AI-Weaponized Malware, Supply Chain Poisoned, and Ransomware Hits Hospitals — Feb 21 Briefing

The cybersecurity landscape is deteriorating fast on multiple fronts simultaneously. The BeyondTrust RCE vulnerability — which we flagged last cycle — has now been officially confirmed by CISA as actively exploited in ransomware campaigns, meaning threat actors have moved from proof-of-concept to live operations. Meanwhile Advantest, a major Japanese semiconductor equipment maker, is down after a ransomware hit, and a Mississippi medical center was forced to close all clinics after being struck — critical infrastructure is clearly in the crosshairs.

The AI-as-attack-vector story is accelerating in a dangerous direction. PromptSpy is now confirmed as the first known Android malware to use generative AI at runtime — it abuses Gemini to automate persistence in the Recent Apps stack, making it harder to detect and kill. This is the inflection point security researchers have been warning about: malware that adapts and reasons in real time. On the supply chain front, Cline CLI 2.3.0 delivered OpenClaw to developer machines via a poisoned update — developers who auto-update AI coding tools just got owned silently.

The PayPal breach (6 months of exposed user data) and the French bank registry breach hitting 1.2 million accounts round out a brutal 48-hour window. The pattern here is clear: attackers are moving faster than defenders can patch, AI is lowering the floor for sophisticated attacks, and critical sectors (healthcare, finance, semiconductors) are all taking direct hits simultaneously.