USA: Cybersecurity Situation, August 2026

Active threats and campaigns in the USA

Ransomware and extortion

In August, ransomware was the main focus, with 25 cases out of 92 incidents and a highly uneven level of certainty. There were two confirmed cases of exfiltration without encryption, four mentions limited to leak sites, and nineteen situations where the material did not make it possible to determine whether there was encryption, exfiltration, or both.

Among the better defined cases was Boston Scientific, which the primary source did not present as ransomware, but as a cybersecurity incident with operational disruption. On the purely extortion side, STORM, CoinbaseCartel, Global Secret Group, KRYBIT, Chaos, Metaencryptor, DragonForce, Emperador, Wallstreet, Falcon, and Qilin accounted for much of the criminal market noise, although not all of the listings were publicly confirmed by victims.

Cases with confirmed exfiltration without encryption

The material made it possible to isolate two cases in which extortion was described as exfiltration without encryption. One was mswalker.com, where follow-up reporting indicated about 620 GB extracted before any encryption was mentioned. The other involved a scenario in which the coverage itself described the publication of sensitive data without being able to support that encryption was the main issue.

In this category, the operational pattern matters as much as the volume. The goal was not to shut down a service, but to use stolen data to pressure the target with the threat of publication. That makes early detection harder, because the company can keep operating while the damage is already underway.

Cases mentioned only on leak sites

Four incidents remained at the level of a simple leak-site mention. This included claims by groups such as Chaos, STORM, CoinbaseCartel, and others about victims in the United States, but without independent public confirmation of the technical scope or the type of information exposed.

That subgroup matters because it shows the gap between the extortion economy and official visibility. An actor can publish a name, a sample, or a threat and still, by the end of the period, there may be no validation strong enough to describe the episode as a confirmed breach.

Fraud, phishing, and account takeover

Documented fraud and phishing activity was low in absolute volume, but very clear in direction. There were four cases, two centered on fraudulent calls or spoofing to obtain data, and two tied to AI-driven scams and weak identity verification.

The most repeated pattern was the use of support or fraud team impersonation to force account changes or transfers. That scheme appears in materials on financial institutions as well as in more general notes on deepfakes and remittances, reinforcing that the human vector remained a relevant entry point in the USA.

APT, espionage, and hacktivism

The APT and espionage segment was marked by Salt Typhoon, Lilac Typhoon, and the operation against QTFY and its QScan and QTRouter platforms. In telecommunications, the sources described a broad espionage campaign with access to lawful intercept, metadata, and obfuscation nodes. In the QTFY case, the focus was on federal agencies, hospitals, energy, and finance.

There was also material on the Iranian campaign against water and on the federal warning about Siemens S7 PLCs. That front does not fit neatly into ransomware or fraud, because it involves remote access, reconnaissance, and exploitation of exposed OT, with potential physical or operational impact rather than monetary loss.

Cases with the highest classification uncertainty

Nineteen incidents linked to ransomware or extortion did not allow the material to determine whether there was encryption, exfiltration, or only publication on a leak site. That ambiguity is not trivial, because it changes how response, notification, and external communication should be prioritized.

Operationally, this block requires careful treatment of any aggregate reading. The month brought more visible criminal activity, but also more documentary noise. The useful takeaway is not that every case caused more damage, but that there were more claims, more campaigns, and more public visibility around extortion.

Critical vulnerabilities affecting the US

August’s technical pressure in the US was driven in large part by the addition of multiple flaws to CISA’s KEV catalog and by joint alerts about active exploitation. The mix of Citrix NetScaler, VMware vCenter, Metabase, Windows, SharePoint, Cisco ASA/FTD, and Zimbra showed that exposure was not concentrated in a single product family.

Technical read of the table

CISA’s bias in August was clearly operational. The goal was not only to publish flaws, but also to set very aggressive remediation deadlines for federal agencies and push private organizations to treat exposure as real. Metabase, NetScaler, vCenter, and N-central stand out as high-priority products because they combine exposed attack surface, broad adoption, and real-world exploitation.

Regulation and compliance in USA

August’s regulatory agenda in the USA was intense and, on several fronts, clearly tougher. There were eleven documented moves, with the financial system as the main focus, but water, telecom, child privacy, information sharing, and the energy supply chain were also on the radar.

The OCC and the FDIC issued a uniform final rule on unsafe or unsound practices, with an explicit materiality threshold for MRAs and a shift toward material financial risks. That may sound like classic bank supervision, but it also affects how banks turn cybersecurity findings into compliance actions.

At the same time, the FTC kept in place and clarified the GLBA Safeguards Rule for financial institutions, while NIST published quick references to translate CSF 2.0 into concrete controls. In practice, that pushes banks, fintechs, and vendors to document controls, risk assessments, and third-party oversight more thoroughly.

Most relevant regulatory moves

Financial sector, privacy, and enforcement

The financial system was where regulation and cybersecurity overlapped most. FinCEN imposed a historic penalty on UBS Financial Services for BSA violations, and the debate over supervision, material risk, vendors, authentication, and incident reporting remained very active.

There was also a $400 million settlement between DOJ and TikTok / ByteDance over child privacy. While it was not a banking case, it set the tone for enforcement against large platforms with operations in the USA. For compliance teams, August showed that exposure is not limited to technical failures, it also includes data handling, disclosure, and third-party governance.

Water, energy, and telecommunications

The water sector saw a notable regulatory and operational response, with joint notices from federal agencies, legislative proposals, and public tracking of more than 100 exposed systems. The energy sector also gained weight with Executive Order 14420 on foreign equipment in the bulk power system.

Telecommunications remained at the center of espionage concerns, with Salt Typhoon still in the background. Although much of the material focused on campaigns from previous years, August reopened the debate over foreign vendors, interconnections, and residual exposure in critical networks.

Most Affected Sectors in the USA

The sector signal for the month was broad, but not scattered. Health care, manufacturing, transportation, finance, and utilities accounted for much of the activity, with water and telecommunications as critical infrastructure fronts and digital services as an indirect exposure vector.

Health care faced the heaviest pressure from ransomware and extortion, but also from unauthorized access incidents, double-extortion warnings, and vulnerabilities affecting the supplier chain. Activity from Medusa and Gunra reinforced the pattern of attacks on hospitals and public health organizations, while STORM, CoinbaseCartel, and other groups added more volume.

Manufacturing and transportation showed up in ransomware campaigns, CVE exploitation, and operational incidents. Encryption was not always involved, but victim disclosure, extortion pressure, and disruptions to administrative processes, logistics, and corporate systems were. In some cases, such as North Carolina Ports, the damage was more about continuity than confidentiality.

Finance and insurance kept the most visible regulatory weight. U.S. Bank denied compromise after a LockBit claim, FinCEN sanctioned UBSFS, and the OCC and the FDIC shifted the supervisory baseline. For financial institutions, August was not just a month of incidents, but of changing expectations for control.

Utilities, especially water, confirmed that OT exposure remains a federal priority. The combination of exposed PLCs, credential changes, and attacks across multiple states shows that the resilience of local infrastructure is not an isolated or purely technical issue. The vulnerability of those environments was also tied to legislative warnings and direct pressure from CISA.

Trends and signals to watch in the USA

A comparison with July shows an improvement in signal quality, not a reduction in risk. Verified incidents rose from 73 to 92, untagged incidents fell from 23 to 12, and the dominant category shifted from generic incidents to ransomware. That points to a month with better analytical visibility and more well-documented criminal campaigns.

The jump from 8 to 18 critical CVEs mentioned is the strongest technical signal of the month. It does not mean there were ten times more exploited vulnerabilities in the country, but that the material reviewed placed much more emphasis on active exploitation, KEV, and patch timelines. For defenders, that means August functioned as a month of pressure around known exposure.

Regulatory activity also increased, from 7 to 11 documented moves. Not all had the same impact, but they did show convergence across banking, water, privacy, information sharing, and energy. The practical reading is that compliance stopped being a side issue and became part of the cybersecurity response.

What to watch in September is whether the wave of leak site posts turns into more public confirmations or whether ambiguity continues to dominate. It is also worth watching the KEV deadline for NetScaler, the real behavior of the groups that exploited Metabase, and whether regulatory measures in water and energy become more concrete obligations for operators and critical infrastructure.

Security recommendations for USA

U.S. security teams should prioritize patching and external exposure in parallel. The mix of Metabase, NetScaler, vCenter, N-central, SharePoint, Windows IKE and Zimbra calls for a remediation campaign based on KEV, not theoretical severity. If an asset is internet-facing or supports remote access, it needs to be at the front of the work queue.

In healthcare and critical services, organizations should strengthen segmentation, phishing-resistant MFA and immutable backups. The warnings on Medusa and Gunra again show abuse of RMM, lateral movement with valid credentials and backup deletion as a recurring pattern. If that trio is not contained, response will be more expensive and slower.

Organizations with logistics, analytics or business software third parties should review permissions, tokens, service accounts and monitoring of access to shared platforms. The ShipMonk case, along with the supplier breach and leak site extortion, shows that indirect exposure can end up affecting customers, reputation and mandatory notifications.

In water, energy and manufacturing, this month’s operational minimum is to inventory exposed PLCs and OT equipment, remove unnecessary direct access and validate factory or shared credentials. Federal alerts on Siemens S7 and water systems made clear that the issue is not abstract, but about exposed surface, weak authentication and remote administration without enough control.

Frequently Asked Questions

What changed between July and August in the U.S., volume or severity?

Both increased, but the clearest shift was in signal quality. August recorded 92 verified incidents, up from 73 in July, unclassified incidents fell, and ransomware became the dominant category. Critical CVEs mentioned and documented regulatory actions also rose sharply.

Which sectors were most exposed in the U.S., and why does it matter to cross-reference them with CVEs?

Healthcare, manufacturing, transportation, finance, water, and telecommunications accounted for a large share of the incidents. Cross-referencing them with CVEs matters because several exploited flaws affected remote access software, virtualization, identity systems, and administrative tools used by those same industries.

What practical priority do Medusa and Gunra have compared with other ransomware groups?

Medusa and Gunra should be treated as high priority because official material linked them to active campaigns against healthcare, critical infrastructure, and enterprise environments, along with double extortion tactics, abuse of exposed vulnerabilities, and lateral movement. The other groups added volume, but with more uncertainty in classification.

What does the confirmation of more than 100 water systems attacked mean for a local operator in the U.S.?

It means this was not an isolated case or just a media headline. CISA acknowledged a concrete figure of more than 100 exposed systems attacked in July, and federal advisories continued to call for segmentation, PLC control, and the removal of direct internet access. For a local operator, the risk is both operational and regulatory.

What is the difference between a leak site mention and a confirmed breach in the U.S.?

A leak site mention is only a claim by the actor or tracker and does not, by itself, equal a verified breach. In August there were four such mentions and nineteen cases where the source did not allow the impact type to be determined. The distinction is key to avoid overreacting or underestimating.

Technical appendix: indicators of compromise and TTPs

This month’s materials do provide TTPs and some useful technical signals, though not always classic IoCs. In ransomware and extortion, the recurring patterns are RMM abuse, PsExec, WMI, lateral movement, shadow copy deletion, pre-encryption staging, and the use of valid credentials. In OT, the material points to Siemens S7 PLCs exposed to the internet, port 102, the use of snap7, and AI-generated exploitation scripts.

In the case of Gunra, the sources cite Fortinet exploitation, credential dumping, RDP, Impacket, exfiltration of local and cloud data, and encryption with ChaCha20 and RSA-4096. In the case of Metabase, the most repeated technical vector was the /api/session/reset_password endpoint or equivalent unauthenticated SQL injection paths.

The material also mentions specific domains and artifacts in campaigns that are not always strictly US-focused. Among the clearest are models.litellm.cloud, M365-OWA[.]com and owa-ms365[.]com in the CaptiveCrunch campaign, and the QScan and QTRouter domains seized by the DOJ in the operation against China-sponsored hacking. Because of their cross-threat value, these elements should be kept as operational reference material, even if not all of them relate directly to the USA.

Material limitations

This report was built exclusively from the material provided for the USA and August 2026. Facts from earlier months included in the file were used only as comparative context and were not counted as part of the month’s volume. There was also one incident without a confirmed date, which was excluded from all indicators.

A zero value in an indicator, especially for CVEs, does not mean there are no critical vulnerabilities in the region. It means none appeared in the material analyzed for this period. This issue did include many critical CVEs, but the methodological rule remains the same for any future note.

Aggregated telemetry, such as attack attempts, blocks, or scans, was not used as an incident or as trend data. When intelligence sources provided detection or exploitation figures, they were always treated as technical context or a methodological warning, not as country telemetry.

Sources outside the permitted list were also not used as evidence, nor were social media posts or sponsored content not authorized by the assignment. When a source presented a claim that was not confirmed by the victim or by a regulator, it was treated as such and not as a verified breach.