This briefing covers 20 cybersecurity and geopolitics stories published around Thursday, August 20, 2026, including activity involving PLA, Salt Typhoon, China, and 5 disclosed vulnerabilities (CVE-2026-64849, CVE-2026-65400, CVE-2026-76389, CVE-2026-76589 and others). Each entry links to the original reporting.
An unreported Chinese-nexus espionage group dubbed SilkParasite has hit Central Asian government bodies with seven RAT families—five previously unknown, including DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT, and NodeEdgeRAT, active since late 2025.
A Chinese APT with links to FamousSparrow is running a spear-phishing campaign deploying multiple RAT families against Central Asian organizations. The operation reveals deliberate PRC tooling diversification to complicate attribution and sustain persistent access across Belt and Road–adjacent states.
The Justice Department indicted 17 alleged Iranian government-linked hackers for breaching email accounts at US federal agencies and stealing intellectual property from dozens of universities.
The DOJ charged 17 Iranians tied to the Mabna Institute hacking-for-hire operation with stealing intellectual property from U.S. organizations valued at $3.4 billion across a years-long campaign. The indictment formalizes longstanding attribution and raises pressure ahead of any diplomatic engagement with Tehran.
China's PLA is piloting AI decision-making in operational command roles while its official newspaper maintains humans retain final authority. The gap between doctrine and practice signals Beijing may be building toward autonomous or semi-autonomous command structures that outpace Western treaty frameworks.
The US-Iran conflict has settled into stalemate as Mohsen Rezaei's appointment to lead Iran's security structure reshapes internal power dynamics. Rezaei's elevation signals hardliner consolidation and reduces near-term prospects for negotiated off-ramps.
Unattributed hackers seized 14,500 Dahua IP cameras over 35 days in a campaign researchers named CameraSwarm, with victims concentrated in Ukraine and Russia. Mass compromise of surveillance hardware in an active war zone creates persistent ISR and botnet potential for whichever actor controls the access.
NSA, CISA, and partner agencies issued a joint advisory warning that threat actors are using AI-generated tools to attack Siemens S7 Series PLCs embedded in US critical infrastructure. AI-accelerated exploit development compresses defender response time and lowers the barrier for sophisticated ICS attacks.
NSA and FBI warn a threat actor is using AI-assisted development to exploit known vulnerabilities in Siemens S7 Series PLCs across US critical infrastructure. AI tooling is accelerating attack sophistication against industrial control systems at a pace that legacy patch cycles cannot match.
CISA and partner agencies warn threat actors are deploying AI-generated scripts to compromise Siemens S7 Series PLCs in US critical infrastructure sectors. The use of AI to automate ICS exploitation marks an escalation in attack sophistication against operational technology environments.
U.S. federal agencies warned that threat actors are using AI-generated code to attack critical infrastructure controllers, calling it an active — not theoretical — threat.
A rare opening exists for US-North Korea diplomacy, but analysts warn demanding denuclearization as a precondition will close it before negotiations begin. Trump's approach will determine whether Washington converts tactical leverage into durable security arrangements or repeats prior impasses.
Despite strong diplomatic momentum, India-Japan defense-industrial cooperation remains shallow due to asymmetric industrial capacity and bureaucratic friction. The gap leaves both nations exposed in an Indo-Pacific security environment increasingly shaped by integrated allied production networks.
Just Security argues that U.S. sanctions effectiveness is eroding due to inconsistent application and lack of clear signaling to targeted states and allies. Diminished sanctions credibility shifts the coercive burden to harder instruments — military or covert — with higher escalation risk.
The FBI confirmed Medusa ransomware has compromised more than 500 U.S. critical infrastructure organizations since June 2021. The scale and sector targeting establish Medusa as a sustained strategic threat, not opportunistic crime.
CISA added CVE-2026-65400 (macOS, CVSS 9.8) and three others affecting SharePoint, vCenter, and Microsoft IKE to its Known Exploited Vulnerabilities catalog, confirming active in-the-wild exploitation.
CVE-2026-64849 in MLflow allows attackers to reach internal and cloud metadata services, exposing response data and tokens. ML infrastructure is now a live federal attack surface under BOD 26-04 mandatory remediation.
CVE-2026-76590 (CVSS 9.9) is a remotely exploitable stack-based buffer overflow in TRENDnet TEW-755AP's wan.cgi, with a public exploit already available. Consumer-grade router flaws with public PoCs historically convert rapidly to botnet recruitment infrastructure.
CVE-2026-76589 (CVSS 9.9) exposes TRENDnet TEW-755AP via the mycli FUN_401000 function's ssid argument, exploitable remotely with a publicly available PoC. Two critical public exploits against the same device in a single release cycle dramatically compresses the patch window for exposed deployments.
CVE-2026-76389 in Cisco Talos Intelligence for Enterprise Security Cloud below v1.0.3 lets credentialed users force outbound requests that leak tokens to attacker-controlled servers.