Welcome to your essential briefing on threats at the intersection of cybersecurity and critical infrastructure, brought to you by Neeve, the edge cloud security platform for smart buildings, making built spaces secure, intelligent, and sustainable.

This Week’s Cyber Insights

• 🤖 AI-Powered Ransomware 2.0 Emerges as Critical I …

• 🏭 IT/OT Convergence Creates New Security Vulnerab …

• 🎯 Cybercriminals Deploy CyberLock Ransomware Thro …

• 🔍 AI Transforms Penetration Testing Landscape for …

• 📰 Further Alerts & Insights

🤖 AI-Powered Ransomware 2.0 Emerges as Critical Infrastructure Threat

Ransomware attacks have entered a dangerous new era, with AI-powered "Ransomware 2.0" marking a significant evolution beyond traditional file encryption. These sophisticated attacks now incorporate artificial intelligence to make them more devastating, harder to detect, and increasingly difficult to prevent against operational technology and building systems.

• Double and triple extortion tactics now standard. Attackers steal sensitive data before encryption and threaten publication, with some groups adding DDoS attacks for maximum pressure

• AI-enhanced phishing success rate reaches 78%. SoSafe research reveals humans opened AI-generated phishing emails at unprecedented rates, with 21% clicking malicious content

• Recent major attacks target essential services. Medusa ransomware hit over 300 organizations across healthcare, education, manufacturing, and insurance sectors in March 2025

• Enhanced reconnaissance capabilities allow attackers to scan networks for vulnerabilities, misconfigurations, and unpatched systems 40% faster than manual methods

🤔 The Bigger Picture:

Ransomware 2.0 represents a fundamental shift that directly threatens operational continuity in smart buildings and critical infrastructure. Unlike traditional ransomware, these AI-powered attacks combine operational disruption with data theft and public exposure threats. For facility managers, traditional backup strategies are insufficient - organizations must implement comprehensive defense strategies that account for data theft, leverage AI for detection, and prepare for multi-faceted extortion tactics.

Read the full article

🏭 IT/OT Convergence Creates New Security Vulnerabilities in Industrial Environments

While IT/OT convergence offers significant security and cost benefits, the integration process is creating new attack vectors that threaten critical infrastructure operations. The research shows 61% of companies have CIOs leading convergence efforts, but security challenges remain the primary concern.

• Security emerges as biggest convergence driver. Organizations cite numerous OT legacy systems with exploitable vulnerabilities as primary motivation for IT/OT integration

• Maturity levels vary dramatically. Only 13% of organizations reach "optimizing" level with fully integrated IT/OT systems, while 23% remain in pilot project phases

• OT data sovereignty creates governance gaps. Most production data remains under OT control while IT provides systems, creating potential security blind spots

• Communication barriers persist. Majority of companies report only loose but regular exchanges between IT and OT teams, hampering unified security approaches

• Geographic challenges complicate security. Individual production sites work with heterogeneous system landscapes, especially international locations

🤔 The Bigger Picture:

IT/OT convergence fundamentally alters the security landscape for smart buildings and industrial facilities. While convergence promises improved security through standardized controls, the integration process creates transitional vulnerabilities that attackers actively exploit. Building operators must ensure security policies span both domains during convergence, establish clear communication between IT and OT teams, and implement step-by-step integration to avoid exposing facilities to ransomware and nation-state attacks.

Read the full article

🎯 Cybercriminals Deploy CyberLock Ransomware Through Fake AI Installers

Cisco Talos researchers have uncovered a sophisticated campaign where cybercriminals exploit the AI boom by creating fake AI software installers that distribute ransomware and destructive malware. The attacks target businesses seeking AI tools, using legitimate-looking websites with domain names that closely mimic real AI vendors.

• CyberLock ransomware demands $50,000 in Monero cryptocurrency and targets sensitive business documents, personal information, and confidential databases with privilege escalation capabilities

• Three distinct malware families identified. CyberLock, previously unknown "Numero" malware that renders Windows machines unusable, and Lucky_Gh0$t Yashma variant

• Domain spoofing tactics employed. Fake websites like novaleadsai[.]com target users searching for legitimate novaleads.app, appearing at top of Google search results

• B2B sector specifically targeted. Attackers focus on business users seeking AI sales and marketing tools, exploiting ChatGPT and InVideo AI popularity

• No data exfiltration observed. Unlike Ransomware 2.0 trends, CyberLock appears focused solely on encryption and ransom demands

🤔 The Bigger Picture:

This campaign highlights the exploitation of AI adoption in critical infrastructure and smart building environments. Facility managers implementing AI-powered building management, energy optimization, or security platforms face elevated risks from fake AI software. The targeting of B2B users suggests attackers understand business-focused AI tools often integrate with operational systems.

Read the full article

🔍 AI Transforms Penetration Testing Landscape for Critical Infrastructure

The cybersecurity industry is experiencing a fundamental transformation as artificial intelligence reshapes both offensive and defensive security strategies. This evolution presents a dual challenge: leveraging AI to enhance traditional penetration testing capabilities while developing new methodologies to secure AI systems against sophisticated attacks targeting critical infrastructure.

• Autonomous pentesting tools emerge. NodeZero by Horizon3.ai offers full-scale penetration tests across on-premises, cloud, and hybrid infrastructures without scope, perspective, or frequency limitations

• AI-guided testing capabilities. PentestGPT, built on GPT-4, can solve simple to moderate HackTheBox machines and CTF puzzles, marking significant milestone in AI-assisted penetration testing

• Deep reinforcement learning integration. DeepExploit tool executes exploits with pinpoint accuracy and penetrates internal networks deeply using self-learning capabilities

• New international standards established. ISO/IEC 42001:2023 represents world's first international standard explicitly addressing AI management systems security

🤔 The Bigger Picture:

The convergence of AI and penetration testing is accelerating security assessments for smart buildings and critical infrastructure. Traditional manual testing approaches cannot keep pace with rapidly evolving AI systems deployed in building automation, energy management, and operational technology. Facility managers must adapt to quarterly or semi-annual testing cycles as AI systems continuously learn and evolve, requiring specialized expertise in artificial intelligence vulnerabilities alongside traditional infrastructure security assessments.

Read the full article

Further Alerts & Insights