The Good, the Bad and the Ugly in Cybersecurity – Week 23

This weekly intelligence summary details several concurrent cyber issues: U.S. agencies and industry disrupted Southeast Asian crypto-enabled fraud networks and froze related funds while the Treasury sanctioned Iran’s Nobitex for sanctions-evasion; Spanish police arrested a suspect tied to a government data leak likely sourced from historical credential dumps; China-linked actor TA4922 is expanding phishing campaigns into Europe and Africa using DLL side-loading, loaders (RomulusLoader, SilentRunLoader) and RATs/infostealers (ValleyRAT, Atlas RAT) to harvest Chrome credentials and cookies; and threat actors are actively exploiting PAN-OS CVE-2026-0257 to bypass VPN authentication, with CISA adding the flaw to its Known Exploited Vulnerabilities catalog and vendors issuing patches and mitigations.