This week’s cybersecurity news roundup covers major developments ranging from international sanctions and hacker arrests to critical vulnerabilities affecting industrial networks and developer tools.
OFAC Sanctions Iranian Central Bank Crypto Reserves
The U.S. Office of Foreign Assets Control (OFAC) has designated two cryptocurrency wallets linked to Iran’s Central Bank, marking the first such action against the institution. The wallets, tied to the IRGC-Qods Force and Hizballah, held approximately $370 million in USDT. In coordination with U.S. law enforcement, Tether froze $344 million across these addresses, which had remained largely dormant since late 2023 as sovereign reserves.
Teenage Scattered Spider Member Arrested in Finland
Finnish authorities arrested 19-year-old Peter Stokes (online handle ‘Bouquet’), a dual US-Estonian citizen, as he attempted to board a flight to Japan. U.S. prosecutors in Chicago charge him as a key member of the Scattered Spider hacking group, alleging involvement in multiple intrusions against large corporations. Stokes faces counts of wire fraud, conspiracy, and computer intrusion, with the U.S. pursuing his extradition. The case has drawn attention due to Stokes’ flashy lifestyle and public taunting of law enforcement.
ADT Confirms Major Data Leak
Home monitoring provider ADT confirmed that unauthorized actors gained access to its cloud-based systems, exposing customer information. The ShinyHunters extortion group claimed responsibility, asserting they exfiltrated over 10 million records from a Salesforce database after ransom negotiations failed. Verified data indicates approximately 5.5 million unique email addresses were leaked, alongside names, physical addresses, and in some cases, partial Social Security numbers.
Microsoft Sunsets Legacy Email Encryption
Microsoft announced that Exchange Online will begin blocking TLS 1.0 and 1.1 for all POP and IMAP traffic starting in July 2026. This full deprecation eliminates previous workaround options, forcing a mandatory transition to TLS 1.2 or later for any products still relying on legacy cryptographic standards.
Outdated NSA Tool Poses Industrial Network Risk
CISA issued an advisory regarding a critical vulnerability in GRASSMARLIN, an open-source tool originally developed by the NSA for mapping industrial control system (ICS) networks. The flaw allows attackers to trigger out-of-band exfiltration of sensitive files, potentially facilitating lateral movement in industrial networks. Because the tool reached end-of-life status in 2017, no official patches will be released, leaving organizations using it exposed.
Poor Metrics Undermine SOC Effectiveness
The UK’s National Cyber Security Centre (NCSC) warns that measuring Security Operations Center (SOC) effectiveness through ticket volume and log counts creates perverse outcomes that compromise network safety. The agency suggests leaders should prioritize ‘time to detect’ and ‘time to respond’ metrics, best validated through red or purple team exercises. Analysts are encouraged to focus on high-value threat hunting and expertise rather than simply racing to close alerts.
North Korean Hackers Target Crypto Firms with Virtual Meeting Lures
BlueNoroff, a financially motivated arm of the North Korean Lazarus Group, is conducting a social engineering campaign aimed at Web3 organizations. Attackers lure executives into fake Zoom meetings where fabricated technical issues prompt victims to execute malicious PowerShell scripts disguised as software fixes. This malware harvests credentials from cryptocurrency wallet extensions and captures live webcam footage to refine deepfake personas for subsequent attacks.
Cursor IDE Vulnerability Enables Silent Code Execution
Novee Security identified a high-severity vulnerability in the Cursor IDE (CVE-2026-26268) that allows attackers to achieve arbitrary code execution via malicious Git hooks. The flaw is triggered when the tool’s AI agent autonomously performs Git operations, executing hidden scripts in nested repositories without the developer’s knowledge or approval.
CISA Releases Zero Trust and AI Guidance
CISA published two guidance resources developed in collaboration with other agencies. One focuses on applying zero trust principles to operational technology (OT), addressing the growing IT-OT convergence that has expanded attack surfaces. The second guidance urges measured rollout of agentic AI systems, highlighting key security risks while offering practical steps for design, deployment, and operation.
Qinglong Platforms Hijacked for Cryptomining
Snyk reports that threat actors are exploiting authentication bypass vulnerabilities in the Qinglong open-source task scheduler to deploy persistent cryptominers. The flaws, tracked as CVE-2026-3965 and CVE-2026-4047, allow unauthenticated remote code execution by exploiting discrepancies in how the system handles URL rewriting and case-sensitive path matching. Impacted servers experience severe CPU saturation.
What to Watch For
Organizations should take note of:
- The continued evolution of state-sponsored cryptocurrency sanctions and enforcement
- Scattered Spider’s ongoing recruitment and operational expansion
- Legacy system vulnerabilities, especially in industrial and OT environments
- AI-powered developer tools introducing new attack vectors
- Social engineering campaigns targeting cryptocurrency and Web3 sectors
Security teams should review their SOC metrics, ensure legacy systems are decommissioned or isolated, and maintain vigilance against sophisticated social engineering tactics.
