Court overturns dismissal, sends case back to Helsinki

A Finnish appeals court on Thursday breathed new life into the prosecution of three senior officers from the Eagle S, the Russia-linked tanker accused of severing Baltic Sea cables on Christmas Day 2024. The Helsinki Court of Appeal ruled Finland has jurisdiction to try the men, reversing a district court decision from last October that had stunned maritime lawyers.

The case now returns to the Helsinki District Court for a full hearing on the merits. The three officers, who were previously detained in Finland, have since left the country. Thursday’s ruling was unanimous.

Why the first ruling alarmed legal experts

The earlier dismissal had sparked fears across the maritime legal community. Lawyers warned it could effectively give ships flying flags of convenience a free pass to damage undersea infrastructure in international waters, with no consequence.

Henrik Ringbom, professor of maritime law at Åbo Akademi University, was blunt about the stakes: “As long as you have a flag state that doesn’t care, you can now count on the freedom of navigation to continue to break cables without consequences. This means that no one can do anything about it. This is completely unreasonable.”

The appeals court, however, took a different view. It held that the alleged crimes were actually committed in Finland, because the damage and its effects on the country’s power and telecommunications supply occurred there.

The ‘maritime accident’ question

Central to the case is whether the incident qualifies as a “maritime accident” under the United Nations Convention on the Law of the Sea. The defendants argued that if it did, only courts in the flag state (the Cook Islands) or the crew’s home countries (Georgia and India) could hear the case.

The appeals court accepted that the anchor’s initial drop could be seen as accidental, and therefore not prosecutable. But what happened afterward, it said, was another story.

Finnish authorities contacted the ship at 3:20 p.m. on Dec. 25. The crew falsely claimed both anchors were raised and secured. Instead, the vessel continued for about 90 kilometers (55 miles), dragging its port anchor for more than three hours and severing four additional cables.

Only the intervention of Finnish authorities prevented further damage, the court noted. That continued conduct, after authorities made contact, took the episode outside the “maritime accident” protection.

Shadow fleet suspicions and accidental causes

The Eagle S incident was one of several cable breaks in the Baltic that stoked fears Russia was waging deniable attacks on European infrastructure. Many were linked to Moscow’s so-called “shadow fleet” — aging vessels with opaque ownership, sailing under flags of convenience to export sanctioned oil and fund the war in Ukraine.

But officials from several European countries bordering the North and Baltic seas told Recorded Future News that governments are increasingly confident the incidents were accidental, not directed by the Kremlin.

Thursday’s ruling is not final. The defense can appeal to the Supreme Court if it grants leave, with a deadline of Oct. 26, 2026.

Implications for the Fitburg trial and damages

Deputy Prosecutor General Jukka Rappe told Finnish broadcaster Yle that the ruling aligns with the prosecution’s position and comes at a good time — weeks before a closely related trial.

In June, prosecutors charged the captain and bosun of the Fitburg, a cargo ship that dragged a damaged anchor for at least 130 kilometers along the Baltic seabed on New Year’s Eve, damaging civilian infrastructure. Those defendants deny wrongdoing and plan to argue Finland lacks jurisdiction.

Rappe, who filed the Fitburg charges, said his position on jurisdiction is identical in both cases. The appeals court ruling will guide the Fitburg trial, though no hearing date has been set.

The Eagle S judgment also put a figure on civil damages. The joint owners of the Estlink 2 power cable — Fingrid, Finland’s state grid operator, and Estonia’s Elering — are seeking about €105 million ($122 million) from the three officers. That includes €55.3 million in repair costs and €50 million in lost income. When prosecutors first brought charges in August 2025, they estimated immediate damage at “at least €60 million” in repairs alone. Estlink 2 was out of service for about six months.

The court also rejected a claim by the Eagle S’s manager, Peninsular Maritime India, for more than €680,000 ($790,000) plus additional sums in dollars, dirhams and rupees, to cover litigation costs. Some technical material related to the cable will remain sealed until 2050.

A Major Medtech Player Brought to a Standstill

Boston Scientific, one of the world’s largest medical device manufacturers, is grappling with a significant cyber incident that has triggered widespread IT disruption across its global operations. The company revealed the breach in a statement on August 26, noting that the attack was identified a day earlier and affected “certain information technology systems,” leading to a network outage that has hampered its ability to process and ship customer orders.

The firm, which employs 59,000 staff and operates in 127 countries, generates around $20 billion in annual net sales. Its products are used to treat more than 48 million patients each year. That scale makes the disruption particularly concerning, as any delay in shipping medical devices can have a direct impact on hospitals, clinics, and ultimately, patient care.

What Happened: A Timeline of the Attack

According to the company’s SEC Form 8-K filing, the incident caused “global” disruption. Boston Scientific said it activated incident response protocols immediately upon detection and launched an investigation with the help of third-party cybersecurity experts. The company is working to restore affected systems, but the timeline for full restoration remains unknown.

In a brief notice, the firm acknowledged that the attack has impacted access to certain operating systems and business applications, including those used for order processing and shipping. This is not just an IT headache; it’s a logistical bottleneck that could ripple through the healthcare supply chain.

The Human Cost of a Cyber Attack

Dray Agha, senior manager of security operations at Huntress, warned that the knock-on effects could be severe. “When a major manufacturer is paralysed and unable to process or ship medical orders, the disruption creates immediate ripple effects that can ultimately delay critical treatments and impact patient care down the line,” he said.

Agha stressed that modern cyber attacks blur the line between digital networks and physical operations. “Manufacturing and medical tech companies must prioritize strict network segmentation,” he argued, “ensuring that an intrusion in one corporate IT environment doesn’t completely derail global business continuity.”

A Growing List of Medtech Victims

Boston Scientific is hardly alone in facing this threat. The medtech sector has become a prime target for cybercriminals, and 2024 has seen a string of high-profile incidents.

• In April, Medtronic confirmed a data breach after being targeted by the notorious hacking group ShinyHunters.
• In June, iRhythm Technologies reported unauthorized activity involving data held in third-party applications.
• In July, Abbott Laboratories said it was investigating two incidents involving unauthorized access at its cancer diagnostics business and its LabCentral portal, though the company claimed there was no operational impact.
• In March, Stryker was hit by pro-Iranian threat actors who used Microsoft Intune to wipe corporate devices and force a shutdown of the company’s global offices.

The Stryker attack bears a striking resemblance to Boston Scientific’s situation, as both involved widespread network outages that halted business operations.

Response and Recovery: What Comes Next?

For Boston Scientific’s security team, the immediate focus is on containment and recovery. Ross Filipek, CISO at Corsica Technologies, emphasized the importance of visibility during such crises. “Security teams need constant visibility into what was affected and which systems are safe to bring back online,” he explained.

Filipek also highlighted the unique pressure healthcare companies face. “In healthcare, downtime carries operational consequences quickly,” he said. “Strong incident response has to protect the environment while helping the business restore critical services as safely and efficiently as possible.”

The company has not disclosed who might be behind the attack, nor has it provided details on whether any data was exfiltrated. As the investigation continues, industry observers will be watching closely to see how quickly Boston Scientific can get its systems back online and what lessons other medical device makers might learn from this incident.

Lessons for the Medtech Industry

This incident serves as a stark reminder that no company, regardless of size or sophistication, is immune to cyber threats. For medtech firms, the stakes are uniquely high. A breach isn’t just about stolen data; it’s about the potential to disrupt life-saving treatments.

Experts agree that proactive measures like network segmentation, regular security audits, and robust incident response plans are essential. As Agha put it, the goal is to ensure that “an intrusion in one corporate IT environment doesn’t completely derail global business continuity.”

For now, Boston Scientific is focused on restoring operations and assessing the full scope of the damage. The company has pledged to provide updates as the investigation unfolds. In the meantime, patients and healthcare providers can only hope that the disruption is short-lived and that critical medical supplies continue to flow.

AI Tools Are Now a Weapon in Ransomware Attacks

Threat actors behind the Aurora ransomware operation have been caught using Cursor Agent, an AI coding assistant, to help carry out attacks. The finding comes from a new report by Gambit Security’s Threat Intelligence team, published on August 27.

Between April 8 and May 26, 2026, the operators used Claude Sonnet — running through Cursor Agent — to assist with exploitation activities against at least 10 victims. The tasks weren’t exotic. They included scanning victim environments, installing VPN clients, and running certificate attacks.

But here’s the kicker: the AI didn’t always succeed. According to the researchers, most commands failed on the first attempt, forcing the attackers to refine their prompts multiple times. Some tasks eventually succeeded; others just returned a report of failed attempts.

This is a clear sign that cybercriminals are experimenting with AI to speed up their operations, even when the tools aren’t perfect.

How Aurora Abuses Cursor Agent in Ransomware Attacks

Cursor Agent is designed for software developers. It can complete complex coding tasks, run terminal commands, and edit code independently. Aurora operators, however, repurposed it for post-compromise work, feeding it credentials or using an existing foothold into a victim’s network.

Some commands were simple intelligence-gathering requests, like “tell me what rights the user has.” Others were more specific, directing the agent to use particular exploitation tools or follow a previously generated attack plan. For example, the agent was asked to enumerate domains, use NetExec’s BloodHound collector, and scan internal subnets with Nmap or NetExec.

The AI was also tasked with active exploitation. That included attempting NTLM relay attacks by coercing authentication with PetitPotam, Coerce Plus, and PrinterBug, as well as running certificate attacks with Certipy. In some cases, the agent was told to install VPN clients or proxychains, configure them, and connect to a victim using supplied credentials or an existing SOCKS tunnel.

Why This Matters for Defenders

The fact that attackers are using AI tools like Cursor Agent doesn’t mean the AI is a superweapon. It’s more like a force multiplier that sometimes misfires. Still, the trend is worrying. As AI tools become more capable, even failed attempts can yield useful intelligence for attackers, and successful ones save time.

For defenders, this means monitoring for unusual AI-assisted activity is becoming more important. If you see commands that look like they’re generated by an AI agent, that could be a red flag.

Aurora Deploys New Linux Ransomware Variant for ESXi

The same report also details a new Linux ransomware variant from Aurora that targets ESXi environments. The attackers used a custom NetExec LDAP module called esxi_finder.py to scan for VMware ESXi hypervisors and vCenter servers inside victim networks.

The variant encrypts virtual machine files while skipping system volumes. That keeps the hypervisor bootable, so victims can still read the ransom demand. It’s a calculated move — they want you to see the note, not just lock you out.

A Second Cluster of Activity Across Six Countries

Gambit researchers also identified a second cluster of activity, attributed with medium confidence to an Aurora operator. This cluster targeted eight victim organizations across Israel, Germany, Austria, Spain, the US, and Argentina.

Aurora ransomware has been active since April 2026, operating a data leak site and going after organizations in multiple countries. The group’s willingness to adopt AI tools like Cursor Agent shows they’re paying attention to new technology — and so should you.

What This Means for Ransomware Defense

The use of AI in ransomware attacks isn’t just a novelty. It changes the game for defenders in subtle ways. AI agents can work around the clock, try multiple approaches, and learn from failures — all without human fatigue.

That said, the report’s findings also highlight the limitations. Many commands failed, and the attackers had to iterate. AI isn’t replacing human hackers yet; it’s augmenting them. But as models improve, the failure rate will drop.

For now, organizations should focus on basics: patch vulnerabilities, monitor for unusual tool usage, and segment networks to limit the blast radius of any compromise. And if you see NetExec or BloodHound being used in your environment, treat it as a potential indicator of an attack.

For more on how attackers leverage AI, check out our analysis of AI-driven phishing campaigns and tips for securing ESXi environments.