Cybersecurity Roundup: Major Incidents, AI Threats, and Regulatory Shifts Mexico’s Cybersecurity Plan Faces World Cup Stress Test Mexico’s newly adopted national cybersecurity strategy announced in November is under pressure as the country co-hosts the FIFA World Cup. The plan includes updated cyber laws, a Q3 2024 deadline for a national strategy, and the creation of a National Cybersecurity Center to monitor threats. However, Recorded Future warns the tournament has heightened risks from ransomware gangs, hacktivists, fraud, credential theft, disinformation, and nation-state actors. NYU adjunct professor José Felipe Otero notes gaps in protecting operational technology, supply chains, and third-party software risks. China-Linked Espionage Campaign Targets North American Universities Proofpoint revealed details of UNK_MassTraction, a suspected China-linked campaign exploiting unpatched Roundcube webmail servers to target U.S. and Canadian universities since May. Focused on physics, engineering, and national security research departments, the attackers use phishing emails to steal credentials, deploy web shells, and maintain persistent access. While fewer than 10 universities were directly observed, Proofpoint estimates the campaign may have impacted dozens of institutions and remains active. Block Settles for $45M Over Cash App Security Failures Block, parent company of Cash App, agreed to a $45 million settlement with 46 U.S. states over allegations it misrepresented security protections and failed to prevent fraud. State attorneys general cited missing safeguards, including no live phone support until 2021, which allowed scammers to create fake accounts and left victims unable to recover stolen funds. The settlement mandates 24/7 customer support and builds on a prior federal agreement requiring up to $120 million in consumer restitution. Mount Royal University Confirms Ransomware Attack Mount Royal University (Calgary, Alberta) disclosed a June cyberattack where hackers stole data from a shared file storage drive and deleted files across campus systems. The CMD Organization ransomware group claimed responsibility, demanding 30 BTC and leaking samples of stolen data. The university is still assessing the breach’s scope and warns recovery may take weeks or months. Affected individuals including past employees are offered two years of credit monitoring and identity theft protection. AI-Powered Attack Breaches AWS in 72 Hours A single attacker leveraged AI-assisted workflows to infiltrate a large AWS environment in just three days, extorting an unnamed global enterprise. Incident response firm Sygnia reported the attacker chained vulnerabilities across cloud services, CI/CD pipelines, stolen credentials, and data stores, using AI to accelerate reconnaissance and tool development. The incident underscores the need for automated detection as attackers outpace traditional security operations. Paris Peace Forum Launches AI Cyber Threat Hub The Paris Peace Forum, a French non-profit, is establishing the Integrated Network for Trusted AI in Cyberspace to study AI-driven cyber threats and coordinate global responses. The initiative brings together governments, researchers, and companies like Microsoft, Orange Cyberdefense, and the Cyber Threat Alliance, aiming to build a rapid-response coalition to counter evolving threats. AI Coding Agents Trigger Security Alerts Security firm Sophos found that AI coding tools like Claude Code, Cursor, and OpenAI Codex are triggering endpoint security alerts typically reserved for attackers. While not malicious, these agents perform actions like accessing browser credentials, enumerating Windows credential stores, and downloading files behaviors that mimic intrusions. The findings highlight the challenge for security teams in distinguishing between legitimate AI assistants and actual threats. IBM and Red Hat Commercialize Lightwell for Open-Source Security IBM and Red Hat have launched Lightwell, a commercial service derived from Project Lightwell, to defend open-source software against AI-powered attacks. The tool uses AI to identify, validate, and backport security fixes into existing software versions, avoiding disruptive upgrades. The launch aligns with broader industry efforts including the Linux Foundation and Chainguard’s Athena coalition to address the growing speed of AI-driven vulnerability exploitation.