Halcyon

Ransomware attacks against energy and utilities are rising. The Cyber Security Resilience Bill is incoming. And Agentic AI is reshaping the threat landscape faster than most defenders can track. If you're a senior leader in the utilities and energy sector, this one's for you. Halcyon and Orange Cyberdefence are hosting an exclusive event in London this May: 🔒 Ransomware Resilience for Utilities: Technology, Regulation, Readiness 📅 Friday, 15 May 2026 | 2:00 PM BST 📍 Bain Capital Offices, 1 Mayfair Place, Mayfair, London Hear from Stuart Okin (Director of Cyber Regulation & Emerging Technologies, Ofgem) on the Cyber Security Resilience Bill and the real impact of Agentic AI on the energy sector, and from Oliver Newbury (Chief Strategy Officer, Halcyon) on how organisations can defeat ransomware before damage occurs. The session includes a live demo, peer-to-peer discussion, and social drinks and canapés on the terrace overlooking Green Park. Seats are limited. Register now: https://lnkd.in/gde9hR97

Twenty years chasing cybercriminals inside the Federal Bureau of Investigation (FBI)’s Cyber Division changes how you see the world. Ransomware stops looking like a tech problem - and starts looking like what it is: organized crime. Criminal entrepreneurs making deliberate decisions about who to target… and what consequences they’re willing to accept. This week, Halcyon’s Cynthia Kaiser brought that perspective to Congress - testifying before the House Committee on Homeland Security after two decades on the front lines. Her message was direct: #ransomware attacks on hospitals should be treated as terrorism - and when they result in patient deaths, prosecuted as homicide. And the case is getting harder to ignore. 👇 📈 Attacks on hospitals nearly doubled - from 238 in 2024 to 460 in 2025 ⚠️ At least 47 patient deaths have already been linked to hospital ransomware - a number that’s almost certainly higher today 🏥 Just months ago, an attack on the University of Mississippi Medical Center forced nine days of manual operations at the state’s only Level 1 trauma center This isn’t theoretical. It’s operational impact - at the worst possible moments, for the most vulnerable people. These groups have built their business model around a single assumption: that the consequences will never match the crime. Cynthia spent her career proving that assumption wrong. She’s not done. Read her full take on the blog: https://lnkd.in/eYEdQa2a #healthcare #cybersecurity

The cloud didn't solve ransomware. It changed where the damage happens. Today's attackers aren't breaking into your environment - they're logging in. From a compromised endpoint, they move through stolen sessions and tokens, and the cloud does exactly what it was designed to do: sync everything, everywhere, instantly. No exploits. No failed controls. Just a trusted identity causing damage at scale - often before a single alert fires. In his latest piece, Halcyon's Sameh Sabry maps out how modern ransomware moves through cloud environments, where #cloud-native controls leave gaps, and why the endpoint remains the only place to stop the chain before impact. If you're a #CISO evaluating your real-time response to a credential-based attack, this is worth your time. 👇 https://lnkd.in/eFSdF7X5

⚠️ THREAT ALERT: That app you just downloaded? It might already own your network. #EvilAI is one of the most deceptive #malware campaigns we've tracked - and it just surged across networks in the Americas and Europe. Here's what makes it dangerous: The fake apps actually work. AppSuite, Epi Browser, PDF Editor, and others behave exactly as advertised - while silently stealing credentials, establishing encrypted C2 channels, and staging #ransomware payloads in the background. In March 2026 alone, the Halcyon Ransomware Operations Center (ROC) blocked 68 EvilAI attempts against our clients. In every single case, all other endpoint security tools missed it. The campaign uses #AI-generated code with anti-analysis loops that force analysts off static detection entirely. Certificates rotate through disposable shell companies before revocations can catch up. And once it's in - it persists, enumerates your defenses, and calls home. Initial access won by EvilAI is being sold to ransomware groups including Qilin, Akira, and Play. Your users are the target. Your EDR may not be enough. Get the full #ThreatIntel from the Halcyon RRC for IOCs, TTPs, and mitigation steps. https://lnkd.in/eta7BeqZ

Here’s the uncomfortable truth: Most ransomware attacks don’t look like ransomware… until it’s too late. They look like: → Normal logins → Remote access tools → Routine admin activity That’s why they keep working. In March, Halcyon’s ROC team saw the same pattern play out again and again - and stopped 98.6% of attacks at the earliest stages. Before lateral movement. Before exfiltration. Before encryption ever had a chance. The latest ROC STAR Report breaks down what that actually looks like in real environments: → What attackers are using → Where they’re getting stopped → And what happens when they’re not Because #ransomware isn’t about getting in. It’s about what happens next. Full report: https://lnkd.in/epsWgJGA

We’re asking the wrong question about Mythos. Most of the conversation is: “What happens when attackers can find more vulnerabilities?” That matters. But it’s not the real issue. The real shift is speed. Ransomware operators don’t need Mythos to succeed. In most cases, they already have access. What’s changing is how fast they can move once they’re in. That window between detection and impact? It’s collapsing. And most defenses were built on the assumption that we had time. That’s the gap. We can keep getting faster at detection... Or we can accept the campaign is already in motion and build for what happens next. Because #ransomware was never just about initial access. It’s about what follows - and whether you can stop it. Mythos doesn’t rewrite that playbook. It just makes it run faster. Ryan Smith and I break down what this actually means - and where teams should really be focusing next. Read more on the Halcyon blog: https://lnkd.in/gP_kF6PK