Weekly Cybersecurity Briefing: Log4j Debate, Minimus Closure, and U.S. Sanctions

Several cybersecurity developments drew attention this week, ranging from renewed concern around Apache Log4j to a container-security startup’s abrupt closure and U.S. sanctions targeting alleged Iranian state-linked hackers.

Log4j report prompts clarification

A report describing a possible critical remote code execution issue in Log4j 2 prompted fresh concern because of the lasting impact of the 2021 Log4Shell vulnerability. Log4j maintainers said the reported behavior was already known and characterized it as a security non-finding. While they acknowledged that remote code execution could theoretically be possible in narrowly defined conditions, they said the practical risk was limited and did not warrant the level of alarm generated by initial reports.

Company and credential exposure updates

U.S. Bancorp said ransomware claims made by LockBit appear to relate to a fourth-party supplier rather than the bank’s own systems. The company said it had not found evidence of a compromise affecting its infrastructure or data repositories.

Container-image security provider Minimus announced it was winding down despite raising $51 million in 2025. The company cited difficult business and investment conditions. Echo subsequently said it had acquired Minimus and its technology.

Separate research again highlighted the risks of exposed credentials. Truffle Security reported identifying more than 700 active AWS credentials with broad account privileges among over 10,000 keys exposed from 2022 through 2026. Intruder said its internet scanning identified thousands of publicly exposed Git repositories, including active cloud, payment, AI-service and source-code platform credentials.

Breaches and threat activity

• Mobile security firm Zimperium said at least 30 malware families are targeting more than 800 banking and fintech applications across 44 countries in Europe, the Middle East and Africa.
• Researcher Troy Hunt found that an alleged Carhartt data leak included a substantial volume of synthetic benchmark data mixed with apparent real customer records, potentially inflating the reported scale of the incident.
• Paylogix disclosed a November intrusion involving files containing personal, financial, health and identity information. The Akira ransomware group claimed responsibility.
• Manchester Airports Group said attackers accessed personal information tied to roughly 8.7 million customers. The organization said operations, aviation security and passenger safety were unaffected, and it declined to pay a ransom.

The U.S. Treasury also imposed sanctions on three Iranian individuals accused of conducting intrusions, data theft and activity directed at critical infrastructure on behalf of Iran’s Ministry of Intelligence and Security. The action accompanied broader U.S. allegations involving Iranian cyber operators.