Cybersecurity Roundup: Medusa Ransomware, Sandworm Campaign and Major Breaches
Summary
A weekly threat-intelligence roundup covers Medusa ransomware’s impact, a Sandworm-linked campaign, attacks disrupting ports and water utilities, major data theft, arrests, and new macOS malware.
Key points
- CISA and partner agencies say Medusa ransomware has breached more than 500 U.S. critical infrastructure organizations since June 2021, up from an estimate of more than 300 in March 2025.
- A Sandworm-linked campaign used fake job offers and trojanized WireGuard VPN software to target IT professionals with malware on Windows and Linux.
- A cyberattack disrupted IT systems and operations at three North Carolina Ports facilities; the authority has not disclosed whether sensitive data was compromised.
- Authorities allege cybercriminals exploited a service-provider software flaw to steal about €30 million from Commerzbank customers in 2023; arrests and charges have followed.
- A breach of the U.K. Police National Legal Database exposed contact information for more than 100,000 officers and criminal justice professionals; investigators report no evidence so far that credentials were compromised.
- A cyberattack disrupted operational technology at 30 Minnesota community water systems; CISA advised critical infrastructure organizations to isolate key OT systems where possible.
- AmnesiaStealer targets macOS users through ClickFix campaigns, stealing browser sessions and other sensitive data, including Keychain information and cryptocurrency wallets.
Article Details
- Event Type
- Security news roundup covering ransomware, targeted attacks, data breaches, malware, financial cybercrime, and law-enforcement actions.
- Impact
- Reported impacts include more than 500 U.S. critical infrastructure organizations breached by Medusa since June 2021; disruptions to North Carolina port operations and 30 Minnesota water systems; exposure of contact information for more than 100,000 U.K. police officers and criminal justice professionals; and approximately €30 million in losses from unauthorized withdrawals from German bank accounts. Other reports describe malware targeting macOS users and a dismantled dark-web drug-trafficking organization.
Threat Actors
ExfilSquadData extortion group that claimed responsibility for compromising the U.K. Police National Legal Database.MedusaRansomware group reported to have breached more than 500 critical infrastructure organizations in the United States since June 2021.SandwormThreat group linked to hackers reportedly targeting IT professionals with fake job offers and a trojanized VPN client.UAC-1045Campaign associated with the reported targeting of IT professionals through fake job offers and a trojanized VPN client.
Malware
Products
Countries
BrazilFour cybercriminals have been arrested in Brazil, while three others have been charged in Europe over allegations that they exploited a vulnerability at a service provider to withdraw funds from Commerzbank customers’ColombiaLed from Medellín, Colombia, the organization relied on U.S.-based members in Florida and North Carolina to receive and distribute the drugs across the country.GermanyUnited KingdomUnited Statesthe Medusa ransomware group has breached more than 500 critical infrastructure organizations in the United States since June 2021.
Industries
Critical infrastructure1. CISA: Medusa ransomware hit over 500 critical infrastructure orgs – Bleeping ComputerDefenseAs of April 2026, the victims span multiple sectors, including Healthcare and Public Health, Defense Industrial Base, Critical Manufacturing, Government Services and Facilities, Information Technology, and FinancialEducationOther affected organizations include those in the medical, education, legal, insurance, technology, and manufacturing industries.Financial ServicesBase, Critical Manufacturing, Government Services and Facilities, Information Technology, and Financial Services.Governmentsectors, including Healthcare and Public Health, Defense Industrial Base, Critical Manufacturing, Government Services and Facilities, Information Technology, and Financial Services.HealthcareAs of April 2026, the victims span multiple sectors, including Healthcare and Public Health, Defense Industrial Base, Critical Manufacturing, Government Services and Facilities, Information Technology, and FinancialInformation TechnologyHealth, Defense Industrial Base, Critical Manufacturing, Government Services and Facilities, Information Technology, and Financial Services.InsuranceOther affected organizations include those in the medical, education, legal, insurance, technology, and manufacturing industries.Law enforcementA multinational law enforcement investigation has dismantled the “Undertaker45” dark web drug trafficking organization, which operated from 2017 to 2023.LegalOther affected organizations include those in the medical, education, legal, insurance, technology, and manufacturing industries.Manufacturingspan multiple sectors, including Healthcare and Public Health, Defense Industrial Base, Critical Manufacturing, Government Services and Facilities, Information Technology, and Financial Services.Port operationson August 5 and causing delays for port operations and truckers.TechnologyDefense Industrial Base, Critical Manufacturing, Government Services and Facilities, Information Technology, and Financial Services.Water utilities7. Hackers disrupt over 30 Minnesota water utilities in coordinated OT attack – Bleeping Computer