AI Weekly Malaysia

An Akira ransomware affiliate breached a victim via a SonicWall SSL VPN account that lacked MFA, then rebooted the machine into Safe Mode to kill security tools—but Safe Mode also broke the encryptor due to memory constraints. Huntress analyst James Northey warns this was a lucky break, not a reliable defense, since attackers could retool the encryptor to work in Safe Mode. Data and credentials were already exfiltrated before the encryption failed.

Why: If you run a SonicWall SSL VPN or any VPN endpoint without MFA, you are the exact target profile described here—credential-spray attacks succeeded in seven minutes against an unprotected account. Enforce MFA on all VPN accounts now, and assume that even if encryption fails, attackers will still steal Active Directory data and file-share credentials before they leave.

This sponsored feature argues that Microsoft's shared responsibility model leaves M365, Entra ID, and Azure customers unprotected against ransomware-driven data deletion, since Microsoft ensures service availability but does not restore data to a known-good point. Brent Torre, described as GM of cyber resilience (vendor not named in excerpt), states Microsoft's native tools handle accidental deletion and governance but are not a backup solution.

Why: If you run SaaS workloads on M365 or Azure, verify whether your team or MSP has a third-party backup that can restore to a point-in-time after ransomware or malicious deletion—Microsoft's native retention is not that. This is a sponsored vendor piece, so treat the framing as marketing and confirm the specific gaps against Microsoft's own documentation rather than taking claims at face value.

Gunra ransomware, a Conti-derived operation active since April 2025 with 51 listed victims, gains initial access by exploiting Fortinet FortiOS/FortiProxy (CVE-2025-24472) and Schneider Electric PowerLogic P5 (CVE-2024-5559) flaws, then deploys double-extortion using Salsa20/ChaCha20 encryption. The group launched a formal RaaS affiliate program in January 2026 with Windows and Linux lockers, though the Linux builds reportedly contain a catastrophic cryptographic weakness. Most victims are in South Korea, Brazil, Spain, Thailand, and Hong Kong, with targets spanning healthcare, financial services, and government sectors.

Why: If your startup or employer runs Fortinet FortiOS/FortiProxy or Schneider Electric PowerLogic P5 appliances exposed to the internet, patch CVE-2025-24472 and CVE-2024-5559 immediately—these are confirmed initial-access vectors for an active ransomware campaign. The Southeast Asian victim concentration (Thailand, Hong Kong) means regional infrastructure is being targeted. Beyond patching, there is little here for builders not running these specific appliances.

US cyber agencies warn that Gunra ransomware-as-a-service is exploiting known Fortinet authentication bypass flaws (CVE-2024-55591 and CVE-2025-24472) to breach critical infrastructure. The group uses double-extortion and a Linux variant capable of 100 parallel encryption threads, targeting organizations globally.

Why: If your startup or enterprise runs FortiOS or FortiProxy on internet-facing appliances, patch CVE-2024-55591 and CVE-2025-24472 immediately and enforce MFA on VPN/RDP. For most general developers and founders not managing Fortinet hardware, this requires no immediate action.

Microsoft reports that China-linked threat actor Storm-1175 has switched from Medusa ransomware to a new C++ strain called StormEncryptor, which appends .encrypted to files and drops a !!!README_FIRST!!!.txt ransom note. Initial access likely exploits CVE-2026-18577, a patch bypass for CVE-2026-18556 in N-able N-central, both allowing authentication bypass and account takeover; CISA has flagged them as actively exploited. Post-compromise behavior includes AnyDesk or SimpleHelp abuse, Advanced IP Scanner for discovery, and Mimikatz for LSASS dumping.

Why: If your team or MSP runs N-able N-central, patch immediately for CVE-2026-18577 and CVE-2026-18556 and audit for AnyDesk, SimpleHelp, Advanced IP Scanner, and Mimikatz activity as compromise indicators. For everyone else not running N-central, no action is required from this specific report.

DeadLock ransomware, active since July 2025 with 96 claimed victims across Italy, Spain, Poland, Türkiye, and the U.S., uses Polygon smart contracts and the Session messaging network to decentralize its extortion infrastructure, making takedown harder. The group employs double extortion, selective encryption using Curve25519 and XChaCha20, and communicates via Session with Bitcoin or Monero payments.

Why: This is a general ransomware threat story with no direct connection to AI, agents, developer tooling, or Malaysian/Southeast Asian infrastructure. Builders in this audience are unlikely to need to change anything based on this unless they operate in the affected regions or sectors.