Welcome to your essential briefing on threats at the intersection of cybersecurity and critical infrastructure, brought to you by Neeve, the edge cloud security platform for smart buildings, making built spaces secure, intelligent, and sustainable.

This Week’s Cyber Insights

• 🔧 Ransomware Gangs Hijack Remote Access Tools for …

• 🏥 Healthcare Cybersecurity Now a Life-or-Death Is …

• 🔓 Google Refuses to Fix Critical Gemini AI Vulner …

• 📰 Further Alerts & Insights

🔧 Ransomware Gangs Hijack Remote Access Tools for Stealth Attacks

Ransomware operators have shifted to highly targeted campaigns that exploit legitimate remote administration software for stealth and persistence, turning trusted IT tools into attack vectors.

• Ransomware families began abusing popular remote access tools like AnyDesk and Splashtop to establish footholds within enterprise networks in early 2025.

• Adversaries bypass security controls by hijacking or silently installing these utilities, as security systems traditionally trust signed installers from legitimate vendors.

• Attackers leverage credential stuffing and phishing to obtain privileged accounts, then deploy remote access tools to move laterally while blending into everyday IT operations.

• High-profile intrusions attributed to LockBit and Black Basta variants combined RAT abuse with file-shredding commands to eradicate forensic traces and maximize ransom demands.

• Attackers either hijack preinstalled tools by injecting credentials into configuration files or silently deploy signed binaries using documented command-line flags.

• This approach leaves no new executables on disk and evades antivirus scanning by abusing trusted executables already whitelisted in enterprise policies.

🤔 The Bigger Picture: 

Building management systems often rely on remote access tools for vendor support and facility monitoring—these same tools are now primary ransomware attack vectors. Implement strict application whitelisting, enforce multi-factor authentication on all remote access tools, and monitor command-line arguments to detect silent installations before attackers establish persistent access to your operational technology environment.

Read the full article

🏥 Healthcare Cybersecurity Now a Life-or-Death Issue

Cybersecurity in healthcare has evolved beyond data protection to become a direct clinical safety concern, with attacks now constituting medical emergencies that disrupt patient care.

• Healthcare cyberattacks are now classified as clinical emergencies due to their direct impact on patient care

• Experts highlight the inseparable connection between cybersecurity and patient safety outcomes

• The frequency of attacks against healthcare infrastructure continues to escalate

• Healthcare organizations are being urged to prioritize cybersecurity as a patient safety measure

• Robust security protocols are essential to protect sensitive patient data and ensure uninterrupted care delivery.

🤔 The Bigger Picture: 

Healthcare facilities face unique operational challenges where cybersecurity failures directly endanger lives. Building systems supporting medical facilities must maintain the highest security standards to ensure continuous operation of life-critical systems.

Read the full article

🔓 Google Refuses to Fix Critical Gemini AI Vulnerability

An alarming security flaw in Google's Gemini AI remains unpatched, with the tech giant stating it has no immediate plans to address the issue despite researcher warnings.

• Security researchers have identified a significant ASCII smuggling vulnerability in Google's Gemini AI system

• Google has explicitly stated it has no immediate plans to fix this security issue

• The vulnerability could potentially expose users and systems to various cyber threats

• ASCII smuggling techniques allow malicious actors to bypass security filters and inject harmful content

• The high infrastructure impact rating suggests potential widespread exploitation risks

🤔 The Bigger Picture: 

Unpatched AI vulnerabilities in widely-used systems like Gemini could affect building automation systems that integrate Google services. Smart building operators should audit their Google service dependencies and implement additional security layers.

Read the full article

Further Alerts & Insights