DIAMATIX Cybersecurity Weekly Digest: AI Phishing, Exploited Infrastructure and Europe’s Cyber Resilience

This week brought several signals worth watching closely — from AI-assisted phishing and conflict inside the cybercrime ecosystem to actively exploited infrastructure vulnerabilities and new European threat data.

We selected the developments most relevant to organizations managing critical systems, sensitive data and regulatory responsibilities.

ShinyHunters vs. Cl0p: conflict inside the cyber underground

ShinyHunters claims it took control of Cl0p’s dark web site following a dispute linked to an Oracle E-Business Suite vulnerability. Reuters reported that two cybersecurity experts considered the conflict likely authentic.

The broader signal is the value of vulnerabilities, access and exploits inside the cybercrime economy.

Read our analysis:
A Rift in the Cyber Underground: ShinyHunters Claims Takeover of Cl0p Site

EvilTokens: AI is now helping attackers choose the target

Microsoft disrupted infrastructure linked to EvilTokens, a platform that used AI not only to create more convincing phishing messages, but also to analyze compromised inboxes, identify trusted contacts and prepare financial fraud.

The important shift is that AI is starting to help attackers understand business context, not simply write better emails.

Read our analysis:
EvilTokens: When AI Helps Phishing Look Like Real Business Communication

Switzerland moves toward post-quantum readiness

WISeKey, SEALSQ and the Canton of Jura are planning a Swiss Post-Quantum Semiconductor and Cybersecurity Center, linking post-quantum cryptography, secure chips, digital identity and trusted infrastructure.

The signal for businesses is clear: post-quantum security is gradually moving from research into infrastructure and strategic planning.

Read our analysis:
Swiss Post-Quantum Security Project Puts Chips, Identity and Trust in Focus

ENISA: critical sectors remain under the strongest pressure

The new ENISA Threat Landscape 2026 reports that ransomware remains the most impactful short-term incident type, while public administration remains the most targeted sector. 73% of targeted organizations were essential or important entities under NIS2.

ENISA also points to increasing use of AI by malicious actors, alongside continued exploitation of vulnerabilities and social engineering.

F5 BIG-IP: critical infrastructure remains a priority target

A critical vulnerability affecting F5 BIG-IP APM also drew attention this week, with reports of active exploitation.

For affected organizations, the priorities are straightforward: identify exposed assets, apply available fixes and review systems for signs of compromise.

Bulgaria: local risk follows the wider European trend

Bulgaria has also seen an increase in publicly reported cyber incidents, including business disruption and theft of internal corporate data.

The local picture reflects the broader European trend: organizations are facing ransomware, data theft, identity compromise and operational disruption at the same time.

From DIAMATIX

This week we also announced that DIAMATIX and Acronis will participate in Municipal EXPO 2026, with a focus on cyber resilience, data protection and practical security requirements for public-sector organizations.

Read more:
DIAMATIX × Acronis at Municipal EXPO 2026

DIAMATIX Weekly Signal

The common pattern this week is clear: attacks are becoming faster, more automated and more closely connected to identities, vulnerabilities and trusted business systems.

For organizations, this means visibility, access control and response readiness need to operate as one process — not as separate tools.

Follow the DIAMATIX Cybersecurity Weekly Digest for the signals that matter — without the noise.

F5 BIG-IP, AI phishing, post-quantum cryptography, NIS2, ransomware, DIAMATIX

Sources: Reuters, Microsoft, Cloudflare, ENISA, F5, Investor.bg, WISeKey/SEALSQ.