shutterstock[.]com

Iranian cyber adversaries are actively targeting internet-exposed industrial systems across brands like Rockwell Automation, Allen-Bradley, Schneider Electric and Siemens. In an advisory update published on July 22, the US Cybersecurity and Infrastructure Security Agency (CISA) said the FBI had observed Iran-affiliated cyber threat actors download a malicious project file to a targeted programmable logic controller (PLC) at a US-based critical infrastructure organization using configuration software. The Bureau also saw the manipulation of data on human machine interface (HMI) and supervisory control and data acquisition (SCADA) displays, resulting in operational disruption and financial loss. Further analysis indicated the project file retained ladder logic for downstream function but added logic that overrode specific instruction sets responsible for maintaining safe operating parameters in the victim’s environment. Iranian Cyber Campaign Targets US Critical Infrastructure This follows an April advisory warning of an ongoing cyber campaign from Iranian actors against US critical infrastructure. According to CISA, these actions disrupted PLCs across several US critical infrastructure sectors, notably government services and facilities, water and wastewater systems and energy. In the initial warning, the agency named PLCs from Rockwell Automation and Allen-Bradley (a subsidiary of Rockwell Automation) as being targeted by these actors, following malicious changes detected in reusable code modules exploited within Rockwell Automation PLC programs. The July update confirmed that the same advanced persistent threat (APT) actors are also targeting PLCs manufactured by Schneider Electric and Siemens. This new assessment comes from findings that the APT actors have been using configuration software, like Rockwell Automation’s Studio 5000 Logix Designer, Schneider Electric’s EcoStruxure Control Expert and Siemens’ Totally Integrated Automation (TIA) Portal on leased, third-party hosted infrastructure to exfiltrate device project files from PLC devices to threat-actor-controlled infrastructure. CISA named some of the specific models being targeted – Allen Bradley’s CompactLogix and Micro850 PLCs, Schneider Electric’s BMX P34 and Modicon M340 models and Siemens’ S7-1200 series PLCs. The agency also said PLCs of other brands could also “potentially” be targeted. While the advisory did not refer to any specific threat group, CISA noted that the ongoing campaign bears similarities with a November 2023 operation that involved a group affiliated to Iran’s Islamic Revolutionary Guard Corps Cyber-Electronic Command (IRGC CEC). The group in question is commonly known as ‘CyberAv3ngers’ and tracked by cybersecurity companies under many names including Bauxite, Hydro Kitten, the Shahid Kaveh Group, Soldiers of Solomon, Storm-0784 and UNC5691. Iranian Hackers Target Flaws Affecting Multiple OT Environments According to Nick Tausek, lead security automation architect at Swimlane, the latest update moves the Iran-linked threat "beyond broad concern and into specific, actionable detail." Security teams now have new indicators, targeted ports, affected device families and examples of attackers changing PLC logic or disabling critical safeguards. Pete Luban, field CISO at AttackIQ, also highlighted that it shows that Iranian cyber activity is becoming less dependent on one product and more focused on weaknesses that repeat across operational environments. "By targeting controllers from several manufacturers, attackers can reuse the same playbook wherever exposed devices and weak access controls exist," Luban said. "The problem is getting that intelligence into active workflows before the attackers move again," Tausek added. "That's hard to do when asset data, network alerts, threat intelligence, and incident procedures live in separate systems. Security teams may understand the threat, but still lose valuable time gathering context and determining which exposed devices require immediate attention," he said. How US CNI Organizations Can Mitigate the Threat The advisory urged US CNI providers to: Install PLCs consistent with manufacturers' guidelines and security best practices Remove PLCs from direct internet exposure via secure gateway and firewall Query available logs for the provided indicators of compromise (IOCs) and check available logs for suspicious traffic on the ports associated with OT devices, including 44818, 2222, 102 and 502 For Rockwell Automation devices, place the physical mode switch on the controller into run position According to Ross Filipek, CISO at Corsica Technologies, the biggest issue faced by affected organizations is that most of them can't pause operations while an incident is investigated. "Water utilities have to keep providing clean water. Energy providers have to maintain power and fuel availability. Local governments still need to support emergency services and public operations. Even a short disruption can force employees into slower manual processes, delay essential services and create public safety concerns," he said. "Trusted backups of PLC logic are critical, as are tested recovery procedures and experienced responders who can contain an intrusion quickly. A single exposed controller may look like a local weakness. In critical infrastructure, it can become part of a much larger national security problem," Filipek added. This article was updated on July 24 to add comments from cybersecurity experts. Image credits: miamariapia / Dwi Doyo / Shutterstock.com

A previously unreported threat actor has been observed targeting cryptocurrency firms with custom macOS malware, fake recruiter approaches and the hijacking of internal development pipelines. Wiz has attributed the activity to a financially motivated cluster, now tracked as Jinx-0164, according to new analysis from the company. Active since at least mid-2025 and focused almost entirely on macOS, the actor shares techniques with North Korean groups such as UNC1069, also known as Sleet. However, it implements these techniques differently and shows no infrastructure overlap with tracked actors. Wiz stopped short of linking it to any state-sponsored threat actor. Fake Meetings and a Cloned Audio Driver The intrusions typically begin on LinkedIn, where the attacker poses as a business contact or recruiter using a credible profile. The target is invited to a virtual meeting on a lookalike domain impersonating a service such as Microsoft Teams. Joining the call triggers a fake technical fault and a prompt to run a "fix," which installs the malware. The payload, a Python-based stealer and remote access tool named Audiofix, masquerades as a system audio driver and runs on both Intel and Apple Silicon machines. Audiofix harvests Keychain contents, browser credentials, SSH keys, cloud provider keys and details from 51 cryptocurrency wallet extensions. It also hijacks Discord, Slack and Telegram sessions and monitors the clipboard for copied wallet addresses. From Laptops to Code Pipelines Rather than pivoting into cloud accounts, Jinx-0164 turned harvested GitHub tokens against the victim's development infrastructure, using the open-source tool nord-stream to pull secrets from CI/CD pipelines. It then injected Audiofix into internal repositories, disguising commits under other developers' names and pushing them to main or existing branches. When colleagues built from the poisoned repositories, their machines were infected too, turning the build process into a propagation channel. Wiz said GitHub's Vigilant Mode, which flags unverified commits, helped expose the impersonation and halt the spread. The group's reach has extended beyond direct intrusions. On April 7, it trojanized version 4.9.1 of the npm package @velora-dex/sdk, a widely used decentralized exchange toolkit, appending code that fetched a second macOS backdoor called MINIRAT. The recruitment-themed lure is itself well established among crypto-focused attackers, echoing earlier campaigns by groups such as Slow Pisces. Wiz urged defenders to watch for the published indicators of compromise, unexpected use of VPN services including Mullvad, Astrill and ExpressVPN, and secret exfiltration from CI/CD workflows. It also advised enabling logs that are off by default, such as GitHub IP logging, and treating unverified commits as suspect. Image credit: alexgo.photography / Shutterstock.com

Security researchers have uncovered covert infostealer malware hidden in one of the top-ranking repositories on Hugging Face, in another example of the dangers posed by the AI supply chain. AI security vendor HiddenLayer explained in a blog post that it had identified the Open-OSS/privacy-filter as malicious on May 7. At the time it appeared as one of the top-trending repositories on the platform, with over 244,000 downloads and 667 likes in under 18 hours. These figures “were almost certainly artificially inflated” to make the repository appear legitimate, the report claimed. The repo itself typosquatted OpenAI's legitimate Privacy Filter release, copying its model card almost verbatim, HiddenLayer claimed. The attack chain for this campaign was spread over six stages. If the user landed on the malicious repository they would be instructed to clone the repo and run start.bat (Windows) or python loader.py (Linux/macOS) directly, according to the report. The Python script contained a base64-encoded string which ultimately dropped a malicious executable – a Rust-based infostealer. The infostealer featured multiple techniques to bypass the victim’s security controls. “It hides its use of Windows APIs to defeat static analysis, runs checks to detect debuggers and sandboxes, looks for signs it's running in a virtual machine (VirtualBox, VMware, QEMU, Xen), and attempts to disable Windows Antimalware Scan Interface (AMSI) and Event Tracing for Windows (ETW) to evade behavioral detection,” the report explained. The malware was designed to steal browser passwords and session cookies, Discord tokens, crypto wallets, Telegram sessions, and more. Mitigation Tactics HiddenLayer urged any user that cloned the malicious repo and executed start.bat, python loader.py or any other file from the repository to treat their system as fully compromised. “Because the payload is a credential-harvesting infostealer, do not log into anything from the affected host before wiping it,” the vendor explained. “Once the host is isolated, rotate every credential that was stored in browsers, password managers, or credential stores on that machine, including saved passwords, session cookies, OAuth tokens, SSH keys, FTP credentials (FileZilla in particular), and any cloud provider tokens.” Users should treat browser sessions as compromised even if the password was not saved, as stolen session cookies can help threat actors to bypass MFA. They should also: Move any cryptocurrency wallet funds to a new wallet generated on a clean device, and assume seed phrases, keystores, and wallet extension data may have been stolen Invalidate Discord sessions and reset Discord passwords, since tokens and master keys are explicitly targeted Block the IOCs in the report at egress, and hunt historically for connections to identify any other affected hosts Infostealers continue to fuel a thriving cybercrime economy. Last month, data from KELA revealed at least 347 million credentials were originally obtained by infostealers found on around 3.9 million infected machines. Image credit: sdx15 / Shutterstock.com

The Clop ransomware group likely began targeting Oracle E-Business Suite (EBS) instances as early as August 9, successfully exfiltrating a “significant amount” of data new insights from Google Threat Intelligence Group (GTIG) and Mandiant have revealed. An individual or group of people claiming to be working with the Clop ransomware was observed sending extortion emails to executives at several organizations since September 29. Google noted that the extortion campaign followed months of intrusion activity by the threat actor and exploitation of the zero-day CVE-2025-61882 began before patches were available. Similarities and Overlap with Clop Activities GTIG analysis, published on October 9, highlighted several indicators that Clop, also tracked as FIN11, was behind the extortion campaign. The contact addresses listed in the extortion emails sent to executives, [email protected] and [email protected], have been listed on the Clop data leak site (DLS) since at least May 2025. To substantiate their claims, the threat actor has provided legitimate file listings from victim EBS environments to multiple organizations with data dating back to mid-August 2025. “To date, GTIG has not observed victims from this campaign on the Clop DLS. This is consistent with past campaigns involving the Clop brand, where actors have typically waited several weeks before posting victim data,” the researchers noted. In addition, the majority of the alleged victims of the Oracle EBS campaign appear to be associated with data theft extortion incidents stemming from the exploitation of managed file transfer (MFT) systems. Such exploits are frequently attributed to Clop and suspected Clop threat clusters. Post exploitation tooling used in the campaign also shows “logical similarities” to malware used in another suspected Clop campaign. This includes the use of the in-memory Java-based loader GOLDVEIN.JAVA that fetches a second-stage payload. This approach has similarities with the suspected Clop exploitation of the Cleo MFT vulnerability in late 2024, which involved the deployment of the GOLDVEIN downloader and GOLDTOMB backdoor. “However, we have also observed evidence that Clop ransomware, and the Clop DLS has not been exclusively used by FIN11, precluding our ability to attribute based only on this factor,” GTIG added. How the Oracle EBS Campaign Unfolded The campaign followed months of intrusion activity targeting EBS customer environments, dating as far back as July 10, 2025. While GTIG was unable to confirm the exact nature of this initial activity, it said it's plausible that this was an early attempt at exploitation of Oracle EBS servers. After Oracle released a Critical Patch Update in July 2025, which addressed nine flaws affecting EBS, Mandiant observed more likely exploitation attempts. GTIG said it cannot confirm if both sets of activity were conducted by the same threat actor. Oracle warned customers on October 2 that hackers were exploiting unpatched vulnerabilities that were addressed in the July Critical Patch Update. Threat actors then began exploiting the zero-day CVE-2025-61882 against Oracle EBS customers as early as August 9, 2025, weeks before a patch was made available. CVE-2025-61882 is an unauthenticated remote code execution (RCE) flaw impacting Oracle EBS versions 12.2.3-12.2.14. An emergency patch for the flaw was released by Oracle on October 4. GTIG assessed that Oracle EBS servers updated through the patch are likely no longer vulnerable to known exploitation chains. Security Recommendations for Oracle EBS Customers GTIG set out a number of actions for organizations to tackle the threats to their Oracle EBS environments. Prioritize the application of Oracle EBS patches released on October 4 Hunt for malicious templates, as the threat actor stores payloads directly in the EBS database Block all non-essential outbound traffic from EBS servers to the internet, as this can disrupt the attack chain even if a server is compromised Monitor and analyze network logs for indicators of compromise Use memory forensics of Java processes associated with the EBS application to reveal malicious code or artifacts not present on disk Image credit: Stefan_Sutka / Shutterstock.com

Oracle E-Business Suite (EBS) customers have been urged to patch a critical vulnerability in the product, after reports that the notorious Clop ransomware group has exploited the bug in attacks as a zero-day. The UK’s National Cyber Security Centre (NCSC) pointed users to an emergency security update from the US software giant published over the weekend. It patches CVE-2025-61882, an unauthenticated remote code execution (RCE) flaw impacting Oracle EBS versions 12.2.3-12.2.14. “CVE-2025-61882 is a vulnerability in the BI Publisher Integration component of Oracle Concurrent Processing within Oracle E-Business Suite,” explained the NCSC. “An unauthenticated attacker can send specially crafted HTTP requests to the affected component resulting in full system compromise. No user interaction is required.” Google’s Mandiant group said the Clop ransomware group exploited the vulnerability as a zero-day back in August, along with other software flaws patched in the July 2025 Critical Patch Update. Clop is notorious for zero-day exploits in popular software, enabling it to steal and hold to ransom sensitive corporate data. That’s the same modus operandi that enabled it to run the massive MOVEit campaign, as well as similar attacks on Accellion and GoAnywhere customers. Scattered Lapsus$ Hunters Leak Exploit The need to patch is made more urgent by the fact that the infamous Scattered Lapsus$ Hunters threat groups has leaked the exploit used by the Clop gang. That means more opportunistic threat actors will likely try to launch attacks on Oracle customers. “Given that exploitation in-the-wild may have occurred since August 2025, customers of affected Oracle E-Business Suite instances that are accessible via the internet, should conduct suitable threat hunting to detect any potential malicious activity,” urged Rapid7. The UK’s NCSC has the following advice: Perform a compromise assessment using IoCs published in Oracle’s advisory Contact Oracle’s PSIRT and the NCSC if you suspect compromise Install the latest Oracle E-Business Suite (EBS) update. The October 2023 Critical Patch Update must be installed first Minimize the number of software instances directly accessible from the public internet. Where Oracle EBS needs to be exposed to the internet, follow Oracle’s deployment guidelines Image credit: JasonDoiy / Shutterstock.com

A recently discovered supply chain attack campaign targeting Salesforce data via the Salesloft Drift app is more extensive than at first thought. Google (GTIG) revealed in a post late last week that threat actors had not just targeted the Salesforce integration with Salesloft Drift, but also a “very small number” of Google Workspace accounts. “We now advise all Salesloft Drift customers to treat any and all authentication tokens stored in or connected to the Drift platform as potentially compromised,” it warned. “We recommend organizations take immediate action to review all third-party integrations connected to their Drift instance, revoke and rotate credentials for those applications, and investigate all connected systems for signs of unauthorized access.” The campaign came to light last week after GTIG claimed an actor tracked as UNC6395 had targeted “numerous” Salesforce customer instances between August 8 and August 18, systematically exfiltrating large volumes of data. At the time, it said the focus for the actor was harvesting credentials such as AWS access keys (AKIA), passwords and Snowflake-related access tokens. Hundreds of organizations are thought to have been impacted. The hackers compromised corporate Salesforce instances after stealing OAuth tokens for Salesloft’s Drift AI chat integration with Salesforce. No vulnerabilities were identified in Salesforce or Google platforms. New IoCs and Activity Spotted Security vendor Astrix revealed 183 previously undisclosed IP-based indicators of compromise (IoCs) connected to the campaign, all of which are Tor exit nodes. That activity was linked to a malicious AWS account that used bucket names extracted from the compromised Salesforce environments in an attempt to access S3 buckets. “Failed authentication attempts inadvertently exposed the threat actor’s AWS account ID,” Astrix explained. “Our analysis indicates this malicious AWS account initiated operations in early August 2025, coinciding with the broader campaign timeline.” The security vendor urged organizations to improve OAuth token management across all of their cloud accounts. Image credit: gguy / Shutterstock.com

Sysadmins have been urged to prioritize updating a new critical vulnerability in Fortinet’s FortiSIEM solution, as exploit code is currently circulating in the wild. Published on Tuesday, CVE-2025-25256 is an escalation of privilege vulnerability with a CVSS score of 9.8. “An improper neutralization of special elements used in an OS command vulnerability in FortiSIEM may allow an unauthenticated attacker to execute unauthorized code or commands via crafted CLI requests,” the advisory explained. “Practical exploit code for this vulnerability was found in the wild.” Fortinet added that the exploitation code currently circulating “does not appear to produce distinctive IoCs [indicators of compromise],” which will complicate network defender efforts to identify and contain any resulting exploits. FortiSIEM is a security information and event management (SIEM) platform designed to provide security operations (SecOps) teams with threat alerts based on analysis and correlation of data from multiple sources. It’s marketed mainly to medium and large enterprises and managed service providers, putting these organizations in the crosshairs of possible attack if workable exploits are developed. Fortinet products are a popular target for threat actors, with vulnerabilities often exploited in ransomware campaigns. It’s unclear whether the announcement is related to a report from GreyNoise, also released on Tuesday, which revealed a “significant spike in brute-force traffic targeting Fortinet SSL VPNs.” Over 780 unique IPs were involved in the attacks, traced to August 3. GreyNoise said this was the highest volume of IPs associated with attacks on Fortinet SSL VPNs in recent months. “New research shows spikes like this often precede the disclosure of new vulnerabilities affecting the same vendor – most within six weeks,” it explained. “In fact, GreyNoise found that spikes in activity triggering this exact tag are significantly correlated with future disclosed vulnerabilities in Fortinet products.” On August 5, the same threat actor switched from targeting FortiOS SSL VPN endpoints to FortiManager’s FGFM service, the threat intelligence firm said. Image credit: Michael Vi / Shutterstock.com

A new wave of targeted phishing attacks exploiting Microsoft 365’s OAuth workflows has been uncovered by cybersecurity experts. These campaigns, observed by Volexity since March 2025, involve Russian-linked threat actors impersonating European diplomats and Ukrainian officials. The emails try to lure human rights workers and NGO staff into handing over authentication codes that grant access to their Microsoft accounts. Sophisticated Social Engineering Behind the Attacks The threat actors, tracked by Volexity as UTA0352 and UTA0355, are using highly personalized tactics to manipulate targets. Victims receive outreach messages via Signal or WhatsApp, typically appearing to come from European officials proposing meetings on matters related to Ukraine. These conversations eventually lead to the attacker sending a Microsoft OAuth login link and requesting a code that the user sees after authenticating. These phishing links redirect users to legitimate Microsoft login pages. However, once the victim returns the displayed code, often via the same messaging platform, the attacker uses it to generate an access token that unlocks the victim’s Microsoft 365 data. In one case, UTA0352 directed targets to a version of Visual Studio Code hosted online. There, victims unknowingly triggered the OAuth process and were prompted to send back an authorization code. These codes, valid for up to 60 days, granted access to the user’s Microsoft Graph data, effectively exposing their emails and files. In another campaign, Volexity discovered UTA0355 using a compromised Ukrainian government email account to send invitations for a fictitious conference. Follow-up messages via messaging apps asked users to authenticate through Microsoft URLs. Once authenticated, the attackers registered a new device to the user’s Entra ID (formerly Azure AD), bypassed security through social engineering and downloaded email data. Key Indicators of Compromise Volexity highlights several signs organizations can monitor for potential compromise, including: OAuth login activity using the Visual Studio Code client ID URLs with redirects to insiders.vscode.dev or vscode-redirect.azurewebsites.net Newly registered devices linked to proxy IP addresses Abnormal two-factor authentication approval requests App IDs not matching typical user email clients According to the security firm, the campaigns exclusively target NGOs, think tanks and individuals with connections to Ukraine. “Based on this, and the use of similar tactics observed in February 2025, Volexity assesses with medium confidence that both UTA0352 and UTA0355 are Russian threat actors,” the advisory reads. The firm also warned that as these tactics rely solely on Microsoft’s trusted infrastructure and first-party applications, traditional security controls may be ineffective. Image credit: JarTee / Shutterstock.com