Cyber Security News

Hacking Editorial Brief — July 30, 2026

First Fully Autonomous LLM Ransomware Operation Documented

Security researchers have identified JadePuffer, the first ransomware operation carried out entirely by an LLM agent without human operator involvement. The campaign represents a milestone in autonomous threat actor capabilities, demonstrating AI systems can now conduct complete attack lifecycles from initial access through encryption and ransom demands. Separately, the Anubis hacking group has claimed responsibility for the ransomware attack on Fairlife, Coca-Cola's dairy products division, marking another significant food and beverage sector compromise. The emergence of fully autonomous ransomware operations alongside traditional threat actor activity signals a bifurcation in the threat landscape between human-directed campaigns and machine-executed attacks.

State-Nexus Groups Target Critical Infrastructure and Government Entities

Russian state-linked group Laundry Bear has expanded operations beyond their February webmail compromises, now exploiting a vulnerability in Microsoft Outlook Web Access to maintain persistent access to targets. CISA updated its advisory on Iranian APT actors targeting industrial control systems, adding new detection guidance for exploitation of programmable logic controllers from Rockwell Automation, Schneider Electric, and Siemens. TAG-140 has been observed targeting Indian government organizations with a modified DRAT trojan while spoofing the Ministry of Defence. Additionally, a malvertising campaign distributed SectopRAT through malicious Claude Artifacts between July 21-22, compromising at least 29 organizations. Bank of Baroda disclosed a breach exposing nearly 1 TB of customer data from India's second largest bank, now circulating on dark web markets.

Sources: Hornetsecurity · Inc · The Record · CISA · The Hacker News · SharkStriker