Cyberattack

• Google ha annunciato l'11 maggio 2026 di aver interrotto un cyberattacco avanzato condotto da un gruppo criminale che sfruttava vulnerabilità guidate dall'IA in sistemi informatici globali. • Gli aggressori hanno sviluppato un exploit zero-day utilizzando l'IA per la scoperta di vulnerabilità e hanno pianificato un evento di sfruttamento di massa mirato a un popolare strumento di amministrazione di sistemi basato sul web e open-source, aggirando l'autenticazione a due fattori. • Il Google's Threat Intelligence Group (GTIG) ha identificato e contrastato proattivamente la minaccia, collaborando con il fornitore interessato per una divulgazione responsabile al fine di prevenire una compromissione diffusa.

• Il blackout di Canvas a livello nazionale ha lasciato studenti e docenti in einer situazione di stallo, costringendoli a riorganizzare rapidamente la fine dell'anno accademico. • Un sistema utilizzato da migliaia di scuole e università negli Stati Uniti è rimasto offline giovedì a causa di un cyberattacco, creando il caos mentre gli studenti cercavano di studiare per gli esami finali e sottolineando la dipendenza dell'istruzione dalla tecnologia. • Gli studenti si sono rapidamente rivolti ai social media per chiedere se altri avessero problemi di accesso a Canvas, con molti in preda al panico per l'impossibilità di visualizzare i materiali didattici contenuti nella piattaforma per studiare per i loro esami finali.

• CrowdStrike disclosed on April 25, 2026, a sophisticated cyberattack via compromised third-party software affecting 2.5 million patient records at UnitedHealth's Change Healthcare subsidiary. • Attackers, linked to North Korean Lazarus Group, exfiltrated data over 72 hours before detection, demanding $22 million ransom. • Incident highlights vulnerabilities in US healthcare IT supply chains, prompting HHS emergency directives for 500+ providers.

• IBM announced IBM Autonomous Security on April 15, 2026, deploying coordinated AI agents to detect and contain threats at machine speed without human intervention. • The service addresses a critical gap: attackers now achieve full network lateral movement in as little as 27 seconds, compared to an average of 29 minutes in 2024—a 65% speed improvement driving urgent demand for AI-powered defenses. • AI-enabled attacks surged 89% year-over-year in 2025, with a 44% increase in assaults exploiting public-facing applications, prompting major security vendors to adopt autonomous AI defense strategies.

• CrowdStrike disclosed on April 20, 2026, a sophisticated supply chain attack affecting 1,200 US clients, including Fortune 500 firms, via compromised third-party software. • Attackers deployed ransomware, encrypting critical systems and demanding $50 million in Bitcoin; no data exfiltration confirmed yet. • The incident highlights rising risks in software supply chains, echoing SolarWinds breach, with FBI joining investigation.

• NATO's Cyber Defense Centre convened an emergency session Friday evening after Russia launched a sophisticated cyberattack targeting Poland's electrical grid and water treatment facilities, temporarily affecting 2.3 million residents. • Polish authorities attribute the attack to Russian military intelligence, claiming it used previously unknown malware variants designed to evade NATO defense systems and test alliance cyber resilience. • The incident prompted NATO to raise its cyber alert status to level 3, the highest in the alliance's history, and triggered Article 5 consultations regarding collective defense implications.

• IBM launched IBM Autonomous Security on April 17, 2026, a multi-agent AI service automating detection, policy enforcement, and remediation against frontier AI-driven attacks in hybrid environments. • The solution addresses emerging 'agentic attacks' where adversaries use advanced AI models, with nearly 80% of global IT leaders citing AI as a major security risk. • IBM also released an enterprise cybersecurity assessment tool focused on threats from large language models and generative AI.

• Iranian cyberattacks target critical U.S. infrastructure as President Trump threatens strikes on Iran's bridges and power plants. • The cyber activity escalates frictions during the fraying ceasefire, with unclear U.S. peace terms. • U.S. officials report the attacks follow Trump's profanity-laden threats, prompting Democratic backlash.