CyberCapsule - May 2026

CONSIDER THIS

• Ho, ho, hey, hey, Nationwide AI Legislation, Not Today. On April 3, 2026, analysts discussed the grim possibility of Congress passing nationwide AI legislation this year, and the reasons for the bleak outlook.
• Airspace Lagging Behind in Cyberspace. On April 3, 2026, a Department of Transportation audit determined that its systems that power the National Airspace System are relying on outdated and inadequate standards.
• The Mountain State Sets High Bar for Statewide Cyber Standards. On April 3, 2026, the West Virgina Legislature signed a bill empowering its chief information security officer to design and implement statewide cybersecurity policies and standards.
• The FBI’s FYI. On April 8, 2026, the FBI published its annual report, highlighting that in 2025 it received more than 1 million complaints of malicious activity, leading to over $20 billion in losses in 2025 alone.
• NIST Narrowing Its List. On April 15, 2026, NIST is narrowing its priority list of vulnerabilities to help reduce workload.
• Harsher Penalties for Hospital Ransomware. On April 21, 2026, during a House Homeland Security Committee, lawmakers pondered harsher penalties for ransomware attacks on hospitals, including designating such attacks as terrorism and assessing homicide charges against attackers.

AS THE WORLD TURNS

• Gone in 60 Minutes. On April 2, 2026, researchers revealed the sophistication of Akira, highlighting its ability to encrypt data as quickly as within an hour of initial unauthorized access.
• Re-Route Old Router. On April 7, 2026, Krebs posted that Russian hackers are exploiting known vulnerabilities in older routers to obtain authentication tokens from Microsoft users.
• Black Basta Back Alright. On April 14, 2026, researchers reported that Black Basta has reemerged and is relying on social engineering to gain remote access to corporate networks.
• The Jig Is Up. On April 16, 2026, two New Jersey men were sentenced for their role in planting North Korean operatives in companies posing as employees.
• DDoS No Mas. On April 17, 2026, a multi-authority contingent took down 53 DDoS domains. 
• Scattered Spider Caught in a Web. On April 17, 2026, a senior figure in the Scattered Spider group pleaded guilty to conspiracy to commit wire fraud and aggravated identity theft.