trial Team (US, legal)

Data exposed: Client files, NDAs, project documents, billing records

Education - 7 victims 🏢

Threat actors: The Gentlemen, Qilin

Notable incidents: Beaconhouse School System (Pakistan, attackers claim coverage of 380,000+ students across 8 countries - figure not independently verified), Colegio Notre Dame Campinas (Brazil), Istarpal (education sector)

---

🏪 SMB REALITY CHECK

If you're under 50 employees with no dedicated security staff, here's what actually matters this week:

Two attacks confirmed this week - ADT (5.5 million records) and Udemy (1.4 million) - and both started with a phone call. The action in "Just Do This" above (the callback rule plus a verbal code phrase) is the one piece of homework that matters. It costs nothing, takes thirty minutes to write down, and breaks the exact chain that brought down two large, well-resourced companies in the same week.

If you run a medical or dental practice, consider this your second consecutive notice. The targeting isn't slowing. Spend an hour this week confirming MFA is enforced on every system that touches patient data and that a recent backup actually restores.

Your Stack, Your Actions:

If You Use...	Do This	Time
Any SSO (Okta, Azure, Google)	Implement the callback rule and code phrase for all reset requests	30 min
Salesforce, HubSpot, or any CRM	Review session timeout - set to 4 hours or less, not "never"	10 min
ADT for physical security	Update access codes and authorized-contact info; brief staff on ADT-themed phishing	15 min
Udemy account (anyone on team)	Reset password; check Have I Been Pwned for the email; change anywhere the password was reused	5 min

Safe to ignore this week: The Arkansas crime lab breach unless you're a law firm, court vendor, or handle legal matters; the Beaconhouse School breach unless you have business in Pakistan or South Asian education; most of the international financial-sector hits.

---

🔮 LOOKING AHEAD

AI Agents Are the Next Identity to Secure

Microsoft began publishing guidance this month on securing Copilot Studio agents - a clear signal that organizations are deploying autonomous AI agents with access to business data. These agents authenticate, access resources, and take actions on behalf of users. They are, in security terms, a new category of identity. And like every other identity that touched corporate systems before them - service accounts, API keys, OAuth tokens - they will become a target.

What's changing: AI agents are moving from experimental to production across the SaaS stack. Your accounting software, CRM, helpdesk tool, and document management system are all racing to add "AI assistants" that authenticate, query data, and take actions. Each one is a credential you didn't have to manage six months ago.

What to watch: Vendors announcing "AI agent" or "AI assistant" features that connect to your data. Permission scopes that read "full access" instead of being narrowly scoped to specific tasks. Agents that retain credentials indefinitely rather than re-authenticating per session.

Bottom line: Treat every AI agent that touches your systems as a privileged service account - documented, monitored, and scoped to minimum necessary permissions. The companies that catalog their AI agents now will spend Q3 fine-tuning. The companies that don't will spend Q3 finding out their friendly assistant had read access to their entire customer database.

---