In partnership with
⏱️ ≈ 7-minute read
Editor’s Note: Today we’ve got Oracle facing extortionists, a government shutdown gutting CISA at the worst possible time, and AI phishing campaigns getting way too clever for comfort. Oh, and hackers raided a UK nursery chain and then apologized. Buckle up.
📬 This Week’s Clickables
📌 Big News: Oracle extortion mess, GoAnywhere zero-day exploited
🚨 Can’t Miss: CISA gutted by shutdown, ransomware spikes in manufacturing, Salesforce/Drift mega-breach, DPRK job lure malware
🤖 AI in Cyber: AI phishing, board vs. SOC risk gap, LOTL surge, global forum debates AI & quantum
🧪 Strange Cyber Story: Hackers say sorry after raiding nurseries
🚨 Big Stories
💾 Oracle confirms extortion campaign targeting its E-Business Suite users
Intro: Enterprises running Oracle’s ERP backbone are suddenly finding themselves in a nasty new extortion scheme.
What Happened: Oracle says hackers have stolen data from its EBS software platform and are targeting customers with extortion demands. Attackers are skipping ransomware encryption altogether and going straight for “pay or we leak.”
Why It’s Important: Oracle’s enterprise software sits at the heart of global supply chains and finance ops. A compromise here means attackers get high-value data with direct leverage over Fortune 500s.
The Other Side: Oracle insists its systems weren’t directly compromised, framing it as an issue impacting customers’ implementations — classic “not our problem” positioning.
👉 Takeaway: The attack shows that extortion is evolving beyond ransomware. Data theft alone is enough leverage if the target is strategic.
TL;DR: Oracle customers are being squeezed by extortionists. Is this the future of “ransomware-less” ransomware?
Further Reading: Reuters
In 2000, a 15-year-old hacker named “Mafiaboy” took down Yahoo!, eBay, CNN, and Dell with a simple DDoS attack — costing companies an estimated $1.7 billion in damages. (Source: FBI archives)Become An AI Expert In Just 5 Minutes
If you’re a decision maker at your company, you need to be on the bleeding edge of, well, everything. But before you go signing up for seminars, conferences, lunch ‘n learns, and all that jazz, just know there’s a far better (and simpler) way: Subscribing to The Deep View.
This daily newsletter condenses everything you need to know about the latest and greatest AI developments into a 5-minute read. Squeeze it into your morning coffee break and before you know it, you’ll be an expert too.
Subscribe right here. It’s totally free, wildly informative, and trusted by 600,000+ readers at Google, Meta, Microsoft, and beyond.
🛠️ Critical zero-day in GoAnywhere MFT being actively exploited
Intro: Remember when GoAnywhere was last year’s Clop playground? Yeah… it’s back.
What Happened: Fortra’s GoAnywhere MFT is in the crosshairs again, with a 10/10 severity zero-day (CVE-2025-10035) already under active exploitation. The bug allows remote command injection and full compromise of managed file transfer servers.
Why It’s Important: GoAnywhere has a history of being ransomware gangs’ favorite playground. This new zero-day threatens thousands of enterprises moving sensitive data.
The Other Side: Patches are live, but if history repeats, expect mass exploitation of laggards who don’t patch fast enough.
👉 Takeaway: This is another reminder that “secure file transfer” is an oxymoron when attackers have the exploit first.
TL;DR: A GoAnywhere zero-day is getting hammered. Did anyone actually patch after last year’s Clop fiasco?
Further Reading: TechRadar
🔥 Can’t Miss
🇺🇸 U.S. shutdown slashes CISA staffing at worst time
The government shutdown has sidelined much of CISA’s workforce, and the expiration of its intel-sharing law is a double gut punch. 👉 Coordination across agencies and industry just got weaker — during peak threat season.🏭 Manufacturing & business sectors see 36% ransomware spike
New research shows ransomware is shifting away from hardened gov and healthcare networks and toward manufacturing and business verticals. 👉 Attackers are following the “least resistant” path — factories and SMBs, beware.🔑 ShinyHunters tied to Salesforce / Drift compromise of 1.5B records
Hackers abused OAuth tokens from Drift integrations to break into Salesforce, hitting ~760 companies and leaking ~1.5B records. 👉 SaaS trust models are a mess — token management and vendor risk reviews just got real.🎣 DPRK-backed actors deploying BeaverTail malware via job lures
North Korean groups are sending fake job offers to drop malware payloads, using new BeaverTail and InvisibleFerret implants. 👉 The lure is the payload — LinkedIn recruiters, maybe don’t click that PDF.
beehiiv is the one platform that does everything for your newsletter. And they do mean everything:
A newsletter editor that makes your words shine like they belong on a bestseller list
A no-code website builder that doubles as your 24/7 subscriber magnet
Revenue tools that make earning money so easy it feels like cheating: ads, referrals, and paid subs
If you’ve got a newsletter (or even just the idea for one), beehiiv is the ultimate no-brainer.
Start for free on the absolute best platform for newsletters. No credit card required.
🤖 AI in Cyber
📧 Phishing campaigns supercharged with AI evasion techniques
Attackers are using AI-driven platforms to craft phishing that sails past defenses and dupes even savvy users. 👉 AI isn’t just writing emails — it’s writing new rules for deception.🛡️ Growing reliance on living-off-the-land attacks
A new report shows 84% of severe intrusions use built-in OS tools, meaning less malware and more stealth. 👉 If AI tools can make sense of behavior anomalies, defenders may finally catch up.📊 Gap between board & SOC perception of AI risk
Executives think they’re ready for AI threats, while SOC teams say otherwise. 👉 Misalignment = missed budgets, blind spots, and panic patching later.🌍 Global Cybersecurity Forum debates AI, quantum, cohesion
World leaders and industry heavyweights debated AI, quantum, and the future of international cyber defense. 👉 The big question: can nations actually cooperate before the AI-driven attacks scale?
🧟♂️ Strange Cyber
🍼 Hackers raid UK nursery chain, “apologize” after stealing data
Intro: You know you’re in strange territory when hackers say “sorry” after a breach.
What Happened: Hackers breached Kido Schools, stealing photos and sensitive records of children. Then, bizarrely, they issued a public “apology” and claimed to delete everything.
Why It’s Important: Even if true, the precedent is chilling — criminals framing themselves as ethical actors after committing the crime.
The Other Side: Security experts point out that “we deleted it, promise” is about as trustworthy as a Nigerian prince email.
👉 Takeaway: There’s no “ethical hacker” badge for stealing kids’ data — just a reminder that attackers will say anything to soften blowback.
TL;DR: Hackers hit a nursery chain, then said sorry. Does remorse count in cybercrime, or is this just villain cosplay?
Further Reading: Washington Post
Thanks for reading this week’s edition. Like what you see? Forward it!
Hate everything you see or have other feedback? Reply back to this email!