Ransomware Rampage Continues: BeyondTrust Goes Live, Advantest Down, AI Malware Evolves

The BeyondTrust RCE vulnerability we flagged in yesterday's briefing has officially crossed into ransomware territory — CISA confirmed threat actors are now actively exploiting it to deploy ransomware payloads, not just webshells and backdoors. That escalation from espionage-grade tools to ransomware operators is a significant signal. Meanwhile, Japanese semiconductor testing giant Advantest confirmed a direct ransomware hit, and a Mississippi medical center was forced to close all clinics after being struck — healthcare and critical manufacturing both taking hits on the same day.

On the AI threat front, PromptSpy is making history as the first confirmed Android malware to use generative AI at runtime. It abuses Google's Gemini API to automate persistence across the Recent Apps screen — meaning AI isn't just being used to write malware, it's now embedded in the malware itself as live operational logic. PayPal also disclosed a data breach that exposed user personal information for a full six months before detection — a timeline that should raise serious questions about their internal monitoring capabilities.

The pattern is consistent: known vulnerabilities moving fast from initial exploitation to ransomware deployment, AI capabilities getting weaponized at the endpoint level, and large platforms sitting on breach disclosures for months. Defenders are losing the response window.