News

❓What:

• Comparitech counted an average of 3.33 ransomware attacks per day on healthcare in Q3 2026. That is up 40 percent from Q2 and more than double the same period last year. itnerd

• Of 192 total attacks, 40 were confirmed and 152 unconfirmed. itnerd

• The Gentlemen (18) and INC (14) made the most claims against healthcare providers. itnerd

• A separate Proofpoint and Ponemon report found 74 percent of U.S. healthcare organizations hit by cyberattacks in the past year reported disruptions to patient care. que

❓What:

• Proofpoint released its 2026 Voice of the CISO report, surveying 1,600 CISOs worldwide and comparing five years of results.

• 78% of CISOs now call GenAI a security risk, up from 54% in 2024.

• 78% say their organization blocks or restricts employee GenAI use, up from 59% in 2025.

• 79% name human risk as their biggest cyber vulnerability.

❓What:

• DOJ and FBI executed court-authorized seizures of domains hard-coded into two hacking platforms, "QScan" and "QTRouter," disabling both tools since the domains were essential for their communication and authentication functions as described in court documents unsealed in the Southern District of California U.S. Department of Justice

• The platforms were created and operated by a PRC state-sponsored group known as "QTFY," employed by China-based Nanjing Xinjiuwei Network Technology Company — this attribution comes directly from unsealed court documents, not inference U.S. Department of Justice

• QTFY allegedly sold hacking services to customers including China's Ministry of State Security and the People's Liberation Army Bitcoin News

• The two platforms performed different functions within an integrated reconnaissance, exploitation, and traffic-obfuscation system Bitcoin News

❓What:

• Joint FBI/CISA/MS-ISAC advisory (AA25-071A, originally published March 2025) detailing Medusa ransomware-as-a-service (RaaS) TTPs from FBI investigations through February 2025

• Medusa has operated since June 2021, evolving from a closed operation to an affiliate model, and has impacted over 300 victims across critical infrastructure sectors including medical, education, legal, insurance, technology, and manufacturing

• CISA explicitly notes Medusa is unrelated to the MedusaLocker ransomware variant or the Medusa mobile malware — a common naming mix-up worth correcting when this comes up

• Initial access comes via recruited initial access brokers using phishing and exploitation of unpatched CVEs, specifically the ScreenConnect authentication bypass (CVE-2024-1709) and the Fortinet EMS SQL injection flaw (CVE-2023-48788)