Cyber Digest

Executive Summary

A Tuesday digest anchored by active Russia Fork-style ransomware escalation against critical infrastructure, the first documented private-cellular-network pivot into a European heat plant, and a New Zealand sanctions action with direct regional significance. First, CISA, the FBI, DoD DC3, NSA, US Secret Service and the Republic of Korea's National Police Agency released a joint #StopRansomware advisory on Gunra, a ransomware-as-a-service derived from the leaked Conti source code whose affiliates have been targeting government, critical manufacturing, healthcare, transport and utilities across the Americas, Europe, the Middle East, Africa and Asia-Pacific. Second, CERT Polska disclosed at DEF CON a second Polish heat plant attack — hidden for months — revealing the first known use of a private cellular data network as a pathway into an industrial control system, with the infection originating from already-compromised wind farm firewalls. Third, New Zealand sanctioned 33 Russian individuals and entities, including Cyber Army of Russia Reborn members, a GRU Unit 29155 commander and Russian IT firm LANIT. Fourth, Microsoft disclosed that China-linked Storm-1175 deployed a new ransomware strain, StormEncryptor, likely using the N-able N-central flaw (CVE-2026-18577) for initial access — extending the week's RMM exploitation theme.

Today's digest tightens three entrenched weekly themes. Privileged-management and RMM exploitation keeps escalating: the week began with the N-able N-central Hotfix 2 (CVE-2026-18577), and Microsoft now attributes a new China-linked ransomware operation (StormEncryptor by Storm-1175) to likely initial access through that same flaw — the first documented end-to-end ransomware deployment on the RMM attack surface, matching the week's pattern of internet-exposed management appliances being weaponised at speed. Critical-infrastructure OT targeting is broadening from awareness to documented incident: the Polish private-cellular-network pivot (first-known use of that path into ICS, traced from wind-farm firewalls through a cellular router to factory-default controllers) arrives alongside the Gunra RaaS advisory naming critical sectors and the US Senate's Water Cyber Shield Act introduced Monday, capping a week that has consistently tied OT/ICS resilience to the highest-impact defensive stakes. State-sanctioning of cyber behaviour is consolidating among Five Eyes allies: New Zealand's CARR/GRU/LANIT sanctions follow Australia's earlier designations and the US Treasury's 2024 actions, showing a converging Western posture on cyber-accountability alongside the ongoing Russia–Ukraine cyber conflict (Sandworm's recruiter-impersonation campaign against Ukrainian IT workers reported this cycle). For CISOs heading into mid-August, the convergence of RMM exploitation, private-network OT pivots, and accelerating AI-agent security controls (Kimsuky's offline AI stack, OpenAI's Astra pause) confirms the priority ordering: patch velocity on internet-exposed management surfaces, OT network segmentation, phishing-resistant MFA, and human review of AI-driven remediation.