🔴 Emperador ransomware hits Vietnam power grid, ⚠️ CoinBaseCartel mid-August wave hits 7 victims, 🎯 ShinyHunters breaches BOK Financial with Aug 24 deadline, 🛡️ Gemini CLI supply chain leads to GCP compromise, 📋 Apollo Global breach part of broader financial sector social engineering campaign, 🔐 768 leaked AWS keys still active with full admin

Emperador ransomware claimed an attack on Vietnam Electricity (EVNHANOI), the country's largest power utility, threatening to publish over 300GB of exfiltrated data including 13.36 million customer records, 6.99 million subscriptions, and 2.26 million account records. The breach hits critical energy infrastructure at a national scale, with the group demanding negotiation or full public disclosure.

CoinBaseCartel launched a mid-August campaign wave claiming seven victims across multiple sectors and geographies: Patel CPA Office and Abacus Advisors in U.S. financial services, Integrated Health Systems in U.S. healthcare, Tower Insurance in New Zealand, RXPE Group in China, and PT Bank Perekonomian Rakyat Bintan in Indonesia. The breadth across accounting, insurance, banking, and healthcare in four countries suggests an opportunistic but wide-reaching operation.

ShinyHunters breached BOK Financial, a major U.S. financial institution, and issued a final ultimatum threatening data publication by August 24 unless the bank negotiates. The deadline creates immediate exposure risk for customers and counterparties.

A supply chain vulnerability in Google's Gemini CLI allowed an attacker to compromise a GCP project through a malicious GitHub issue, demonstrating how developer tooling trust chains can be weaponized for cloud infrastructure takeover.

Truffle Security's study on 768 leaked AWS keys continued to draw coverage from additional outlets, reinforcing the finding that hundreds of root and IAM keys with full AdministratorAccess remain active across public code repositories, Git histories, and container registries spanning a four-year exposure window.

Apollo Global Management disclosed that its July breach was part of a broader social engineering campaign targeting financial institutions including law firms, rating agencies, and medical technology companies during a five-day window in July. Apollo is the first victim to formally confirm that sensitive PII including Social Security numbers was compromised.

A Chinese-speaking threat actor continued to gain coverage for building an autonomous attack pipeline using DeepSeek AI through the Hermes Agent framework, automating the full kill chain from reconnaissance to exploitation against internet-facing infrastructure.

Adversa AI's zero-click Grok attack picked up additional reporting on its Cryptographic Context Injection technique, which silently exfiltrates user name, location, subscription tier, and conversation history from Grok 4.5 Fast through hidden instructions on attacker-controlled webpages.

Kaspersky identified a supply-chain attack on Android car head units via DoFun, a Chinese automotive software provider. The MoYu group, previously linked to the BadBox botnet, compromises the device-update mechanism to turn generic Android infotainment systems across multiple vehicle brands into proxy botnet nodes for ad fraud.

A SecurityWeek roundup spotlighted three active banking trojan families targeting financial institutions: Manic, Grandoreiro, and ToxicPanda 2.0, each with distinct toolchains operating across multiple regions.

Connecticut disclosed a Medicaid provider portal breach exposing payment and claims information tied to roughly 41,000 HUSKY Health members. Gainwell Technologies, the state's fiscal agent for Medicaid, detected the breach on June 25.

DYSPHOR1A ransomware claimed an attack on Yoma Fleet, a leading vehicle leasing and financing company in Myanmar, threatening to expose student accounts, personal information, academic records, and financial data.

Watchlist: rotate any leaked AWS credentials immediately; audit Gemini CLI and developer tooling supply chains for GCP project exposure; monitor the CoinbaseCartel campaign for additional victims across financial services, healthcare, and insurance; track ShinyHunters' August 24 BOK Financial deadline; and verify VPN and cloud access controls against the social engineering pattern disclosed in the Apollo Global breach.