Cyber Briefing: 2026.05.14
Attackers are leveraging legacy proxy tools for persistent access in a landscape where critical infrastructure and healthcare remain highly vulnerable to third-party supply chain failures and evolving
Welcome to Cyber Briefing, your daily source for all things cybersecurity. We bring you the latest advisories, alerts, incidents, and news every weekday.
Current cyber activity highlights a shift toward sophisticated persistence and increased targeting of critical infrastructure. The ClickFix campaign has advanced its tactics by integrating PySoxy, an old Python-based SOCKS5 proxy, to maintain stealthy network access rather than relying on one-off commands. Simultaneously, the Canadian telecommunications sector is grappling with a rise in nation-state intrusions and ransomware, while the healthcare industry faces ongoing fallout from third-party vulnerabilities, specifically through major breaches at Atrium Health and Interim HealthCare involving legacy systems and vendor portals.
On the strategic and economic front, global agencies and tech leaders are pivoting heavily toward AI integration and supply chain transparency. CISA and G7 partners have introduced new guidance for AI Software Bills of Materials (SBOMs) to help organizations track data and model dependencies. This shift is mirrored in the private sector and national economies: the UK’s cybersecurity market has surged to £14.7 billion with a massive focus on AI firms, while Cisco is restructuring its workforce, cutting 4,000 positions, to aggressively reallocate resources into AI infrastructure and security development.
Listen to our podcast here ⏬
⚡THREAT LANDSCAPE
ClickFix Campaign Evolves with PySoxy SOCKS5 Proxy
A new ClickFix campaign is using PySoxy, a 10-year-old open-source Python SOCKS5 proxy tool, to establish persistent network access after initial infection. The attack moves beyond typical ClickFix tactics that rely on single PowerShell command execution, instead building a layered intrusion chain that allows attackers to maintain stealthy access to compromised systems. Organizations should monitor for unusual SOCKS5 proxy activity and PowerShell executions that establish persistent connections. Read More
🚨INCIDENTS & REAL-WORLD IMPACT
Canadian Telecom Providers Face Cyber Threats
Canadian telecommunications providers are experiencing increased cyber threats including ransomware attacks, SIM swapping fraud, data breaches, and nation-state intrusions targeting critical infrastructure. These attacks threaten both customer data security and the operational integrity of essential communication networks. Telecom operators should implement enhanced security monitoring, multi-factor authentication, and incident response capabilities to defend against these evolving threats. Read More
Atrium Health, Interim HealthCare Hit by Vendor Breaches
Atrium Health Navicent and Interim HealthCare facilities in Texas disclosed patient data breaches stemming from third-party vendor compromises. Atrium Health was affected by the January 2025 Oracle Health breach involving legacy Cerner servers, exposing medical records and Social Security numbers for patients treated before mid-2022. Interim HealthCare locations in Lubbock and Amarillo were impacted by unauthorized access to Doctor Alliance’s web portal between October and November 2025, affecting 2,737 patients total. Read More
🔓 EXECUTIVE RISK & CYBERNOMICS
CISA releases AI SBOM guidance for supply-chain oversight
CISA and G7 cyber agencies released guidance on minimum elements for AI software bills of materials (SBOMs), extending traditional software supply-chain documentation to include AI models, datasets, training data, and infrastructure dependencies. The guidance is voluntary and aims to help security teams assess AI systems during procurement and vendor risk management, though experts note it provides visibility into what vendors disclose rather than assurance of actual system behavior. Security leaders should use AI SBOMs to question vendors about model provenance, data sources, dependencies, and security controls before allowing AI products into production environments. Read More
🛡️ POLICY, REGULATION & LEGAL SIGNALS
UK Cyber Sector Grows to £14.7bn as Resilience Bill Advances
The UK cybersecurity sector generated £14.7 billion in revenue last year, employing nearly 70,000 people across 2,603 firms, with AI-focused security companies growing 68% annually. The government launched the Cyber Resilience Pledge, a voluntary initiative urging organizations to adopt security best practices, though experts criticize this approach as insufficient. The Cyber Security and Resilience Bill continues through parliament, aiming to mandate stronger protections for critical infrastructure providers through incident reporting requirements and managed service provider accountability. Read More
💻 CAREER ENABLEMENT
Cisco cuts 4,000 jobs, prioritizes AI and security
Cisco announced plans to cut up to 4,000 jobs (approximately 5% of its workforce) starting May 14, 2026, as part of a strategic shift toward AI and security investments amid intensifying competition and component shortages. Despite the layoffs, the company reported strong Q3 FY26 results with revenue of $15.8 billion (up 12% year-over-year) and raised its AI infrastructure revenue forecast from $3 billion to $4 billion for the fiscal year. Affected employees will receive pro-rated bonuses, placement services with a 75% success rate, and one year of free access to Cisco training courses in AI, security, and networking. Read More
Copyright © 2026 CyberMaterial. All Rights Reserved.
Follow CyberMaterial on:
Substack, LinkedIn, Twitter, Reddit, Instagram, Facebook, YouTube, and Medium