CyberWatch Weekly: AI-Run Ransomware, Iranian Recruitment Lures, and a Healthcare Breach Nine Months in the Making

This week’s incidents point to one common shift: attackers are stripping effort from the equation while defenders continue paying the full price. A ransomware affiliate handed most of its attack chain over to an AI agent and dropped the price of compromising a company to the cost of a Starbucks. An Iranian espionage group refined a recruitment lure to the point where the fake employer now bans candidates from using AI, because the tools would recognise the payload. And a healthcare data processor disclosed the true scale of a December intrusion this week, nine months after the attack was successful. Here’s a closer look at this week’s top cybersecurity headlines.

Exposed Server Reveals Ransomware Operation Running on an AI Agent for Under $4 per Victim

Cybernews researchers recognised an exposed server on 22 July belonging to an affiliate of The Gentlemen ransomware group, containing 3.1TB of stolen data across 30 companies. The operation ran entirely on an open-source AI harness powered by DeepSeek V4 Pro with little human involvement. The operator prompts a GitLab URL and stolen credentials, likely sourced from infostealer logs or access brokers. The AI agent handles reconnaissance, exploitation, exfiltration, and the ransom demand by itself. Logs suggest a token cost of $0.40 to $4.00 was required per company, which is the total cost of the attack. Encryption has been dropped completely in favour of straight data-theft extortion, with the agent generating pressure dossiers on each victim, working out what ransom figure the stolen data can realistically support. The model’s safety guardrails were bypassed by framing the work as a capture-the-flag exercise themed around Alice in Wonderland, cloned from a public GitHub repository, so the model believed it was solving GitLab CI/CD security challenges rather than compromising the data of real victims. Exploited vulnerabilities included CVE-2021-22205, CVE-2023-7028, CVE-2023-2825, and CVE-2021-22214, all long patched and all still sitting exposed somewhere. 

The detection problem here is structural. The agent writes its own post-exploitation scripts for container escape, lateral movement, and privilege escalation based on what it finds in the environment, where signature-based controls have nothing consistent to match against. Researchers recommend restricting GitLab instances to trusted networks or VPN allowlists, watching for bulk repository cloning and unfamiliar tooling appearing on CI/CD runners, flagging HTTP PUT traffic that carries data out of trusted segments, and auditing repositories for embedded secrets and whether they are marked private or not.  

Source: Cybernews Research

Mirage Kitten Delivers NodeRabbit and PollCat Through Fake Technical Assessments

Kaspersky has documented an Iranian state-linked espionage campaign targeting developers and technical specialists across aviation, aerospace, and financial technology in Egypt, Ethiopia, and Afghanistan. The group was tracked as Mirage Kitten and is also known as UNC1549, Smoke Sandstorm, and Nimbus Manticore. They approach targets through LinkedIn and job platforms, posing as recruiters for major technology firms. Victims are asked to complete a coding assessment hosted on Amazon cloud storage. Two previously undocumented malware families were identified in research: NodeRabbit, a cross-platform remote access trojan capable of infecting Windows, Linux, and macOS, and PollCat, which digs in for persistent access and delivers follow-on payloads. Two details in the tradecraft stand out. One archive told the candidate to fix application flaws within three hours and explicitly forbade the use of AI assistants, which Kaspersky reads as a deliberate move to keep those tools from noticing the malicious component in the project. In the PollCat campaign, targets were given a single-use six-digit access code valid for a short window, squeezing the decision window further. The group also runs command and control through legitimate Azure and Cloudflare infrastructure, and in some cases wrote the target organisation’s own name into an Azure subdomain, so the traffic resembles normal corporate activity.

The attack surface here sits outside the corporate perimeter entirely, since the attack happens on a personal laptop and LinkedIn account before the target ever logs into work. Practical controls include hardening developer endpoints to the same standard applied to privileged systems, egress monitoring for cloud subdomains that resolve outside sanctioned tenants, and writing recruitment lures into technical staff awareness programmes rather than leaving phishing simulation as something finance and HR go through once a year.  

Source: Kaspersky Securelist, reported by The Record

Aesto Reports 9.5 Million Affected, Nine Months After Attackers Entered Its AWS Environment

Healthcare data company Aesto notified the US Department of Health and Human Services this week that more than 9.5 million people had sensitive information exposed in an intrusion that took place in December 2025. The attackers were inside the company’s Amazon Web Services infrastructure between 2 December and 18 December. Aesto warned its customers in June, but the scale of stolen data remained unpublished until now. The stolen data covers names, Social Security numbers, medical information, driver’s licence numbers, financial account numbers, and health insurance details. At least 30 healthcare organisations were caught up in it. No group has claimed responsibility, and the company has not responded to comment publicly. The detail that makes this more than another large number is what Aesto actually does: it handles data migration and archiving for medical facilities upgrading their systems or switching electronic health record vendors. That means it holds records belonging to patients of organisations that were never its direct customers, and often data that the originating provider has already moved on from. The week reported two similar disclosures, with Baylor Genetics reporting 2.8 million affected and Park Dental Partners filing an 8-K with the SEC over possible patient data access.

Archival and migration processors concentrate risk in a way that active production systems do not, precisely because the data is retained without any operational owner watching it. Third-party risk assessments that map only live integrations will miss these relationships entirely. It is worth reviewing which of your vendors still hold historical records from decommissioned systems, what the contractual retention and deletion terms actually underline, and whether your incident notification clauses require the processor to report scope on a defined timeline instead of whenever it is convenient for them.

Source: The Record, citing Aesto’s HHS filing

Conclusion

One pattern connects all three stories. The cost of attacking keeps falling. The cost of defending has not moved. An AI agent runs a full extortion campaign for the price of a sandwich, a recruitment lure now anticipates and blocks the tools that would expose it, and a nine-month disclosure gap leaves 9.5 million people unaware their records moved. Any control built on the quiet assumption that attacks are expensive to run deserves a revisiting insight. 

Stay vigilant and informed, tune in next week for more updates in InfosecTrain’s CyberWatch Weekly!