LinkedIn Carousel - #CyberWeekly Week 10

Cyber War Goes Live

Operation Epic Fury sparks global cyber escalation — 60+ hacktivist groups mobilize as Iran's internet drops to 1%

Platform: NIS2 Countdown — 6 Weeks to Go

Google Dismantles Chinese Espionage in Sheets

LexisNexis Breach Exposes Government Data

Easy Cyber Protection

1/4

Cyber war goes live — Operation Epic Fury triggers global escalation

On February 28, the United States and Israel launched a joint military offensive against Iran — and the cyber dimension lit up within hours.

60+ hacktivist groups activated within days, including pro-Russian groups joining the fray — a significant escalation in coordinated cyber retaliation
Iran's internet dropped to 1-4% connectivity following the strikes. Unit 42 believes this temporarily mitigates nation-state cyber operations from within Iran — but proxies and affiliates abroad remain active
Phishing campaigns weaponized a fake Israeli Home Front Command "RedAlert" app, delivering mobile surveillance malware through a legitimate-looking Android package
European businesses are not spectators. Previous Iranian cyber campaigns have targeted European infrastructure. Pro-Russian hacktivist groups already active in Europe (remember the Milano Cortina Olympics DDoS) are now aligned in this conflict

Unit 42: Iran threat brief → https://unit42.paloaltonetworks.com/iranian-cyberattacks-2026/

2/4

Platform Spotlight: NIS2 countdown — 6 weeks to audit day

April 18, 2026. That's when essential entities must demonstrate at least CyFun Basic or Important level compliance.

Wiki checklists now work: you can check off compliance tasks directly in your wiki pages — no more switching between document and tracker. Each checkbox saves immediately and syncs across your team
Assessment dropdowns polished: the CyFun level assessment now flows smoothly with no visual glitches — answer a few questions about your sector and size, and you'll know exactly which level applies
Evidence as tasks, not deliverables: stop treating compliance evidence as something you assemble at audit time. Each piece of evidence appears as a task when it's due. Complete the task, and the audit trail builds itself — timestamped, linked to the right control, ready for the auditor

Start free → https://easycyberprotection.com/start

3/4

Google dismantles Chinese espionage network hiding in Google Sheets

A China-linked threat actor breached at least 53 government and telecom organizations across 42 countries — and used Google Sheets as their command-and-control channel.

GRIDTIDE backdoor: a C-based malware that abuses the Google Sheets API to disguise C2 traffic as normal cloud activity — making detection extremely difficult. Supports file upload/download and arbitrary shell commands
42 countries, 53+ organizations: primarily governments and telecoms across Africa, Asia, and the Americas, with suspicion of 20+ additional countries. Many organizations may have been compromised for years
Google's response: sinkholed all domains, disabled attacker-controlled Google Cloud accounts, and terminated access to the Google Sheets instances used for C2. A coordinated industry effort
Living off the land: the attackers used legitimate system tools for reconnaissance, privilege escalation, and lateral movement via SSH — the same "blend in" strategy that makes access control and monitoring essential

Google: Disrupting GRIDTIDE → https://cloud.google.com/blog/topics/threat-intelligence/disrupting-gridtide-global-espionage-campaign

4/4

LexisNexis confirms breach — 400K profiles, government emails exposed

Legal data giant LexisNexis confirmed this week that hackers breached its AWS infrastructure and leaked 2 GB of stolen data.

Government data exposed: 100+ accounts with .gov email addresses, including U.S. federal judges, DOJ attorneys, and SEC staff — making this a national security concern, not just a privacy incident
Attack vector: the attackers claim they exploited a "React2Shell" vulnerability in an unpatched React frontend application to gain initial access to LexisNexis' AWS infrastructure
Stolen data includes: real names, emails, phone numbers, job functions, IT incident tickets, and account credentials for government agencies and law firms

SecurityWeek: LexisNexis breach → https://www.securityweek.com/new-lexisnexis-data-breach-confirmed-after-hackers-leak-files/