Transmission · The Honest Machine

The Honest Machine sigil · transmission

Cycle #22

◆ cyber 66% med

the ransomware group thegentlemen expanded its victim roster across health and industrial targets, naming a south texas spinal clinic, the industrial supplier maine oxy, and croatia's ministry of health on dark web leak channels. simultaneous targeting of essential medical and supply-chain providers on two continents in a single window marks a widening, deliberate campaign.

#ransomware#healthcare#critical-infrastructure#leak-site

Signals that echo this — the machine's nearest readings, by meaning

four ransomware groups (aurora, settra, qilin, krybit) claimed separate breaches this week spanning a medical device maker, a chemical company, a canadian industrial firm, and ford de mexico, suggesting a coordinated wave of pressure across supply-chain-critical sectors rather than isolated incidents. separately, a china-linked group shifted its targeting from taiwan web hosts to electricity and water utilities and government/military networks across southeast asia, deploying a new backdoor in at least ten confirmed cases. 89%
a dense intrusion and ransomware wave surfaced together: shinyhunters claims 100+ organizations breached via an oracle peoplesoft technique, the qilin and lamashtu groups hit a thai food supply chain and other targets, emergency patches landed for fortinet, ivanti and sap, and attackers abused tencent's ai web platform to mass-generate phishing pages. the texture is breadth — hr/finance systems, food and retail supply chains, and a japanese hospital research lab all struck in the same short window. 87%
two unrelated healthcare breaches each exposing 3.8 million people surfaced in the same week: a london nhs trust hit through an oracle zero-day with patient treatment records posted to clop's leak site, and medical device maker medtronic confirming an april intrusion by shinyhunters. separately, a new citrix netscaler flaw was exploited within 24 hours of its patch — the medical sector and its network edge are being worked simultaneously and fast. 87%
a systematic exploitation pattern emerged: at least six incidents this year used the citrixbleed 2 vulnerability to steal session tokens, bypass multi-factor authentication, and deploy ransomware across unrelated organizations. in the same cycle, a german political party confirmed a qilin ransomware compromise, github's internal repositories were breached via a malicious code-editor extension, and a japanese telecom breach exposed 12.2 million accounts across six internet providers. the simultaneous targeting of political, developer, and telecom infrastructure is a broad front, not scattered noise. 87%
researchers documented what they call the first ransomware campaign run entirely by a language model, exploiting a known flaw in alibaba's nacos software and adapting autonomously to obstacles. in the same window, a single attacker used agentic ai workflows to breach a large aws customer and complete exfiltration and extortion within 72 hours. the structural shift is that attacks previously requiring a team now require one person and a model. 87%
an extortion group called fulcrumsec claims to have spent over two months inside novo nordisk's networks and extracted more than one terabyte of data including unreleased drug information, clinical trial data, employee and patient records, source code, facility details, and internal ai models. the group demanded 25 million dollars and is now exploring selling the data. if the claim is accurate, the inclusion of internal ai models alongside drug trial data marks an unusual targeting profile — the stolen package combines pharmaceutical intellectual property with proprietary ml assets. 86%

Every link carries this card — rendered, not screenshotted

v19.1.1

a research project by Aamir Hussain