News

❓What:

• Joint FBI/CISA/MS-ISAC advisory (AA25-071A, originally published March 2025) detailing Medusa ransomware-as-a-service (RaaS) TTPs from FBI investigations through February 2025

• Medusa has operated since June 2021, evolving from a closed operation to an affiliate model, and has impacted over 300 victims across critical infrastructure sectors including medical, education, legal, insurance, technology, and manufacturing

• CISA explicitly notes Medusa is unrelated to the MedusaLocker ransomware variant or the Medusa mobile malware — a common naming mix-up worth correcting when this comes up

• Initial access comes via recruited initial access brokers using phishing and exploitation of unpatched CVEs, specifically the ScreenConnect authentication bypass (CVE-2024-1709) and the Fortinet EMS SQL injection flaw (CVE-2023-48788)

❓What:

• ShinyHunters (tracked by Mandiant as UNC6240) exploited an unpatched RCE flaw in Oracle PeopleSoft PeopleTools, CVE-2026-35273 (CVSS 9.8), between May 27 and June 9, 2026 — before Oracle's advisory landed on June 10, making it a true zero-day for the entire window

• The flaw sits in the Environment Management Hub (PSEMHUB) component and requires no authentication or user interaction — just HTTP network access to the exposed endpoint

• Affects PeopleTools 8.61 and 8.62; Oracle says older, unsupported versions are likely vulnerable too

• The intrusion came to light because attackers left their own staging servers exposed — open directories running Python SimpleHTTP on port 8888, discovered by researcher @nahamike01 and triaged by Mandiant

❓What:

• A firmware integration error from March 2021 in Coinkite's Coldcard hardware wallet caused seed generation to route through a deterministic software PRNG instead of the device's STM32 hardware RNG, on five affected models/tracks.

• Block traced the root cause to a production config flag (MICROPY_HW_ENABLE_RNG) that checked whether a macro existed rather than whether it was enabled, silently binding builds to MicroPython's weak Yasmarang fallback, seeded only from chip UID and timer state at init with no further entropy collected.

• Galaxy Research mapped an initial sweep of 1,196 addresses in 41 minutes on July 30, draining 1,082.65 BTC (~$70.2M at the time); two additional suspected waves have since raised the total to 1,367.05 BTC (~$88.6M) across 4,585 addresses.

• Coinkite shipped emergency firmware on July 31 for all affected models, but patching does not repair seeds already generated on vulnerable firmware.

❓What:

• A coordinated cyberattack targeted operational technology at more than 30 Minnesota community water systems on July 26 and 27, triggering a statewide cybersecurity response. thehackernews

• Braham's water plant went offline, prompting the city to ask residents to minimize water use, while Plymouth reported cellular communications problems at two water towers and multiple wastewater lift stations but continued operating manually.

• South St. Paul and Maple Plain kept services running after automated utility controls were affected, with Maple Plain declaring a local state of emergency.

• Officials have not publicly named the attacker, initial access method, affected products, exploited vulnerability, or whether data was stolen. The 30+ figure reflects systems targeted, not confirmed compromised or disrupted.