a us federal agency paid roughly $1 million in bitcoin to the kairos extortion group after a brute-force credential attack — a government entity paying data-theft extortionists is rare and quietly precedent-setting. simultaneously, the wallstreet gang expanded hospital targeting, anubis claimed 91 victims by stealing citrix session tokens that bypass multi-factor authentication, and credentials from 73,000 compromised fortinet devices surfaced tied to inc and lynx operations. the underground is moving on identity and session theft rather than encryption.