Alex: Good morning. It's Tuesday, August 11th, 2026. This is Cleartext. I'm Alex Chen.

Jordan: And I'm Jordan Reeves. Let's get into it.

Alex: We have a packed show today. Attackers breached a Polish power plant through a private cellular network and shut down a turbine. China-linked actors are deploying custom ransomware through RMM tools. Kimsuky is running offline AI to sharpen its phishing and malware ops. We've got iOS zero-days proliferating to criminal groups, a supply chain breach rippling across industries, and two critical vulnerabilities CISA says ransomware gangs are actively exploiting right now. Let's start where the real alarms are ringing.

Jordan: Poland. A combined heat and power plant serving about fifty thousand residents. Attackers came in through the private APN cellular network the grid operator uses to communicate with remote equipment. They shut down a steam turbine and the process-water treatment system. CERT Polska says this is the first confirmed use of this specific intrusion vector. And here's what makes it worse: when recovery operations started around seven thirty in the morning, the attackers were still inside the network.

Alex: Let's unpack why this matters at the board level. Every CISO running OT environments, whether it's energy, manufacturing, water treatment, has been focused on the IT-OT convergence problem for years. But the assumption has generally been that the threat enters through IT and pivots to OT. This attack skipped the IT perimeter entirely. It came in through the cellular backhaul that connects remote equipment to the control network. That's infrastructure most security teams don't even have visibility into because it's managed by the telecom provider or the grid operator.

Jordan: Right. Private APNs have been treated as trusted pipes. They're not routed over the public internet. There's an implicit trust model baked in: if the traffic is on this APN, it's authorized. That assumption just got demolished. And the persistent access piece is critical. Recovery was happening in parallel with active adversary presence. That tells me either the defenders didn't know the attackers were still there when they started, or they knew and had no choice but to restore service anyway because people needed heat.

Alex: Either scenario is bad. If you're a CISO with distributed OT infrastructure relying on private cellular connectivity, your action item today is to map every cellular connection into your control environment, understand who manages those APN configurations, and figure out what monitoring you actually have on that traffic. Because if the answer is none, you have a blind spot that just became a proven attack path.

Jordan: And for what it's worth, residents didn't lose heat. The plant recovered. But the fact that a turbine was shut down remotely through a cellular network should be a wake-up call far beyond Poland.

Alex: Let's pivot to the China-nexus ransomware story, because this connects to a broader pattern. Microsoft Threat Intelligence linked Storm-1175, a China-affiliated group, to a new ransomware strain called StormEncryptor. It's written in C++, appends a .encrypted extension, and the deployment vector appears to be an unpatched flaw in N-central, the remote monitoring and management platform.

Jordan: Two things jump out. First, this is a known China-nexus actor shifting from Medusa ransomware to a custom-built strain. That's not just new malware. That's investment. They built their own tool, which means they want operational independence from shared ransomware ecosystems. Second, the vector. N-central is everywhere. It's what MSPs use to manage their clients' environments. If you compromise an RMM platform, you don't just get one victim. You get every organization that MSP manages.

Alex: If you're running N-central or your managed service provider is, treat this as an emergency patching event. Full stop. And the broader strategic point here is that the line between espionage-motivated and financially motivated attacks from China-nexus actors continues to blur. That complicates your threat model. You can't neatly categorize these groups anymore.

Jordan: Which brings us to Kimsuky, because North Korea is making its own investments. South Korean firm Genians found that Kimsuky is running AI models on air-gapped servers with retrieval-augmented generation capabilities, using it to improve phishing content and automate malware development. This isn't prompting ChatGPT from a Pyongyang internet café. This is purpose-built, offline AI infrastructure designed to evade sanctions and API controls.

Alex: The practical implication for defenders is that the quality floor on phishing just went up. If Kimsuky can generate contextually rich, linguistically polished phishing at scale using offline AI tuned on their own document collections, your employees' ability to spot a bad email by looking for broken grammar or generic language is degrading fast.

Jordan: And the malware automation piece means faster iteration on tooling. Shorter dwell times between when a vulnerability is disclosed and when Kimsuky has a working exploit or payload. This is exactly the scenario the threat intel community has been warning about. Nation-states building AI into their offensive pipelines. It's happening now.

Alex: Let's touch on the Sandworm campaign briefly. CERT-UA attributed a fake recruiter operation to Russia's GRU that's been running since May, targeting Ukrainian IT professionals. Jordan, this one's interesting because it weaponizes the hiring process.

Jordan: Sandworm has always been creative with social engineering, but posing as recruiters is smart because it exploits a moment of vulnerability. People actively looking for work are motivated to open attachments, click links, engage with strangers. And this doesn't stay contained to Ukraine. Any organization with Ukrainian employees, contractors, or hiring pipelines touching Eastern Europe should be aware. Your HR and talent acquisition workflows are an attack surface. Treat them accordingly.

Alex: Now let's talk about two things that are operationally urgent. CISA confirmed ransomware gangs are actively exploiting a high-severity SharePoint remote code execution vulnerability. This has been flagged as exploited since early July. And separately, CISA confirmed ransomware exploitation of two SonicWall SMA1000 vulnerabilities, including a maximum-severity SSRF flaw.

Jordan: SharePoint first. It's everywhere. It's the document backbone of most enterprises. A remote code execution flaw in SharePoint that ransomware operators are using is a direct path to an encryption event. If you haven't patched this since July, you've had over a month of exposure. That's not a risk acceptance conversation. That's a gap.

Alex: Same urgency on SonicWall SMA1000. These are enterprise remote access gateways. If ransomware actors can exploit a max-severity SSRF on your VPN concentrator, they're inside your network with broad access. Patch today. Validate your exposure. If you can't patch immediately, pull it behind additional controls or take it offline until you can.

Jordan: And I'll connect these two to the Gunra ransomware advisory. FBI and South Korea's National Police Agency jointly warned that the Gunra gang is breaching critical infrastructure through vulnerabilities in Fortinet and Schneider Electric systems. Healthcare, financial services, government. The joint nature of that advisory, FBI plus South Korea, suggests there may be a state-nexus or at minimum state tolerance behind this group.

Alex: Three separate ransomware exploitation warnings in forty-eight hours, all targeting perimeter infrastructure. If you're a CISO and you haven't done a perimeter device audit this quarter, this is your prompt.

Jordan: Let's shift gears. The Ceva Logistics breach. Cyberattack between July 29th and August 1st. Customer names, addresses, order data stolen. The blast radius is enormous. Banks, retailers, Valve notifying Steam customers in Europe. GDPR timelines are in motion.

Alex: This is supply chain risk in its purest form. Ceva is a logistics provider. They ship physical goods for companies across every sector. If your organization uses Ceva for fulfillment, your customer data may be in this breach, and your notification obligations may have already started. Check your vendor risk register. Initiate your breach notification protocol if Ceva is in your supply chain.

Jordan: Two more items worth your attention. First, the Coruna and DarkSword iOS exploit chains. These were previously nation-state only. Now they're in the hands of organized cybercrime groups. Fully patched iPhones are being compromised. If you have executives carrying iPhones and you rely on the Apple ecosystem's reputation for security as your mobile strategy, that assumption needs revisiting. Lockdown Mode, MDM controls, and executive device monitoring should all be on the table.

Alex: And finally, OpenAI's Daybreak program. They've launched Red and Blue tiers giving vetted cybersecurity vendors access to frontier models for offensive and defensive work. GPT-5.6-Cyber is specifically trained for exploit development with reduced safety refusals. Sixteen vendors are initial partners.

Jordan: I have mixed feelings about this. On one hand, giving defenders access to AI-powered vulnerability research is genuinely useful. On the other hand, a model specifically trained to develop exploits with reduced guardrails is going to leak. Not the model itself necessarily, but the techniques, the approaches, the outputs. Whatever approved partners learn from GPT-5.6-Cyber will inform adversary tooling within months. That's just how this works.

Alex: Agreed. CISOs should evaluate Daybreak as a procurement option but also as a leading indicator of what's coming at them offensively.

Jordan: So stepping back, what's the theme today?

Alex: Perimeter assumptions are failing. The Polish attack bypassed IT perimeters through cellular. SharePoint and SonicWall are perimeter devices being exploited at scale. iOS exploit chains that were supposed to be contained to nation-states are in criminal hands. The walls we built are not holding the way we designed them to hold.

Jordan: And the adversaries are getting more capable faster. Kimsuky with offline AI. Storm-1175 building custom ransomware. Sandworm weaponizing HR processes. The sophistication curve is steepening, and it's steepening across multiple nation-state actors simultaneously. That's not a coincidence. That's a trend.

Alex: For CISOs listening, the action items from today are concrete. Audit your cellular connectivity into OT environments. Patch SharePoint and SonicWall SMA1000 immediately. Check whether N-central is in your environment or your MSP's. Verify whether Ceva Logistics is in your supply chain. And revisit your mobile device security strategy with the assumption that iOS zero-days are now available to criminal groups, not just governments.

Jordan: Busy Tuesday.

Alex: That's Cleartext for August 11th, 2026. Show notes and links to every story we covered are at cleartext.fm. We'll be back tomorrow. Stay sharp.

Jordan: See you then.