Loading story…
Latvia’s National Security Service (SAB) reported that 2025 saw a record high in registered cyber threats targeting the country, with Russia assessed as the primary source of cyber risk amid Latvia’s support for Ukraine. SAB said most activity was linked to cybercrime and digital fraud, but the most serious cases included intrusion attempts, malware distribution, equipment compromise, and DDoS attacks, and it warned that operational technology (OT) in energy, water, and transport often lacks sufficient protections. The agency also noted that Russian-linked hacktivist activity has shown willingness and capability to target industrial control systems for short-term disruption and intimidation, and that DDoS activity against government and critical services often aligns with politically sensitive events.
In the UK, senior national security figures warned Parliament that resilience alone may be insufficient against cyber and hybrid threats (including sabotage and disinformation), arguing the country needs an offensive deterrence component to impose costs on hostile states rather than “absorbing” attacks. Separately, Check Point Research data cited by Dark Reading indicated Latin America and the Caribbean experienced the highest average weekly attack volume globally (3,065 attacks per week; +26% YoY), with prevalent activity including information disclosure, attempts at remote code execution and authentication bypass, and a shift toward data-leak extortion, credential theft, and edge-device exploitation; the report also projected continued ransomware growth, particularly affecting healthcare and manufacturing.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
In a report discussed publicly in late January, SAB warned that Russia's cyber threat to Latvia would remain elevated into 2026 and beyond regardless of the outcome of the war in Ukraine. The agency also highlighted growing risks to operational technology in energy, water, and transport systems.
At a UK parliamentary national security hearing, former National Security Adviser Lord Sedwill warned that resilience and defensive measures alone would leave the country merely 'absorbing' cyber and hybrid attacks without deterring hostile states. The hearing also examined NATO resilience spending targets, ransomware legislation, and gaps in counter-disinformation capabilities.
Check Point Research reported that during 2025, Latin America and the Caribbean became the world's most-targeted region for cyberattacks, averaging 3,065 attacks per organization per week, up 26% year over year. The activity included widespread information disclosure, remote code execution and authentication-bypass attempts, and ransomware affecting more than 5% of organizations.
Latvia's national security service (SAB) said 2025 saw an all-time high in registered cyber threats against the country, surpassing levels recorded before Russia's 2022 invasion of Ukraine. SAB assessed that Russia remained the main cyber threat, with incidents including intrusion attempts, malware distribution, equipment compromise, and DDoS attacks.
SAB cited a major DDoS attack in late July that followed reports of a Latvian company winning an international drone procurement contract. The incident was presented as an example of politically timed disruptive activity linked to heightened Russian threat behavior.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
therecord.media
Open sourcetherecord.media
Open sourcedarkreading.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Government and industry reporting highlighted **ransomware and hybrid cyber activity** increasingly intersecting with geopolitical conflict and critical infrastructure risk. The UAE Cyber Security Council said it **thwarted a ransomware operation** targeting the country’s “digital infrastructure and vital sectors,” describing attempted network intrusions, ransomware deployment, and phishing, and alleging the use of **AI-enabled tooling** to increase sophistication; the statement did not attribute the activity publicly but came amid broader reporting on Iran-linked cyber pressure against the UAE. In Romania, the head of the National Cybersecurity Directorate warned that recent ransomware incidents affecting critical services (including the national water agency and energy providers) appear **systematic and aligned with Russian strategic interests**, with attacks claimed by or attributed to Russian-speaking groups including **Qilin** and **Gentlemen**. Separately, Air Côte d’Ivoire confirmed a **cyberattack impacting parts of its information system** after the **INC ransomware** group claimed theft of **208 GB** of data and threatened publication if a ransom was not paid; the airline said it notified regulators (including France’s **ANSSI**) and engaged national and international incident response support. Broader sector analysis reported **manufacturing** as a leading ransomware target due to interconnected IT/OT environments, legacy systems, and high downtime costs, with surveys indicating a significant portion of manufacturers paid ransoms in 2025 and median payments around **$1M**. Strategic context reporting assessed Russia is likely to escalate coordinated **hybrid warfare** (cyber, influence, sabotage) against NATO members, while public-opinion polling in several NATO countries showed majorities view disruptive cyberattacks on hospitals or power grids as potential **acts of war**—underscoring rising expectations for stronger state responses to such campaigns.
Jun 29, 2026
CrowdStrike’s 2025 global threat reporting says financially motivated intrusions are accelerating, with **average breakout time** (lateral movement after initial access) dropping to **29 minutes** and the fastest observed breakout time at **27 seconds**; the report also describes attackers increasingly using **social engineering**, **living-off-the-land** techniques, and abuse of **trusted systems** to move across *cloud, identity, enterprise,* and unmanaged device boundaries, alongside a reported **37% year-over-year increase** in cloud-focused attacks and a growing set of tracked adversaries (281 named groups plus additional activity clusters). Check Point Research’s 2025 retrospective similarly emphasizes that many 2025 operations relied on **familiar techniques combined in new ways**, highlighting themes such as early **ToolShell** exploitation assessed as Chinese-nexus activity against North American government targets and **identity-centric** intrusions (including **AiTM** credential theft) against US think-tank researchers. Several other items in the set are not about these annual threat-report findings and instead cover separate topics: Romania’s cyber chief warning that ransomware incidents against critical infrastructure may align with **Russian hybrid objectives**; sector-level reporting that **manufacturing** remains heavily targeted by ransomware due to IT/OT interconnectivity and downtime pressure; and US law-enforcement/FBI reporting on a surge in **ATM jackpotting** losses and related indictments. Additional entries are primarily **generic commentary, newsletters, or professional/educational content** (e.g., quantum-preparedness opinion, Enigma/RSAC history piece, a weekly video briefing, a malware-newsletter link roundup, a recon how-to article, and a governance/career feature page) and do not substantively corroborate the specific annual threat-report story.
Jun 29, 2026
Recent reporting highlights a shift in enterprise cyber risk toward **external dependencies and identity abuse**. Coverage of the EU’s **NIS2** directive emphasizes that organizations are expected to treat **supply-chain security** as a core governance and architecture issue, reflecting the reality that third parties (e.g., cloud providers, software suppliers, maintenance access, and outsourced services) are frequent intrusion paths rather than risks contained “inside the firewall.” Separately, findings cited from Eye Security’s *State of Incident Response Report 2026* indicate attackers are increasingly **exploiting existing access** rather than “hacking in,” with **identity-based attacks** dominating and **passwords** implicated in the vast majority of such incidents; common initial compromise paths still include phishing, exposed/misconfigured internet-facing systems, social engineering, and software supply-chain attacks. In healthcare, a Trellix threat intelligence report based on **54.7 million detections** from 2025 healthcare environments warns cyber incidents are escalating from IT disruption into a **patient safety** issue due to highly interconnected systems and “cascading” outages. The report identifies **email** as the leading threat vector and the **U.S.** as the primary target, and describes ransomware and extortion activity intensifying, including groups such as **Qilin** (noted for targeting EHR databases), **INC Ransom**, and newer actors like **Sinobi** focusing on biotech; it also reports a sharp rise in **extortion-only** tactics with per-patient ransom demands intended to sidestep corporate insurance dynamics. Across these sources, **phishing** remains a dominant initial access method, with lures increasingly tailored to privileged IT roles (e.g., “AI Transformation” themes).
Jul 12, 2026