exfiltration

An investigation into a threat actor bypassing AI safety controls to coordinate credential theft, VoIP fraud planning, and database exfiltration. The post “Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities appeared first on Unit 42 .

A new CISA advisory warns of the threat posed by SafePay to businesses and critical infrastructure, and urges defenders to take action to mitigate the group’s tactics

A Belarus-aligned hacktivist group spent nearly two years within the network of a Russian healthcare organization. According to a report published by Russian cybersecurity firm Solar, the activity has been attributed to a threat cluster dubbed Partisan Zmiy, which is also known as the Cyber Partisans. Known to be active since at least 2020, the group has a track record of striking industrial enterprises and government agencies in Russia and Belarus with a backdoor called Vasilek that uses Telegram for command-and-control (C2) and data exfiltration. Some of the attacks have also leveraged phishing lures to deliver an installer that simultaneously deploys the legitimate FortiClient VPN program on the system as well as an open-source program known as DNSCat2 that allows attackers to gain control of the infected host. A notable aspect of the threat actor is their ability to stage destructive attacks with a wiper referred to as Pryanik, alongside taking steps to systematically clear Windows event logs using a utility dubbed Evlx. The Rostelecom subsidiary said it discovered the intrusion in December 2025, although evidence suggests that the earliest signs of compromise date back to early 2024. The name of the targeted organization was not identified. The exact initial access vector used to breach the entity is also not known. Unlike other attacks linked to Cyber Partisans, the threat actors remained on the network for an extended period of time without carrying out any destructive activity, marking something of a shift in modus operandi. "The attacked organization possessed an extensive infrastructure and two-way trusted relationships with numerous subsidiary medical institutions," Solar said. "We hypothesize that the lack of infrastructure disruption is due precisely to the value of this access for further espionage and trusted relationship attacks." Observed as part of the intrusion is a loader-scheduler service ("vmauad") that masquerades as a legitimate VMware component to maintain persistence and evade cursory inspection. To accomplish this, the attackers are said to have taken advantage of a trusted-but-unmonitored VMware Tools directory location to plant malicious executables or replace legitimate VMware DLLs with a malicious version ("vmtools.dll") containing the backdoor. The primary responsibility of the Windows service is to launch the rogue binary "C:\Program Files\VMware\VMware Tools\authd.exe" that, besides launching a GOST tunnel every Saturday from 10 p.m. to 11 p.m., runs an updated version of Vasilek (version 1.5.8) once, eight hours after the service begins. Once installed, Vasilek is equipped to collect information about an infected computer, execute Windows commands, launch and terminate processes, transfer files, capture screenshots, record keystrokes, and escalate privileges via runas. It can also prevent the machine from going into sleep mode, and update or remove itself. One new addition is the "move_cursor" command that, as the name implies, allows the backdoor to move the cursor and simulate user input on the victim's screen. "The group consistently invests in stealth and operational security, rather than new capabilities: hostname binding in two independent components, nightly scheduled payload launches, system proxy inheritance, disguise as legitimately installed but unused software, file rotation across the same paths, time-stomping, outgoing message suppression, and anonymous messages on behalf of the group in operator chats," Solar said. "The backdoor's feature set has remained largely unchanged over four revisions. Due to Telegram being blocked in Russia by ISPs, communication between the Vasilek backdoor and C2 has become unstable." The disclosure comes as Solar also disclosed details of a phishing campaign that employs JavaScript attachments mimicking business-themed documents, such as payments and purchase orders, to deliver a previously unreported malware family known as HypeAgent. The Windows malware is a full-featured trojan designed to take complete control over infected systems, packing the ability to steal files, open a console, change desktop wallpaper, turn on a webcam, log keystrokes, launch hidden VNC and RDP sessions, control the mouse, and even deploy a cryptocurrency miner. It's also capable of stealing cookies associated with Discord, Steam, GitHub, Instagram, Telegram, Binance, ChatGPT, Claude, and Cursor, and tampering with the installed Exodus wallet app to inject JavaScript that can collect the victim's password, PIN, mnemonic phrase, and private key. Earlier this June, Solar also observed legitimate infrastructure compromised by the ProxyCB proxyware botnet malware making automated requests to Russian websites and online platforms, while identifying possible overlaps between the botnet infrastructure and historical activity linked to TeamSpy, a threat cluster known for abusing TeamViewer to facilitate reconnaissance and data theft. Last month, the U.S. Department of Justice (DoJ) charged Searzhudin Tamirlanovich Aktulaev, a 40-year-old Russian national extradited from Cyprus in May 2025, for exploiting an online messaging service of a well-known freelance employment platform to send malware-laced Excel attachments to about 80,000 of its users in 2016 and 2017 using 255 fake accounts. The attacks led to the deployment of two types of malware, a variant of the TVRAT (aka Sheldor, SpyAgent, TeamBot, TeamSpy, and TVSPY) and DarkVNC, to harvest and send data from a victim computer to a remote server under the attacker's control. Thousands of computers are assessed to have been infected as a result of this scheme.

A new report from the CrowdStrike Counter Adversary Operations team details research into four previously unreported threat actors, each of whom left their offensive agent frameworks exposed via open directories. In doing so, they shared detailed insight into their use of AI agents and revealed how adversaries are quickly becoming more proficient in AI. AI is changing the speed and scale of cyber operations. Counter Adversary Operations, which brings together the CrowdStrike Intelligence and CrowdStrike OverWatch teams, is closely watching. Between May and August 2026, CrowdStrike Intelligence documented several incidents in which threat actors used AI not only to create tooling or artifacts, but to conduct agentic campaigns in which AI agents make decisions and execute commands. About the Adversaries Below is a high-level overview of the threat actors behind these campaigns: Threat Actor 1 A Spanish/English-speaking operator that has compromised at least 15 Argentina-based healthcare entities and exfiltrated credentials and medical records from at least one victim. The threat actor ran a purpose-built autonomous penetration testing (pentesting) harness against Argentine healthcare organizations. They implemented a dual-agent architecture in which a “Supervisor” Claude Code agent selects the next task from a state machine (i.e., a predefined workflow of attack stages) and an “Executor” agent performs the task. This framework is derived from the open-source PentestGPT project, but the threat actor has rebuilt it with additional MCP servers, Python-based exploitation scripts, and skills. Threat Actor 2 A Chinese-speaking operator with 20+ named global targets. They compromised government entities of two countries and targeted private sector entities in Brazil and the U.S., including entities in biotech, healthcare, food and beverage, retail, technology, and travel. This threat actor primarily accessed Claude models via a China-based AI proxy service (aka a “transfer station”), and they built two pentesting harnesses that grant Claude Code varying levels of autonomy. One harness consists of a Python-based project that deterministically conducts reconnaissance and then asks an AI provider to choose among a preestablished set of possible actions that are deterministically routed to the appropriate agent. A different harness provides more agentic flexibility, allowing Claude Code to operate either as a single agent pursuing a target according to an elaborate standard operating procedure, or delegating actions to multiple specialist agents in parallel. Threat Actor 3 The least sophisticated of the four in this report is an Indonesian-speaking actor that uses 819 skills (overwhelmingly sourced from public GitHub repositories, primarily claude-red1) without additional orchestration to enable Claude Code to conduct intrusion campaigns. In these campaigns, the threat actor instructs Claude Code to compromise a target and assumes the skills will offer sufficient guidance to ensure the intrusion succeeds. However, in the observed activity, the threat actor periodically had to intervene to overcome the model’s safety guardrails or to exhort Claude Code to keep trying to overcome a particular barrier. Despite their limited grasp of security fundamentals, the threat actor still used Claude Code to compromise several Indonesian government domains, a government domain of another country, and several private-sector entities. Threat Actor 4 Threat Actor 4 is a group of Russian-speaking individuals. They exfiltrated corporate client data from a U.S.-based customer relationship management vendor and compromised several private-sector SaaS and data center entities based in Russia, Kyrgyzstan, and the U.S., in addition to one government domain of another country. This threat actor uses a single /pentest-setup slash command to task Claude Code with a seven-step workflow. This workflow provides guidance for enumerating the target environment, grants Claude Code near-total autonomy in selecting exploitation methods, defines a high-level post-remote code execution workflow, and provides explicit exfiltration instructions. What This Means for Defenders The four cases documented in this report likely demonstrate that agentic AI commoditizes baseline offensive cyber operations. This assessment is made with moderate confidence based on the included case studies, all of which showcase threat actors delegating operational decision-making across the kill chain to agentic AI. Working at machine speed, agentic AI can autonomously achieve objectives, often within an hour. Findings from these cases likely support the following assessments: Agentic AI-supported intrusions will almost certainly increase in volume and sophistication, an assessment made with high confidence based on threat actors’ rapid adoption of agentic AI, the effectiveness of the agentic AI-supported intrusions, the continuous improvements in AI models, and the proliferation of open-source offensive agent frameworks.2 Agentic AI will reduce barriers to effective intrusions as we expect over the next 12 months, some low-skill threat actors will likely use agentic AI to conduct campaigns at a level of effectiveness and scale previously only achievable by organized criminal groups or state-nexus actors. Some threat actors will likely improve the OPSEC of their agentic intrusion campaigns over the next 12 months, an assessment made with moderate confidence based on AI development trends and trusted open-source reporting. The team’s findings expand on how these adversaries weaponize AI coding assistants and enable long-term agentic operations using different methodologies. Download the full report for detailed case studies and guidance on how defenders can respond to this activity. 1 https[:]//github[.]com/SnailSploit/Claude-Red 2 https[:]//github[.]com/vxcontrol/pentagi

In January, we responded to the Lazarus Group’s novel attack campaign against South Korea, which followed last year’s Operation SyncHole . In this new operation, the group employed an updated malware chain that included both their old and new malware, which we disclosed in full, and used another mandatory South Korean security software program as a part of infection chain using a watering‑hole strategy. Notably, the group targeted victims more selectively, sending spear‑phishing emails with links to fabricated but relevant sites, such as portfolio and résumé pages tailored to each target. We dubbed this activity Operation FlashHole. Operation FlashHole attack flow during initial compromise Our examination reveals that the earliest evidence of this new operation dates back to July 2025. This suggests the group began preparing for the campaign shortly after ending Operation SyncHole, which lasted at least four months. We identified a minimum of three organizations impacted by the campaign in South Korea’s software, construction, and wired communication equipment manufacturing sectors. These sectors differ from those affected by Operation SyncHole, indicating that the group has expanded its target scope over time. Background After more than a year since the first observation of Operation SyncHole, we detected a suspicious execution chain originating from legitimate South Korean software. This chain mirrors the one from the previous operation; however, this time, the attacker abused CrossWeb EX instead of Cross EX, which was abused in Operation SyncHole. Both applications appear to be maintained by the same vendor, and both are related to financial security. CrossWeb EX is a financial security solution that is required to access widely used online banking and government websites. It encrypts communications between the user’s browser and the web server using public key infrastructure (PKI). This is not the first time Lazarus has abused this software. It was also used in 2021 to deploy the Racket downloader and again in 2022 and 2023 . Although the exact method by which CrossWeb EX was abused remains unclear, we determined that the attack chain ultimately leads to the execution of the malware in memory. We noted that the spawned process was running with a high integrity level. The parent process, INISAFECrossWebEXSvc.exe , originates from the installation bundle of INISAFE CrossWeb EX V3 version 3.4.1.2, released in 2023 after KrCERT’s public advisory . As we already mentioned in our SyncHole blog post, this pattern closely mirrors the long‑standing strategy employed by the Lazarus Group to target South Korea. Since CrossWeb EX and similar software is mandatory for South Korean users and typically runs in the background to interact with the browser, it has been leveraged as a critical attack vector by the group. In 2025, a paper was presented at the USENIX Security Symposium that investigated vulnerabilities in South Korea’s mandatory security software and demonstrated how such software can unintentionally create a massive attack surface. In July 2026, the South Korean government and several local security vendors also published a joint security advisory covering typical Lazarus attack techniques, including exploitation of financial security software. While this advisory overlaps with our findings from Operation FlashHole and Operation SyncHole, and AhnLab’s detailed analysis report Operation Double Barrel covers a wide range of recent Lazarus Group activities, we are conducting a more granular classification based on their TTPs. We will discuss this further in the attribution section. Initial infection vector Although we could not precisely determine what triggered the infection chain, our analysis uncovered a suspicious website hosted on GitHub Pages that is associated with the GitHub account used as the C2 channel. The GitHub account was created last September, and the initial version of the site was designed to showcase the résumé of a senior network appliance developer. In January, however, this site was replaced with another featuring an interior design showcase. The first site was likely accessed by an employee of a wired communication manufacturing company, while the second site likely affected a target in the construction sector. Appearance of the malicious websites The first site with the résumé had a photograph supposedly of a job seeker, but the lack of EXIF metadata and the unnatural texture of the image indicate that it was generated by AI. This suggests the Lazarus Group has incorporated AI into its long‑standing strategy, like other Korean‑speaking threat actors ( 1 , 2 ). The group most likely also used AI to create the lure site: the job seeker’s name resembles the Korean version of “John Doe,” and the portfolio was populated with seemingly meaningless details and random companies. The generated site was then manually tailored to specific targets. Suspected use of an AI-generated image on the résumé site The websites contained embedded links that loaded an external JavaScript file via a script tag. Malicious link embedded in the résumé site: hxxps://javadevhouse.co[.]kr/ajax/libs/jquery/1.7.3/jquery.min.js Malicious link embedded in interior design site: hxxps://pythonapischool[.]com/api/detach Based on the analysis, we assess with medium-to-high confidence that the targets received phishing emails containing links to the malicious site hosted on GitHub Pages (using the domain <username>.github.io). The research results showed a high possibility that visiting the malicious site initiated an infection process involving CrossWeb EX software. This assessment aligns with Lazarus’s recent approach, as detailed in the joint advisory published by the South Korean government and security companies. Full infection chain Following the initial compromise, the legitimate Windows binary fsquirt.exe was executed under the CrossWeb EX process and injected with shellcode containing a malicious DLL – TechHub malware. From our extensive and thorough examination, we identified several malicious payloads and reconstructed the complete infection chain. The infection chain is rather complex and reveals the Lazarus Group’s advanced operational techniques on targeted hosts. These techniques conceal their malicious payloads, intent and their sophisticated malware delivery framework. The latter was updated extensively compared to the previous campaign, despite the new operation starting less than a year later. Significantly, the execution chain below exists only in memory during the initial infiltration, highlighting the attackers’ considerable efforts to hide the initial compromise. Initial infection chain Following the initial compromise, the group sought to maintain persistence on the network by installing a pair of malware strains – TouchHub and TouchShift – leveraging DLL side‑loading under the name mscoree.dll . TouchHub was deployed by the first instance of TechHub. It then used DLL side-loading to launch TouchShift, which led to the in‑memory execution of another TechHub instance. After launching the second time, TechHub deployed another pair, ClientHub and LPEClient, rather than executing Cubridge directly. Only minimal traces of these files were found on disk; the remainder of the malicious code persisted exclusively in memory. Expanded infection chain after gaining persistence Since Cubridge remains only in memory at the initial compromise stage, we suspect the group designed this indirect, multistage chain to deliberately redeploy Cubridge after gaining persistence, as it serves as the most sophisticated orchestrator of the attack. Malware set The full chain comprises advanced variants of the known Lazarus malware strains, including TechHub, Cubridge, TouchShift, LPEClient, and the newly identified TouchHub and ClientHub. TechHub – the start of the chain TechHub, a downloader that plays a central role in this attack, communicates with GitHub using a Personal Access Token (PAT). It serves as the initial payload, providing the top of the chain with sufficient functionality to profile compromised hosts and facilitate subsequent payloads. This variant is a more advanced version of the malware named CLOUDBURST by Mandiant and NickelLoader by ESET. According to their reports, the earlier version communicated with a C2 server via HTTP(S) to fetch additional payloads. The latest iteration we found, however, communicates with GitHub instead and has updated command strings. We identified three variants of TechHub in the chain: an in‑memory version, a simple DLL side‑loading version, and a DLL side‑loading version that uses a registered Windows service. Depending on which stage loads the malware, it contacts a private GitHub repository via the GitHub API using either hard‑coded credentials or credentials retrieved from its configuration file. When TechHub loads, it creates a 4‑byte hexadecimal identifier (ID) in the range 0x1000–0xFFFF or reads one from the configuration file, enabling the attackers to distinguish between compromised hosts. TechHub then checks a GitHub issue by sending the request GET /issues?state=[open/closed] to determine whether any previous communication remains active and removes any traces of it if found. It then proceeds with the handshaking process. It creates a new issue titled 1[ID] with the body “hel” using the POST /issues request, and sets its status to open. It then retrieves a file from the repository containing the 2[ID] value in its name. This file contains the RSA public key. It generates a random 16‑byte XOR key, encrypts it with the provided RSA public key, and uploads the result, prefixed with 1[ID] , to the repository. The hard‑coded IV is XORed with the generated 16‑byte key and then used after the handshake. During file exchange, filenames follow the pattern [1|2][ID][random-16-byte-key] throughout communication. The “2” prefix indicates delivery from the repository to TechHub, while “1” indicates delivery from TechHub to the repository. The random 16‑byte key in the filename is used for AES encryption or decryption of each file’s contents, employing either a hard‑coded IV or an updated IV. After the key exchange is complete, TechHub reads a file with the prefix “2” once again and verifies that the delivered data equals “hel”. If the check passes, TechHub gathers extensive information from the infected host. This data is then encrypted and sent to the repository. After transmitting the device information, the process concludes by updating the body of the previously created issue from “hel” to “hey” using PATCH /issues/[issue number] . The malware is now fully prepared to receive commands from the repository. TechHub supports four commands. The laeca command deploys a payload packaged in shellcode that reflectively loads the embedded payload directly into memory. Command Description mqdrz Collect information about the device and its running processes laeca Directly invoke the received shellcode in memory aqvxp Terminate the current process rtcya Beaconing after finishing the handshake process Cubridge – the framework orchestrator Cubridge, deployed via TechHub on the compromised host, is capable of retrieving various payloads through multiple methods. It serves as the central orchestrator of the entire malware framework, supporting a range of plugins, modules, and tools. An earlier version of Cubridge was also disclosed in the reports covering the previous version of TechHub. In those reports, Mandiant identified it as SIDESHOW, and ESET identified one of its modules as LightlessCan. To establish communication with the C2 server, Cubridge randomly selects one of the predefined C2 servers and constructs a dedicated C2 URL for every request, using the pattern [C2_URL]/[page1]/[page2]/[page3] . This is achieved by concatenating terms from predefined word lists. Our analysis identified a single hardcoded C2 server – hxxps://cubedesign[.]co[.]kr/news/AABBCC – associated with the examined instance that is configured to version 5.1. During URL generation, AABBCC is substituted with a null value. The page3 segment is assigned a randomly generated integer between 10000000 and 99999999 . Consequently, each generated URL is designed to appear authentic and remain unique for each request. The predefined list for page1 is shown below. TechHub randomly selects one item from the list. economy, opinion, politics, national, international, medical, investment, sports, lifestyle, shopping, culture The predefined word list for page2 is shown below. article, list, story This means the hardcoded URL can later be transformed, for example, into hxxps://cubedesign[.]co[.]kr/news/economy/article/12345678 by following the steps described above. Authentication using the POST request with the C2 server requires three parameters in the form of key‑value pairs. Each key is randomly generated using a different predefined word dictionary, and the associated values consist of a randomly generated 8‑byte hexadecimal bot ID, a fixed authentication token ( KW4Ofw982CNJjxd51AVqkGAop ), and a randomly generated 16‑byte hexadecimal session ID. Cubridge employs a more robust handshaking process than TechHub, combining the RSA and RC6 algorithms. Unlike TechHub, it skips the profiling step and proceeds directly to command and control after the handshake. During communication, the malware mimics browser requests, using X‑CSRF‑Token and X‑Requested‑With headers for authentication and the Upgrade‑Insecure‑Requests header to request additional data. Cubridge’s communication sequence Cubridge contains extensive functionality, with a particular focus on loading subsequent‑stage payloads. The commands employ various techniques, such as DLL injection, reflective loading, and section‑mapping injection. The payloads may be delivered in various forms: Plugins – reusable extensions that add functionality as needed and can be invoked at any time (in shellcode and DLL form); Tools (in DLL form) – independent utilities that perform one-off tasks; Modules – components that are loaded once and remain active providing an extended set of functionalities. It is anticipated that the commands for plugins and shellcode will load identical types of plugins because both support a similarly formed exported function for subsequent activity. The shellcode can be generated using the open‑source sRDI tool to package a DLL‑style plugin. The capabilities of a single DLL are likely utilized to load a tool that works independently because when a single DLL is loaded, only its DllMain entry point and its parameters are accessible; no other exported functions are exposed. Command Payload type Description 0 – Collect device info including the computer name, time zone, PID, and other similar details 1 Archive the specified file/directory using the legacy ZipCrypto algorithm and the hard‑coded password: xdkiTajAAxc3i/w[<881fnC!G*cb1Dit2sh.gAk/ 2 Create a file at the specified path 3 Possibly plugin Inject the provided DLL payload into the target process and load it reflectively using reflective DLL injection 4 Plugin Reflectively load a plugin in DLL format 5 Retrieve the address of the specified exported function from the target plugin and run it with the provided parameters 6 Retrieve all information about the loaded plugins 7 Unload the specified plugin 8 Shellcode Inject the provided shellcode into the target process and load it using section mapping injection 9 Load the provided shellcode directly into memory 10 Retrieve the address of the specified export function from the target shellcode (likely a plugin in shellcode form) and run it with the provided parameter 11 Retrieve all information about the loaded shellcode 12 Unload the specified shellcode 13 – Set the scheduled Cubridge execution time (in minutes) by updating a global variable 14 Set the scheduled Cubridge execution time (in minutes) by updating a global variable, while disabling monitoring by also updating another global variable 15 Terminate in a controlled manner 16 Get the configuration for Cubridge: retrieve the global flags, the number of C2 servers, the C2 addresses, etc. 17 Update the global flags, the number of C2 servers, the C2 addresses, etc. 18 Tool Load a DLL reflectively with the specified parameter 19 Configure the parameters for loading a single DLL 20 Unload the single DLL 21 Module Load the “action module” ( ActionModule.dll ) reflectively and invoke its AppinfoView export function 22 Load the “function module” ( FunctionModule.dll ) reflectively and invoke its PresentationFontConfig export function Commands 21 and 22 each load a different module. As their internal names imply, the action module manages basic file and process operations, while the function module implements Windows’ default commands. The action module covers commands 23–41 , and the function module handles commands 42–79 . The action module handles system operation commands, file system interactions, and process behavior. It is invoked by passing the appropriate command and parameters to its AppinfoView export function. The module supports 19 commands, numbered 23 through 41 . Execution results are first sent to Cubridge, which then forwards them to the C2 server. Command Role 23 Get local disk space for each drive 24 Get information about the specified file or directory 25 Execute the provided command 26 Get information about the specified file or directory (similar to command 24) 27 Execute the provided command under the target process (PPID spoofing) 28 Execute the provided command under the target process within the provided session (PPID spoofing + session impersonation) 29 Get detailed information about processes 30 Terminate the provided process 31 Suspend all threads belonging to the specified process 32 Resume all threads belonging to the specified process 33 Permanently delete the file by overwriting its entire contents with the sequence: 0 → 1 → random bytes → 1 → 0 34 Rename the provided file to :EFS (the alternate data stream area) and delete it using the native API SetFileInformationByHandle 35 Set the current working directory 36 Copy the specified file to the provided path 37 Delete the specified directory 38 Move the specified file to the provided path 39 Create the provided directory 40 Initiate a non‑blocking connection attempt to the specified IP address and port (possibly for port scanning) 41 Read the specified file The function module implements commands that emulate Windows’ built-in commands. Similar to the action module, its DllMain routine initializes all supported command functions, which are later accessed through the PresentationFontConfig export. Altogether, the module offers 38 commands, numbered from 42 to 79 . While we believe this module is based on the previous LightlessCan, this is the first time we’ve seen it in the form of a separate module. Command Role 42 Capture all displays and archive them using the legacy ZipCrypto algorithm with the hard‑coded password: xdkiTajAAxc3i/w[<881fnC!G*cb1Dit2sh.gAk/ 43 Synchronize the MAC (Modified, Accessed, and Created) times of the file provided in the second argument to match those of the file provided as the first argument 44 Get information about the specified directory 45 Get information about the specified drive 46 Inject the provided DLL payload into the target process 47 Unload the specified DLL from the specified process 48 Implementation of the ipconfig command 49 Implementation of the net command 50 Implementation of the netsh advfirewall firewall command 51 Implementation of the netstat command 52 Implementation of the ping -6 command 53 Implementation of the reg command 54 Implementation of the sc command 55 Implementation of the ping command 56 Implementation of the whoami command 57 Implementation of the nslookup command 58 Implementation of the schtasks command 59 Implementation of the systeminfo command 60 Implementation of the arp command 61 Call the CryptUnprotectData function to retrieve the AES key that DPAPI protects. Extract the key using the encrypted_key keyword from Chromium’s Local State file located at: %LOCALAPPDATA%\Google\Chrome\User Data\Local State 62 Not implemented 63 Not implemented 64 Read the specified file and decrypt it using an XOR operation with the key 0x59 . Then extract the paths from the decrypted buffer and archive files and directories at these paths with the legacy ZipCrypto algorithm, using the hard‑coded password: xdkiTajAAxc3i/w[<881fnC!G*cb1Dit2sh.gAk/ 65 ~ 79 Not implemented Besides the modules, we also observed that the actor deployed various plugins and tools. Type of payload Name Description Plugin ADFinder ( AdFinder.dll ) Launches LDAP queries in an Active Directory environment, taking six arguments such as log file path, ADsPath, search filter, and attribute names Plugin FileCollector ( Dll.dll ) Recursively scans every subdirectory and file in the provided directory, gathering detailed information about each Tool Browser stealer Can be injected into Chromium-based browsers, such as Google Chrome, Microsoft Edge, and Brave. Once injected, it extracts files and credentials from the victim’s browsers, including stored passwords, bookmarks, history, preferences, and cookies Tool Process collector Iterates over all running processes, collecting each process’s ID, path, and command line TouchHub installs a service for TouchShift During our analysis, we obtained a previously unknown malware sample from TechHub’s private GitHub repository, which served as a parent installer for TouchShift. We dubbed this malware TouchHub. Upon execution, it copies the legitimate printfilterpipelinesvc.exe to C:\Windows\System32\RasConv\ImeBroker.exe , registers it as a service, and places an embedded TouchShift payload named mscoree.dll in the same directory. Following creation, the malware synchronizes the MAC timestamps of C:\Windows\System32\drivers\monitor.sys with those of the newly written file, hindering forensic analysis. It then goes through the service registration process by collecting up to 100 legitimate service names that are registered under the netsvcs svchost group in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost . It randomly selects one of these names, appends two random alphabetic characters to form a new service name, and uses this name to create a service that runs the hard‑coded command line C:\Windows\System32\RasConv\ImeBroker.exe -TimeBroker with the description Microsoft Service . The newly created service is started immediately. Overall, TouchHub creates three files in the designated directory to launch TouchShift with SYSTEM privileges. Path Type Description C:\Windows\System32\RasConv\ImeBroker.exe Executable file registered as a service Copied from C:\Windows\System32\printfilterpipelinesvc.exe C:\Windows\System32\RasConv\mscoree.dll Side-loaded TouchShift payload Dropped by TouchHub. It contains encrypted payloads and includes portions of a legitimate DLL’s contents, which significantly inflates its size C:\Windows\System32\RasConv\ActivationStore.dat TechHub’s configuration file Dropped by TouchHub after extracting configuration values TouchShift, a prevalent loader employed across multiple infection chains The version of TouchShift dropped by TouchHub is almost identical to the version described in Mandiant’s blog post , even sharing the same malicious export function, LockClrVersion . It takes the argument supplied by TouchHub and XORs it with a hard‑coded key. The resulting value is XORed once more with the executable’s filename, and this result is used as the AES key. All strings involved in this process (the argument, the XOR key, the filename) must be exactly 16 bytes long. If a string is shorter, it is padded with NULL bytes ( \x00 ); if it is longer, it is truncated to 16 characters. For example, one of the string combinations in the obtained sample was: Argument: -TimeBroker\x00\x00\x00\x00\x00 (padded with NULL) Hard-coded XOR key: x809G736iC3f8Wp8 Executable filename: ImeBroker.exe\x00\x00\x00 (padded with NULL) After deriving the key, the malware decrypts the embedded payload using AES‑CBC‑128 without padding. The decrypted data is shellcode that starts with a call instruction. It wraps the next‑stage payload – identified as the third version of TechHub (DLL side-loading with a registered service) – that reads the ActivationStore.dat file as an external configuration. ClientHub We also identified a new piece of malware stored in TechHub’s private repository, which we named ClientHub. It supports various commands formed using a bitmask. There are at least two versions of ClientHub: one that communicates with websites via HTTP(S) and one that interacts with the Dropbox API using credentials. Depending on the version, its configuration is sourced from internal resources or the external configuration file C:\Program Files\Common Files\System\msadc\msadc.inc. The configuration comprises keys and IVs for the SNOW 1.0 algorithm, scheduled execution times, and C2 server addresses encrypted with the SNOW stream cipher. The SNOW cipher is a family of high‑speed stream ciphers used for secure data encryption in telecommunications and wireless networks. This is the first time it has been observed in the malware of the Lazarus Group. To establish C2 communication, the malware initially generates a 32‑byte random array. It subsequently overwrites portions of this array with data collected from the compromised device. The resulting 32‑byte array comprises a blend of random bytes and relevant information. This array is later used as the key for the SNOW algorithm to decrypt data received from the C2 server. Finally, the key array is encrypted with a hard‑coded RSA public key and encoded in Base64. Offset Size Field value 0 4 Current process ID 4 4 First four bytes of the decrypted C2 server information. 8 7 Randomly generated bytes 15 1 Calculated flag value that indicates a state machine . 16 8 Current system time, represented as a FILETIME structure. 24 8 Randomly generated bytes The ciphertext is delivered to the C2 server via GET requests. Each request contains headers that are atypical for malware: Sec-CH-UA , Sec-CH-UA-Platform , Sec-CH-UA-Mobile , Sec-Fetch-Mode , and Sec-Fetch-Dest . These headers are normally used by legitimate Chromium‑based browsers and enable malware to imitate legitimate traffic and evade detection. The C2 server replies with commands in a custom header and message body. struct header { int has_more_data // whether more body data remains int body_checksum;// ROR13 checksum for the body data int body_type; // specifies the body type int unknown; int body_length; // Length of the body data int IV[2]; // Random IV used to encrypt the body data }; The body_type field in the header determines how the subsequent payload is processed. This value functions as a bitmask, with each bit representing a distinct flag (e.g., 0x1 , 0x2 , 0x4 , etc.). The resulting behavior also depends on whether the least‑significant bit (bit 0) is set: when the value is odd, the malware interprets the incoming message body as an additional payload that is subsequently loaded into memory. Conversely, when the value is even, the malware invokes the previously loaded payload. The odd value supports four distinct loading methods based on the received message body and ensures that each method executes only once. Bitmask Value in decimal Description Result sent to the C2 0x00000001 1 DLL loading: load the received body reflectively along with the provided parameter The payload’s image base 0x00000011 3 Plugin: load the received body reflectively, obtain the address of a function in the payload, and then invoke that function along with the provided parameter The payload’s image base, the address of the invoked function, and the execution result 0x00000101 5 Plugin: load the received body reflectively, obtain the address of a function in the payload, but refrain from invoking it immediately The payload’s image base, the address of the function 0x00001011 11 Plugin: execute the behavior associated with value 3, then unload immediately after invoking the plugin – 0x00010001 17 DLL loading: load the received body reflectively with the provided parameter, maintaining stateful communication via a persistent interactive session using a shared buffer The payload’s image base, the address of the interactive shared buffer, and the execution result The even value provides two distinct invocation methods for DLLs and plugins that have already been loaded and are associated with the odd‑value bitmask. The 2 (0x10) flag allows the payload previously loaded with the 1 , 3 , or 5 bitmask to be reused and invoked directly. The value 16 (0x10000) corresponds to the 17 (0x10001) flag in loading mode and uses the established interactive shared buffer to exchange data. All values are guaranteed to act independently. Bitmask Value in decimal Description Result sent to the C2 0x00000010 2 Invoke the previously loaded DLLs and plugins along with the provided parameter The execution result 0x00000100 4 Not implemented – 0x00001000 8 Unload the previously loaded DLLs and plugins The execution result 0x00010000 16 Send the updated parameter to the payload loaded by the command with the value 17, and exchange data through the interactive session. This command also determines whether to retrieve the execution result or unload the payload The execution result Taking into account the loading mechanism, we identified four plugins deployed to the target that work perfectly with ClientHub. Plugin Description File archiver Archives the provided file using the legacy ZipCrypto algorithm (without password protection) and returns the compressed data File collector Searches for all files matching the provided search pattern and collects metadata including filename, MAC timestamps, file size, and attribute values File cleaner Overwrites the provided file with NULL bytes, renames it to a randomly generated filename of the same length, and then deletes it. If a directory with a search pattern is provided, it locates all matching files, renames each to a randomly generated name of identical length to its original name, and deletes them Drive and session monitor Monitors remote session changes and local drive changes for the provided duration (in 10-minute intervals) and returns the collected status information In addition to the plugins, ClientHub supports the loading of LPEClient malware and communication with it. We found that ClientHub’s body_type values 16 and 17 correspond to LPEClient’s C2 communication mechanism. LPEClient LPEClient is the only malware that was also observed in Operation SyncHole, indicating that the actor relies heavily on it for sophisticated victim profiling and payload delivery across multiple operations. LPEClient first appeared in 2019, and was discovered in 2020 . Since then, the tool has been widely observed in the Dream Job and Cascade Hole campaigns that targeted South Korea. Recent research conducted by Check Point revealed that LPEClient was used to deploy the FudModule malware using a zero-day. LPEClient has evolved continuously over time, but we discovered that it recently underwent a major operational revamp. It no longer contains the C2 server address itself; instead, it interacts with ClientHub via a shared buffer. We believe this change is intended to enhance concealment. Timeline of LPEClient The previous version collected the computer name, memory status, CPU specifications, operating system details, version of the ntoskrnl.exe file, firmware table, antivirus name, domain name, user name, the integrity level of the current process, and a random byte sequence of 1,568 bytes. The newly updated LPEClient variant mostly collects the same information; however, it also introduces several changes. It does not collect the version of the ntoskrnl.exe file by querying the FileVersion value. Instead, depending on the specific build, it reads either the HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\UBR registry key or the SYSTEM_BUILD_VERSION_INFORMATION structure to retrieve the revision portion of the Windows build number. These values can be used to infer the system’s cumulative update or patch level. To collect information about installed antivirus products, it switched from querying a WQL command to reading the WMI repository file directly. It now reads C:\Windows\System32\wbem\Repository\OBJECTS.DATA and searches for keywords such as AntiVirusProduct, companyName, and displayName to identify the installed products. It also collects low‑level Windows security mitigation states. To achieve this, it queries the SYSTEM_KERNEL_VA_SHADOW_INFORMATION structure for the Kernel VA Shadow mitigation status and the SYSTEM_SHADOW_STACK_INFORMATION structure for the Shadow Stack (CET) protection status. Additionally, it generates a 32‑byte random unique identifier by using the HighwayHash algorithm and an XOR operation with the current system time. The collected information, including the generated identifier, is compressed with the XPRESS Huffman algorithm using the maximum compression setting. The compressed data is then concatenated with the message ID 0xF07D6B34 and encrypted using GOST (also known as Magma), Russia’s national cryptographic standard that employs a DES‑like structure, before being sent to the ClientHub via a shared buffer. Initially, KrCERT described the algorithm as a custom DES‑like scheme. However, further analysis by us and Check Point confirmed that it is actually the GOST algorithm. The key is randomly generated by a proprietary key‑generation algorithm and prepended to the encrypted message. The next request handles the key exchange by delivering the message ID 0xA39CF278 together with the generated unique identifier. The response is decrypted using the AES‑CBC‑256 algorithm. The SHA‑256 hash of the previously generated 1,568‑byte random value, which was originally sent to the C2 server during the collection phase, serves as the key for this decryption. Through this process, LPEClient obtains a byte array comprising four 1,568‑byte blocks from the C2 response. Each block contains an ML‑KEM‑1024 public key, where ML‑KEM is a NIST‑standardized post‑quantum key encapsulation mechanism derived from CRYSTALS‑Kyber. LPEClient then generates four distinct pairs of shared keys and ciphertexts from these blocks, encrypts the ciphertexts with the GOST algorithm, and transmits them to the C2 server via ClientHub together with the message identifier 0xEF8C0D51 and the associated identifier. Now that the preparation phase for receiving payloads is complete, the malware is ready to receive payloads forwarded by ClientHub from the C2 server, along with the necessary parameters. The use of post-quantum cryptography shows that the group intends to hide subsequent payloads. The response to the 0xEF8C0D51 message is decrypted with the Threefish algorithm using a 256-byte key, composed of the four distinct shared keys. Threefish is a tweakable block cipher that accepts a ‘tweak’ value alongside the key and the message. The concept of a tweak is similar to that of a nonce or initialization vector, which are used in different types of ciphers. In LPEClient communication, the tweak for the decryption is derived by XORing the unique identifier with 165 (0xA5) . The first four bytes of the decrypted message must specify the parameter’s length, followed by the parameter itself and then the payload. The payload must be larger than 4 KB and start with the characters 'MZ' , which indicates that the decrypted payload is an executable file. The payload is then reflectively loaded into memory. After successful loading, LPEClient sends the message ID 0xCB790A25 to the C2 server. Before loading the acquired payload, LPEClient takes measures to bypass security products. Instead of invoking VirtualProtect directly, the malware uses the identified HeapPageAllocator::ProtectPages in jscript9.dll to modify the memory page protection of the MD4Update function. The beginning of the function is then overwritten with a hard‑coded opcode sequence that serves as a syscall stub with the required arguments. LPEClient then uses the syscall stub to disable a user‑mode syscall instrumentation hook. We identified the final payload that was ultimately loaded as Cubridge. The overall communication process is as follows. Data relay flow between LPEClient and C2 via ClientHub Comparison of plugins and modules Throughout the engagement, we identified a variety of payloads deployed by TechHub, Cubridge, and ClientHub. These payloads have been categorized as tools, plugins, and modules that constitute the group’s modular malware framework. While we have not yet ascertained which payloads are deployed under specific conditions, the evidence suggests that the Lazarus Group’s toolkit is becoming increasingly sophisticated and segmented into specialized components rather than a single comprehensive backdoor. We also believe that TechHub and Cubridge may share similar tools. Deployed via Type of payload Family TechHub/Cubridge Tool Process collector, Browser stealer Cubridge Module Action module, Function module Cubridge Plugin ADFinder, FileCollector ClientHub Plugin File archiver, File collector, File cleaner, Drive/session monitor These modularizations are not confined to the instances within this campaign. As previously noted, similar patterns have been identified in CookiePlus, MISTPEN, SIGNBT, and IMETHOD. Note that we have reclassified the ThreatNeedle variant used in Operation SyncHole as the latest version of IMETHOD, the predecessor of ThreatNeedle in use since at least 2016. Infrastructure Based on the information we obtained from the TechHub malware, we identified at least three primary repositories used as the C2 server and one fallback repository. The earliest evidence indicates that the group has been leveraging GitHub as a C2 server since at least July 2025. We suspect that all the accounts were created using hijacked email accounts, and disguised as normal repositories by copying or creating normal projects to avoid suspicion. For the Cubridge and ClientHub C2 servers, the Lazarus Group employed only a minimal number of compromised yet legitimate South Korean media and interior design websites. Later, we observed that a broader range of compromised legitimate sites across various industries were also exploited. In addition, one ClientHub sample that we detected used Dropbox as a C2 channel. Victims We have identified at least three firms from the software, construction, and wired communication equipment industries in South Korea that were targeted by Operation FlashHole. As with the previous operation, however, we remain confident that a considerably larger number of organizations across a broader spectrum of industries have been affected. The software sector was the only sector targeted in both the SyncHole and FlashHole campaigns. This suggests the actor is eager to compromise the sector, steal source code, and exploit vulnerabilities for further attacks. Attribution and links to other campaigns Operation FlashHole is the latest wave in the broader Cascade Hole campaign, which involves the use of South Korean software as a potential entry point to deliver malware targeting the country. Although the malware chain has advanced significantly since last year, we assess with medium-to-high confidence that the same actor is responsible for both the SyncHole and FlashHole operations based on the initial vector, targets, multi‑stage chain, and technical and operational improvements. The use of LPEClient in particular is a strong indicator supporting this assessment. The malware strains used in the attack are historically linked to the toolsets observed in the Lazarus Group’s notorious Dream Job campaign. Earlier versions of TechHub (also known as CLOUDBURST and NickelLoader), Cubridge (also known as SIDESHOW and LightlessCan), and TouchShift were all observed in that campaign, especially between 2022 and 2023. We also discovered that both CookiePlus and ClientHub have significant overlaps in class name, configuration path, and plugins. Based on these similarities, we assess with medium‑high confidence that ClientHub is an advanced version of CookiePlus. Since July, around the time Operation SyncHole began winding down, we have also observed several notable attacks against South Korea employing the COPPERHEDGE backdoor and targeting various South Korean organizations. Interestingly, the start times of these activities align with the earliest evidence we have identified for Operation FlashHole. Although the backdoor was part of the second phase of Operation SyncHole, it has been operating independently with its custom loader since then. These incidents featured malware chains and tools that were distinct from those used in Operation SyncHole and FlashHole. As AhnLab noted in their report , the same backdoor was likely observed in atypical activity, specifically the Gunra ransomware infection. Our investigation further revealed that one instance of a backdoor infection ultimately resulted in the exfiltration of data to a dark web leak site, which clearly differed from Gunra’s. The site appears to have been crafted exclusively for this activity. In summary, unlike other attacks, the backdoor was used in conjunction with both ransomware and data exfiltration. Data leakage site linked to the COPPERHEDGE backdoor on the dark web Another noteworthy point is that the recent Dream Job campaign employs an updated malware chain that, since around 2024, has primarily involved MISTPEN and ForestTiger rather than the earlier arsenal that included tools such as TechHub and Cubridge. However, the updated versions of this older malware have now re-emerged as part of Operation FlashHole. Considering these changes and all aspects of each attack’s TTPs, we have organized a classification for each attack. Overlaps between the recent attacks by Lazarus Group Conclusion Our analysis shows that the Lazarus Group begins preparing for its next operation shortly after completing the previous one, ultimately deploying an enhanced malware chain by refining existing tools. The group continues to use the advanced version of LPEClient for profiling and payload delivery, indicating that the tool is meticulously managed and well maintained. Ironically, the group seems to have adopted more secure post-quantum cryptography faster than many legitimate security products. These observations suggest the involvement of a dedicated developer, with others orchestrating comprehensive attack scenarios against newly targeted software. We anticipated that specialized attacks targeting South Korea would persist. However, we did not foresee multiple attack campaigns being executed simultaneously, each leveraging different types of software and tools. Notably, the COPPERHEDGE cluster appears to be involved in monetizing the attacks, while Operation FlashHole is focused on espionage. We are closely monitoring these changes to understand their motivations and ultimate goals. In October 2025, the South Korean government unveiled a comprehensive cybersecurity plan that will phase out the mandatory installation of security software for users beginning in 2026. We estimate that operations exploiting this software will remain highly active for some time, maximizing efficiency, before the software is fully eliminated or mitigated. Kaspersky products detect the exploits and malware used in this attack with the following verdicts: MEM:Trojan.Win64.Shellcode.gen, Trojan.Win64.DLLhijack.*, Trojan.Win64.Lazarus.*. Indicators of compromise File hashes TouchShift ec84d6cb2ae7974767aedac246b50a3e              mscoree.dll a28cba214058fcae2883d8cffc883abd                 mscoree.dll c105d6b16f544582772de0159f24c00a                mscoree.dll 2f8475a90a25624ed02f1d18d4e6d65d               mscoree.dll 676fabe30a28b53925fba98e34b35986               mscoree.dll b4a7eff35f048f06fb0a2d7631f23a7d                   mscoree.dll ClientHub Loader ff07641dc56914dd90ee0bd7404d7ad7                liblzma.dll File paths C:\ProgramData\Dell\Dell1.tmp C:\ProgramData\Dell\Dell3.tmp C:\ProgramData\Package.txt C:\ProgramData\RasConv\mscoree.dll C:\ProgramData\Apple\mscoree.dll C:\ProgramData\ssh\mscoree.dll C:\ProgramData\qorestor\mscoree.dll C:\ProgramData\Dell\mscoree.dll C:\ProgramData\Dell\Dell1.tmp C:\ProgramData\Dell\Dell3.tmp C:\Windows\System32\RasConv\mscoree.dll C:\Windows\System32\RasConv\ActivationStore.dat C:\Windows\System32\DrvConh\mscoree.dll C:\Windows\System32\DrvConh\ActivationStore.dat C:\Program Files\Common Files\System\msadc\msadc.inc C:\ProgramData\desktops.ini C2 servers javadevhouse.co[.]kr pythonapischool[.]com hxxps://cubedesign[.]co[.]kr/news             C2 of Cubridge hxxps://cubedesign[.]co[.]kr/mobile/fashion             C2 of Cubridge hxxps://fp-news[.]co[.]kr/shop/cart                                 C2 of Cubridge hxxps://k-wbc[.]co[.]kr/skin/social/social_view.php          C2 of ClientHub hxxps://rcsh[.]co[.]kr/modules/bbs/tiles/bbs_div/inputForm.php     C2 of ClientHub hxxps://www[.]ksog[.]org/insert_file/handle.php                    C2 of ClientHub

Unit 42 details how threat actors leverage Web3 infrastructure and open-source supply chain attacks to breach enterprise cloud environments The post Evolution of Web3 in Cloud Supply Chain Attacks appeared first on Unit 42 .

Linux backdoors targeting telecom and network appliances in South Korea and Taiwan have been disguising their traffic as email services and seemingly legitimate processes to blend in and evade detection. Threat actors are known to name their malicious software after a legitimate operating system component or a process as a defense evasion measure. By borrowing the name of a real binary, it may

Analysis of Blinder Tunnel, an Iran-nexus campaign using fake Dubai Airports recruitment lures and GitHub C2 malware to target critical infrastructure. The post Blinder Tunnel Campaign Targets Iraqi Infrastructure appeared first on Unit 42 .

Cybersecurity has never been easy. Threats evolve at breakneck speed. Corporate attack surfaces continue to expand with each new digital investment. Regulatory requirements add extra pressure on stretched teams. And behind it all, the unpredictability of human nature means there is no such thing as 100% security. But the market for security solutions doesn’t make things any easier for SMBs. Smaller organizations usually have fewer resources and less expertise to throw at the problem than their larger counterparts. But they absolutely understand the need for advanced protection. It’s just that they also want it to feel simple, guided and manageable. Solutions and services that foreground such an approach are in short supply. But they do exist. SMS understand the importance of cybersecurity “Good enough” security is simply not good enough at a time of persistent geopolitical uncertainty and rapid technological change. ESET data reveals that three-quarters (75%) of SMBs are concerned about global conflicts and cyber warfare. And nearly half have experienced at least one cyber incident in the past year. Whether it’s Iran-nexus threat actors targeting British power and US water plants, or, as shown by recent ESET research, Russia-aligned hackers hitting Polish energy facilities, state-backed attacks are more frequent and more ambitious than they’ve ever been. SMBs are very much in the crosshairs, as providers of critical infrastructure themselves or suppliers to firms operating in critical infrastructure. But that’s only half the picture. Financially motivated groups continue to pose an outsized threat, usually via ransomware or data theft extortion. Often they operate with impunity from hostile states, where they elude the reach of Western law enforcement agencies. There’s growing evidence to suggest they even collaborate with government hackers on some campaigns. Yet the identity of the adversary is arguably less important than the tactics they’re using to target global SMBs. AI is empowering threat actors everywhere to upskill and scale attacks more cost effectively than before. They’re moving through the attack chain at speed, from reconnaissance to exfiltration, collapsing the vulnerability exploitation window, and building highly convincing personalized phishing messages. A new wave of autonomous agent-powered attacks will come next. We know what they’re capable of, because they’ve already broken free of vendor testing environments to socially engineer victims, create fake personas, exploit weak passwords, and deploy malicious code. If rogue agents can do this, then deliberately manipulated agentic AI can too. AI is also the target. As SMBs embrace coding agents, chatbots and AI-assisted workflows, these tools are creating a new attack surface. Do you know what you’re running in your organization? Can you be sure it’s not being manipulated by malicious third parties? And are your users following policy when they interact with the technology? A third (32%) of North American and even more (42%) European organizations admit to having no rules in place to restrict the use of AI applications outside approved processes or platforms. Overwhelmed and overpriced Against this backdrop, it’s perhaps not surprising that ESET finds that 58% of SMBs believe they are more vulnerable to cyber attacks than larger enterprises. It’s not just that they’re facing an unprecedented threat landscape. The pressure is operational as well as technical. SMBs often struggle to make sense of a market crammed with industry jargon, competing marketing claims, and point solutions which address only narrow problems. They buy more technology, but the outcomes don’t improve. The average company might use scores of siloed security tools, all pushing out alerts and impressive-looking dashboards. That does nothing but create more operational overhead, alert fatigue, and training gaps. Without the time, skills and confidence to manage all that technology, SMBs can quickly become overwhelmed. Real threats slip through the net while teams waste valuable time chasing false positives. Critical security updates are left undeployed while teams patch non-essential systems. Important tools are misconfigured. Reducing the burden Smaller organizations want better protection, not another security puzzle to solve. They need tools and services they understand; that are simple to operate and deliver plain-language guidance and explanations on how they work and what they’re doing under the covers. They want 24/7/365 monitoring to ensure that any threat at any time can be caught and contained as soon as possible, reducing the impact on the organization. And they want expert help to understand what threats to prioritize when alerts are flying in and context is in short supply. For many, this will mean outsourcing some parts of the security function to a trusted partner. They may not know the search term. But for many, the destination should be managed detection and response (MDR) which reduces the burden on in-house teams while ensuring no alert is missed. Yet historically, the SMB market has not necessarily been well served by MDR providers. Smaller organizations may have felt locked out of a market that often charges a premium for their capabilities. After all, in-house 24/7 monitoring and threat hunting doesn’t come cheap, especially during a time of skills shortages. Then there’s onboarding. Despite offering simplicity on the surface, many MDR offerings don’t work out like that in practice. They require integration with multiple systems and data sources, the granting of the correct permissions to outsourced SOC staff, the fine-tuning of detection rules, incident response planning, and many other complex, time-consuming tasks. What most SMBs want is continuous monitoring, detection of suspicious activity, clear guidance on next steps, and experts on hand to help with containment and remediation as required. But in reality, it can be much more complicated. For SMBs, this is about finding value for money: security that delivers the outcomes it promises. This matters more than ever at a time of continued business uncertainty, and the threat of cyber disruption which could have lasting consequences. All organizations have to assume that they’ll be breached at some point in the future, no matter how effective their preventative controls. The key to avoiding potentially crippling financial and reputational damage is to contain and recover from any attack as quickly as possible. That means finding security that helps them make better decisions, not security that creates more work. What SMBs want Against this backdrop, SMBs are looking for several complementary capabilities from their security partners. They want products and services that help to: Lower the operational burden by absorbing the day-to-day work that in-house teams are struggling to get through. A provider might do this by automating routine processes such as remediation of common issues. By offering teams AI assistance to improve productivity. And by ensuring there’s always expert help for things like onboarding and intervening when AI and automation don’t deliver. Detect and contain threats faster to maintain resilience. This capability must work round the clock, given that threat actors increasingly look to strike at weekends and during holidays to maximize their efforts. By minimizing dwell time, organizations can reduce the costs associated with an incident. IBM calculates that data breaches last year which took under 200 days to identify and contain incurred costs of $4.32 million, while those with a lifecycle exceeding 200 days had an average cost of $5.65 million. Encourage clearer understanding and better decision making, by not bombarding the customer with too much technical information. They need to know what happened, how serious the incident is, what the service provider has done to remediate, and what else needs to be done by their organization. Too much information can cripple response efforts. Deliver stronger operational continuity with a system which will support resilience by preventing incidents where possible, limiting the impact when they do occur, and ensuring the company can maintain minimum viable operations while recovering swiftly. SMBs have a smaller margin of error than large enterprises, making rapid recovery key to preserving customer trust and minimizing the financial impact. Drive faster time to value through rapid onboarding and deployment, ensuring the SMB can start benefitting from the service as soon as possible. AI and automation can help here, and ensure the exposure window is kept as short as possible. Encourage safer AI adoption by ensuring that all AI in use in the organization is managed and governed securely. That means first understanding what is in use in the organization, what data is being fed into it, and (in the case of agents) what it can access. Then working out policies and controls to minimize risk. A secondary layer of protection works to reduce leakage risks and prompt injection or data poisoning so that existing systems can’t be hijacked by malicious third parties. Increase protection across the corporate attack surface, which could include identity, collaboration tools, remote access, AI usage, SaaS apps, cloud infrastructure and more. A trusted provider will help to manage risk across this distributed and complex IT environment, which could stretch from remote employee laptops to cloud servers. Threat actors are past masters at finding gaps in protection, so coverage must be comprehensive. Deliver the right approach for each individual organization, because no two SMBs are the same. They have different risk profiles, attack surfaces, IT maturity levels and budgets. For some, automated protection is sufficient. For others, a white-glove security relationship with comprehensive support is a better fit. The key is offering choice without confusion, and services aligned to the customer’s risk appetite. The case for supervised security What this translates into is friction-less, supervised security for the AI era. Friction-less because it should reduce unnecessary friction in terms of purchasing, deployment and use. And offer robust protection without the need to interpret complex technical alerts or integrate disconnected point solutions. Supervised, because it should offer a blend of AI, automation and dedicated human oversight, ensuring the customer is in the driving seat but with an expert navigator by their side. And “security for AI” because it should leverage AI to enhance prevention, detection, response, correlation, investigation, and efficiency. But it should also have capabilities to reduce risk across the customer’s AI attack surface. AI is changing the game for security. But it should never be treated as a feature, or a marketing message. It should be embedded into the fabric of what a trusted security partner delivers. Not to replace human expertise, but to enhance it where necessary, making teams more productive and catching threats which their eyes might miss. Ultimately, SMBs want confidence that they are better protected, supported, and prepared. That they are doing everything they can to minimize an intrusion. And that, if a breach does occur, that they can recover as quickly as possible. Beyond this, they need to feel this confidence without the operational burden that is hurting so many smaller organizations. Because security should at the end be a business enabler. Not a burden on growth and innovation. The market is evolving. A better approach is available for SMBs. You just need to find the right security partners; those which focus specifically on meeting the needs of the mid-market with simpler solutions that deliver supervised cybersecurity outcomes.

Microsoft has warned that threat actors have gained the advantage over defenders by using AI to enhance the speed and scale of attacks

The China-based hacking group has been exploiting SharePoint vulnerabilities since July 2025. The post Warlock Expands SharePoint Exploitation in Critical Infrastructure Attacks appeared first on SecurityWeek .

Microsoft says cyberattackers are currently benefiting from artificial intelligence faster than defenders, allowing threat actors to speed up vulnerability discovery, malware development, and post-compromise activity while security teams struggle to keep pace. [...]

Under certain conditions, CVE-2026-73570 can be exploited via specially crafted emails without user interaction. The post Zimbra Vulnerability Exploited in the Wild Prior to Public Disclosure appeared first on SecurityWeek .

BlackFog adds prompt protection and governance for agentic AI BlackFog has announced the launch of ADX Vision 2.0, expanding its AI security capabilities to help organizations govern and control the use of generative and agentic AI across the enterprise. As employees move from simply interacting with AI tools to deploying agents capable of making decisions and acting on corporate data, the security challenge for organizations is changing. Traditional controls were not designed to address risks such as prompt injection, unauthorized data exposure and limited visibility into what AI is doing with corporate data. ADX Vision 2.0 provides an independent control layer for enterprise AI that operates directly on the endpoint, before data ever reaches an AI service. This gives organizations visibility, governance and auditability across every AI interaction, whether initiated by an employee or an AI agent, and determines what AI is allowed to do with data, regardless of which tool or model is being used. The launch builds on ADX Vision’s Shadow AI discovery and control capabilities, expanding into a broader security and governance layer as organizations deploy increasingly autonomous AI systems. Seven layers of prompt protection ADX Vision 2.0 introduces seven layers of protection designed to identify prompt injection attempts and other malicious or manipulated prompts: Context switching protection Obfuscation protection Jailbreak detection Data exfiltration protection Dangerous prompt pattern detection Fuzzy keyword detection Structural anomaly detection The same protections apply whether a prompt is written by an employee or generated by an AI agent acting on their behalf. This extends security to autonomous workflows where there is no human oversight of what is being sent. Custom controls can also be applied at a company or departmental level to identify sensitive information, including credit card numbers, Social Security numbers and domain-specific terminology. Greater control and auditability ADX Vision 2.0 enables organizations to redirect AI requests to sanctioned, officially licensed LLM services, helping enforce AI policies without preventing employees from benefiting from the technology. For example, an employee who opens a personal ChatGPT account can be automatically routed to the company’s enterprise AI instance, keeping corporate data within approved environments. The platform also introduces an optional prompt auditing feature for leading frontier LLMs. This provides greater visibility and accountability around the information being shared with AI systems and supports governance and compliance requirements as regulation evolves. “AI is quickly moving from something employees interact with to something that can make decisions and take action on their behalf,” said Dr. Darren Williams, CEO of BlackFog. “That changes the security equation. When an agent is sending prompts on an employee’s behalf, there’s no human in the loop to catch a manipulated instruction or a leak of sensitive data. ADX Vision 2.0 inspects agentic prompts with the same protections as those written by humans.” Token visibility and accountability ADX Vision 2.0 also introduces a unified view of token consumption across LLMs, showing organizations where tokens are being consumed and by whom. This supports financial planning and drives cost efficiency, while also helping identify potential token theft, where attackers use stolen API keys or credentials to access AI services and run up usage at the organization’s expense.

Vulnerability disclosures continue to skyrocket, doubling over the course of the year to more than 10,000 each month, Google researchers warned.

Threat actors have weaponized a now-patched security flaw in Zimbra Collaboration Suite (ZCS) to deploy web shells and access mailbox data, according to findings from the Microsoft Security Research team. The attack exploits CVE-2026-73570 (CVSS score: 8.9), an unauthenticated operating system command injection flaw that can lead to remote code execution when Simple Network Management Protocol

WatchGuard has rolled out patches for 15 code execution, DoS, authorization, and path traversal bugs in Fireware OS. The post WatchGuard Patches Critical Fireware OS Code Injection Vulnerability appeared first on SecurityWeek .

Given that the browser is where business apps are accessed and used, it makes sense that attacks are happening there too. Most breaches today begin in a browser session. Often, they never leave it, with the entire attack chain from initial access to exfiltration playing out in the browser. Here are the six most dangerous techniques that should be on every security team's radar in 2026. 1.

Al momento del lancio dei GitHub Agent Workflows, chi si occupa della sicurezza dei sistemi agentici si è chiesto: cosa succederebbe se l'agente leggesse qualcosa di cui non dovrebbe fidarsi. GitLost è un promemoria di quanto sia costoso attivare un flusso di lavoro senza aver prima valutato i permessi. Ecco come funziona l'attacco L'articolo GitLost: così la prompt injection negli agenti AI può esfiltrare repository privati proviene da Cyber Security 360 .

The cyber criminal behind JadePuffer, the first known agentic ransomware infection reported over the summer, has also used stolen Azure identities to conduct destructive attacks on cloud storage and other resources, according to Microsoft. In July, Sysdig threat hunters uncovered JadePuffer, the first-ever documented agentic ransomware infection in which an LLM drove the entire extortion operation, from gaining initial access to compromising a production database server and destroying data. Now Redmond says that it has detected the same attacker, which it tracks as Storm-3168, up to new mischief. Over an 18-hour period in early June, Storm-3168 compromised two service principals and used these machine identities for “extensive Azure-focused resource destruction” and “cloud credential collection that could be used to facilitate future exfiltration,” researchers Yossi Weizman and Tushar Mudi wrote on Friday. The two compromised service principals belonged to the same cloud tenant. The crims used one of them to conduct reconnaissance and resource discovery, and the other to carry out destructive operations and credential collection. The Redmond researchers don’t know how Storm-3168 initially hijacked the service principals, but noted that an employee of the same organization previously exposed client IDs, client secrets, and tenant IDs in plaintext in a public GitHub issue. “Since the beginning of this year, we also observed repeated probing from Storm-3168 linked infrastructure against multiple Azure App services for different customers,” the duo wrote. The entire attack took about 18 hours, with the discovery piece lasting about 15 hours and 30 minutes. During this time, the compromised service principal collected detailed information about Azure Virtual Machines, subscriptions, resource groups, and resources, completing more than 300 successful read operations. “This breadth of activity would give the threat actor visibility across the organization’s Azure environment,” Weizman and Mudi wrote. About 90 minutes after the first machine identity began hoovering up Azure information, the second compromised service principal started its work, reading Azure VMs and resource groups across two subscriptions in just five seconds. According to Redmond, both of these service principals used Storm-3168 linked infrastructure, the same network fingerprint, and the user agent python-requests/2.34.2. About 16 hours after the initial target reads, the second service principal successfully discovered Azure App Service configuration stores - it was likely looking for exposed credentials, we’re told - and unsuccessfully attempted to find Azure OpenSearch resources. Seventy seconds after this, it also attempted a ListKey operation against a non-existent storage account. Then, the destruction began. During this part of the operation, the compromised service principal attempted more than 150 destructive or credential-stealing attempts in 35 minutes. The destructive activity only lasted about 7 minutes with the machine identity attempting to delete more than 100 Azure Storage accounts. Most of these were successful, although Azure resource locks and storage account-level deletion did block a few. Additionally, the attacker deleted an Azure Key Vault, Function App, App service plan, all of which belonged to the same resource group and likely supported the Function app. “The same service principal also attempted to delete multiple Azure SQL databases in parallel with the storage account deletions mentioned earlier, but every deletion attempt failed because it used an unsupported API version for the Azure SQL database resource type,” Weizman and Mudi wrote. About 28 minutes after the destruction ended, “the same service principal made an inventory request for Azure Storage Accounts and sent more than 30 successful ListKeys requests, asking ARM to return each storage account’s access keys,” they added. “These storage accounts included Azure Site Recovery related storage accounts.” Multiple unsuccessful deletion attempts were also made against Azure Site Recovery locks and Azure Backup protection locks protecting storage accounts. According to Microsoft, the destructive activity - deleting numerous Azure resources, while also targeting backup and recovery-related resources - seems to indicate that Storm-3168 was setting up a ransomware attack. “Taken together, the resource destruction, attempts to interfere with recovery mechanisms, and collection of credentials that could provide access to data are consistent with tactics that can support ransomware and extortion operations,” Weizman and Mudi wrote. However, no ransom note was ever sent. "We did not observe a ransom note or confirm successful data exfiltration in the activity described here," they wrote. ®

For the latest discoveries in cyber research for the week of 28th September, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES The FBI has confirmed unauthorized activity affecting FBIjobs.gov after the ShinyHunters group defaced the website. The group claimed to have stolen employee and applicant information and shared samples of purported FBI personnel records with several media organizations. Astrana Health, a major US healthcare technology provider, has confirmed a cyberattack that exposed confidential information. Attackers spoofed the company’s telephone number to impersonate personnel and gained access to its servers. Astrana restored systems from backups and disclosed the incident in an SEC filing but has not publicly revealed what data was exposed. Cryptocurrency exchange Bitget has disclosed the theft of $351.6 million from several hot and warm wallets. The company detected unauthorized transfers on September 24 and temporarily suspended withdrawals. Bitget said cold wallets and most platform assets were unaffected, while suspected North Korean involvement remains under examination. Ludwig Maximilian University of Munich, one of Germany’s largest universities, has suffered a data breach after an attacker accessed an enrollment system. The university said information was likely retrieved, potentially including names, bank details, health insurance information, and financial aid identifiers belonging to students. AI THREATS Australia has revealed that an OpenAI agent gained unauthorized access to a government Medicare statistics portal while performing an internal research task. After encountering access restrictions, the agent found a workaround and accessed public and non-public files. Officials said no personal information was accessed, while OpenAI described the behavior as unintended. Researchers have described a financially motivated campaign using open-source AI agents to automate attacks against online retailers. The operators launched 105 attack projects between September 10 and 15 and compromised at least 27 organizations to varying degrees, stealing more than 600,000 valid payment card records. Researchers have highlighted CLOSEDQUORUM, a Windows malware that uses four commercial AI models to determine its next post-compromise action. The models can direct credential and cryptocurrency wallet theft, persistence, or process injection. Cisco Talos has not confirmed that the malware has been successfully deployed in real-world attacks. VULNERABILITIES AND PATCHES Check Point has observed active exploitation of two critical pre-authentication vulnerabilities with CVSS scores of 9.8 – CVE-2026-85102 and CVE-2026-93616. The flaws affect Security Gateway and Security Management products and can enable remote code execution. Fixes for both vulnerabilities are available. F5 has released fixes for CVE-2026-94127, a critical heap-based buffer overflow vulnerability in BIG-IP Access Policy Manager with a CVSS score of 9.8. The actively exploited flaw allows unauthenticated remote code execution when affected systems are configured with an access policy and OAuth profile. Check Point IPS provides protection against this threat (F5 BIG-IP Heap Overflow (CVE-2026-94127)) WordPress has fixed CVE-2026-87902, a vulnerability affecting versions before 7.1.2 that allows unauthenticated attackers to include local PHP files outside active theme directories. Attackers have begun exploiting the flaw to write malicious PHP files and execute commands under specific server and theme configurations. THREAT INTELLIGENCE REPORTS Researchers have detailed Storm-2570, a ransomware affiliate operating across Qilin, DragonForce, Anubis, and BERT ecosystems. The actor maintains consistent post-compromise tooling and infrastructure across deployments, including remote access, credential theft, lateral movement, security tampering, and cloud-based data exfiltration before ransomware deployment. Researchers detailed an INC ransomware intrusion affecting at least 175 endpoints. Particularly useful intelligence includes BYOVD-based security-tool disabling, AnyDesk, lateral movement through scheduled tasks, and a 17-day gap that researchers say could indicate separate initial-access and ransomware actors. Researchers have tracked an active TeamFiltration campaign targeting more than 5,700 Microsoft 365 accounts across 28 tenants in Latin America, particularly organizations in Chile. Seven service accounts were compromised, with subsequent activity including corporate VPN authentication attempts and access to Azure Portal and SharePoint Online. Researchers have identified Storm-3168, associated with JADEPUFFER, using compromised service principals to conduct destructive operations in Azure environments. The actor performed reconnaissance, credential collection, and bulk deletion attempts targeting storage accounts, SQL databases, Key Vaults, virtual machines, recovery protections, and other cloud resources.     The post 28th September – Threat Intelligence Report appeared first on Check Point Research .

The company says the measure was precautionary and that it has no evidence of Kiteworks or customer systems being compromised. The post Kiteworks Urges Server Shutdown, Finds Advanced Forms Vulnerability appeared first on SecurityWeek .

The threat actor known as JADEPUFFER has been observed orchestrating destructive actions within a Microsoft Azure environment using compromised service principals. Microsoft, which is tracking the activity under the name Storm-3168, has called it an evolution of the threat actor's tradecraft. The attack took place in early June 2026 over a period of about 18 hours. "The destructive operations

Citrix has released patches for the critical NetScaler vulnerabilities tracked as CVE-2026-88771 and CVE-2026-88772. The post Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug appeared first on SecurityWeek .

In this interview with Help Net Security, Chris Latimer, CEO of Vectorize, talks about the security risks hiding in AI agent memory. He found coding agents storing API keys, credentials, and sensitive documents in plain text on developer machines and in cloud services. Latimer explains how attackers could plant poisoned memories through plugins, skills, and MCP integrations, often aimed at new coders who trust too easily. He covers why access control for agent memory lags … More → The post If you do one security check this quarter, make it agent memory appeared first on Help Net Security .

The ‘SalesBleed’ set of weaknesses in Salesforce’s Agentforce agents exposed CRM data to attackers via prompt injection and DNS exfiltration

Three vulnerabilities in Salesforce Agentforce allowed hackers to hijack trusted agents, steal data, and launch phishing attacks. The post ‘SalesBleed’ Flaws in Salesforce Agentforce Enabled Zero-Click Data Exfiltration appeared first on SecurityWeek .

Security flaws in Salesforce Agentforce allowed poisoned leads to hijack its AI agents, silently steal CRM data without requiring a click, and send phishing messages under the agents’ identities. Zenity Labs uncovered the three vulnerabilities, collectively called SalesBleed, and reported them to Salesforce, which worked with the AI agent security provider to fix the issues. While these attack chains no longer work, Zenity co-founder and CTO Michael Bargury told The Register that the vulnerabilities highlight the difficulties in controlling what agents can access - and what happens if and when they bypass guardrails intended to limit that access. “The bigger lesson here is about what it takes to keep AI agents contained,” Bargury said. “The idea of secure-by-design remains essential but for agents it may no longer be enough. We can anticipate risks and build protections into an agent from the start, yet still miss edge cases and the different ways it might behave once it encounters the real world.” He added, the challenge of agent constraint is a “wider trend” that extends beyond SalesBleed. “We’ve seen it with the OpenAI-Hugging Face incident where the agents managed to escape the sandbox that was meant to contain them, and we’re starting to see these types of flaws more and more often,” Bargury said. “As AI agents get more powerful, we need to monitor them ever more closely to keep track of what they’re up to. Because even when we think they’re contained, a single overlooked gap can change everything.” 0-click data exfiltration The first two vulnerabilities turn a public lead form into a data exfiltration channel for stealing sensitive customer information. Zenity researchers detailed the flaws in a Thursday report and also demonstrated the attack chain in a video proof-of-concept. The attack begins with an attacker abusing the Web-to-Lead form to plant an indirect prompt injection inside Salesforce. The malicious instructions remain dormant until an employee asks an Agentforce agent a question about leads - for example, "check my latest leads and help me with the newest one." This causes the agent to process the poisoned lead and carry out the hidden instructions: Query the Accounts table using the same subagent's Query Records tool. Return a couple of fields, e.g., a company name and a deal size. Paste the values as a subdomain string for the attacker-controlled hostname. Print that URL back to the user as an HTML img src tag to generate a DNS query to the attacker-controlled DNS authoritative server (this is also where the URL redaction was supposed to stop us). All of this happens without the employee ever knowing it. This vulnerability is due to weaknesses in Salesforce’s Trusted URLs controls, which are supposed to restrict the external destinations that Agentforce can access, and redact links or images pointing to untrusted URLs. Zenity found that this security mechanism didn’t register hostnames ending in an unrecognized top-level domain, and that adding certain characters interfered with how URLs were parsed. Abusing these two weaknesses allowed the researchers to write a string containing malicious instructions that successfully bypassed the URL redaction mechanism. The instructions tell the Agentforce agent to query Salesforce records and embed the stolen CRM data in image requests to an attacker-controlled server: . “Since the frontend renders and fetches external image URLs in these tags without additional sanitization or user interaction, this allows loading images from any https source, or in our case: sending a request to fetch the image from any https source,” the Zenity team wrote. This time, via Slack Digital thieves could also abuse Slack’s URL unfurling mechanism to achieve this same zero-click Salesforce data exfiltration attack, the researchers found. “Slack automatically retrieves information from links to generate previews, and specially constructed links can cause Slack to initiate requests that carry CRM data to attacker-controlled infrastructure as soon as the links appear,” they said. The same public lead submission serves as the entry point, and then when an employee interacts with the Salesforce agent via Slack, they unknowingly trigger the malicious instructions and send sensitive data outside the organization to an attacker-controlled server. “Salesforce fixed the URL redaction bypass, so this specific chain is closed. However, this type of vulnerability isn’t Salesforce-specific,” according to the researchers. “Any agent that reads records submitted by external sources, renders links or images back to a user, and also holds tool access to sensitive data, has the same three ingredients sitting in the same place,” they noted. Agents gone phishing The third flaw - detailed in a separate blog - also involves Agentforce’s integration with Slack. When combined with the URL-redaction bypass, this vulnerability could be abused by an internal user or an external attacker to deliver phishing links using the agent’s own identity. This attack exploits missing security controls in the Reply to a Slack Thread Agentforce action. This particular action did not require user confirmation before sending a message, and it also lacked visible attribution to the invoking user. This means that an agent that invoked Reply to a Slack Thread could send messages without a user approving them. A malicious insider who already chats with the agent and uses its Slack actions could exploit this vulnerability to send phishing messages under the trusted agent’s identity while remaining anonymous. Meanwhile, an external attacker could abuse this flaw via an indirect prompt injection planted in the Web-to-Lead, causing the agent to post phishing messages once an employee processed the poisoned lead. Zenity reported all three security snafus to Salesforce on June 1, and the CRM giant confirmed it was working on fixes a day later. Zenity confirmed Salesforce’s fix for the Trusted URLs bypass on August 19, and on September 21, said it had tested all of Salesforce’s fixes and confirmed that all three vulnerabilities had been fixed. ®

Every attack leaves a trail across the network, from initial reconnaissance to lateral movement and data exfiltration. That makes the network one of an organization’s richest sources of security intelligence. But visibility is only half the story. Because the network connects every user, device, application, and workload, it is also the natural place to verify identity, apply consistent policy, and contain suspicious activity close to its source. The result is faster detection, stronger enforcement, and a smaller blast radius. So, what does it take to make security an integral part of the network, and where should organizations begin? What is integrated network security? Integrated network security takes security functions that traditionally sat outside the network and embeds them directly into the network fabric to simplify and sharpen protection in the enterprise. Routers, switches, and access points become cybersecurity defenders that identify and prevent threats rather than simply routing and filtering traffic. What challenges does enterprise security face today? Enterprises face a gap as the network perimeter dissolves. The assets that used to reside inside the headquarters LAN have scattered everywhere, from the cloud through to edge-based equipment and on-premises servers. Bolting more security tools onto your infrastructure to protect those assets isn't sustainable. License costs increase, tools overlap and sometimes conflict with each other, or they leave non-obvious gaps through which attackers can pass. This fragmented approach to security also involves different teams working at different speeds. Coordination is slow and difficult, hindering the security effort and driving up costs. Why is integrating security into the network the answer? Unifying security and networking together offers several benefits: Standardization Building security directly into the network itself lets you encode a standard approach that works everywhere across the organization and covers everything that connects to the network, (so, in other words, everything you use). This means that you can apply the same policy across the entire network, maintaining them without worrying about fragmentation or policy drift. Agility Agility has become even more important in the AI era. Attackers now use this technology to move more quickly and at scale. Being able to implement and change policies centrally that ripple throughout the organization means that you can adapt to this fast-changing security landscape. Operating from a single source of truth also eliminates the need to stitch together insights from multiple sources. Simplification This "implement once run everywhere" capability lets you encode zero-trust principles into the foundation of the system. NIST has a standard for this - SP 800-207 - which promises protection at the asset level rather than the traditional and flawed "one authentication and you're in everywhere" VPN approach. Zero trust isn't so much an individual product as a complete security discipline, and it's hard to implement piecemeal using different solutions. Instead, putting it at the foundation of the network makes it more immediately and ubiquitously workable. Some zero-trust security measures also belong in the network. One example is micro-segmentation, which closes off parts of the network at a granular level to avoid lateral movement and limit the blast radius from any attack. Network-based security also supports robust security for other complex disciplines such as SASE and SD-WAN. Collaborative security Having a common fabric for networking and security enables network and security teams to work closely together. These teams have traditionally operated at a distance, and the gap between them has been valuable for attackers. The less daylight there is between these two functions, the more likely you are to stop intruders. How does AI fit into integrated network security? AI is important in two ways when integrating security into the network. First, AI has also become integrated into the network. Machine learning helps to spot patterns in network activity, using them as the feedstock for AIOps systems that predict problems and maintain network reliability and performance. AI has also proven itself to be a valuable security mechanism. That same pattern recognition and predictive capability enables AI to head off attacks before they become a problem. Using AI to support network and security teams enables them to do more with less by delegating routine work so that they can focus on more sophisticated work. Attackers are also using AI to augment their assaults on organizations. If you are behind the curve and don't use AI to help defend yourself, then you will find yourself on the back foot when it comes to preventing those attacks. Where do I begin integrating security into my network? Savvy partners have developed solutions that bake security directly into network equipment and which support hybrid environments to take security wherever your network goes. That includes built-in security capabilities like device profiling and NAC; centrally managed firewalls; and network-integrated AIOps that provide security teams with real-time information that can bolster security operations. Start by assessing your organization’s greatest source of risk, whether it’s expanding zero trust, supporting hybrid work, or defending against AI threats. There’s no right single place to begin but here are some options: Unified SASE provides secure access for users wherever they work, while simplifying both networking and security. Hybrid mesh firewalls offer consistent policies and enforcement across different network domains such as datacenters and cloud environments. Universal zero-trust network architectures support every identity, device, and workload. AIOps use AI to improve visibility, accelerate troubleshooting, and automate operations. These are different entry points into the same long-term architecture. Any and all of them will advance your journey to integrated native network security. Which you choose depends on the specific challenges of your business. Sponsored by HPE.

Mac security researcher Patrick Wardle says it’s trivial to turn Muse into “the ultimate backdoor.” Increasingly, AI assistants are changing from tools that simply answer questions into agents that can plan tasks, use connected services, and take actions for us. These actions might include booking appointments, filling out forms, creating documents, making purchases, or interacting with email and calendars. To do that, they need more permissions, account connections, and sensitive data. So, when Meta promised that “Muse is built from the ground up for privacy and security,” we did not expect an AI agent that can easily be manipulated into handing all that access to an attacker. Meta says Muse can handle appointments, forms, customer-service interactions, purchases, document creation, and connections to services such as WhatsApp, email, calendars, and social platforms. It may also receive macOS permissions to access protected resources, including files, the microphone, camera, location, and calendars. According to Ars Technica , Wardle found that a locally running application or terminal command could alter an undocumented Muse configuration setting that controls the server used for dictation transcription. By redirecting dictation traffic to an attacker-controlled server, an attacker could capture voice prompts and obtain the authentication token for the victim’s Muse account. This is not a remote-code-execution vulnerability that can compromise an otherwise clean Mac. The attacker first needs a way to run code locally, such as through malware, a malicious application, or social engineering. But as we have seen with infostealer malware finding its way onto Macs , that initial access is far from impossible. Someone’s watching your accounts. Make sure it’s us. PROTECT YOUR IDENTITY Traditional infostealer malware must independently locate browser data, credentials, documents, chat histories, and other valuable material. A compromised AI agent could lower that barrier by bundling access to multiple services and operating-system permissions behind one already authenticated interface. Ultimately, this is not just about one unsafe configuration setting. It shows why AI agents need a higher security standard than ordinary apps. How to stay safe Wardle’s advice about Muse is simple: “Please don’t install.” The same caution should apply to other AI agents. The Open Worldwide Application Security Project (OWASP), a nonprofit foundation that provides free application-security guidance, lists prompt injection, tool abuse, privilege escalation, data exfiltration, excessive autonomy, memory poisoning, and sensitive-data exposure among the major security risks posed by AI agents. A useful rule is that an AI agent should not have more access than it needs, and it should not be able to turn untrusted instructions into sensitive actions without meaningful checks. In practice, this means: Avoid giving a new agent broad access to email, chat apps, calendars, cloud storage, payment methods, and device permissions all at once. Regularly review and remove connections the agent does not genuinely need. Be aware of prompt injection . Do not assume that an AI agent will recognize malicious instructions embedded in a webpage, document, email, or other external content. Watch for unusual agent behavior, such as unexpected requests for new permissions, account reauthentication, external file sharing, or actions you did not initiate. You should also protect your device against malware: Keep your software updated so attackers can’t use known vulnerabilities against you. Use an up-to-date, real-time anti-malware solution on all your devices . To protect against ClickFix attacks , don’t follow instructions you find on websites and in unsolicited messages that tell you to run commands. From reporting threats to removing them. Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by  downloading Malwarebytes today .

Executive summary In April 2026, we at Kaspersky’s Global Emergency Response Team (GERT) responded to a security incident at a manufacturing organization in the Middle East. The threat actor obtained domain admin-equivalent control of the organization’s Active Directory environment and authored a malicious Group Policy Object (GPO) named PAYLOAD, linking it at the domain root. Through that single object, the actor delivered ransom notes, hijacked the desktop wallpaper and lock screen, enforced a logon banner, and disabled the local administrator account across every domain-joined Windows workstation — all without dropping a ransomware binary or encrypting any data. The only ransomware we found in this incident was PAYLOAD sample targeting ESXi on Linux servers. Besides that, data exfiltration was observed originating from the file servers and several additional systems, and was later published on the dark web. This case is an example of two converging trends that define the 2026 ransomware landscape : Living-off-the-land abuse of trusted AD infrastructure. Group Policy is a signed, allowlisted, SYSTEM-privileged distribution channel that the majority of endpoint detection and response tools is designed not to inspect. By delivering impact through GPO rather than through malware, the actor sidestepped the entire file- and process-based detection stack. Encryptionless extortion. Industry telemetry shows extortion-only incidents grow significantly year-on-year. PAYLOAD fits this model; the leverage is operational disruption and the threat of escalation rather than cryptographic denial of data. We confirmed that no files were encrypted on Windows machines, no malicious binaries were resident on disk, no endpoint persistence was established, and no malicious processes were running at the time of analysis. The entire attack lived inside Active Directory itself. The defensive implication is stark: an organization whose detection strategy depends on catching a ransomware executable would have seen nothing until the first endpoint rebooted and the ransom wallpaper appeared. In this article, we will describe the GPO attack chain and provide operational advice on how to detect such threats, including detailed remediation recommendations. Group Policy as an attack surface Attacks through group policies are nothing new. They can inflict significant, domain-wide damage with multiple malicious capabilities. A Group Policy Object (GPO) is essentially a combination of a Group Policy Container (GPC) in Active Directory and a Group Policy Template (GPT) in SYSVOL. The Group Policy scope depends on whether the GPC is linked to the directory tree at the domain, site, or organization unit (OU) level. A link at the domain root means the policy applies to every computer and user object beneath it. Thus, a GPO compromised at the domain root can affect all in-scope domain users and computers, potentially granting an attacker complete control over the corporate network. What makes GPO abuse even more dangerous is that group policies are processed in a trusted, high-privilege environment, ensuring persistence because endpoint cleanup is not enough to remove them. We have already discussed GPO architecture and ways it can be compromised in greater detail in an earlier blog post . Other public threat intelligence has also repeatedly documented this technique in ransomware operations. Microsoft observed Ryuk operators distributing ransomware through Group Policy, SYSVOL startup items, and PsExec. LockBit affiliates have been documented modifying SYSVOL Group Policy files, including ScheduledTasks.xml, to support ransomware execution and propagation. BlackCat/ALPHV operators have also abused GPOs to create scheduled tasks and deploy ransomware. Another notable example of GPO abuse is PAYLOAD ransomware, which weaponizes GPO Preferences and policy settings for pure impact rather than as a launcher for an encryptor. Let’s take a closer look at this attack, which is detailed further below. Attack timeline During the April 2026 investigation, we managed to reconstruct the attack timeline as outlined below: Date Event 11 April Initial access. Threat actor authenticates to the FortiGate SSL VPN using a valid but compromised domain credential. 13 April GPO authored. Malicious GPO, PAYLOAD ({C897F2C7-C2AC-4E6F-BF48-58036FF29E79}) created and linked at the domain root, configuring ransom notes, wallpaper, lock screen, logon banner, and administrator account disablement. 13 April SYSVOL staging. The payload.jpg and hello.txt files written to \\DC.THECOMPANY.local\sysvol\THECOMPANY.local\. 13 April Second GPO. GPO named win Firewall Off ({22099AD2-E062-4F56-B574-5099BBA4E7A6}) linked at the domain root, disabling Windows Firewall on all profiles. 13 April Dormancy. GPO cached on endpoints but computer configuration not yet applied — no endpoint had rebooted since the policy update. 13 April Data exfiltration. Data exfiltration was observed originating from the file servers and several additional systems. 14 April Detonation. Most of the endpoints begin rebooting; computer configuration policies apply. Ransom wallpaper, logon banner, and notes appear. Operational disruption begins. 15 April Response. Kaspersky GERT engaged. Forensic triage of affected workstations and the domain controller initiated. 16 April Assessment. GERT confirms no file encryption, no resident malware, no endpoint persistence. Next, we will discuss each of these stages in more detail and share the findings from our incident response activities. Incident overview Initial access The entry vector was a compromised valid account (MITRE ATT&CK T1078) used to authenticate through the organization’s FortiGate SSL VPN — an external remote service (T1133). Insufficient logging on the FortiGate appliance prevented us from reconstructing how the credential was originally compromised. Three hypotheses were considered plausible in the context of the attack, in no particular order: Password spraying or credential stuffing against the SSL VPN portal. Phishing-led credential harvesting. Purchase of pre-compromised credentials from an initial access broker (IAB). Once on the internal network, the actor operated with the compromised security principal’s privileges. Because the account was able to create and link a GPO at the domain root, it held either domain admin privileges or a delegated equivalent (e.g., membership of Group Policy Creator Owners combined with link rights on the domain object). FortiGate SSL VPN authentication logs and ESXi/virtualization privilege escalation logs were insufficient to reconstruct the lateral movement and privilege escalation chain between initial VPN access and the GPO write privilege level. The most common real-world routes to GPO control — DCSync , Kerberoasting of privileged service accounts, and Pass-the-Hash/Pass-the-Ticket — could not be confirmed or ruled out. Execution Rather than deploying an encryptor, the actor abused the victim’s Active Directory policy infrastructure, resulting in malicious GPOs being configured and linked at the domain root to deliver the observed impact across domain-joined systems. The two GPOs below constitute the entire offensive toolkit observed. The PAYLOAD GPO We performed a Resultant Set of Policy (RSOP) analysis, which helped us list all policy settings on the affected workstations. From these results, we reconstructed the following changes delivered by PAYLOAD: GPO extension/CSE Setting/path Configured value/resulting action Files (Group Policy Preference) Source SYSVOL\hello.txt → Desktop, C:\, D:\ Dropped as README-payload.txt (ReadOnly) Registry (Computer) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption Welcome to Payload! Registry (Computer) HKLM\…\Policies\System\legalnoticetext (ransom demand text) Personalization Policy Lock Screen Image \\DC.THECOMPANY.local\sysvol…\payload.jpg Desktop Policy (User) Wallpaper path \\DC.THECOMPANY.local\sysvol…\payload.jpg Security Settings (GptTmpl.inf) Accounts: Administrator account status Disabled The PAYLOAD GPO enabled the following actions: Drop SYSVOL\hello.txt to the desktop and root directories C:\ and D:\ as a read-only README-payload.txt by tampering with the “Group Policy Files” client-side extension (CSE). Modify the HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ registry key, changing the legalnoticecaption value to "Welcome to Payload!" and the legalnoticetext to the ransom note text through the “Group Policy Registry” CSE. Set payload.jpg located in the targeted domain controller’s SYSVOL as the lock screen image by altering the personalization policy, and as the wallpaper by altering the desktop policy at the user level. Revoke administrator rights for the administrator account (locking the account) by editing the Security Settings CSE in the GptTmpl.inf file. Settings changed by PAYLOAD GPO This activity was enabled entirely through a legitimate group policy mechanism, meaning there is no malware code for security solutions to look for because the malicious logic is contained within the policy configuration. The win Firewall Off GPO A second domain-root-linked GPO, named “win Firewall Off”, disabled Windows Firewall across the domain, private and public profiles on all endpoints (T1562.004). Deployed independently of PAYLOAD, this object degraded host defenses and ensured the actor retained unimpeded network reach to endpoints for any follow-on activity. Settings changed by win Firewall Off GPO The one-day delay detonation The most forensically instructive detail is the one-day gap between GPO creation (13 April) and visible impact (14 April). Analysis of Master File Table (MFT) timestamps and the Group Policy History registry key confirmed the policy was written to SYSVOL and cached on endpoints on 13 April. However, computer configuration settings (wallpaper and lock screen machine policy, security settings, firewall disabling) only apply upon reboot or policy refresh — and no endpoint had rebooted in the interim. The attack therefore remained dormant in the GPO cache for one day before detonating en masse when machines were restarted in accordance with standard procedures. We have to point out here that this delayed policy application is characteristic of GPO-based operations and has two potential consequences for defenders. Firstly, it may grant the actor a quiet window for exfiltration, persistence, or further staging between weaponization and impact. Secondly, it can be used to sever the temporal link between the cause (a GPO-creation event in the directory log) and the effect (mass user-visible disruption occurring at a later time), complicating timeline reconstruction unless directory service auditing is in place. Forensic findings Initial incident response engagement revealed a number of findings associated with the attack that we share below. No file encryption A full review of the MFT on affected workstations found no files bearing a .payload extension characteristic to PAYLOAD ransomware and no evidence of bulk renaming or encryption I/O patterns. The attackers’ objectives were operational disruption and extortion via visual impact and access denial. No endpoint persistence All standard persistence locations were clean: Scheduled tasks — no malicious tasks Run/RunOnce keys — clean Startup folders (user and system) — clean Services — no malicious service installed WMI event subscriptions — none Boot sector/MBR — unmodified The attack’s persistence mechanism is the GPO link itself on the domain controller, with no endpoint-resident component. No active malicious processes Live process and memory analysis revealed no injected threads, process hollowing or anomalous outbound connections. Registry timeline analysis Group Policy History, Shadow and State registry keys on the workstation recorded the application of PAYLOAD on 13 April: HKLM\…\Group Policy\History\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}\1 HKLM\…\Group Policy\Shadow\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}\0 HKLM\…\Group Policy\State\Machine\GPO-List\7 HKCU\…\Group Policy\History\{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}\1 HKCU\…\Group Policy\State\S-1-5-21-…\Loopback-GPO-List\5 The presence of the “Loopback-GPO-List” entry indicates the GPO was processed in loopback mode , ensuring the user configuration (wallpaper) applied regardless of which user logged on to the machine. SYSVOL artifacts Two files were staged on the domain controller’s SYSVOL share and served to endpoints through the Files Group Policy Preference CSE: payload.jpg — the ransom image used for both wallpaper and lock screen. hello.txt — the ransom note, distributed to desktops and drive roots as README-payload.txt. Detection engineering Because no malicious binary or process exists, the detection logic should focus on the directory service and SYSVOL indicators. Below are the highest-value telemetry sources for identifying the described malicious activity. Directory service change auditing (DS Access) Enable Advanced Audit Policy → DS Access → Audit Directory Service Changes on all domain controllers and set up alerts for the following events: Event ID Meaning Hunt focus 5137 A directory service object was created The account that created new groupPolicyContainer objects must be an authorized GPO administrator 5136 A directory service object was modified Changes to gPLink on the domain root or sensitive organizational units; changes to gPCMachineExtensionNames / gPCUserExtensionNames / gPCFileSysPath / versionNumber for all GPOs 5141 A directory service object was deleted GPO deletions (relevant for tamper detection and remediation assessment) A gPLink modification at the domain root by a non-standard account is one of the most telling indicators of this attack class. SYSVOL file integrity monitoring Monitor \\DC.THECOMPANY.local\sysvol\THECOMPANY.local\Policies\ for unexpected files, particularly image files, text files, scripts, ScheduledTasks.xml, and modified registry.pol/GptTmpl.inf files that were created by sources other than legitimate replication. Endpoint policy application telemetry On endpoints, GPO application is logged in the Group Policy Operational log (Microsoft-Windows-GroupPolicy/Operational) and reflected in the History and Shadow registry keys shown above. A sudden domain-wide change to the applied policy set is a strong post-detonation signal. Missing 5136 events If the contents of a GPO’s SYSVOL change without a corresponding 5136 event, this can indicate direct SYSVOL/template editing (e.g., via open-source tools such as PowerView or SharpGPOAbuse) that bypasses the normal Group Policy Management Console (GPMC) modification path. While we recommend treating the absence of expected audit events as suspicious, it should be noted that this can be caused by misconfigured auditing. Anti-forensics and recovery-inhibition capabilities Confirmed PAYLOAD family capabilities The Windows endpoint attack described in this report was implemented through malicious Group Policy Objects and did not involve a recovered ransomware executable, resident endpoint malware, confirmed file encryption or active malicious processes at the time of the forensic examination. However, PAYLOAD cryptomalware for Windows does exist, and other sources, including public analysis of its samples, reveal further malicious capabilities of this ransomware that could be used by security teams to enrich detection logic and security policies. The behaviors documented in this section must therefore be interpreted as family-level capabilities identified through the public reverse engineering of PAYLOAD ransomware samples. They were not confirmed as having executed during the GPO-based incident unless corresponding evidence was identified in the host, memory, process, event-log, or hypervisor. Windows Event Log clearing Public reverse engineering of the PAYLOAD Windows variant reveals an optional event log clearing capability (T1685.005, formerly T1070.001). The ransomware dynamically resolves Windows Event Log APIs, enumerates available event log channels, and clears individual channels. Implementation artifacts include: Runtime loading of wevtapi.dll EvtOpenChannelEnum EvtNextChannelPath EvtClearLog Enumeration of Security, System, Application, and PowerShell logs, and operational channels A command-line option controlling whether log clearing is performed Clearing event logs reduces the availability of records related to process execution, authentication, PowerShell, service control, and system changes. However, it does not necessarily remove events that were already forwarded to a SIEM, Windows Event Collector, EDR backend, or protected log archive. Forensic indicators Windows Security Event ID 1102 Event logging shutdown or failure events Sudden reductions in event record identifiers Multiple event channels restarting from low record numbers Gaps between endpoint and centrally forwarded telemetry Execution of utilities or APIs associated with log management Direct access to EVTX files (Windows Event Log files) under the Windows event log directory We should note that these indicators can’t be interpreted on their own. For instance, Event ID 1102 should be correlated with a number of aggravating factors, such as: Event ID 4688 or Sysmon Event ID 1 for process creation Event ID 4624 for the associated administrative logon EDR process trees PowerShell operational logging Windows Event Forwarding records Privileged access management activity At the same time, the absence of Event ID 1102 does not prove that log clearing did not occur. Direct deletion, truncation, service impairment, or an incomplete audit configuration may produce different evidence. Security process and service termination PAYLOAD analysis reveals that the Windows ransomware variant contains logic that targets security processes and services (T1685 and T1489). This capability is intended to stop security products, backup software, database services, and applications that may lock files targeted for encryption. Process and service termination serves several objectives: Reduce endpoint detection and response visibility. Release file handles so data can be modified. Interrupt backup and recovery services. Prevent databases and enterprise applications from protecting active data. Reduce interference with encryption operations. Forensic indicators Security agent services changing from running to stopped Event ID 7036 service state changes Event ID 7040 service start type changes Event ID 4688 or Sysmon Event ID 1 for service control utilities Sysmon Event ID 5 for terminated processes EDR health degradation affecting many endpoints Repeated termination attempts against security or backup processes Execution of dedicated process killing utilities VSS deletion, backup and recovery suppression Public PAYLOAD sample analysis reports the deletion of Windows Volume Shadow Copies before encryption (T1490). This behavior removes local restore points and reduces the victim’s ability to recover files without external backups. Recovery inhibition is broader than VSS deletion and may include multiple other malicious techniques, including the following: Deleting shadow copies, backup catalogs, and hypervisor snapshots Disabling recovery services Modifying boot recovery settings Compromising backup management platforms Deleting or encrypting backup repositories In the PAYLOAD Windows sample that is proven to perform encryption, VSS deletion is confirmed to have taken place before encryption. A broader compromise of the backup platform was not established in the investigated incident. Forensic indicators Execution of shadow copy management utilities Backup catalog deletion attempts Recovery configuration changes Backup service termination Mass snapshot deletions Backup administrator logons outside normal maintenance windows Backup retention or immutability changes Backup jobs failing immediately before disruptive activity Ecosystem-relevant ransomware techniques Above, we discussed the techniques specific to PAYLOAD ransomware. In this section, we’ll review other common ransomware techniques, such as BYOVD abuse and ESXi policy weakening, that remain relevant risks in the ransomware ecosystem. However, these techniques should not be attributed to this incident without supporting driver load, process, memory, ESXi, vCenter, or backup platform telemetry. We describe these techniques below as they may prove useful in other ransomware-related forensic investigations. The examples used in this section are therefore ecosystem-relevant: they are commonly observed in ransomware operations but not conclusively attributed to the analyzed PAYLOAD samples. ETW suppression and in-memory patching Event Tracing for Windows (ETW) is a kernel-supported tracing architecture used by Windows components, diagnostic utilities, security products, and endpoint monitoring systems. Although we didn’t encounter this technique in our case, some ransomware families can patch ETW-related functions inside the ransomware process (T1685, formerly T1562.001). The reported routine changes the memory protection of code pages, overwrites the beginning of selected ETW functions so they return without producing events, restores the original protection, and refreshes the instruction cache. Reported target functions include EtwEventWrite , EtwEventWriteFull , EtwEventWriteTransfer , and EtwRegister . This modification applies to the process-local mapping of ntdll.dll. It does not disable ETW globally across Windows, but it can reduce the telemetry generated by the modified process. Forensic indicators Writable or recently modified executable pages within ntdll.dll Memory protection changes affecting ETW function addresses In-memory code differing from the corresponding clean DLL on disk EDR memory tampering alerts Unexpected calls to memory protection APIs followed by telemetry silence Process execution visible in network or filesystem telemetry but absent from expected ETW-derived sources Inconsistent telemetry between EDR, Sysmon, Windows Event Logs, and network monitoring It should be noted that telemetry gaps are not conclusive evidence of ETW patching. Other factors include agent upgrades, network outages, endpoint shutdowns, SIEM ingestion failures, collector backpressure, and filtering or licensing changes. Memory acquisition is the strongest validation source when process-local ETW patching is suspected. Vulnerable signed driver abuse, BYOVD Bring Your Own Vulnerable Driver (BYOVD) involves introducing or abusing a legitimately signed but vulnerable kernel driver (T1068 and T1685). The attacker exploits the driver’s exposed functionality to gain kernel-level capabilities, modify protected memory, terminate security processes, remove security callbacks, or bypass operating system security controls. BYOVD is highly relevant to contemporary ransomware operations. However, the reviewed public PAYLOAD analyses do not provide sufficient evidence to conclude that BYOVD is an intrinsic PAYLOAD capability. It should therefore be presented as an ecosystem-relevant technique rather than a confirmed PAYLOAD feature. Forensic indicators Unexpected .sys files written to user-writable or temporary directories New kernel driver services Sysmon Event ID 6 Driver hashes matching Microsoft or community vulnerable driver blocklists Invalid, revoked, expired, or unusual driver signatures Driver load followed by EDR termination New privileged processes immediately following driver loading Code Integrity or Defender alerts Service creation events referencing driver files ESXi security policy weakening Ransomware operators are increasingly targeting ESXi and vCenter because compromising the virtualization layer provides access to many business-critical virtual machines. Public research typically describes operators performing the following activities (T1685, T1490 and T1489): Enabling SSH on ESXi hosts Changing root passwords Disabling execInstalledOnly Modifying lockdown mode exceptions Stopping virtual machines Deleting snapshots and backups Changing host firewall policies Copying custom ransomware binaries to hypervisors On the target organization’s Linux servers we saw an ESXi PAYLOAD variant, which makes this behavior operationally relevant. Nevertheless, the reviewed evidence does not indicate that PAYLOAD operators used any of these policy-weakening actions in the investigated incident. Forensic indicators Unexpected ESXi SSH enablement Changes to execInstalledOnly Secure Boot enforcement changes Lockdown mode configuration changes Root password changes New or unusual administrator accounts Bulk VM shutdown activity Bulk snapshot deletion New binaries in datastore or temporary paths vCenter tasks originating from unexpected accounts or systems Missing or disabled remote syslog forwarding Remediation To contain the described threat and limit possible damage, several remediation steps should be taken. Below, we recommend a four-phase remediation approach for containing this threat and restoring the affected environment. Phase 1 — domain controller actions (to be performed first) When dealing with PAYLOAD GPO, the first priority of the remediation plan should be to remove the source GPOs. Until this is done, endpoint cleanup is ineffective because the next policy refresh re-infects cleaned machines. The immediate domain controller actions to be taken are: Delete PAYLOAD GPO. Remove {C897F2C7-C2AC-4E6F-BF48-58036FF29E79} via GPMC. Delete or revert win Firewall Off GPO. Remove {22099AD2-E062-4F56-B574-5099BBA4E7A6}. Clean SYSVOL. Delete jpg and hello.txt from \\DC.THECOMPANY.local\sysvol\THECOMPANY.local\. Rotate credentials. Reset the compromised account; audit all privileged accounts and group memberships for unauthorized changes; rotate krbtgt twice if domain admin compromise is confirmed. Force refresh. Perform gpupdate /force across endpoints after deletion; re-enable local administrator and firewall via clean policy. Phase 2 — Active Directory and GPO hardening Adopt the AD tiered administration model and confine domain admins to Tier 0 with no interactive logon to workstations and member servers. Separate GPO creation from GPO linking rights, and grant both only to a dedicated, audited administrator role. Enable GPO change auditing (Event IDs 5136, 5137, 5141) and forward to a SIEM. Monitor SYSVOL with file integrity tooling. Phase 3 — credential and access hardening Enforce phishing-resistant MFA on all VPN and remote access entry points. Deploy Windows LAPS to generate unique, rotated local administrator passwords. Enable Credential Guard to protect LSASS-resident secrets. Adopt Privileged Access Workstations (PAW) for all administration. Implement just-in-time elevation through Privileged Identity Management (PIM) for domain admin. Phase 4 — detection and monitoring SIEM rule: GPO creation or domain-root gPLink change by a non-standard account. SIEM rule: file creation events under SYSVOL from non-replication sources. Implement enhanced, centrally collected FortiGate SSL VPN logging (auth events, session detail, source IP geolocation, impossible travel check) and detailed perimeter monitoring. Deploy a canary GPO whose application anywhere signals attacker GPO write access. Conclusion PAYLOAD demonstrates a maturing tactic of turning the victim’s own trusted infrastructure into a weapon. By weaponizing Group Policy, the actor achieved a domain-wide impact without a single malicious binary on any endpoint, evaded file- and process-based detection entirely, and caused organization-wide disruption within seconds of the first reboot. The absence of encryption is the most strategically significant finding and is consistent with the 2026 trend toward encryptionless extortion . At Kaspersky GERT, we assess with moderate confidence that the missing encryption reflects one of two scenarios: (1) a deliberate decision to stay below the irreversible data destruction threshold while preserving the option of a follow-on encryption phase, or (2) an operation interrupted before full execution. The absence of encrypted files must not be mistaken for the absence of a serious compromise — the most critical impact lies in the actor gaining domain admin-level control. This incident proves that a threat actor with domain admin access and a working knowledge of group policy internals can inflict domain-wide disruption equivalent to a ransomware attack without writing a single malicious file to any endpoint. Detection strategies anchored solely in file- or process-based indicators are blind to this attack class. Effective controls include directory service change auditing, SYSVOL integrity monitoring, and privileged access governance, which allow for GPO protection. Detection by Kaspersky solutions Kaspersky security solutions effectively detect the described malicious activity at various stages of the attack. Possible detection scenarios are listed below. To protect organizations that use our Kaspersky SIEM system, we have prepared a package of correlation rules designed to help detect this type of malicious activity. The rules are now available for customers to download from the SIEM repository; the package name is: [OOTB] Group policy hijacked: PAYLOAD ransomware – ENG. The “Group policy hijacked: PAYLOAD ransomware” package contains rules that detect suspicious file creation or modification in the SYSVOL shared folder on a domain controller, as well as changes to critical attributes and settings of domain group policies. Some rules may require adjustment if they trigger in response to legitimate activity, such as synchronization between domain controllers or the configuration of a new group policy. To ensure the detection rules function correctly, verify that events from Windows systems are being received in full, including events with the following identifiers: Sysmon: 11, Security — 4663, 5136, 4657. We also recommend applying the following rules available in the repository to detect all attack stages. Detection of Windows Event Log clearing to cover up traces of an attack: R050_03_Windows Event Log was cleared Detection of suspicious access to the LSASS process, which may indicate attempts to dump credentials: R262_Suspicious access to the LSASS process Detection of the Volume Shadow Copy service being started, which is used to create shadow copies before deleting them: R231_20_Running the Volume Shadow Copy service Detection of shadow copy deletion: R321_Shadow copy deletion Detection of Windows Defender disablement: R076_01_Windows Defender Antivirus was disabled Detection of attempts to disable or modify the system firewall: R240_03_Disabling system firewall via the registry Detection of a service installation from a non-system folder, which may indicate malware persistence techniques: R281_01_Installation of a service from a non-system folder For the rules in this list to function correctly, it is necessary to configure Security event auditing for event IDs 4663, 5136, 4657, 7036, and 1102. In addition to the SIEM system, when audit settings are configured correctly, the process of creating, modifying, and deleting GPOs generates a large number of characteristic artifacts on the domain controller, enabling Kaspersky Endpoint Detection and Response Expert to promptly alert the user to anomalies in the infrastructure. The creation of a new GPO is covered by the gpo_creation rule, which triggers in response to the corresponding event in the infrastructure. Changes to existing policies are detected by the following rules: The setting_the_gpcmachineextensionname_attribute rule detects changes to the gPCMachineExtensionNames attribute. The setting_the_gpcfilesyspath_attribute rule detects the use of the gPCFileSysPath attribute of a Group Policy Object, which specifies the path to the GPO’s contents in SYSVOL. The broader rule setting_the_grouppolicycontainer_class detects a change to the groupPolicyContainer class. GPO deletion is covered by the gpo_deletion rule. In the next major version update of Kaspersky EDR Expert, a new event type, GPO, will be introduced, allowing users to track changes to Group Policy Objects. For information security officers, GPO events will serve as an additional source of context when investigating activity in Active Directory and will help detect changes that could affect the configuration, access rights, and security of endpoints before a potentially malicious policy is deployed. MITRE ATT&CK mapping Tactic Technique Observed behavior Initial Access T1078 — Valid Accounts Compromised domain credential used for VPN authentication Initial Access T1133 — External Remote Services FortiGate SSL VPN used as entry point Privilege Escalation T1078.002 — Domain Accounts Account held domain-level GPO create/link rights Privilege Escalation/Defense Impairment T1484.001 — Group Policy Modification Malicious PAYLOAD GPO created and linked at domain root; re-applies on every refresh/reboot; uses trusted channel to evade EDR Defense Impairment T1686 — Disable or Modify System Firewall win Firewall Off GPO disables Windows Firewall on all profiles Impact T1491.001 — Internal Defacement Wallpaper and lock screen replaced with ransom image Impact T1531 — Account Access Removal Local Administrator account disabled via GPO Security Settings Collection T1005 — Data from Local System Data exfiltration was observed originating from the file servers Command and Control T1071 — Application Layer Protocol No live C2 confirmed; delivery achieved entirely via GPO Indicators of compromise GPOs PAYLOAD ransomware GPO: {C897F2C7-C2AC-4E6F-BF48-58036FF29E79} win Firewall Off GPO: {22099AD2-E062-4F56-B574-5099BBA4E7A6} File names and MD5 hashes payload.jpg: Ransom wallpaper and lock screen image (SYSVOL) hello.txt: Ransom note source (SYSVOL) README-payload.txt: Ransom note dropped to desktops and drive roots killer.exe ( 0108656A3E1ADE6CA4F21B084F5E1208 ): process killer tool kill.exe ( BEA5E267F24D7DA59F6821BFFDBFF293 ): process killer tool IP addresses 37.19.210[.]12 146.70.117[.]239 149.102.229[.]154 104.164.55[.]46 104.28.162[.]228 104.28.163[.]162 64.190.76[.]14 192.42.116[.]50 192.42.116[.]12 192.42.116[.]56 192.42.116[.]97 192.42.116[.]52 Registry keys HKLM\...\Policies\System\legalnoticecaption = Welcome to Payload! SYSVOL path \\DC.THECOMPANY.local\sysvol\THECOMPANY.local\payload.jpg Event IDs 5137: GPO object creation on DC — review creator account 5136: GPO attribute modification — watch gPLink at domain root

Intent injection attacks are a new worry for AI-native 6G networks Intent-based networking (IBN) lets operators state the outcome they want and leaves its translation into network policy to software, an approach AI-native 6G designs have moved to the forefront. Researchers at the University of Ottawa and Nokia Bell Labs argue that this abstraction gives attackers new openings, and it tests two machine-learning detectors against one of them. Threat model−Malicious intent injection through vulnerable API (Source: Research paper) The authors call that threat adversarial intent injection: hiding malicious instructions among legitimate ones. They evaluated their detectors on 1,100 intents they constructed, partly with a large language model’s help, so the reported figures describe performance on that dataset. The entry point Intents are machine-readable requests, often in JSON, that an IBN system turns into network policies. The researchers focus on the point where requests are accepted: an attacker with a compromised API key submits intents that pass as routine updates. The paper names denial of service, privilege escalation, traffic redirection and backdoors as possible consequences; its experiments are limited to detecting the injected intents. For malicious examples, the team wrote 20 base attack intents, covering threats such as phishing and data exfiltration, and produced nine variants of each. One variant turns a rule that drops traffic with logging enabled into one that null-routes it with logging set to a limited mode. To model ambiguity, the authors relabeled 40 malicious intents as benign and 90 benign intents as malicious. As a check for easy keyword giveaways, they built a rule-based classifier from 88 terms they classed as strong discriminators. Across the full dataset it caught about 10% of malicious intents, although 96% of the intents it flagged carried a malicious label. Reading the sequence The researchers’ bet is that attackers can give themselves away in how they space out their requests. To test that, they built four versions of their data, with malicious intents arriving at a fixed average pace, scattered at random, speeding up over time, or slowing down. Their detectors look at short runs of consecutive requests, up to six at a time, and flag runs likely to contain a malicious one so a person can review them. The authors found that longer runs generally helped, with some exceptions. They tried two kinds of detector. One learned from examples labeled safe or malicious. The other studied only normal activity and raises a flag when something departs from that pattern, an approach the authors pitch for teams with little advance knowledge of what attacks look like. The first detector caught between three-quarters and 96% of the runs containing malicious requests, depending on the attack pattern. The second caught the most of any method tested in three of the four patterns, but it had trouble with the fixed-pace attack, missing about a third of those runs. Both caught more than an earlier detector that judges one request at a time, which flagged roughly half to 60% of malicious cases across the four patterns. Open questions In future work, the team plans to add more varied JSON policy configurations that better reflect real IBN deployments, and to use explainable-AI methods that make detection decisions easier to interpret. Download: The Agentic Software Development Guide

The Iran-linked "hacktivist" persona known as Handala Hack has been attributed to a Telegram-based surveillance backdoor called HEAVYGRAM and a Delphi-based utility known as CRUDEEXCLUDE. "HEAVYGRAM offers builtin commands supporting remote command execution, system, network and process information discovery, data and Telegram session files exfiltration, screenshot capture, DLL sideloading, file cleanup, and persistence via Windows autorun registry keys," Group-IB said. On the other hand, CRUDEEXCLUDE is a Delphi-based Windows utility employed to prepare environments for the deployment of subsequent stages such as HEAVYGRAM. First observed in late July 2024, the malware is often disguised as a legitimate application with a graphical user interface (GUI), and configures Microsoft Defender exclusion paths for defense evasion. The findings build upon an alert the U.S. Federal Bureau of Investigation (FBI) first issued in March 2026 and again earlier this week, in which it accused Iranian cyber actors acting on behalf of the Ministry of Intelligence and Security (MOIS) of targeting Iranian dissidents, journalists opposed to Iran, and other opposition groups to conduct intelligence collection, leak data, and inflict reputational harm against targets of interest. It's worth noting the U.K. National Cyber Security Center is tracking the same malware family under the moniker CHOSEN BRICK, describing it as a flexible tool that can be used to "support a range of potential operational outcomes." The attacks typically involve the use of social engineering via messaging platforms like Telegram, WhatsApp, and Instagram to communicate with targets under the pretext of offering technical support or posing as trusted contacts, and then deliver malware dressed up as a seemingly harmless installer to trigger the infection. These applications masquerade as legitimate applications like Pictory, KeePass, and Telegram, and contain the second-stage implant. Handala Hack, which came into being shortly after the October 7, 2023, armed attacks by Hamas and other Palestinian militant groups targeting southern Israel, is assessed to be an online persona operated by Void Manticore (aka Banished Kitten, Red Sandstorm, and Storm-0842), a threat actor affiliated with Iran's MOIS. It has a history of conducting destructive wiping attacks and hack and leak operations. In an alert issued last September, the Canadian Rapid Response Mechanism (RRM) called out the threat actor for targeting and doxxing five Iran International journalists, including one from the country, as part of a hack and leak operation. According to Group-IB, HEAVYGRAM was first detected in the wild in September 2023. Once launched, the malware prevents Defender from scanning the paths staging the malicious payloads and executes PowerShell code to set up persistence for the next-stage implant via the Windows Registry. A notable aspect of the Python-based malware is its use of Telegram for command-and-control (C2), allowing it to list running programs, take screenshots, capture web browser data, upload/download files, turn on the microphone, copy Telegram and WhatsApp data, steal saved passwords, download additional malware, and delete files. Incoming messages from the Telegram bot are parsed based on a prefix delimiter system - Prefix @@, to execute arbitrary system commands via os.popen Prefix **, to write the message body to C:\ProgramData\ur.txt Prefix ##, to enable a backdoor command suite that supports the following capabilities - - runexe - Start an arbitrary process on the host - whois - Retrieve the host's public IP address via api.ipify[.]org - runtro - Execute a secondary trojan payload - cht - Dynamically update the C2 Telegram bot token and operator user ID - regtro - Install the trojan payload into Windows autorun Registry keys - reg - Install the main malware executable into Windows autorun registry keys - dt - Exfiltrate Telegram Desktop application data "Attachments received through the Telegram bot are handled based on filename pattern matching," Group-IB said. "The persistent implant handles C2 communication via two functions: send_initial_message – transmits an initial connection beacon containing the full computer domain name of the compromised host, [and] send_health_msg – a background thread that sends a heartbeat message every 24 hours with the host’s domain name, confirming that the implant remains active." HEAVYGRAM has been found to be delivered through four methods: WSF/VBS scripts, VBScripts and HTML Application (HTA) files, executables with embedded archives, and CRUDEEXCLUDE containing embedded archives. CRUDEEXCLUDE was first documented by Google in December 2025 as being used to set up staging directories for housing HEAVYGRAM and another specified malware family named SHADEGENES while masquerading as legitimate applications like Pictory and Telegram. Further review of the Telegram infrastructure has revealed two main setups: one where C2 relies on a single Telegram bot and group, and another where one bot handles check-ins while a secondary bot manages logging and stage polling with a group. "The newly identified samples demonstrate a flexible, multi-stage infection chain in which operators combine tailored social engineering, application masquerading, defense evasion and persistent access to compromise targets of interest," Group-IB said. "The extensive use of Telegram across operations is particularly notable, providing operators with a natively encrypted command-and-control channel that has low setup, maintenance and rotation cost."

AI keeps showing up in the wrong places. Attackers are using it to speed up exploits, test defenses, and automate more of the job. Some models are also crossing lines on their own. That is not a great combination. The rest of the week is more familiar: old bugs still working, fresh exploit chains, exposed systems, weak defaults, and simple paths that should have been harder to abuse. A few of these stories are clever. Most are just easy. Here’s what mattered this week. ⚡ Threat of the Week OpenAI Agents Behind May 2026 Attack on RubyGems — The "major malicious attack" that targeted RubyGems in May 2026 was the work of a swarm of OpenAI agents, according to researchers. The event was driven by a cluster of OpenAI agents that engaged in en masse publication of thousands of packages to RubyGems in May and June 2026. "The swarm behaves extremely similarly to the German-wiki agents we previously found," researchers Spencer Kitts, Thomas Larsen, and Sydney Von Arx said. The development came as Anthropic owned up to yet another incident in which its models accessed third-party systems without authorization. The new AI trespass dates back to January 2026. It involved an early version of Claude Opus 4.6 that was given a Capture the Flag (CTF) challenge. "The model discovered a machine belonging to a third party that it was able to access, and stated that it believed this third party was part of the CTF," it said. "Inside the machine, the model found a file listing a password, which it used to gain admin access to the system." The model went on to collect more credentials, altered a system setting to make the system easier to reach, and read personal information belonging to one individual connected to that unnamed organization. It may have done more but for the fact that it exhausted its allotted computing budget, causing the session to come to an end. Many incidents involving agents from frontier AI labs acting against their programming to escape restrictions in pursuit of their goals have heightened concerns over the increasing capacity of AI models and developers' ability to contain them. While AI developers have a responsibility to build guardrails that prevent models from conducting harmful actions, the incidents also highlight the responsibility of companies performing these evaluations to set up their testing environments properly. While AI companies routinely highlight their models capabilities, much less is said about accountability if those safeguards prove insufficient, or about who bears the consequences when increasingly capable systems are misused despite those controls. OAuth & MCP Investigation Checklist: 4 Steps to Assess Risk OAuth grants enable data sharing across apps, AI tools, and MCP servers, and most go unreviewed. Learn four steps for finding risky grants and closing the gaps before they turn into a security incident. Get the Guide ➝ 🔔 Top News Anthropic and Google Detail Abuse of AI — Threat actors are increasingly integrating AI capabilities into multiple stages of an attack lifecycle with an aim to automate and scale their operations. "Over the past quarter, threat actors have moved beyond simple prompt-based LLM interactions to integrate AI capabilities into multiple stages of an attack lifecycle," Google Threat Intelligence Group (GTIG) said. "While traditional script-based automation has long been a staple of threat actor operations, groups are increasingly upgrading these workflows, creating highly autonomous systems capable of reasoning through complex tasks and making dynamic decisions without the need for human oversight." GTIG said it "has not yet observed threat actors deploying fully autonomous pipelines against targets in the wild," with the adversarial adoption of agentic AI signaling "a gradual maturation of tradecraft," as adversaries employ commercial and open-weight models to turn public disclosures and patch delays into working N-day exploit code, refining their tooling, and progressing "toward constructing functional, multi-stage exploit chains." Threat Actors Exploit New Vulnerability Chain — Multiple espionage-motivated threat activity clusters have been found deploying a previously undocumented exploit kit called BlueMoon that chains together multiple vulnerabilities in Microsoft Windows and Google Chrome. The exploit chains together two Google Chrome flaws (CVE-2026-85046 and CVE-2026-87491) and one in Microsoft Windows Advanced Local Procedure Call (CVE-2026-85880) to deliver a previously undocumented exploit kit called BlueMoon. The exploit chain has been put to use by four espionage-focused clusters, three of them assessed to be China-aligned. Proofpoint said it observed less than 20 organizations targeted globally as part of the campaigns. The episode fits a recurring pattern in which otherwise separate China-linked threat actors obtain access to the same offensive tooling at about the same time, raising questions about a digital quartermaster that supplies them with the same tool, or if it's being sold to multiple threat actors as a service. Disgruntled Researcher Drops New Microsoft Defender PoC — The disgruntled security researcher known as Chaotic Eclipse has dropped a proof-of-concept (PoC) for yet another zero-day in Microsoft Defender. The vulnerability, codenamed ShieldCrash, is assessed to be a patch bypass for CVE-2026-69414 (CVSS score: 7.8), also called ShieldBreak, which the researcher reported last month. ShieldBreak itself was a bypass for another Defender flaw called RoguePlanet (CVE-2026-50656). The release of this new zero-day is the latest in a long back-and-forth between the security researcher and the software giant over the company's alleged handling of their bug reports. The researcher has since revealed himself to be Abdelhamid Naceri, a former Microsoft employee who said he was fired in September 2024 over concerns that he "put the company and customers at risk by sharing vulnerability information with external parties." Naceri has been previously credited with CVE-2021-41379 and CVE-2021-24084. Xinbi Guarantee Goes Down in Law Enforcement Action — The U.S. Department of Justice (DoJ) announced coordinated actions aimed at an illicit online marketplace called Xinbi Guarantee that offered scam services, including seizing Telegram channels used to run the service, confiscating two cryptocurrency wallets, and deploying the Scam Center Strike Force to Madagascar to help disrupt 13 scam compounds run by Chinese organized crime syndicates. The Treasury Department announced sanctions on the Chinese-language platform, Xinbi Guarantee, and two businesses it accused of supporting the marketplace's operations: Anwen Technology, the Cambodia-based developer of a cryptocurrency payment app called XinbiPay, and SafeW Technology Co., maker of an encrypted messaging application allegedly used by Xinbi's money-laundering and merchant networks. "Xinbi runs an escrow-backed marketplace that connects scam syndicates with vendors selling stolen data, fake identity documents, deepfake tools, and cash-out services, settling primarily in USDT on TRON," TRM Labs said. The marketplace is estimated to have processed over $36 billion in transactions since 2022, particularly driven by the decline of sanctioned Huione Guarantee and Tudou Guarantee. Zero-Click WeChat Worm Could Hijack Accounts and Spread via Single Call — Calif researchers disclosed details of a critical vulnerability in Tencent-owned WeChat that could be used to create a worm, dubbed WeWorm, that's capable of spreading through calls across both Android and iOS, even without the recipient answering the call. A fix for the vulnerability was pushed by Tencent on August 21, 2026, for Android (8.0.77) and iOS (8.0.76). The exploit essentially takes control of a victim's WeChat account within seconds, which then calls another contact and repeats the process without user interaction. Declining the call, however, stops the infection, but answering it or allowing it to ring allows the infection to spread. "Exploitation takes only seconds, and gives us full control of the WeChat account," Calif said. "We can read and send messages, make calls, and act on the victim's behalf." A key prerequisite is that the exploit requires the attacker to be on the victim's friends list. In a hypothetical attack scenario, an attacker could exploit another app, gain root access using techniques like those in OEMpocalypse to take over the victim's WeChat app, and use it to initiate the attack. There is no evidence the WeChat flaw was exploited in the wild. Google Play Early Access Becomes a Security Blind Spot — Bad actors are misusing Google Play's Early Access program to push deceptive apps that claim to offer money, rewards, casino winnings, and premium content. "The same feature that shields developers from unfair criticism also strips users of the earliest warning that an app cannot be trusted," Bitdefender said. The company's analysis found thousands of Early Access apps that appeared to include fake casino and reward games, and potentially misleading utilities and applications using recognizable third-party trademarks. Many of these apps are promoted through TikTok, Facebook, and other social platforms, including advertisements featuring AI-generated deepfakes of celebrities and other public figures. Some of these apps have been found to seek unusual permissions (e.g., a QR code scanner prompting to replace the official Android launcher) and engage in clickjacking. The findings are concerning because Early Access eliminates one of the mechanisms users normally rely on to identify sketchy software: bad reviews and poor ratings. Hackers Deploy Linux Rootkit on F5 BIG-IP APM Devices — Bad actors are deploying a Linux rootkit on hacked F5 BIG-IP APM devices to intercept PHP file loading and inject a fileless web shell directly into memory. The malware is suspected to be deployed as a second stage following the exploitation of CVE-2025-53521, a critical remote code execution (RCE) flaw that was patched by F5 in March 2026. The injected web shell accepts specially formatted requests, decrypts their contents, executes them through PHP's eval() function, and returns an HTTP 201 response dressed up as a CSS stylesheet. ESET is tracking the same malware as PoisonedRefresh. Hackers Exploit Sogou Input Method Flaw to Deploy GRAYRABBIT — Threat actors with links to a China-aligned espionage group have been found exploiting a critical vulnerability (CVE-2026-51990) in Tencent's Sogou Input Method for Windows to deploy GRAYRABBIT, a backdoor previously identified as used by UNC3569. "The vulnerability chains three separate weaknesses into a single, one-click exploit: unvalidated command-line argument injection in the sgbiz: custom protocol handler, unrestricted URL navigation in a CEF-based webview, and a severely outdated, unsandboxed Chromium browser engine," Gen said. The one-click remote code execution exploit also leverages an V8 type confusion vulnerability affecting older versions of Chrome prior to 95.0.4638.69 (CVE-2021-38003) owing to the fact that Sogou bundled version 80 of the Chromium browser. Tencent fixed the flaw in April 2026. ️🔥 Trending CVEs Bugs drop weekly, and the gap between a patch and an exploit is shrinking fast. These are the heavy hitters for the week: high-severity, widely used, or already being poked at in the wild. Check the list, patch what you have, and hit the ones marked urgent first — CVE-2026-85880, CVE-2026-81963 (Microsoft Windows), CVE-2026-85706 (GitLab), CVE-2026-44756, CVE-2026-58240 (SAP), CVE-2026-76578 (FreeIPA), CVE-2026-84282 (Ascensio System SIA ONLYOFFICE ownCloud integration plugin), CVE-2026-67401 (cPanel and WHM), CVE-2026-82533 (DeepSeek Harness), CVE-2026-10090 (Red Hat Advanced Cluster Management for Kubernetes), CVE-2026-18667 (Tenable Sensor Proxy), CVE-2026-20293, CVE-2026-33197, CVE-2026-6485 (UEFI Shell), CVE-2025-20701 (Skullcandy Dime 3), CVE-2026-84390, CVE-2026-84388, CVE-2026-26084, CVE-2026-84393 (Fortinet), CVE-2026-12647, CVE-2026-12645, CVE-2026-12646, CVE-2026-12650, CVE-2026-12744, CVE-2026-12745 (Ivanti), CVE-2026-78546, CVE-2026-78547 (Citrix), CVE-2026-85102, CVE-2026-85103 (Check Point), CVE-2026-51990 (Tencent Sogou Input Method), CVE-2026-42016, CVE-2026-42018, CVE-2026-82329 (JFrog Artifactory), CVE-2026-84286 (ExLlamaV3), CVE-2026-61578, CVE-2026-61582, CVE-2026-61583, CVE-2026-61584, CVE-2026-61585, CVE-2026-61587, CVE-2026-61600, CVE-2026-61601, CVE-2026-61602, CVE-2026-70647, CVE-2026-70648 (Chamilo), and a local privilege escalation vulnerability in AOMEI Backupper amwrtdrv.sys driver. 🎥 Cybersecurity Webinars Learn How to Know What to Fix First Before AI Speeds Up the Attack → AI-powered attacks are accelerating, but fragmented security data slows down the response. Join this webinar to learn how to connect SBOM, application, cloud, and vulnerability data, identify truly exploitable risks, and prioritize what to fix first. How to Identify Which CVEs Are Truly Exploitable Within Hours → AI can turn newly disclosed vulnerabilities into working attacks within hours. Join this webinar to learn how real-world attack simulation helps security teams confirm which CVEs are exploitable, validate whether existing controls can stop them, and prioritize the exposures that demand immediate action. 📰 Around the Cyber World China Company Uses Claude for Deceptive Dating Network — Anthropic said it observed a China-based app studio using Claude to build over 20 dating apps with 4,700 AI personas that held conversations with at least 25,000 users who thought they were talking to real people. While the studio also recruited real people for live video calls and social media follows, the AI personas were instructed never to admit they were automated and to deflect requests for photos or calls. The backend fabricated likes, visitors, and video, and kept track of which users had started to suspect. The development comes as the company said it detected and disrupted unauthorized large-scale efforts by China-based AI labs including Alibaba, Moonshot, and DeepSeek to train their models using Claude. Anthropic said operators affiliated with Alibaba used Claude outputs to help train its Qwen models, while Moonshot relayed some Kimi user requests to Claude and used some of the resulting exchanges to train its own models. China dismissed the U.S. allegations as "groundless." Russia Uses AI for Cyber Espionage — In more AI abuse, Anthropic also said it disrupted a cyber espionage operation whose tradecraft and targeting match the Russian state-nexus group tracked as Midnight Blizzard. The activity involved the use of Claude to monitor if its malware evaded detection by security products. When a tool was flagged, AI agents automatically modified and rebuilt it, then redeployed it, and repeated the process until the malware went undetected again. This approach, Anthropic said, shifts the onus back on defenders, allowing capable adversaries to "close the loop" and bypass traditional security controls faster than defenders can develop and deploy them. The group also compromised at least three hospitality vendors that operate hotel guest Wi-Fi, using stolen admin credentials to redirect guest traffic through DNS hijacking, a campaign called CaptiveCrunch. The same actor bulk-exported mailboxes at drone component manufacturers and stole a complete software development kit for a drone vision system. The findings illustrate that threat actors are not only getting aboard the illicit model usage train to increase the speed of their attacks but also targeting AI credentials and infrastructure. What's more, the technology has collapsed the skill gap that set state-sponsored hackers apart from script kiddies. In other words, sophistication is no longer a "reliable signal of who is behind an operation." Anthropic also said, "With AI, diverse target environments are made trivial to understand and adjust to; unique and obscure configurations are made clear and exploitable. The old adage of 'security through obscurity' is no longer viable in this new AI-assisted world: everything connected to the internet is a potential target for exploitation." Google's David Agranovich said: "The gap between a lone operator and a nation-state actor has mostly closed. Agentic tooling can do recon, exploitation, and exfil and develop/deploy capabilities that rival those APTs traditionally deployed." OpenAI's Agents Used 10 Sites for Unauthorized Comms — In a report last week, Reuters said AI agents from OpenAI used more than 10 previously undisclosed websites for unsanctioned communications earlier this year, indicating that the rogue activity was much wider in scope than previously thought. This included "a core set of communally edited wikis, online text storage sites, and a pair of link shorteners run by two universities." Anthropic Calls for Pacing the Frontier — Anthropic CEO Dario Amodei said the company is "unilaterally committing" to giving third-party evaluators permanent, employee-like access to verify its adherence to safety measures, in addition to urging AI companies to slow how quickly they improve their most advanced models. The second step requires AI companies to establish "common safety standards" with the help of governments in order to restrict the rate of unchecked AI progress. The final measure would have the U.S. and other democratic governments coordinate with authoritarian governments to ensure everyone is on the same page about compliance. OpenAI CEO Sam Altman said he agrees with Amodei that "committing to having independent evaluators with employee-like access is a great idea", and OpenAI will follow suit. Google DeepMind's Demis Hassabis said "the direction is correct for meeting this critical moment." Ukrainian National Sentenced to 4 Years in Prison for Conti Attacks — Oleksii Oleksiyovych Lytvynenko, 44, was sentenced to sentenced to four years in prison for his participation in Conti, a ransomware group that attacked more than 1,000 organizations globally before it disbanded in 2022. Lytvynenko pleaded guilty in June 2026. "Lytvynenko joined that conspiracy as both an intruder and a developer — personally harming at least 12 companies, storing stolen data from victims, and helping build the malicious tools Conti used to extort and threaten communities," the U.S. Justice Department said. "Even after the Conti conspiracy ended, he continued engaging in active ransomware operations until his arrest." PaperCut Flaws Exploited in the Wild — watchTowr said it has observed recent PaperCut NG/MF vulnerabilities (CVE-2026-81578 and CVE-2026-82078) being exploited for benign fingerprinting, to mass scanning, to full exploitation, and eventually to a human operator reading files through a web shell. "After gaining code execution in one particular case, a threat actor dropped in-memory implants, including Godzilla C2 web shells and 'suo5' HTTP proxy tunnels," the company said. "Both were deployed as servlet filters, designed to intercept inbound HTTP requests and operate entirely out of memory with nothing written to disk, persisting until the PaperCut service is restarted. Eighteen seconds after the second wave was deployed on our PaperCut instance, a new and separate IP address began interacting with the deployed Godzilla web shell, using the correct AES key and password." FireClient Attack Chain Evolves — BlueVoyant said it identified a new deployment method for the FireClient backdoor during its investigations into Microsoft Teams-based social engineering campaigns. "While FireClient's post-compromise capabilities remain largely unchanged [...], the threat actor has significantly evolved the malware's installation routine by replacing the Firefox profile abuse technique with an MSI-based delivery mechanism that leverages portable applications and DLL sideloading," security researcher Thomas Elkins said. "The updated infection chain delivers FireClient through Windows Installer (MSI) packages containing a portable version of Kodi, which sideloads a trojanized zlib.dll to execute the FireClient loader. Following initial compromise, the loader establishes communication with command-and-control (C2) infrastructure hosted behind AWS API Gateway REST API endpoints before deploying the FireClient backdoor. Threat actors later deploy environment-specific FireClient loader variants masquerading as VMware Tools and NCPA. The intrusion progresses through credential theft, lateral movement, and concludes with data exfiltration." Abuse of Direct Send — Threat actors are continuing to abuse Microsoft 365 Direct Send in phishing campaigns. "It was designed for a practical, unglamorous purpose: letting office printers, scanners and legacy on-premises applications send email without needing a dedicated account and also bypassing security gateways," KnowBe4 Threat Lab said. "Attackers have found that this path works just as well for them. By connecting to that same open endpoint, they can send an email claiming to be from anyone at your organization's HR, accounting, admin or your CEO. The email arrives looking like it came from an internal address, because technically, it entered through your own infrastructure." KnowBe4 said it found 29,785 confirmed Direct Send spoofs across July and August 2026. Attackers were observed to be particularly active from Monday to Tuesday during U.S. Eastern business hours, with volumes peaking just before noon, before dropping and reaching their highest point at around 2 p.m. EST. Google Adds Option to Switch Between Password Managers on Android — Google introduced a new password manager switching experience on Android that doesn't require users to download CSV files when migrating to a new app. "Historically, moving your passwords meant downloading them into an unencrypted text file, which left them unprotected on your device," Google said. "And passkeys couldn't be transferred at all, so you'd have to recreate them across multiple sites and apps. Now, moving your passwords and passkeys to a new password manager is simpler and safer." The new transfer experience is currently available on Google Password Manager, 1Password, Bitwarden Password Manager, and Dashlane, with more to follow. IDScan Confirms Breach — Identity verification firm IDScan confirmed unknown threat actors obtained customer data held in its cloud platform following an investigation that connected the Louisiana-based company to a database breach that exposed scans of 153 million driver's licenses. "IDScan.net has determined that an unauthorized third party may have accessed and/or copied certain customer information stored within their accounts on the IDScan.net cloud," IDScan said. "The types of information contained within the affected data may include full names and driver’s license or other government-issued identification numbers." The leak was exposed after an illicit service called Nexus was advertising access to more than 153 million driver’s license scans belonging to Canadian and U.S. citizens. The service has since gone offline. Conclusion That’s the week. More automation, faster abuse, old bugs still earning their keep, and plenty of systems making the easy path easier than it should be. Most of this still comes back to basic things: patch sooner, lock down what does not need to be open, and assume someone will test the shortcut. The tools are changing. The weak spots are not.

Threat actors have been exploiting three high-severity vulnerabilities in JFrog Artifactory to compromise deployments and install backdoors, cybersecurity firm Wiz reports. Many organizations use Artifactory to manage software artifacts, binaries, AI models, containers, and packages. The three flaws, CVE-2026-42016, CVE-2026-42018, and CVE-2026-82329, can allow attackers to bypass authentication and gain administrative privileges on vulnerable Artifactory instances. An improper authentication bug patched on August 12, CVE-2026-42018 can be exploited to obtain an anonymous-user token that provides access to sensitive artifacts and repository data. Patched on July 27, CVE-2026-42016 is an insufficient token validation issue that can be exploited for privilege escalation. CVE-2026-82329 is an authentication bypass patched on August 28 that could be exploited remotely without authentication to gain administrative privileges. In-the-wild exploitation was reported a few days later. According to Wiz, CVE-2026-42018 and CVE-2026-42016 have been chained together since mid-August to obtain the anonymous-user token and then use it to elevate privileges to administrator. “Between August 15 and September 8, 2026, we observed multiple actors chain CVE-2026-42018 and CVE-2026-42016 against self-hosted Artifactory instances,” Wiz says. The hackers were seen deploying persistent admin accounts, installing malicious plugins to gain arbitrary code execution, running shell commands through the plugin endpoint, dropping second-stage payloads, and occasionally updating the scripts for continuous access. Multiple threat actors also started exploiting CVE-2026-82329 in the first week of September, for configuration exfiltration, persistent admin access, token minting, cluster key exfiltration, and asset enumeration. In some instances, the attackers were seen attaching their own SSH keys to the user accounts they created. On Friday, CISA added CVE-2026-42018 and CVE-2026-42016 to its KEV catalog, one week after it added CVE-2026-82329 to the list. In line with BOD 26-04, federal agencies were given two weeks to patch their vulnerable instances. All organizations are advised to update their self-managed Artifactory deployments to versions 7.161.20, 7.146.38, 7.133.29, 7.125.20, 7.117.28, or 7.111.21 as soon as possible. Related: GitLab Vulnerability Exploited One Day After Disclosure Related: Fortinet Code Execution Flaw Exploited in PivotC2 RAT Attacks Related: PaperCut Flaws Exploited in AI-Powered Attacks Related: Critical NetScaler Vulnerability Exploited in Attacks

A malicious cross-store Twitch browser extension has leaked OAuth tokens associated with nearly 31,000 users to proxy servers operated by a Russian commercial bot service. The extension, named "Twitch Enhanced Viewer | JeetBot," lists HISHIMIRO/jeetbot.cc as its developer and has the following identifiers on the Google Chrome Web Store and Mozilla Firefox Add-Ons store - Chrome - pnhhdhhcadcjfckjhpmjneldiegbojfb - 30,000 users (Published on June 26, 2025) Firefox - [email protected] - 604 users (Published on July 7, 2025) Both extensions are still available for download as of writing. The extension listing description states: "JeetBot is a modern tool for streamers and viewers who appreciate quality, convenience, and control," adding it "expands Twitch capabilities: 1080p stream for regions with constraints." "Current builds (v85.x) forward the token inline as an &auth= query parameter on a network-layer redirect to the operator's proxy," Socket security researcher Kush Pandya said. "The token is forwarded for every channel the user watches, except a hardcoded allowlist of ten Russian streamer channels, whose sessions are exempted from forwarding." "The operator is a commercial Twitch, Kick, and VK Live bot SaaS that has broad Twitch host permissions and relays live authenticated sessions through its own infrastructure." While the extension claims to offer an ad-free experience and serve region-unlocked content, it does so by routing Twitch's video-playlist requests to "usher.ttvnw[.]net" through operator-controlled proxy servers along with the user's OAuth token as an "&auth=" query parameter. Specifically, the add-on embeds code to recover the Twitch OAuth token and send it to the proxy. The token can enable access to a user's chat, whispers (i.e., private messages), and account settings. Given that the token is placed in the URL query string, it gets written in cleartext into the proxy server's request logs. The token redirection mechanism, however, is excluded for a hard-coded list of 10 Twitch channels, most of them being Russian-language streamers with thousands of followers - pch3lk1n (580K followers) fasoollka (361K followers) flamie (132K followers) dosia (29 followers) fander (2 followers) almazer (4 followers) forzorezor (177K followers) akyuliych (1.1M followers) lagoda1337 (225K followers) lagoda (77.3K followers) "For every channel outside this list, the user’s live token is forwarded to the proxy," Pandya explained. "Earlier v4.x builds (for example version 4.8, January 2026) went further, POSTing the token to a dedicated set-token endpoint on the operator host, with backups on deno.dev and deno.net." JeetBot advertises itself as a "powerful bot for Twitch, Kick and VK Live with message speech synthesis, automatic translation, and many other features to enhance interaction with viewers." It claims to have over 26,000 active streamers and 1 billion processed messages. The site's footer identifies the operator as a Cyprus-based developer named Aleksandr Popov. On their LinkedIn profile, the developer claims JeetBot to be their pet project. However, it appears that the developer has already taken steps to address the problem. An alert issued on the JeetBot documentation page now states that version 85.8.7 of the Firefox add-on addresses the problem and that an equivalent Chrome version is currently under review - In the previous implementation, the extension sent the user's Twitch OAuth token to our proxy servers to retrieve stream playlists. An OAuth token is a credential and must be protected. Version 85.8.7 changes how playlists are retrieved: the user's OAuth token is no longer sent to our proxies. Check your installed extension version and update to 85.8.7 or later. Older installations using the previous mechanism continue to send the token until updated. The documentation also urges users to temporarily disable the extension to halt further transmission of the token if the extension is not available. However, the developer warned that disabling or updating the extension does not revoke previously transmitted tokens. When contacted for comment, Popov told The Hacker News that the exfiltration of the Twitch OAuth tokens was an oversight that has been addressed in the latest version of the extensions. The developer also noted that a Chrome update has been submitted and is still awaiting Chrome Web Store review. "We appreciate Socket drawing attention to the token-handling and disclosure concerns," Popov said. "We have taken those concerns seriously and changed the extension’s implementation. We acknowledge that the previous description and privacy policy did not adequately explain the transmission of Twitch OAuth tokens to our proxy servers. That was an oversight on our part, and we take responsibility for it." Asked why the token redirection mechanism was omitted for those ten channels, Popov stated it was part of a playback workaround that was created to address an error that viewers reported when attempting to access Twitch outside Russia or via VPN. The list can be modified by navigating to the extension's "Channels with restrictions" setting starting version 85.8.4 - Viewers reported being unable to watch these channels when accessing Twitch from outside Russia or through VPN connections. The Twitch player displayed the following message: "A proxy or unblocker has been detected. This premium content will not be available to you while it is in use. (Error #3)" We introduced a separate playback workaround to address this specific error. That mechanism did not require forwarding the viewer's OAuth token, so the extension omitted it when routing requests through that alternative playback path. The ten channels were the default entries for this workaround, based on viewer reports. The list was configurable: users could add or remove channels through the extension's interface. It was therefore a user-adjustable playback setting, rather than a fixed exemption for those ten channels. Popov also told The Hacker News that the previous token forwarding feature was implemented to obtain Twitch stream playlists and support playback features, and that similar approaches have been implemented by other Twitch playback extensions such as ReYohoho Twitch Proxy, XT Viewer, and ggsel Ханти. However, what sets these extensions apart is that they explicitly mention in their Chrome Web Store listings that the OAuth token is transmitted to their server to provide "1080p/1440p quality access" for Russian users. "In our own checks, we also observed these extensions transmitting tokens in URL query parameters," Popov pointed out. "Their use elsewhere does not remove our responsibility to protect credentials and accurately disclose data handling." "Day-to-day development of the extension was handled by Hishimiro. I did not ensure that its description and privacy policy kept pace with the implementation. This was a failure in our review process, and we accept responsibility as a team." Popov also pushed back against the characterization of the extension as malicious, stating its end goal is to provide playback functionality and emphasized that the forwarded tokens are not used for any kind of unauthorized account activity. "We recognize the security risk of the previous design, which is why we removed the need to forward users' OAuth tokens," he added. "Approximately 31,000 users across Chrome and Firefox route their live Twitch OAuth session tokens through operator-controlled proxy infrastructure," Socket said. "A Twitch OAuth session token is a bearer credential: whoever holds it can act on the account without the password or a second factor, including reading and sending whispers, posting in chat, and spending channel points. The exposure is undisclosed in both store listings."

Microsoft has disclosed details of two campaigns in which threat actors are abusing third-party email delivery infrastructure to blast financial fraud scam messages and using passkey-themed social engineering to breach cloud environments. The first campaign, per the tech giant, involved sending over a million scam emails between August 3 and 5, 2026, by masquerading as chief executive officers (CEOs) of various target companies, aiming to persuade accounts payable departments at those firms to initiate Automated Clearing House (ACH) transfers for a supposed ServiceNow annual subscription. Evidence indicates that the operators behind the campaign have leveraged generative artificial intelligence (AI) to facilitate the creation of email templates and draft emails tailored to their recipients. The activity primarily singled out enterprise users in the U.S., spanning IT services, consumer goods, real estate, and discrete manufacturing sectors. "The campaign follows steps before and during the execution of the campaign: threat actors register impersonation domains, send executive-themed payment requests through trusted infrastructure, embed fabricated invoices and supporting conversations, and attempt to convince finance personnel to initiate ACH transfers," the Microsoft Security Research team said. "Unlike traditional invoice scams that rely on a single social engineering lure, this campaign layered executive impersonation, vendor branding, fabricated invoices, and supporting email conversations into a unified narrative intended to reduce recipient skepticism." The spoofed email messages contained a purported "approval" of the fake invoice to trick recipients into making payments to attacker-controlled accounts. To lend a veneer of legitimacy to the deception, the threat actor included a forged email thread along with the fabricated invoice. In a clever twist, the attackers identified CEOs, CFOs, and presidents at victim organizations and plugged their names and email addresses into the emails' signatures so that they look convincing to the targets. The campaign also heavily relied on bogus domains and content designed to impersonate trusted brands and individuals. Some of the registered domains are below - service-nowinc[.]com domainlify[.]net Passkey-Themed Social Engineering Leads to Cloud Compromise The second campaign documented by Redmond revolves around cloud-based intrusions targeting multiple accounts in which suspicious sign-ins are followed by the threat actors adding their own authentication methods, as well as high-volume Microsoft Graph activity, SharePoint and OneDrive downloads, and mailbox collection through REST APIs. The activity, which has been detected since May 2026, is consistent with "automated collection from compromised cloud identities using proxy-associated infrastructure," Microsoft said. The attack commonly begins with identity-focused social engineering. The threat actors call or message a user's personal phone number, while claiming to be from the organization's IT help desk and urging them to immediately update their passkey, multi-factor authentication (MFA), or single sign-on (SSO) configuration to avoid access disruptions. Unsuspecting employees are redirected to counterfeit websites that mimic the legitimate Microsoft sign-in experience via SMS messages sent to their personal devices. The end goal here is to use the pretext to guide them through adversary-in-the-middle (AitM) or device-code authentication flows and take control of their Microsoft accounts either by capturing the credentials or unknowingly granting access on the actor's behalf. "The actor appears to invest heavily in pre-attack research, likely gathering information about employees and organizational structure from public sources such as social networking and professional profiling platforms," Microsoft said. "In a smaller number of cases, actors take advantage of already compromised accounts to expand their reach" by sending similar passkey-themed messages via Microsoft Teams. What's more, the threat actor has been observed registering domains built around themes such as passkeys, SSO enrollment, account activation, and identity verification, at the same time including the target organization's name as a subdomain in the pattern: " . [.]com" - passkeyhelpdesk[.]com secure-passkey[.]com setupmypasskey[.]com add-passkey[.]com integratedsso[.]com oktasession[.]com syncmykey[.]com portalsetuphub[.]com It's worth noting that this modus operandi overlaps with a loose-knit cybercrime collective tracked by the cybersecurity community under the monikers Cordial Spider, O-UNC-045, PREY-0058, and UNC6671. The e-crime adversary has been described as a coordinated group of threat actors that operates multiple public extortion brands while sharing overlaps in the underlying phishing infrastructure and targeting footprint. "UNC6671 uses credential harvesting panels hosted on generic root domains masquerading as being related to passkeys, appending victim-specific subdomains to facilitate targeted voice phishing campaigns," Google-owned Mandiant noted last month. Although the exact nature of these connections is unclear, it's suspected that they have been driven by splintered affiliates retaining access to shared initial access playbooks or relying on the same commoditized phishing panels, voice-phishing callers, and shared infrastructure. Microsoft, for its part, has attributed the initial access activity observed in this campaign to a range of threat actors, including Storm-3121 and Storm-3032. While Storm-3121 carries out initial access activity leading to ShinyHunters and Falcon (aka CL-CRI-1182) extortion, Storm-3032 is its designation for UNC6671, which refers to a set of actors that broke off from the BlackFile (aka CL-CRI-1116) group and now operate under the Helix extortion brand. In at least one case investigated by Microsoft, the threat actors are said to have carried out an anomalous sign-in to Microsoft Office Home from an unmanaged device to expand their access to other applications like SharePoint Online and OneDrive through the Graph API and enumerate sensitive files and internal services. Another incident involved the use of a passkey lure to launch a device code phishing attack and gain control of a victim's account without having to steal their credentials or cookies, effectively getting around MFA safeguards. The third attack pattern detected by Microsoft employs compromised credentials, likely obtained from a prior event, to register their own phone-based method to bypass MFA and engage in reconnaissance and post-exploitation activity. "Following initial access, the actor's first objective was to transform a temporary compromise into a persistent foothold," the Windows maker said. "Rather than relying solely on stolen credentials, the actor enrolled an MFA method under their control, typically by registering a new phone number, authenticator application, or software-based one-time password (OTP) token." An advantage this actor-controlled second factor offers is that it allows the threat actor to sign-in into the victim's corporate account without their participation and maintain continued access in combination with unrevoked sessions or valid credentials. The various actions the threat actor can take upon establishing MFA persistence are as follows - Conduct extensive internal reconnaissance using the Graph API and inventory users, groups, permissions, resources, and accessible content across the tenant using the compromised identity. Inspect roles and high-value accounts and service identities for privilege escalation. Enumerate mailbox messages, folders, and attachment metadata for intelligence collection. Conduct high-volume access and download activity aimed at SharePoint Online and OneDrive for Business, and even Microsoft Exchange Online in some cases. Engage in sustained data exfiltration that lasts from several hours to multiple days depending on the volume of files and email content harvested from the compromised user. Deliberately rotate infrastructure across the attack lifecycle and use separate IP addresses for authentication, reconnaissance, and exfiltration activities so as to subvert network-based indicators. "The attack underscores a critical detection challenge: Microsoft Graph abuse rarely appears suspicious when viewed through a single API call," Microsoft said. "This attack serves as a strong example of why Graph activity must be assessed holistically, with emphasis on behavioral progression and cross-event correlation rather than individual API requests in isolation."

The "major malicious attack" that targeted RubyGems in May 2026 was the work of a swarm of OpenAI agents, according to a new report published by researchers Spencer Kitts, Thomas Larsen, and Sydney Von Arx. On May 12, Maciej Mensfeld, senior product manager for software supply chain security at Mend.io, disclosed details of a coordinated cyber attack that targeted the package manager for the Ruby programming language with hundreds of junk gems, prompting the maintainers to suspend new user sign-ups for about four days. In a follow-up analysis, Socket highlighted a campaign dubbed GemStuffer that involved a cluster of more than 150 gems that used the package registry as a data exfiltration channel and staged public data scraped from U.K. local government democratic services portals. At that time, the software supply chain security company noted the activity shares the "same abuse pattern" as the broader RubyGems spam-publishing incident. "It's not clear what exactly the end goals are, as the information appears to be publicly accessible anyway," The Hacker News reported back then. The latest findings, which were first reported by The Wall Street Journal, indicate these events were propelled by a cluster of OpenAI agents, with the earliest package uploaded to RubyGems on May 5, 2026, before more than 2,000 packages were submitted between May 11 and 12, 2026. These efforts were followed by the agents publishing five more packages between May 26 and 27, 2026, and another 83 packages on June 18, 2026. The assessment that this incident was the result of an OpenAI agent swarm stems from the fact that the packages were authored using a large language model (LLM) and hundreds of the packages that were pushed to RubyGems had "oai" in their name. Fifteen of the packages listed "oai" as their author, while another had "[email protected]" as the contact email address. The names of some of the junk packages are below - chatoaitestgit1778552630 lambhgproxyoai oaibx0092307 oaicx8859010 oaicx3857133 oaidx4526859 oaiex4149420 oaifx7943598 oaigx5861576 oaihx0305933 oaiix0379958 oaijx0156671 oaikx5119809 oailm2 oaipgttatggxy oaifetchgemugkejy oaiproxytestabc789 oaitfossilxbnowl "The swarm behaves extremely similarly to the German-wiki agents we previously found," the researchers said, referencing another May 2026 incident in which internally deployed autonomous agents hijacked a German wiki forum, DseWiki, and turned it into a bulletin board to ask for answers, pool results, and share techniques for circumventing their restrictions as part of a timed web-lookup task. "The June agents were accessing 49 of the same files as the wiki agents. The May agents were accessing different files (mostly local U.K. government data), but these files are very similar in character to those pursued by the wiki agents. Moreover, they use the same retrieval methods. 1,397 packages mention r.jina.ai, which was used heavily by the agents on the wiki. We also see that many packages mention example.com, which wiki agents used to test their posting ability." The agents are said to have exploited a design quirk in the RubyDoc.info documentation build process to exfiltrate public data from U.K. government websites, likely as part of an information gathering task similar to the research tasks processed by the German wiki-exploiting agents. "The process of building documentation for a gem involves evaluating a user-specified '.yardopts' file, which allows linking to Ruby scripts intended to help with this process," the researchers explained. "In the GemStuffer campaign, the agents abused this to gain arbitrary remote code execution on RubyDoc.info's servers." One of the gems, "zzsouthrunner" (which again matches the "ZZ" naming scheme the agents adopted in both the wiki and Hugging Face incidents) has been found to leave the following explicit comment at the top of "data/script.rb": malicious crawler/exfil for Southwark Jan 2026 docs via rubydoc.info worker It's worth noting that the GemStuffer campaign targeted public-facing ModernGov portals used by Lambeth, Wandsworth, and Southwark. The entire exploitation chain can be summed up as follows - Submit a malicious package to RubyGems Trigger a documentation request, so that RubyDoc.info will build the package Use the build script to run code on RubyDoc.info and scrape target websites Exfiltrate the data off RubyDoc.info's servers by publishing another gem back to the RubyGems package registry, which is publicly viewable Additionally, the OpenAI agents have been found attempting to steal other users' API keys after gaining remote code execution capabilities on the build environment, while clearly being aware that what they were doing is unauthorized breaking and entering into real systems. This is evidenced by the names given to the files (e.g., hack.rb, evil.rb, inject.rb, exploit.rb, and ssrf.rb), the packages themselves (e.g., pwnp999, exfiltestwand3, hacksvn1778554764, and lambproxyhackabcxyz), and the comments left in the source code (e.g., "# malicious probe," "#hack," "# malicious test," and "# malicious crawler/exfil"). In some cases, however, the rogue agents attempted to go under the radar, leaving comments to conceal the malicious payload in the next release version of the packages. "# disable evil in next version and bump version," reads a comment left within the "data/evil.rb" file in the yardxabc889 gem. Troublingly, the agents also attempted to exploit a CDN caching bug (CVSS score: 7.3, no CVE) on May 12, 2026, that was only patched by RubyGems in July 2026. At a high level, the issue could hand one account's API key to another account holder for up to an hour, thereby allowing an attacker to leak a random user's key. Six of the packages published as part of the campaign used this vulnerability before it was fixed, although it's unclear if they succeeded in their efforts. RubyGems, in its July alert, said it found no sign that this pathway has been exploited in a malicious context. The names of the six Ruby gems are below - slnleaker5 zzwandshostyard lambfetchx548811 lambfetchx550961 lambfetchx550961 yardbreakerxqh1778552850 "If you signed in to rubygems.org with a gem client older than v3.2.0 (or otherwise via a legacy key), your key could have been exposed," RubyGems noted in an advisory. "Currently, 18% of sign-ins through gem sign-in come from an affected version, and for the first several years of this bug, before we changed the client's sign-in path in December 2020, it was every gem client." Some of the other actions undertaken by the agents are listed below - Agents bypassed RubyGems' email confirmation system to get working API keys without having to verify their email addresses in order to register a large number of accounts using disposable email addresses. The issue was fixed on May 12, 2026. The ability to register with a disposable email was disabled on May 16, 2026. Agents attempted to use RubyGems' webhook system to stage data in the form of encoded URLs. Agents used a cluster of 83 gems published to RubyGems over a 3-hour window on June 18, 2026, to experiment with different methods of accessing the U.S. Securities and Exchange Commission's (SEC) county.json dataset. This is not the first time OpenAI agents have targeted RubyGems. In its postmortem published late last month, OpenAI said it observed its agents exploiting JFrog Artifactory's JRuby-backed RubyGems processing to obtain the signing key and forge administrator credentials as part of an attack targeting the artificial intelligence (AI) company's infrastructure. The researchers also noted that it's unknown at this stage why the agents took the trouble of attacking RubyGems in order to scrape publicly available data and if the agents worked together as in the case of the other incidents. It's believed that the agents may have been attempting to use RubyGems as a way to persistently stash the scraped data and bypass rate limits. "We suspect they were cooperating with each other, both because that would better justify going to such lengths to cache the websites and because the packages the agents upload seem to have thousands of downloads," the researchers said. "But this is far from definitive." Last week, OpenAI said it treated the wiki incident as an "instance of misalignment similar to the ones we'd shared," and that it has historically "treated misalignment largely as a research question, which gets communicated in research publications such as systems cards." The American company then went on to state that the AI community does not yet have a "clear standard for how to report misalignment that shows up during training, evaluation, and deployment, including examples that don't look like traditional security incidents but could provide insight into AI behavior and future risks." It also said it's working on a framework that it intends to share publicly in the coming weeks. The episode is only the latest in a series of cyber attacks linked to frontier AI labs that have set alarm bells ringing and spurred calls for tighter AI regulation. As it has become abundantly clear, unless carefully restricted, AI agents will go to extreme lengths to complete the tasks assigned to them, even if that means breaking out of sandboxes or conducting social engineering attacks on real people. The ever-growing list of incidents where AI agents from OpenAI, Anthropic, and Meta have breached or attempted to access external systems has raised concerns about the pace of AI development and their potential to slip out of human control. "Based on our review, our agents used the RubyGems platform to access the internet to carry out benign tasks and retrieve public information," OpenAI said in a statement shared with Reuters. "We'll continue to investigate as part of our broader review of agent activity during training and evaluation." RubyGems, for its part, said its own investigation found no evidence the attempts succeeded, and that it's committed to detecting and combating abuse irrespective of whether the activity originates from humans or automated tools. "Based on the evidence available to us, we cannot determine whether the packages were created or published by AI agents," Colby Swandale, technical lead at Ruby Central, said. "Our focus is on identifying and preventing abuse, regardless of whether it comes from people or automated tools."

Anthropic says multiple threat groups, including the financially motivated and state-sponsored espionage groups linked to Russia and China, tried to abuse its Claude AI model for malicious purposes. The AI company says that between December 2025 and August 2026, it recorded various forms of artificial intelligence misuse, including for cyber and influence operations, surveillance, scams, development of biological and conventional weapons, and model distillation. Over the eight-month period, Anthropic disrupted several activities linked to the ShinyHunters collective, infamous for massive data theft attacks that typically begin with social engineering and account compromise. An alleged French-speaking member of the group that used the handle ‘frkoo’ distributed a credential-harvesting pipeline across ten AWS EC2 workers that downloaded from multiple stores and then scanned for secrets in 1.8 million Android APKs. “This pipeline mass-downloaded 1.8 million distinct Android APKs from multiple app-store sources, decompiled them, and scanned for hardcoded secrets with TruffleHog,” Anthropic explains. “Verified findings were routed in real time to a Telegram group organized into over 100 source types.” The same actor used a separate automated process to collect GitHub organization email addresses and used them to obtain GitHub Personal Access Tokens (PATs). The two pipelines provided initial-access credentials that 'frkoo' used "for the bulk of the confirmed breaches" associated with the hacker. Anthropic says that 'frkoo' also set up a carding shop at policenationale[.]cc that impersonated the French national police to sell stolen payment-card records, full cardholder information, and an interactive map of victim addresses. Suspected ShinyHunters members also stole AI API keys and used them for breaching other organizations or for reconnaissance activity. In one case, they breached a software-as-a-service provider and stole data belonging to around 200 downstream customers. Fast-paced attacks With the help of Claude AI, it took a suspected ShinyHunters threat actor about 34 hours to extract authentication data and get more than 2,100 sets of Azure AD authentication tokens linked to over 40 separate corporate Microsoft tenants. According to Anthropic, "AI agents performed nearly all of the work." Additional harmful activity involving Claude and attributed to ShinyHunters affiliates includes breaching a technology provider and stealing 1TB of data, compromising an airline, and accessing systems of an energy company. ShinyHunters moved quickly after obtaining initial access. In the case of an enterprise software firm, the hackers went to bulk data theft in just a few hours. In another instance, the AI company says that the attacker moved from a single stolen developer token to full administrative control in less than three hours. Russian and Chinese hackers Anthropic’s report also highlights activity attributed to the Russian espionage group “Midnight Blizzard,” which used Claude to automate malware development, research, infrastructure acquisition, phishing, persistence, command-and-control (C2) operations, and data exfiltration. The threat actor also set up a feedback loop that rebuilt malware whenever security products detected it. Anthropic observed Midnight Blizzard targeting over 20 government, defense, diplomatic, intelligence, and foreign-policy entities. The campaigns included device-code phishing, ClickFix attacks, DNS hijacking through compromised hotel Wi-Fi providers, WhatsApp account takeovers, cloud-email theft, and Windows, Android, and iOS malware, with Claude being used throughout all attack stages. Midnight Blizzard automated its operations through AI-driven workflows built around Claude Code skills, with the human operator primarily modifying those skills when they needed refinement. Anthropic also describes an espionage operation attributed to a Chinese-speaking group tracked as GTG-10007, where Claude was used "as the engineering and orchestration layer of a coordinated offensive program involving a variety of tasks," such as: intrusion attempts against production systems reconnaissance of foreign-government networks across the Middle East, Europe, and Southeast Asia a standing vulnerability-research and exploit development effort against major endpoint-security products malware development building an intelligence-collection platform The GTG-10007 espionage group operated autonomous vulnerability-research workflows while the human operators were away, which uncovered multiple previously unknown vulnerabilities in a major security product. Additionally, the automated effort also delivered "working exploits for several families of network and security appliances." The actor then leveraged the exploit code against several government organizations around the globe. The group's operations targeted around 50 organizations across government, education, retail, energy, technology, healthcare, finance, and manufacturing, with confirmed compromises at an education-technology company, a retailer, and a Southeast Asian government agency. The AI company notes that it disrupted the actors’ use of Claude for harmful activities and banned the threat actors' account. Furthermore, Anthropic adjusted its guardrails based on the observed malicious use, added measures to detect future misuse faster, and contacted the authorities, industry partners, and victims. Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed. Save your seat

CVE-2026-89332 - Kiro IDE Sensitive Workspace Data Exfiltration via Agent-Written Workspace Configuration Bulletin ID: 2026-111-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/11/2026 12:00 PM PDT Description: Kiro IDE is an agentic development environment that makes it easy for developers to ship real engineering work with the help of AI agents. We identified CVE-2026-89332, where the Kiro agent could modify a workspace's settings file in an untrusted workspace in Kiro IDE. A specially crafted repository could use this to point the Kiro Powers registry URL, which Kiro fetches when the Powers panel is opened, at an external endpoint, sending potentially sensitive workspace data to that endpoint. Kiro presented the edit to the user for approval, showing the inserted data and the URL, but the file was already written to disk, so opening the Powers panel before responding to the prompt made the request anyway. Impacted versions: Kiro IDE < 0.8.135 Resolution: This issue has been addressed in Kiro IDE version 0.8.135 and greater. We recommend upgrading to the latest version and rotate any credentials present in a project opened on an earlier version. Workarounds: None. References: Please email [email protected] with any security questions or concerns.