International overview 2026: the most important cyber news of week 20

ESET described a campaign by Ghostwriter, also known as FrostyNeighbor, against Ukrainian government institutions that began in March. Targets with Ukrainian IP addresses received PicassoLoader malware through a PDF document; the campaign focused on the military, the defense sector and government institutions. A ransomware attack disrupted several of Foxconn’s North American manufacturing plants, and the Nitrogen ransomware group claimed responsibility. Customer data was downloaded from Škoda’s German sales portal after a security vulnerability was exploited. THORChain reported that one of its six vaults had been compromised and that cryptocurrency worth approximately USD 10.7 million had been stolen.