Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

The Gentlemen is a financially motivated ransomware group that combines data theft with encryption to increase pressure on victims. They first came onto the threat scene in July 2025. Rather than relying on encryption alone, the group exfiltrates sensitive business data before locking files, leaving organizations to deal with both operational disruption and the risk of stolen information being exposed.

Jailbreak prompts (i.e. prompts designed to remove or bypass the guardrails and rules that govern AI systems, like LLMs) prompts have been circulating for years. At first, a lot of it was pretty simple: copy a prompt, tell the model to ignore its rules, and see what happens. It was also largely noisy, unverified, and often didn’t work. But the noise was still telling us something. Threat actors were beginning to study AI systems the same way defenders were, and over time, the goal started to change.

Not every threat matters equally to every organization. A newly discovered APT or ransomware group targeting European automotive manufacturers is definitely worth paying attention to, especially if you’re in that sector. But if you’re a financial services firm in California, it’s probably not an immediate priority. You might look into it, track its activity, and assess whether it could become relevant.

Bitsight TRACE has been actively monitoring the Aisuru botnet since February 2026. Through our dedicated infrastructure, we have observed the specific commands issued to the botnet and operational patterns orchestrated by the botnet's operators.

Insurance has always been a data-rich industry. But recent threat intelligence makes it clear that attackers are not only going after insurers because they are large organizations. They’re going after them because insurance touches some of a threat actor’s favorite things: money, identity, healthcare, legal claims, third-party relationships, and highly sensitive customer records.

AI adoption is moving faster than most of us anticipated and, more importantly, faster than most organizations can govern it. Organizations are implementing the use of AI-enabled applications, browser extensions, coding assistants, and automated agents to enable employees to work faster. In many cases, these tools are adopted without security review, procurement approval, or a clear understanding of where organizational data is being sent.

Most of the exposure research we publish goes one way. We count some category of internet-exposed devices, the number is bigger than you hoped, and it is climbing. Webcams. Industrial control systems. NTP servers old enough to vote. The story is almost always "there is more of this exposed than there should be, and it is getting worse.".

Financial institutions are not short on cybersecurity policies, frameworks, or regulatory requirements. Turning those requirements into a living risk management program can be challenging. Organizations need a program that can keep pace as technology environments expand, cloud adoption grows, third parties are added, and external exposures change. Especially as the threat landscape continues to evolve.

AI is quickly becoming one of the most useful tools available to security researchers. Its ability to analyze enormous volumes of data, identify vulnerabilities, reconstruct attacks, connect seemingly unrelated signals, and help defenders respond faster than humans could alone is incredibly beneficial.

In this post, we will uncover the “Fuyao Enterprise,” a previously unknown, sophisticated and highly modular botnet operating within Android TV boxes. This operation marks a shift in modern ad-fraud, where automated bots fake both clicks and views to defraud advertisers and ad-networks. While deploying novel tactics and techniques, Fuyao managed to escape public research for several years. Now, its operators openly advertise their network of over 120,000 “AI digital humans.".