Threat Brief — 2026-08-13 — Linux ransomware and legacy SIM attacks

Executive summary: An official government advisory warns that ransomware operators are increasingly targeting Linux servers, signalling a shift beyond the Windows-dominated ransomware landscape. Separately, the malicious-SIM-card modem exploit first reported yesterday gains a concrete high-impact use case: researchers demonstrate that a single rogue SIM can hijack EV chargers by abusing a 1981-era modem command, underscoring how deeply legacy telecom protocols are embedded in modern IoT infrastructure.

Top items

• Government warning: ransomware groups now actively targeting Linux servers. An official advisory alerts organisations that Linux server fleets are in ransomware crosshairs — historically under-prioritised compared to Windows endpoints, Linux systems often lack equivalent EDR coverage and hardening baselines. Server admins should review access controls, patch status, and backup/restore procedures immediately. (src: anquanke)

• Malicious SIM card hijacks EV chargers via 1981 legacy modem command. Building on research first reported 2026-08-12 by The Hacker News, this development shows the attack applied to a real-world IoT target: a single rogue SIM can execute attacker code inside cellular modems embedded in EV chargers, abusing SIM Toolkit commands dating back to 1981. The finding demonstrates the attack surface extends well beyond generic modems into safety-critical connected infrastructure. (src: anquanke)

Themes

• Linux as a growing ransomware target: Today's government warning reinforces a trend — threat actors are diversifying beyond Windows. Organisations that treat Linux servers as inherently safer may be operating with a false sense of security.
• Legacy telecom protocols in modern IoT: The EV-charger hijack via 1981 modem commands echoes the broader pattern of decades-old protocol flaws (SCTPhantom, Wi-Fi deauth) resurfacing in contemporary infrastructure. Cellular IoT deployments inherit telecom standards that predate modern threat models.