How stolen identities, trusted tools, and compressed attack timelines are reshaping cyber defense

If you run security for a hospital system, a bank, a college, or a manufacturer, a new government advisory deserves ten minutes this week.

On July 13, NSA, CISA, FBI, and DC3, joined by partners across the Five Eyes and Europe, released "Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting" (AA26-194A). It documents a decade-plus campaign by Russia's FSB Center 16 against networking devices. The sectors it names as most at risk are financial services, healthcare and public health, energy, communications, the defense industrial base, and government, especially at the state and local levels.

Two weeks ago, Anthropic announced that its newest AI model was too dangerous to release to the public. The Claude Mythos Preview reportedly found critical software vulnerabilities, including some that had gone undetected for over twenty years. In response, Anthropic launched Project Glasswing, a $100 million coalition that includes Apple, Microsoft, Google, AWS, JPMorgan Chase, CrowdStrike, the Linux Foundation, and about fifty other major industry players. Their goal is to find and fix the most serious issues before attackers do. That was the main story.

If you've been in cybersecurity long enough, you develop a reflex: dramatic claims usually aren't true. So when a tweet started circulating in early April 2026 alleging 10 petabytes of data had been stolen from China's National Supercomputing Center in Tianjin—including defense documents and missile research—my reaction was the same as most practitioners: prove it. This brings us to the crucial question: did it really happen?

ProCircular has been monitoring a troubling uptick in ClickFix attacks—a sneaky form of social engineering that tricks users into running harmful scripts on their systems. This type of attack is particularly clever, masquerading as legitimate interactions to catch users off guard.