Cyber Briefing: 2026.04.28
Today's threat landscape is defined by a volatile mix of state-sponsored stealth, such as Sandworm’s use of SSH-over-Tor...
Welcome to Cyber Briefing, your daily source for all things cybersecurity. We bring you the latest advisories, alerts, incidents, and news every weekday.
Today’s threat landscape is defined by a volatile mix of state-sponsored stealth, such as Sandworm’s use of SSH-over-Tor, and high-stakes corporate breaches at firms like Itron and Medtronic, while a surge in SMS-based CAPTCHA fraud highlights the continued effectiveness of simple social engineering. Intellectual property remains a prime target, evidenced by the theft of sensitive aerospace software by Chinese actors, even as Proofpoint reports a widespread crisis of confidence regarding AI security controls.
This escalating risk environment is being met with a hammer of regulatory enforcement, with DORA mandating stricter operational resilience in the EU and U.S. privacy fines hitting a staggering $3.45 billion, all while a stagnating, undervalued cybersecurity workforce threatens the very human foundation of global defense.
Listen to our podcast here ⏬
⚡THREAT LANDSCAPE
Fake CAPTCHA scam leads to costly phone bills
Researchers have uncovered a scam that uses fake CAPTCHA pages to trick mobile users into sending international SMS messages, leading to unexpected charges. This scam, known as International Revenue Share Fraud, exploits telecom billing systems to generate revenue for cybercriminals. Users should avoid sending SMS to verify CAPTCHAs, regularly check their phone bills for unusual charges, and consider using mobile protection apps to block malicious sites. Read More
Sandworm Uses SSH-over-Tor Tunnel
The state-sponsored threat group Sandworm, also known as FROZENBARENTS, has been found using SSH-over-Tor tunneling to maintain covert access to targeted networks. This technique is part of their ongoing efforts to infiltrate government bodies, energy firms, and research institutions for intelligence gathering. Organizations should enhance their network monitoring and implement robust security measures to detect and prevent such sophisticated intrusions. Read More
🚨INCIDENTS & REAL-WORLD IMPACT
Itron discloses security breach
Itron, a U.S.-based company specializing in smart solutions for energy and water infrastructure, experienced unauthorized access to its IT systems on April 13, 2026. The breach did not affect customer-hosted systems, and Itron has engaged cybersecurity experts and law enforcement to investigate and contain the incident. Operations continue largely unaffected, and the company is assessing the need for further legal and regulatory actions while insurance is expected to cover much of the incident’s costs. Read More
Medtronic Confirms Data Breach
Medtronic, a leading medical technology company, confirmed a data breach on April 24, where an unauthorized party accessed its corporate IT systems. The breach did not affect Medtronic’s product safety, customer connections, or manufacturing and distribution operations, and there was no impact on patient safety or hospital networks. Medtronic has taken steps to contain the breach, is investigating the incident with cybersecurity experts, and is committed to enhancing its cybersecurity measures. Read More
Chinese Engineer Stole US Military Software
A Chinese aerospace engineer named Song Wu impersonated US researchers and engineers to obtain sensitive military software from NASA, the US military, and universities over four years. This breach involved the unauthorized sharing of aerospace engineering and computational fluid dynamics software, which is crucial for developing advanced weapons and is protected under US export controls. Organizations should enhance their cybersecurity measures, particularly against social engineering attacks, and ensure employees are trained to recognize and report suspicious requests for information. Read More
🔓 EXECUTIVE RISK & CYBERNOMICS
Proofpoint AI Incident Report 2026
Proofpoint’s 2026 AI and Human Risk Landscape report reveals that over half of organizations lack confidence in their AI security controls to detect compromised AI systems. The study, which surveyed over 1,400 security professionals globally, highlights that while AI adoption is widespread, many organizations struggle with security readiness and incident investigation across multiple systems. Organizations are advised to consolidate security tools and enhance AI protections to better manage the risks associated with AI deployment. Read More
🛡️ POLICY, REGULATION & LEGAL SIGNALS
DORA and Operational Resilience
The EU’s Digital Operational Resilience Act (DORA), effective since January 2025, mandates financial services firms to systematically manage IT risk, test resilience under realistic conditions, and govern third-party dependencies. Despite progress, many organizations still struggle to meet these requirements, particularly in maintaining control during incidents when access is compromised. To comply with DORA, firms should implement independent management access to critical infrastructure, ensuring operational control even when primary networks are disrupted. Read More
U.S. Companies Face Record Privacy Fines in 2025
In 2025, U.S. states imposed $3.45 billion in fines on companies for privacy violations, surpassing the total from the previous five years combined. This surge in penalties is attributed to stronger state privacy laws, enhanced interstate enforcement collaborations, and increased scrutiny on AI’s impact on privacy. Companies are advised to strengthen their privacy programs to comply with evolving regulations and avoid substantial fines. Read More
💻 CAREER ENABLEMENT
Cybersecurity Professionals Feel Undervalued
A recent report reveals that over three-quarters of cybersecurity professionals did not receive a pay raise last year, leading to feelings of being undervalued and prompting many to consider changing jobs. Despite significant cybersecurity incidents, only 22% of organizations have increased their investment in cybersecurity, leaving many professionals pessimistic about future pay increases. To retain talent and reduce risk, companies should ensure cybersecurity staff feel valued and supported. Read More
Copyright © 2026 CyberMaterial. All Rights Reserved.
Follow CyberMaterial on:
Substack, LinkedIn, Twitter, Reddit, Instagram, Facebook, YouTube, and Medium