darktrace

Prevalent AI Raises $22 Million to Expand Data Fabric Platform

AI-powered data fabric company Prevalent AI today announced raising $22 million in growth funding from Integrity Growth Partners (IGP). Founded in 2017 by former GCHQ and Darktrace leaders and headquartered in London, Prevalent AI has operated on a bootstrapped basis until now. The UK-based company has built a data fabric platform that turns fragmented enterprise data into a knowledge graph that security teams and AI agents can use to gain context, clarity, and control. Prevalent AI addresses the cybersecurity risks posed by fragmented data in enterprise environments amid accelerated AI adoption. The platform cleans, connects, and contextualizes enterprise security data, continuously identifies and remediates risks, and enables organizations to securely deploy and operate AI agents. It provides organizations with a comprehensive view of the data that exists across their environments, how it relates, and where operational gaps exist. Prevalent AI will use the fresh investment to accelerate US expansion, scale go-to-market efforts, extend the platform beyond cybersecurity, and deepen its leadership team. “Large enterprises do not have a shortage of tools or data. They have a shortage of context. Security teams are being asked to make decisions across thousands of systems, controls, identities, and data sources that were never designed to work together,” said Prevalent AI co-founder and CEO Paul Stokes. “For almost a decade, we have been using AI to continuously clean, connect, and contextualize enterprise data so organizations can see what exists, what is working, where the gaps are, and what needs attention. We started with security because that is where fragmented data does the most damage,” Stokes added. Related: Xpander Raises $7.5 Million for AI Management and Governance Related: Fortinet Acquires AI Security Company Virtue AI

securityweek.comAug 19, 2026extracted

「AIの暴走を止められない」　CISO座談会で見えたAIセキュリティの限界

itmedia.co.jpJul 6, 2026extracted

Over 80% of Sports Organizations Targeted by Hackers in the Last Year

Over 80% of professional sports organizations were targeted by cyber-attacks during the last year and over half of them were hit more than once, researchers have warned. In a report published on June 11, the day the FIFA World Cup 2026 kicked off, figures from Darktrace revealed that 84% of sports organizations – including teams, venues and event bodies – were targeted by cyber-attacks during the last year. And for most of them, facing a cyber-attack was not a one-off event: 57% experienced multiple cyder incidents in the 12-month period. Sports teams and organizations make a tempting target for cybercriminals and other threat actors for a number of reasons. Sports fixtures, especially international events, are highly publicized, meaning that the attackers know exactly when they are happening. That means that if attackers had the goal of causing maximum disruption, be it via crippling infrastructure with a ransomware attack or disrupting online services with a DDoS attack, they know when to strike. The importance of keeping operations active is not lost on cybersecurity leaders in the sports industry: a third said that the most important task for cybersecurity teams is to help stadium operations maintain critical functions during live sporting events. This is crucial, because if a cyber event meant that stadium operations were disrupted, fans may not be able to get through the gates, or the game might not be able to be played, creating multiple issues for the fans, teams, sporting bodies and sponsors. “Professional sport is a high-pressure environment where timing matters,” said Nathaniel Jones, VP of security and AI strategy at Darktrace. “A suspicious login, unusual data movement or unexpected AI agent action may look small in isolation, but during a live event it can become operationally significant very quickly.” Cyber-Attacks Target Fan Data A further reason why sports organizations are a major target for cyber-attacks is the data they handle. Like any large organization, sports bodies collect and handle information about customers: the fans. This includes sensitive information like credit card details and personal information, all of which are major targets for cybercriminals, either to steal and use directly themselves or sell to others on underground forums. Either way, if this information is stolen, it puts the fans at risk of theft, fraud and more. In addition to this, sports organizations carry vast amounts of information about the teams and athletes themselves. This could range from personal data about the athletes to information about contracts and sponsorship deals, or even confidential data around how the organization works, commercial partnerships and relationships with third-party suppliers. Targeting the Supply Chain Indeed, it is the supply chain around these third-party suppliers which are commonly targeted by threat actors who view them as weak point to be exploited. Ticketing providers, broadcasters, cloud services and stadium technology software suppliers are all potential targets for attackers, who could leverage the trusted relationship with the sports organization to help conduct an attack. Social engineering is a key attack technique deployed against sports organizations. According to Darktrace, sports organizations received 19% more phishing emails than those in other sectors. Analysis of 116,000 phishing emails which targeted sports organizations found that 21% directly targeted executives and other VIPs, while 37% involved ‘novel’ social engineering techniques which leveraged AI-powered assistance. Meanwhile, 84% of phishing emails detected successfully bypassed DMARC authentication, highlighting the challenge that organizations face. As sporting organizations face increasing pressures from cyber threats, the report concluded that they must take action to ensure that they don’t become a high-profile victim of cyber-crime: especially at the key moment when the eyes of the world are watching. “The most effective way to mitigate the risks facing sports organizations both internally and from external actors today is to adapt a behavioral approach to security. That means shifting away from rules and signatures and focusing on understanding both human and AI behavior inside your environment,” said Jones. Image credit: katatonia82 / Shutterstock.com

infosecurity-magazine.comJun 12, 2026extracted

Researchers Detect ZionSiphon Malware Targeting Israeli Water, Desalination OT Systems

Cybersecurity researchers have flagged a new malware called ZionSiphon that appears to be specifically designed to target Israeli water treatment and desalination systems. The malware has been codenamed ZionSiphon by Darktrace, highlighting its ability to set up persistence, tamper with local configuration files, and scan for operational technology (OT)-relevant services on the local subnet. According to details on VirusTotal, the sample was first detected in the wild on June 29, 2025, right after the Twelve-Day War between Iran and Israel that took place between June 13 and 24. "The malware combines privilege escalation, persistence, USB propagation, and ICS scanning with sabotage capabilities aimed at chlorine and pressure controls, highlighting growing experimentation with politically motivated critical infrastructure attacks against industrial operational technologies globally," the company said. ZionSiphon, currently in an unfinished state, is characterized by its Israel-focused targeting, going after a specific set of IPv4 address ranges that are located within Israel - 2.52.0[.]0 - 2.55.255[.]255 79.176.0[.]0 - 79.191.255[.]255 212.150.0[.]0 - 212.150.255[.]255 Besides encoding political messages that claim support for Iran, Palestine, and Yemen, the malware embeds Israel-linked strings in its target list that correspond to the nation's water and desalination infrastructure. It also includes checks to ensure that in those specific systems. "The intended logic is clear: the payload activates only when both a geographic condition and an environment-specific condition related to desalination or water treatment are met," the cybersecurity company said. Once launched, ZionSiphon identifies and probes devices on the local subnet, attempts protocol-specific communication using Modbus, DNP3, and S7comm protocols, and modifies local configuration files by tampering with parameters associated with chlorine doses and pressure. An analysis of the artifact has found the Modus-oriented attack path to be the most developed, with the remaining two only including partially functional code, indicating that the malware is still likely in development. A notable aspect of the malware is its ability to propagate the infection over removable media. On hosts that do not meet the criteria, it initiates a self-destruct sequence to delete itself. "Although the file contains sabotage, scanning, and propagation functions, the current sample appears unable to satisfy its own target-country checking function even when the reported IP falls within the specified ranges," Darktrace said. "This behavior suggests that the version is either intentionally disabled, incorrectly configured, or left in an unfinished state." "Despite these limitations, the overall structure of the code likely indicates a threat actor experimenting with multi‑protocol OT manipulation, persistence within operational networks, and removable‑media propagation techniques reminiscent of earlier ICS‑targeting campaigns." The disclosure coincides with the discovery of a Node.js-based implant called RoadK1ll that's designed to maintain reliable access to a compromised network while blending into normal network activity. "RoadK1ll is a Node.js-based reverse tunneling implant that establishes an outbound WebSocket connection to attacker-controlled infrastructure and uses that connection to broker TCP traffic on demand," Blackpoint Cyber said. "Unlike a traditional remote access trojan, it carries no large command set and requires no inbound listener on the victim host. Its sole function is to convert a single compromised machine into a controllable relay point, an access amplifier, through which an operator can pivot to internal systems, services, and network segments that would otherwise be unreachable from outside the perimeter." Last week, Gen Digital also took the wraps off a virtual machine (VM)-obfuscated backdoor that was observed on a single machine in the U.K. and operated for a year between May 2022 and June 2023, before vanishing without any trace when its infrastructure expired. The implant has been dubbed AngrySpark. It's currently not known what the end goals of the activity were. "AngrySpark operates as a three-stage system," the company explained. "A DLL masquerading as a Windows component loads via the Task Scheduler, decrypts its configuration from the registry, and injects position-independent shellcode into svchost.exe. That shellcode implements a virtual machine." "The VM processes a 25KB blob of bytecode instructions, decoding and assembling the real payload – a beacon that profiles the machine, phones home over HTTPS disguised as PNG image requests, and can receive encrypted shellcode for execution." The result is malware capable of establishing stealthy persistence, altering its behavior by switching the blob, and setting up a command-and-control (C2) channel that can fly under the radar. "AngrySpark is not only modular, it is also careful about how it appears to defenders," Gen added. "Several design choices look specifically aimed at frustrating clustering, bypassing instrumentation, and limiting the forensic residue left behind. The binary's PE metadata has been deliberately altered to confuse toolchain fingerprinting." Update In a follow-up analysis published on April 23, operational technology (OT) security company Dragos called ZionSiphon a "poor attempt at generating OT malware" using a large language model, adding it's riddled with errors and not a credible threat to desalination facilities or any critical infrastructure. It also pointed out that the malware is nowhere near production-ready. "The code is broken and shows little to no knowledge of dam desalination or ICS protocols," security researcher Jimmy Wylie said. "It would fail to cause any significant negative consequence in the OT environment, much less set unsafe chlorine levels. The checks for dam desalination-related hosts are ineffective. Chlorine manipulation via configuration files and Modbus TCP is ineffective. The code to check for Modbus TCP, DNP3, and S7Comm devices is immature at best, incorrect at worst." (The story was updated after publication on April 24, 2026, to include insights from Dragos.)

thehackernews.comApr 20, 2026extracted

New Chaos Variant Targets Misconfigured Cloud Deployments, Adds SOCKS Proxy

Cybersecurity researchers have flagged a new variant of malware called Chaos that's capable of hitting misconfigured cloud deployments, marking an expansion of the botnet's targeting infrastructure. "Chaos malware is increasingly targeting misconfigured cloud deployments, expanding beyond its traditional focus on routers and edge devices," Darktrace said in a new report. Chaos was first documented by Lumen Black Lotus Labs in September 2022, describing it as a cross-platform malware capable of targeting Windows and Linux environments to run remote shell commands, drop additional modules, propagate to other hosts by brute-forcing SSH keys, mine cryptocurrency, and launch distributed denial-of-service (DDoS) attacks via HTTP, TLS, TCP, UDP, and WebSocket. The malware is assessed to be an evolution of another DDoS malware known as Kaiji that has singled out misconfigured Docker instances.It's currently not known who is behind the operation, but the presence of Chinese language characters and the use of China-based infrastructure suggest that the threat actor could be of Chinese origin. Darktrace said it identified the new variant targeting its honeypot network last month, a deliberately misconfigured Hadoop instance that enables remote code execution on the service. In the attack spotted by the cybersecurity company, the intrusion commenced with an HTTP request to the Hadoop deployment to create a new application. The application, for its part, embedded a sequence of shell commands to retrieve a Chaos agent binary from an attacker-controlled server ("pan.tenire[.]com"), set permissions to allow all users to read, modify, or run it ("chmod 777"), and then actually execute the binary and delete the artifact from disk to minimize the forensic trail. An interesting aspect of the attack is that the domain was previously put to use in connection with an email phishing campaign carried out by the Chinese cybercrime group Silver Fox to deliver decoy documents and ValleyRAT malware. The campaign was codenamed Operation Silk Lure by Seqrite Labs in October 2025. The 64-bit ELF binary is a restructured and updated version of Chaos that reworks several of its functions, while keeping most of its core feature set intact. One of the more significant changes, however, concerns the removal of functions that enabled it to spread via SSH and exploit router vulnerabilities. Taking their place is a new SOCKS proxy feature that allows the compromised system to be used for ferrying traffic, thereby concealing the true origins of malicious activity and making it harder for defenders to detect and block the attack. "In addition, several functions that were previously believed to be inherited from Kaiji have also been changed, suggesting that the threat actors have either rewritten the malware or refactored it extensively," Darktrace added. The addition of the proxy feature is likely a sign that threat actors behind the malware are lookingto further monetize the botnet beyond cryptocurrency mining and DDoS-for-hire, and keep up with their competitors in the cybercrime market by offering a diverse slate of illicit services. "While Chaos is not a new malware, its continued evolution highlights the dedication of cybercriminals to expand their botnets and enhance the capabilities at their disposal," Darktrace concluded. "The recent shift in botnets such as AISURU and Chaos to include proxy services as core features demonstrates that denial-of-service is no longer the only risk these botnets pose to organizations and their security teams."

thehackernews.comApr 8, 2026extracted

Chaos malware expands from routers to Linux cloud servers

Chaos malware expands from routers to Linux cloud servers Chaos, Go-based malware first documented by Lumen’s Black Lotus Labs, has historically targeted routers and edge devices. A new variant observed in March 2026 shows the malware operating against misconfigured Linux cloud servers, a category of infrastructure the botnet had not previously prioritized. Darktrace’s malware research team documented the compromise through its CloudyPots program, a global honeypot network the company runs to capture attacker behavior across a range of services and cloud platforms. One honeypot in that network runs Apache Hadoop, an open-source distributed data processing framework, deliberately misconfigured to allow remote code execution. That misconfiguration gave attackers a foothold and gave researchers a documented look at the updated malware. How the attack unfolded The intrusion began with an HTTP request to the Hadoop deployment’s resource manager endpoint. The request defined a new application and embedded a sequence of shell commands. Those commands pulled a Chaos agent binary from an attacker-controlled server, set permissions, executed the binary, then deleted it from disk. The deletion step limits forensic recovery after execution. The initial infection being delivered to the unsecured endpoint (Source: Darktrace) The binary was served from pan[.]tenire[.]com, a domain previously linked to Operation Silk Lure, a separate campaign that distributed the ValleyRAT remote access trojan through malicious job application attachments. That campaign also contained extensive Chinese-language strings throughout its stages. What changed in the malware The new sample is a 64-bit ELF binary compiled for x86-64 Linux. This marks a departure from earlier Chaos variants, which targeted ARM, MIPS, and PowerPC architectures common in consumer routers. The internal namespace was restructured and several functions were rewritten or removed, including the SSH brute-forcing spreader and certain vulnerability exploitation routines previously inherited from Kaiji, the botnet Chaos is believed to have evolved from. The core feature set remains intact. The malware establishes persistence using systemd and stores a keep-alive script on disk. DDoS attack functions are present and support HTTP, TLS, TCP, UDP, and WebSocket protocols. “A new function of the malware is a SOCKS proxy. When the malware receives a StartProxy command from the command-and-control (C2) server, it will begin listening on an attacker-controlled TCP port and operates as a SOCKS5 proxy. This enables the attacker to route their traffic via the compromised server and use it as a proxy. This capability offers several advantages: it enables the threat actor to launch attacks from the victim’s internet connection, making the activity appear to originate from the victim instead of the attacker, and it allows the attacker to pivot into internal networks only accessible from the compromised server,” Nathaniel Bill, Malware Research Engineer at Darktrace, explained. The command-and-control server is reached through an embedded domain, gmserver[.]osfc[.]org[.]cn, which at the time of analysis resolved to an IP address geolocated to Hong Kong. Proxy functionality signals a shift in botnet economics Darktrace’s research notes that another DDoS botnet, Aisuru, was previously observed pivoting to sell proxy access to other threat actors. The addition of equivalent functionality in Chaos suggests botnet operators are treating proxy services as a revenue stream alongside DDoS-for-hire, expanding the range of criminal activity these networks can support. The addition of proxy capability changes the risk profile for organizations running cloud workloads. A compromised server enrolled in a proxy botnet can be used to bypass rate limits, mask attacker origins during credential stuffing or reconnaissance campaigns, and enable lateral movement within environments that share network trust relationships with the infected host. The cloud misconfiguration problem The attack succeeded because the targeted service was reachable and improperly secured. Hadoop’s resource manager, when exposed to the internet without authentication controls, allows anyone to submit applications and execute code on cluster nodes. This is a known configuration risk, and the pattern generalizes to other management interfaces and administrative services routinely deployed in cloud environments. Darktrace’s analysis attributes suspected Chinese origin to Chaos based on Chinese-language strings in the malware binary and zh-CN locale indicators, a characterization consistent with the original Lumen research that documented the malware. The infrastructure connections between the delivery server and ValleyRAT’s distribution campaign add circumstantial weight to that assessment, though definitive attribution remains difficult.

helpnetsecurity.comApr 8, 2026extracted

Stolen Logins Are Fueling Everything From Ransomware to Nation-State Cyberattacks

Like an inverted pyramid, the range of different attack modes are now built on top of the single point of identity abuse. Stolen credentials are a major threat. Legitimate credentials illegitimately acquired provide legitimate access to illegitimate actors. Once inside the network, these bad actors have greater ability to move and act in stealth. The continuing rise in ransomware attacks bears testament. The theft and resale of credentials operates on an industrial scale. Fueled by the rise of increasingly more sophisticated infostealers, stolen credentials are packaged into ‘logs’ and sold to criminals on the black market. Ontinue reports, “Listings tied to LummaC2 alone surged by 72%, with high-privilege cloud console credentials selling for $1,000–$15,000+.” Ransomware has been one of the primary beneficiaries of stolen credentials. More than 7,000 incidents and 129 active groups were tracked through 2025. At the same time, ransom payments decreased slightly from $892M in 2024 to $820M in 2025. This apparent contradiction is actually logical. “Larger targets, with larger payout potential, will have seen the most aggressive corporate investment (process and technology) mitigating exposure to this attack pattern,” explains Trey Ford, chief strategy and trust officer at Bugcrowd. These larger targets are also more susceptible to government pressure to not pay ransoms, and ransomware income has consequently declined. The ransomware groups have responded with more attacks demanding smaller payments from more but smaller companies. These bad actors have simultaneously increased the pain threshold. Theft of data for blackmail has been growing for several years but is now often supplemented with operational disruption. “Beyond encrypting endpoints, attackers disrupt the ability to operate by wiping systems, deleting backups, sabotaging virtualization, attacking OT/ICS-adjacent services, or breaking identity/administration planes.” Think of modern ransomware as a multi-layer extortion machine, it continues. “Even when victims avoid paying, they are still dealing with downtime, regulatory exposure, third-party disruption, and long recovery cycles.” Nathaniel Jones, VP of security & AI strategy, and field CISO at Darktrace, adds, “Rather than relying solely on encrypting a target’s data for ransom, threat actors will increasingly employ double or even triple extortion strategies, encrypting sensitive data but also threatening to leak or sell stolen data.” At the same time, adversarial use of AI to assist in attacks is growing. Sophisticated and compelling phishing attacks are already evident, but Ontinue has also seen “the first meaningful signs of LLM-assisted malware development in 2H 2025.” This isn’t yet autonomous malware, but are signs that attackers are using AI to assist malware development for speed and features. “LLMs didn’t write the malware, but they wrote large pieces of it,” says Ontinue. “This lowers the bar dramatically. Adversaries with minimal engineering ability now ship tools that look more professional but still contain fundamental security flaws.” Stolen credentials are also fueling supply chain and SaaS attacks. The two big examples from 2025 are the Salesloft Drift OAuth campaign (with more than700 victim organizations) and the Shai-Hulud npm worm. Both campaigns abused the trust necessary in modern business infrastructure, with that trust breached by legitimate but stolen credentials. The increase in global geopolitical tension has further increased and complicated the cybersecurity battlefield – and has probably decreased any remaining ‘honor among thieves’. The Shai-Hulud actor (financially motivated rather than nation state motivated), for example, may attempt to delete the target’s home directory if it finds little to harvest. “This nihilistic ‘scorched earth’ fallback is new and signals the author’s willingness to cause irreversible damage,” notes Ontinue. Such behavior has traditionally been associated with nation state political motivations. This is widening. It is no longer government against government: targets now include civilian entities while attackers include politically motivated citizens as well as elite nation state actors. Ontinue quotes three examples: North Korea’s Lazarus Group $1.5B cryptocurrency theft; wiper attacks targeting Polish civilian infrastructure by Ghost Blizzard; and record-setting DDoS activity peaking at 31.4 Tbps via botnets with more than 500,000 IPs. There is little sign that geopolitically motivated attacks are likely to decrease in the immediate future – they are more likely to increase. Prompted by the US/Israel war against Iran, Iranian actors used wipers in the attack against Stryker earlier this year. The base of this inverted pyramid of malicious activity is occupied by infostealers fueling the activity. Infostealers are a successful tool for malicious actors. They use social engineering to get installed. Industry is yet to find a successful method to prevent social engineering, so it is unlikely that we will be able to stop infostealers. The implication is organizations should assume that attackers have or will obtain legitimate identities to use in their attacks. This means that more energy must be applied to recognizing and blocking the misuse of credentials while in use rather than simply trying to prevent their theft. “To combat today’s new era of threats, driven by the force multiplier of AI, we need to embrace a new approach of adaptive identity,” says Mark McClain, CEO at SailPoint. “Modern identity tools need to be able to discern between regular user activity and abnormal activity, and grant – or deny – access accordingly. Every access decision is driven by who or what the identity is, the context of the data they touch, and the security signals surrounding them. By unifying identity, security, and data contexts, businesses can make real-time decisions to mitigate risk without disrupting operations.” Ontinue summarizes this. “The organizations that will succeed in this new landscape will not necessarily be those with the strongest perimeters, but those that rethink how security is applied across identity. This means treating identity as the core control plane, monitoring authentication activity as closely as endpoint behavior, and securing both human and non-human identities with equal rigor.” Related: AI Speeds Attacks, But Identity Remains Cybersecurity’s Weakest Link Related: Iran Readied Cyberattack Capabilities for Response Prior to Epic Fury Related: Shadow AI Risk: How SaaS Apps Are Quietly Enabling Massive Breaches Related: 136 NPM Packages Delivering Infostealers Downloaded 100,000 Times

securityweek.comMar 31, 2026extracted

RSAC 2026 Conference Announcements Summary (Day 2)

As hundreds of vendors descend on San Francisco for the RSAC 2026 Conference, the sheer volume of news can be overwhelming. To help you navigate the noise, SecurityWeek is providing a daily digest of the most significant announcements. Below is our curated roundup of essential product and service updates, along with reports from the second day of the event. Roundups of announcements from day 1 and the days leading up to the conference are also available. Offensive security firm Assail has launched Ares, an autonomous red-teaming platform designed to discover, chain, and exploit vulnerabilities across APIs, mobile applications, and web applications. Ares is a self-healing, self-teaching platform that autonomously adapts attack strategies in real time and requires no hands-on expertise to manage. BlackCloak has released three new capabilities for its Digital Executive Protection platform. Impersonation Protection, now enhanced with device-level biometric validation and geolocation signals, lets BlackCloak members authenticate the legitimacy of communications from other members in real time via the mobile app. Search Suppression complements the existing Data Broker Removal service by automatically suppressing a member’s PII from search engine results while broker removal requests are still being processed. Member Travel Advisory (coming this spring) delivers AI-synthesized, continuously updated risk analysis across cybersecurity, physical, geopolitical, and social dimensions for every country directly within the app. ConductorOne announced a new integration with CrowdStrike Falcon Next-Gen Identity Security that feeds live threat signals drawn from real-time detections, behavioral analytics, and threat intelligence directly into ConductorOne’s access governance workflows. Security teams can filter and prioritize high-risk identities during access reviews and approval decisions based on real-time activity, rather than risk scores. ConductorOne’s policy engine can also use those Falcon signals to automate responses and trigger a review, deny access, or revoke entitlements the moment risk levels shift. Cyera has introduced a new suite of capabilities, including Browser Shield for AI and Data Lineage, to provide real-time visibility into how employees and autonomous agents interact with sensitive data. Browser Shield prevents data exposure at the prompt level within public AI models, while the Data Lineage tool automatically maps how agents move and transform files across their lifecycle. Additionally, the new Cyera MCP allows security teams to build their own data security agents to automate threat hunting and risk remediation using plain-language queries. CrowdStrike launches cloud security innovations, Falcon Data Security, Agentic MDR CrowdStrike announced new Falcon Cloud Security enhancements to help eliminate cloud risk through adversary-informed prioritization. Organizations can identify cloud exposures most likely to be exploited and their root causes, enabling faster remediation. CrowdStrike also introduced Falcon Data Security, a new data security solution that stops data theft across the agentic enterprise. Falcon Data Security discovers, classifies, and stops data theft in real time. The security giant also unveiled Agentic MDR for managed detection and response. Falcon Complete’s analysts build and deploy intelligent agents to automate high-friction security workflows and stop breaches. Darktrace launches adaptive security awareness training and introduces MSSP offering Darktrace has announced Adaptive Human Defense, which replaces scheduled security awareness training with behavioral AI-driven micro-coaching sessions delivered in real time as risks appear in a user’s inbox. Darktrace also unveiled an expansion of Darktrace / EMAIL to include full-message, cross-channel analysis across email, Microsoft Teams, Slack, and Zoom, enabling detection of blended social engineering campaigns across all four platforms, including prompt-injection threats targeting corporate AI assistants. The company also announced a new managed email security offering for MSSPs, built on Darktrace / EMAIL’s Self-Learning AI. Drata has released three new agentic AI capabilities for its trust management platform. The first, Agentic TPRM Assessment (now generally available), automates vendor security reviews by autonomously accessing live evidence from Drata Trust Centers, evaluating controls against defined criteria, and generating findings, follow-ups, and executive reports. The second, Agentic Questionnaire Response (in beta), manages the full security questionnaire lifecycle from intake and drafting to SME collaboration and final delivery, with configurable human-in-the-loop controls. The third, AI Trust Center Creation, ingests a customer’s existing artifacts and quickly auto-generates a complete Trust Center preview. Eclypsium has released the Eclypsium Supply Chain Security Platform version 4.3. The latest version of the platform provides continuous monitoring of network edge devices for vulnerabilities, indicators of compromise, and unknown binaries that may harbor vulnerabilities and custom malware introduced via the IT supply chain. GC Cybersecurity has unveiled its 5th generation Autonomous Data Protection Platform. The new ISE Autonomous Data Protection Platform is designed to address the growing risk of sensitive data exposure across AI, cloud, and SaaS environments. Powered by agentic AI and a 5th generation cybersecurity architecture, the platform continuously discovers, classifies, and protects data in real time, going beyond traditional perimeter-based defenses. Hadrian has released Nova, an agentic pentesting product that autonomously simulates offensive techniques against an organization’s external attack surface, including chaining vulnerabilities and escalating access across real assets. Testing is customer-scoped and repeatable on demand, with findings reviewed by human experts before delivery. Nova is priced per test and is available immediately. KnowBe4 launches phishing alert button for Microsoft Teams and expands platform KnowBe4 is extending its one-click Phish Alert Button (PAB) to Microsoft Teams, allowing users to report suspicious messages directly within the collaboration platform. The integration enables security teams to manage threats from both email and Teams within a single, streamlined workflow. KnowBe4 also expanded its Artificial Intelligence Defense Agents (AIDA) platform with deepfake training agents that generate custom, high-fidelity deepfake simulations featuring an organization’s own leaders to train employees on how to spot AI-generated impersonations. Living Security announced the general availability of its AI-native Human Risk Management platform. Powered by the Livvy AI risk intelligence engine, the platform is designed to secure the “hybrid workforce” — both human employees and AI agents operating across enterprise systems. The platform analyzes behavioral signals across the workforce to identify risk, explain why it matters, and guide remediation before incidents occur. Huntress has expanded its Managed Identity Threat Detection & Response (ITDR) product to cover Google Workspace, adding to its existing Microsoft 365 coverage. The solution detects anomalous authentication activity, attacker-created Gmail inbox rules designed to suppress MFA notifications or hide security alerts, and logins from data center providers commonly associated with threat actors. iCOUNTER announced the general availability of its Counter Threat Operating System (CTOS), a new platform designed to introduce “compromise intelligence” as a control layer for third-party risk. The initial release includes CTOS-TPR, which detects early-stage adversary activity such as reconnaissance and targeting aimed at vendors and partners. By continuously monitoring threat activity and mapping it against an organization’s extended ecosystem, CTOS enables companies to identify and act on risks before they lead to breaches. Miggo is expanding its Runtime Defense Platform to protect AI and agentic environments, with new capabilities including AI-BOM, runtime guardrails and agentic detection and response. It tackles the fact that agents are making decisions dynamically at runtime, so security teams need visibility and protection where models, tools and data actually interact. The enhancement gives security teams visibility and control over AI agents, MCP toolchains and Shadow AI running in production. NetRise launched Provenance, a new product that identifies risk associated with contributors to the open source components inside enterprise software and connected devices. Provenance adds a layer of trust and intelligence to the NetRise Platform, enabling teams to see a variety of project health signals, including advisory relationships and how compromises propagate through dependency graphs, defining a blast radius from a malicious contributor. Novee has launched autonomous AI red teaming for LLM applications, designed to uncover flaws in chatbots, copilots, and agents. It tests for real AI-specific attack paths such as prompt injection, jailbreaks and agent manipulation rather than relying on traditional appsec approaches that were not built for AI behavior. Nudge Security adds new AI agent discovery capabilities Nudge Security announced an expansion of its platform with the addition of AI agent discovery, enabling customers to gain immediate visibility and control over agent identity and permissions. The new capabilities discover AI agents at the source of creation, understand their access risks, and engage their human creators to gain additional context regarding the scope of use for each agent. RSA has announced expanded integration with Microsoft, adding support for the new Microsoft 365 E7: The Frontier Suite through RSA ID Plus for Microsoft, which provides authentication for both human users and AI agents across hybrid, cloud, and on-premises environments. Separately, RSA announced several new passwordless enhancements: a next-generation desktop passwordless client for macOS and Windows, enhanced mobile passkeys with proximity verification, and datacenter passwordless support for Linux and other OS servers. Sectigo has introduced the Sectigo Partner Platform (SPP), a multi-tenant CLM platform designed for MSPs, MSSPs, VARs, and distributors. Unlike single-tenant alternatives, SPP gives each end customer a fully isolated tenant with separate certificate inventories, usage reporting, billing, and admin controls, all managed through a single partner interface. The platform integrates with Sectigo Certificate Manager (SCM) and automates certificate validation, issuance, and renewal workflows. SPP is currently available to a limited number of channel partners, with broader rollout planned. SentinelOne and LevelBlue are combining SentinelOne’s Purple AI and Singularity Platform with LevelBlue’s threat intelligence and Indigo platform to give organizations a unified, AI-powered security operations model, covering MDR, managed SIEM, and incident response in one place. The goal is to reduce dwell time and fragmentation that make most enterprise security stacks hard to manage. Sentra announced a new solution to help organizations securely adopt Google Workspace with Gemini by addressing key AI adoption risks. The platform tackles four core risks: shadow and unused sensitive data, over-permissioning, incorrect or missing labels, and data leakage through AI-generated outputs, using in-place discovery, classification and automated labeling. These capabilities give organizations the visibility and controls needed to maintain data governance, compliance and cost efficiency while preparing for AI. Skyhawk Security has introduced a new Threat Actor Context capability that maps simulated cloud attack scenarios to known adversary tradecraft, campaigns and CVEs. The product enhancement was built for prioritization. It gives security teams more context on which attack paths are most relevant based on real-world threat activity, helping them focus on the true risks to critical assets. Tenable has introduced Hexa AI, an agentic AI engine within the Tenable One platform that automates security workflows and transforms exposure intelligence into coordinated action. Hexa AI helps security teams prioritize and remediate risk at machine speed across IT, cloud, identity and AI environments. By leveraging Tenable’s Exposure Data Fabric, the platform enables organizations to move from reactive response to proactive, continuous risk reduction. Vectra AI has expanded its platform with three new exposure management capabilities. The first is a passive, agentless continuous asset inventory that automatically discovers and tracks unmanaged, OT, and IoT devices across hybrid environments. The second is proactive exposure detection, which identifies observed security and compliance gaps such as risky protocol usage, weak encryption patterns, and exposed credential files. The third is environment observability, providing network-wide visibility into PQC readiness, Zero Trust posture, data movement, and network performance. Zscaler publishes threat research and announces new integrations Zscaler has published its Threatlabz 2026 VPN Risk Report, which shows that 51% of organizations experienced a VPN-related security incident in the past 12 months. The study also found that only 5% trust their VPN infrastructure to detect and stop AI-enabled threats, and only 6% of organizations can deploy a critical VPN patch within 24 hours. Zscaler also announced that it’s now part of Databricks’ new Open Security Lakehouse Ecosystem, which unifies all structured and unstructured security data into a single platform that integrates with any tool to enable social engineering detection, insider threat detection, and anomaly detection.

securityweek.comMar 25, 2026extracted

Darktrace expands MSSP offering with AI-driven managed email security

Darktrace expands MSSP offering with AI-driven managed email security Darktrace has launched its managed security service for MSSPs, enabling partners to deliver AI-native email security with real-time detection, investigation, and response across the email ecosystem. The launch is supported by updates to the Darktrace Defenders Partner Program designed to provide flexibility and scalability for partners at every stage of their services maturity, helping them expand security offerings and deliver AI-native protection to customers around the world. Email threats continue to grow in sophistication as attackers leverage generative AI to craft more convincing and personalized social engineering campaigns. Analysis of 32 million phishing emails detected across Darktrace’s global customer fleet in 2025 shows AI-assisted phishing techniques increased from 32% to 38% year-over-year, highlighting a shift toward longer, more targeted attacks designed to evade traditional defenses. On average, Darktrace research shows that approximately 17% of email threats bypass Secure Email Gateways but are detected by Darktrace’s AI. As email threats become harder to detect and faster to execute, many organizations, particularly smaller businesses with limited security resources, are increasingly turning to managed security service providers for support, seeking more flexible ways to consume security and the ability to outsource complex operations. MSSPs play a critical role in extending advanced cybersecurity capabilities to these organizations, but protecting multiple customer environments at scale introduces operational challenges as analysts must investigate large volumes of alerts while maintaining consistent detection and response. By enabling MSSP partners to deliver Darktrace-powered protection as a managed service, the new offering helps make enterprise-grade AI email security accessible to a broader range of organizations. “As organizations face increasingly sophisticated and automated cyber threats, security operations must evolve beyond traditional alert monitoring,” said Feras Tappuni, CEO of SecurityHQ, a global managed security service provider. “At SecurityHQ, we focus on engineering security performance for our customers—combining global threat intelligence, advanced AI-driven detection, and human expertise to reduce noise and accelerate response. Technologies like those offered by Darktrace help strengthen that capability by enabling faster detection and deeper investigation across complex environments. By integrating these capabilities into our global security operations, we’re helping organizations improve protection while giving security teams the clarity and confidence they need to respond effectively,” Tappuni continued. To help MSSPs meet this growing demand while maintaining effective protection at scale, Darktrace today introduces a new AI-native managed email security capability built on its industry-leading Darktrace / EMAIL solution, extending protection across the entire email ecosystem, collaboration platforms like Microsoft Teams, identities, and sensitive data. Darktrace / EMAIL has been widely recognized as a leading email security solution, including being named a Leader in the 2025 Gartner® Magic Quadrant for Email Security Platforms and a 2025 Gartner Peer Insights Customers’ Choice for Email Security Platforms. Introducing AI-native managed email protection Darktrace’s new managed email security offering enables MSSPs to deliver AI-native protection across email, collaboration platforms, and user identities powered by Self-Learning AI, which continuously learns the normal communication patterns of every user and organization it protects. Instead of relying on traditional static rules or lists, the system dynamically adapts to each environment, identifying subtle behavioral anomalies that may signal early-stage threats such as phishing, business email compromise (BEC), or account takeover (ATO). The service allows partners to deliver Darktrace’s advanced messaging and identity security capabilities, including AI-driven threat detection across email, Microsoft Teams, and user identities, integrated data loss prevention (DLP) and DMARC monitoring to prevent sensitive data loss and domain impersonation, as well as behavior-driven security training with Darktrace / Adaptive Human Defense. Together, these capabilities detect and contain advanced threats, prevent data exfiltration, stop spoofing and impersonation attacks, and strengthen user resilience against social engineering. Through this MSSP-ready model, partners can: Deliver continuous, real-time detection and containment of advanced email threats Automate investigation and prioritization with AI to reduce manual triage Maintain consistent protection across multiple customer environments “As a longstanding Darktrace customer and partner, we’ve seen firsthand how effective its AI-driven approach can be in stopping advanced threats,” said Bob Keblusek, Chief Innovation and Technology Officer at Sentinel Technologies, a premier IT services provider and industry leading MSSP. “Darktrace has consistently pushed the boundaries of innovation in cybersecurity, delivering solutions that provide real, long-term value for organizations. That track record made it a natural fit to build a managed security practice around their technology. With this new managed services model, we’re able to bring Darktrace’s advanced capabilities to more customers, helping them strengthen protection against evolving threats while reducing operational burden,” Keblusek added. To support partners operating across multiple customer environments and enable service delivery at scale, Darktrace has also introduced enhancements to its ActiveAI Security Portal, which unifies control, configuration, and visibility across all Darktrace deployments. The newly introduced SOC Alert Triage Dashboard provides multi-tenant visibility and AI-driven alert investigation and triage across multiple customer environments. The portal enables analysts to investigate incidents, manage workloads, and coordinate response across clients from a single interface, helping service providers streamline SOC operations and accelerate response times. “Customers today prioritize outcomes over additional standalone security tools,” said Mathias Schick, Business Manager Security at Bechtle. “Especially in the mid-market, organizations often lack the capacity, both financially and operationally, to manage complex security environments themselves. By integrating Darktrace’s technology into our managed services portfolio, we can deliver a complete, automated security offering that reduces friction for customers while strengthening protection against increasingly sophisticated threats.” Expanding the Darktrace Defenders Partner Program Darktrace is expanding support for MSSPs within the Darktrace Defenders Partner Program, providing partners with greater flexibility to build and scale security services. The program introduces a flexible framework designed around partner needs, allowing organizations to engage as resellers, service providers, or fully managed security providers. Key features of the program include: Flexible commercial models designed for MSSP business structures Scalable deployment paths that accelerate time-to-value Co-selling, enablement, and go-to-market support to help partners expand services Unified management capabilities that simplify operations across customer environments This flexible model allows partners to grow their services business at their own pace while unlocking new recurring revenue opportunities. “Our partners are at the forefront of helping organizations defend against increasingly sophisticated cyber threats,” said Dan Monahan, Chief Partner Officer, Darktrace. “By expanding MSSP capabilities within the Darktrace Defenders Partner Program and introducing AI-native email security services, we’re enabling partners to bring innovative AI-powered protection to market as managed services, helping them protect customers, scale their operations, and unlock new revenue opportunities.”

helpnetsecurity.comMar 24, 2026extracted

Darktrace Flags 32 Million Phishing Emails in 2025 as Identity Attacks Intensify

More than 32 million high-confidence phishing emails were detected by Darktrace in 2025, showcasing a substantial escalation in identity-driven cyber threats. The data was collected by Darktrace from incidents across its global customer base and points to a year defined by automation, convergence and accelerating attacker speed. Over 8.2 million phishing emails targeted VIPs, accounting for more than 25% of all observed phishing attempts. Meanwhile, 1.6 million phishing emails originated from newly created domains and 1.2 million incorporated malicious QR codes. Notably, 70% of phishing emails successfully passed DMARC authentication, 41% were classified as spear-phishing and 38% contained novel social engineering techniques. One-third exceeded 1000 characters. Identity Compromise Dominant Entry Vector The Darktrace report also showed how identity compromise has overtaken vulnerability exploitation as the dominant entry vector. Common Vulnerabilities and Exposures (CVE) increased by approximately 20% year-on-year (YoY), with exploitation often occurring before public disclosure. "Identity has become the attacker's skeleton key. Instead of forcing their way through a firewall, adversaries are logging in with stolen credentials, hijacked tokens and abused permissions, then moving laterally under the cover of legitimacy," commented Shane Barney, CISO at Keeper Security. "When identity controls are fragmented or overly permissive, attackers don't need novel exploits. They just need access that looks routine." Across the Americas, SaaS and Microsoft 365 account takeovers accounted for nearly 70% of incidents. Manufacturing represented 17% of recorded cases and 29% of ransomware incidents in the region. About 47% of all global security events tracked by Darktrace in 2025 originated in the Americas alone. Regional and Sector Trends Reveal Expanding Attack Surface The Darktrace report also highlighted how regional patterns reflect differing levels of digital maturity and geopolitical pressure. In Latin America, 44% of cases involved malware spreading after credential theft or phishing. Education was the most impacted sector at 18%, with Brazil, Mexico and Colombia reporting the highest volumes over the past three years. Europe recorded 58% of incidents linked to cloud and email compromise, compared with 42% involving network-based attacks. Meanwhile, Africa experienced a 60% YoY rise in ransomware and saw 76% of compromises classified as network-based. In Asia-Pacific and Japan, 84% of organizations said AI-powered threats are already impacting them, yet only 42% reported having formal policies governing safe AI use. "Identity is no longer about perimeter-based defense. The rise in AI-based agents and the massively accelerating threat landscape has rendered that approach inadequate, and prompted a shift towards identity as the critical element to enterprise security," SailPoint CEO, Mark McClain, said. "This report's findings demonstrate that there is now a need for real-time, intelligent, and dynamic identity security, built to govern and secure not just 'who,' or in the case of AI agents, 'what,' has access to the enterprise, but what data they can access and what they are able to do once inside." Additional findings, regional breakdowns and sector-specific analysis from the report are available on Darktrace's website.

infosecurity-magazine.comFeb 26, 2026extracted

Wormable XMRig Campaign Uses BYOVD Exploit and Time-Based Logic Bomb

Cybersecurity researchers have disclosed details of a new cryptojacking campaign that uses pirated software bundles as lures to deploy a bespoke XMRig miner program on compromised hosts. "Analysis of the recovered dropper, persistence triggers, and mining payload reveals a sophisticated, multi-stage infection prioritizing maximum cryptocurrency mining hashrate, often destabilizing the victim system," Trellix researcher Aswath A said in a technical report published last week. "Furthermore, the malware exhibits worm-like capabilities, spreading across external storage devices, enabling lateral movement even in air-gapped environments." The entry point of the attack is the use of social engineering decoys, advertising free premium software in the form of pirated software bundles, such as installers for office productivity suites, to trick unsuspecting users into downloading malware-laced executables. The binary acts as the central nervous system of the infection, serving different roles as an installer, watchdog, payload manager, and cleaner to oversee different aspects of the attack lifecycle. It features a modular design that separates the monitoring features from the core payloads responsible for cryptocurrency mining, privilege escalation, and persistence if it's terminated. This flexibility, or mode switching, is achieved via command-line arguments - No parameter, for environment validation and migration during the early installation phase. 002 Re:0, for dropping the main payloads, starting the miner, and entering a monitoring loop. 016, for restarting the miner process if it's killed. barusu, for initiating a self-destruct sequence by terminating all malware components and deleting files. Present within the malware is a logic bomb that operates by retrieving the local system time and comparing it against a predefined timestamp - If it's before December 23, 2025, the malware proceeds with installing the persistence modules and launching the miner. If it's after December 23, 2025, the binary is launched with the "barusu" argument, resulting in a "controlled decommissioning" of the infection. The hard deadline of December 23, 2025, indicates that the campaign was designed to run indefinitely on compromised systems, with the date likely either signaling the expiration of rented command-and-control (C2) infrastructure, a predicted shift in the cryptocurrency market, or a planned move to a new malware variant, Trellix said. In the case of the standard infection routine, the binary – which acts as a "self-contained carrier" for all malicious payloads – writes the different components to disk, including a legitimate Windows Telemetry service executable that's used to sideload the miner DLL. Also dropped are files to ensure persistence, terminate security tools, and execute the miner with elevated privileges by using a legitimate but flawed driver ("WinRing0x64.sys") as part of a technique called bring your own vulnerable driver (BYOVD). The driver is susceptible to a vulnerability tracked as CVE-2020-14979 (CVSS score: 7.8) that allows privilege escalation. The integration of this exploit into the XMRig miner is to have greater control over the CPU's low-level configuration and boost the mining performance (i.e., the RandomX hashrate) by 15% to 50%. "A distinguishing feature of this XMRig variant is its aggressive propagation capability," Trellix said. "It does not rely solely on the user downloading the dropper; it actively attempts to spread to other systems via removable media. This transforms the malware from a simple Trojan into a worm." Evidence shows that the mining activity took place, albeit sporadically, throughout November 2025, before spiking on December 8, 2025. "This campaign serves as a potent reminder that commodity malware continues to innovate," the cybersecurity company concluded. "By chaining together social engineering, legitimate software masquerades, worm-like propagation, and kernel-level exploitation, the attackers have created a resilient and highly efficient botnet." The disclosure comes as Darktrace said it identified a malware artifact likely generated using a large language model (LLM) that exploits the React2Shell vulnerability (CVE-2025-55182, CVSS score: 10.0) to download a Python toolkit, which leverages the access to drop an XMRig miner by running a shell command. "While the amount of money generated by the attacker in this case is relatively low, and cryptomining is far from a new technique, this campaign is proof that AI-based LLMs have made cybercrime more accessible than ever," researchers Nathaniel Bill and Nathaniel Jones said. "A single prompting session with a model was sufficient for this attacker to generate a functioning exploit framework and compromise more than ninety hosts, demonstrating that the operational value of AI for adversaries should not be underestimated." Attackers have also been putting to use a toolkit dubbed ILOVEPOOP to scan for exposed systems still vulnerable to React2Shell, likely in an effort to lay the groundwork for future attacks, according to WhoisXML API. The probing activity has particularly targeted government, defense, finance, and industrial organizations in the U.S. "What makes ILOVEPOOP unusual is a mismatch between how it was built and how it was used," said Alex Ronquillo, vice president of product at WhoisXML API. "The code itself reflects expert-level knowledge of React Server Components internals and employs attack techniques not found in any other documented React2Shell kit." "But the people deploying it made basic operational mistakes when interacting with WhoisXML API's honeypot monitoring systems – errors that a sophisticated attacker would normally avoid. In practical terms, this gap points to a division of labor." "We might be looking at two different groups: one that built the tool and one that's using it. We see this pattern in state-sponsored operations – a capable team develops the tooling, then hands it off to operators who run mass scanning campaigns. The operators don't need to understand how the tool works – they just need to run it."

thehackernews.comFeb 23, 2026extracted

Cyber Insights 2026: The Ongoing Fight to Secure Industrial Control Systems

The cybersecurity challenge for Industrial Control Systems (ICS) is they were designed in conditions of peace but now operate in a continuous war zone. Bryson Bort, CEO and founder at SCYTHE, starts his conversations on ICS security with a joke: ‘How can you tell a computer is an ICS?… It’s at least 20 years old.’ The purpose is not to elicit laughter but to make people think. “Once the humor passes and the reality sets in, the scale of the problem – an entrenched ecosystem with the inertia of security challenges baked in for years – becomes apparent..” The continuing problem for securing ICS This is the biggest problem for ICS security. “Something that was designed and tested to the best practices available when it was released can easily become vulnerable to attacks using more sophisticated attacks later in its lifecycle,” explains Tim Mackey, head of software supply chain risk strategy at Black Duck. “In effect, legacy best practices may not be up to the task of mitigating current threats; or worse – those that might be deployed in the coming years.” ICS are vulnerable. This is exacerbated by the operators’ reluctance, if not inability, to take the systems off-line to patch any vulnerabilities. Dario Perfettibile, VP and GM of European operations at Kiteworks, expands, “ICS security problems will unfortunately persist in 2026 because the core challenge is both economic and operational. Critical infrastructure operators simply cannot accept downtime for comprehensive overhauls, and legacy systems with 20- to 30-year lifespans weren’t designed for today’s cyber threats.” Mackey continues, “Attackers know that critical infrastructure providers are measured in their up-time or service availability; so, once a device is compromised, the attackers have the luxury of mapping out and planning a very targeted attack rather than just being opportunistic.” Industrial Control Systems were built for reliability and safety, not cybersecurity; and their weaknesses are persistent. “Many devices still rely on outdated protocols without authentication, flat network architectures, and long hardware lifecycles that make patching or replacement difficult,” says Jeff Macre, principal OT security solutions architect at Darktrace. “These challenges are compounded by limited visibility into assets and the operational risks of downtime, so the fundamental security problems in ICS environments will persist well into the future.” This is the challenge for both industry and society – the critical industries we depend upon, themselves depend upon some of the most vulnerable computer systems. Cyberattacks against ICS Both nation states and cybercriminals target ICS: the former for political expediency and the latter for financial extortion. “The critical infrastructure (CI) has become a strategic target as nation states and criminal groups both understand its value and vulnerability,” comments Raed Albuliwi, CPO at Xona. The need to keep ICS operational makes it more susceptible to ransomware from criminals, while taking down areas of the critical infrastructure can adversely affect public sentiment and disrupt society for political purposes. Elite nation state actors also breach and quietly occupy critical industries – a process known as pre-positioning – so they can neutralize the CI in rapid order either in response to, or preparation for, kinetic warfare. Michael Freeman, head of threat intelligence at Armis, warns, “By 2026, more than a third of global energy and utilities infrastructure will have experienced cyber pre-positioning activity – quiet access, data collection, and operational mapping by both human and AI-assisted adversaries.” Gary Schwartz, go-to-market lead at NetRise, adds, “State-aligned actors increasingly prioritize pre-positioning during periods of relative calm by infiltrating software supply chains that feed into network infrastructure. These footholds may appear benign today: simple reconnaissance, credential harvesting, mapping. But in a geopolitical crisis, the same access can be rapidly weaponized to disrupt industrial operations.” The fusion of IT, OT and IoT exposes every sector of the CI to new attack vectors. “Attackers could weaponize ‘smart city’ systems or exploit minor IoT devices as entry points, and then laterally move into core operational networks to cause physical damage or service outages,” says Alex Mosher, president and CRO at Armis. “Agriculture, transportation, healthcare, and energy grids will face cyber sabotage designed to disrupt essential services rather than steal information.” Joe Saunders, founder and CEO at RunSafe Security, notes that artificial intelligence (AI) is powered by vast amounts of electricity. “The surge in demand will bring renewed attention to the resilience of ICS and SCADA environments that power energy production, transmission, and data center operations.” He continues, “Greater dependency on the energy grid and data centers gives adversaries more incentive to target industrial systems for both disruption and leverage, as the consequences of an attack will be much higher. Securing these environments will move from a technical challenge to a national security imperative.” The ICS stakes can be very high. Consider, for example, the November 2025 announcement that the UK plans to build Small Modular Reactors (SMRs) in Wales. “The ICS systems in the SMRs will undoubtedly be computer controlled, and internet connected – massively increasing the threat landscape,” suggests Jeremy Epstein, security co-chair of the ACM US technology policy committee, and principal research scientist at Georgia Tech Research Institute. “Nation-state adversaries and terrorists can be expected to be monitoring the progress of SMRs in the UK, US, and everywhere else, developing new types of attacks. And whatever gets installed will probably be there for 30-50 years, the lifecycle of a nuclear power plant.” The current nation state situation will get worse. “Attacks will demonstrably increase as geopolitical tensions worsen. Russia’s Ukrainian power grid attacks and Chinese reconnaissance of U.S. water systems establish ICS as legitimate targets,” comments Perfettibile. “Geopolitical conflicts are fueling a surge in OT/ICS attacks,” adds Vikesh Khanna, CTO and co-founder at Ambient.ai. “State-sponsored actors and hacktivists target critical infrastructure for disruption, as seen in DDoS campaigns, ransomware, and even physical sabotage attempts. This convergence of cyberwarfare and geopolitics heightens risks.” Macre adds, “We’re already seeing more OT‑focused malware and ransomware linked to geopolitical conflict. For example, VoltRuptor is a sophisticated ICS/SCADA malware developed by the Infrastructure Destruction Squad, featuring multi-protocol support, persistence, and anti-forensics capabilities. It has been deployed in attacks against critical infrastructure and is sold on dark web forums. Analysts believe it is aligned with state-sponsored campaigns targeting countries that aren’t either pro-Russia or China, making it a significant geopolitical cyber threat.” Bort believes, “Ransomware will continue to increase. The asymmetric advantages of these kinds of cyberattacks will continue to increase.” It is often difficult to accurately attribute ransomware to criminals, state actors or a mix of the two since disruption could be the result of criminal activity or the purpose of state actors. Cyble reported it observed ‘a staggering 5,967 (ransomware) attacks globally in 2025’, with many of these targeting critical industries. Andrew Lintell, GM for EMEA at Claroty, adds, “With 12% of OT devices expected to carry known exploitable vulnerabilities (KEVs) and 7% linked to ransomware campaigns, industrial cybersecurity will need to be treated as a continuous operational priority.” ICS is a nut caught between cybercriminals and state actors, and between them it will increasingly be targeted and cracked in the coming years. ICS in 2026 and beyond The overriding belief is that ICS will seek and require greater resilience in 2026, although Trevor Dearing, Director of critical infrastructure at Illumio stresses the need to go further into ‘anti-fragility’, “Aiming not just to withstand attacks, but to emerge stronger from them… It’s not just about recovery, it’s about adaptation, learning, and improvement.” Since the primary cause of ICS problems is the longevity of the hardware, the most obvious solution would be to rip them out and replace them with modern, more secure systems. Although replacement may happen gradually over time, this is not considered a short term solution. “Many ICS assets are designed for 10‑ to 20‑year lifecycles, and replacing them outright is rarely cost‑effective. The equipment itself is expensive, and new components often have interoperability challenges with existing systems. Mixing old and new technologies can introduce more risk than it solves,” explains Macre. Khanna comments, “Practical and financial hurdles like downtime, compatibility, and high costs (often millions per site) slow progress, particularly when factoring in physical retrofits.” Saunders adds, “The economic and operational barriers to replacement are simply too high. Gradual modernization will happen over time, but resilience has to start now, with cybersecurity that protects existing assets while the industry transitions.” As a result, improvements to security will need to co-exist with aging hardware. “Industrial systems and critical infrastructure are entering a new era of hybrid automation. Modern controllers, robots, and automation software are making real-time decisions alongside decades-old, legacy equipment,” says Anusha Iyer, Founder and CEO at Corsha. Modern security must be added to ICS hardware without interfering with its operational priorities. This will most likely be achieved by modern security controls assisted by artificial intelligence to achieve a degree of automation – and will focus on introducing zero trust principles. “Automation provides a great opportunity for enterprises to optimize and gain efficiencies but also adds complexity and risk. Taking an identity-centric approach to controlling connections and managing risk creates a shared foundation for visibility, trust, and governance across digital and operational domains,” continues Iyer. Understanding and reducing the identity attack surface should be critical thinking for every organization, says James Maude, field CTO at BeyondTrust. “Organizations need to think about how to securely manage privileged access into their critical environments. Ensuring that employees, vendors, and 3rd parties have just the access and permissions needed to do their job without additional risk exposure. This can be combined with real time monitoring and controls to audit and terminate access in the event of identity compromise.” Brian Reed, CMO at Corsha, says “Automated machine identity with continuous authentication establishes that control layer in a way that is simple to deploy, simple to manage, and easy to scale as systems grow.” Identity management is key to any zero trust approach. “The C-Suite, CISOs, and CSOs need to look beyond siloed views of obviously privileged identities in individual systems and take a holistic view of the combinations of privileges, entitlements and roles that could be exploited by an attacker to elevate privilege, move laterally and inflict damage,” continues Maude. The identity security debt accumulated by many organizations represents a greater risk than any other area since it only takes one attacker to login with the right identity and all is lost because of the available paths to privilege. Schwartz comments on the growing adoption of OT-aware zero trust. “Carnegie Mellon’s Software Engineering Institute, Emerson, and Control Engineering have all published guidance showing how zero trust can be adapted to ICS using authenticated engineering actions, granular segmentation, and tightly governed remote access. This reflects the reality that supply-chain compromise is often inevitable, so access must be constrained even for trusted components.” He adds that SBOMs and vendor transparency are becoming essential. “Supply-chain failures like Log4Shell and XZ Utils demonstrated that operators need visibility into what’s inside their controllers and software stacks. None of these approaches solve everything, but collectively they move ICS toward a more verifiable, trustworthy ecosystem that’s harder to compromise at the source and easier to defend in practice.” Segmentation is an important part of the path to resiliency through zero trust. Agnidipta Sarkar, chief evangelist at ColorTokens, has two recommendations for resilience. The first is microsegmentation. It prevents an attacker using lateral movement to reach the ‘ICS islands of excellence’. The second is to prevent credential misuse “by using cryptographic passwordless authentication. Both approaches are fundamental to adopting zero trust for cyber resilience,” he suggests. Carlos Buenano, CTO for operational technology at Armis, believes that CTEM will become the operational center of gravity. “A few years ago, CTEM (continuous threat exposure management) was just another Gartner acronym. In 2026, it’s the organizing principle for any serious OT security program.” He explains, “CTEM represents a shift from periodic vulnerability management to continuous, risk-based exposure assessment and management across hardware, firmware, network paths, and even supply-chain dependencies. But the key difference this year is context. We’re no longer prioritizing based on CVSS scores alone. Instead, we’re aligning exposures with what actually matters; the physical process, the human safety implications, and the potential operational impact.” AI is increasingly included to add speed and efficiency to security controls. Agentic AI offers enormous potential for autonomous action in the future, but the extent to which it may safely be introduced into the ICS ecosphere is unclear and likely to be very slow. However, it has already arrived within ICS physical security. “A key innovation is agentic physical security for proactive threat prevention,” comments Ambient.ai’s Khanna. Such platforms can leverage AI agents to monitor physical spaces in real-time, detecting anomalies such as unauthorized access attempts or suspicious behavior near ICS assets. AI-driven anomaly detection is another recommended use of AI. “It could detect anomalies like unauthorized access attempts or suspicious behavior near ICS assets,” suggests Khanna. “This integrates seamlessly with ICS for holistic monitoring, combining computer vision with access control systems to verify identities and prevent breaches before they escalate. Adaptive protections using ML for real-time encryption and threat response are game-changers, especially when layered with physical barriers and AI-verified access.” Darktrace’s Macre adds, “Passive anomaly detection is safe for fragile ICS networks, and AI can take it further by learning what ‘normal’ looks like for each unique environment. That means fewer false positives and more actionable insights – which is critical for teams who are drowning in ‘noise’. When paired with autonomous response, organizations can stop threats in real time, while still keeping humans in the loop when needed.” However, NetRise’s Schwartz warns, “Its value is often overstated. It can highlight unusual network traffic, suspicious engineering actions, or deviations in process behavior, providing a spotlight on activity that operators might otherwise miss. But anomaly detection only sees what happens after a compromise manifests on the network. It does little to address the deeper software supply-chain risks that now dominate ICS intrusions.” He continues, “Real resilience comes from combining behavioral monitoring with pre-deployment assurance: examining the code that runs on devices, validating its integrity, and governing how updates are introduced into the environment. In other words, anomaly detection watches the symptoms; supply-chain analysis addresses the cause.” SCYTHE’s Bort also warns, “The inclusion of AI, or any security tooling, increases risk: think about it, how exactly do these tools work? Most of them depend on internet connectivity for execution or the updates needed to be current. That connectivity increases risk because it increases direct surface area.” But before resilience and recovery can be realized, ICS environments will need two things in 2026. The first will be a more complete and detailed ‘inventory’ of components in the CPS area. Christian Terlecki, Director of Federal at Armis says, “In 2026, Agencies will need continuous CPS discovery and purpose-aware risk scoring. That means the ability to identify controllers, medical devices, industrial controllers, and edge appliances and to understand not just that a device exists, but what its operational role is, where its interconnections lead, and what safe remediation looks like.” In many federal contexts, he continues, “safe remediation won’t be an automatic patch; it will be a compensating micro-segmentation rule, compensating control or a virtual patch applied at the network layer, and the CPS program must support those options with clear, actionable steps.” Sam Maesschalck, lead OT cyber security engineer at Immersive, suggests the second new requirement: “In 2026, the industry will also face increasing pressure to grow and upskill the OT security workforce. Organizations will prioritize hands-on training, scenario-based exercises, and cross-discipline capability building between IT and OT teams. Those that mature fastest will be the ones investing in continuous education, realistic OT lab environments, and workforce development programs rather than relying solely on tools and external consultancies.” So, how do we defend today’s systems? “Through a continually evolving set of defenses, monitoring systems, and responses,” suggests Epstein. “What works in 2025 will certainly not be good enough in 2030, as the threats will continue to advance, and the systems will continue to evolve adding new attack surfaces.” Will AI be the silver bullet? “No,” he continues. “But it can be part of a solution, going beyond anomaly detection. The protection for the water system for Springfield Ohio will be different from the one from Springfield Virginia and all of the dozens of other Springfields around the country – not even including The Simpson’s hometown. Upgrades to address security will be different for each Springfield, and AI systems addressing security will need to be customized for each one.” In the end, he adds, “It’s hard to be a serious cybersecurity expert without being a pessimist. In nearly 40 years in the field, I’ve seen some things get better (for example, we’re much better at building software than we were), but the threats have evolved more rapidly. ICS needs more attention in the form of industry, government, and academic R&D to build and adapt technologies to address rapidly evolving threats.” Related: CISA Warns of ScadaBR Vulnerability After Hacktivist ICS Attack Related: Canada Says Hackers Tampered With ICS at Water Facility, Oil and Gas Firm Related: NIST Publishes Guide for Protecting ICS Against USB-Borne Threats Related: Iranian Hackers’ Preferred ICS Targets Left Open Amid Fresh US Attack Warning

securityweek.comFeb 17, 2026extracted

Microsoft Discloses DNS-Based ClickFix Attack Using Nslookup for Malware Staging

Microsoft has disclosed details of a new version of the ClickFix social engineering tactic in which the attackers trick unsuspecting users into running commands that carry out a Domain Name System (DNS) lookup to retrieve the next-stage payload. Specifically, the attack relies on using the "nslookup" (short for nameserver lookup) command to execute a custom DNS lookup triggered via the Windows Run dialog. ClickFix is an increasingly popular technique that's traditionally delivered via phishing, malvertising, or drive-by download schemes, often redirecting targets to bogus landing pages that host fake CAPTCHA verification or instructions to address a non-existent problem on their computers by running a command either through the Windows Run dialog or the macOS Terminal app. The attack method has become widespread over the past two years since it hinges on the victims infecting their own machines with malware, thereby allowing the threat actors to bypass security controls. The effectiveness of ClickFix has been such that it has spawned several variants, such as FileFix, JackFix, ConsentFix, CrashFix, and GlitchFix. "In the latest DNS-based staging using ClickFix, the initial command runs through cmd.exe and performs a DNS lookup against a hard-coded external DNS server, rather than the system's default resolver," the Microsoft Threat Intelligence team said in a series of posts on X. "The output is filtered to extract the Name: DNS response, which is executed as the second-stage payload." Microsoft said this new variation of ClickFix uses DNS as a "lightweight staging or signaling channel," enabling the threat actor to reach infrastructure under their control, as well as erect a new validation layer before executing the second-stage payload. "Using DNS in this way reduces dependency on traditional web requests and can help blend malicious activity into normal network traffic," the Windows maker added. The downloaded payload subsequently initiates an attack chain that leads to the download of a ZIP archive from an external server ("azwsappdev[.]com"), from which a malicious Python script is extracted and run to conduct reconnaissance, run discovery commands, and drop a Visual Basic Script (VBScript) responsible for launching ModeloRAT, a Python-based remote access trojan previously distributed through CrashFix. To establish persistence, a Windows shortcut (LNK) file pointing to the VBScript is created in the Windows Startup folder so that the malware is automatically launched every time the operating system is started. The disclosure comes as Bitdefender warned of a surge in Lumma Stealer activity, driven by ClickFix-style fake CAPTCHA campaigns that deploy an AutoIt-version of CastleLoader, a malware loader associated with a threat actor codenamed GrayBravo (formerly TAG-150). CastleLoader incorporates checks to determine the presence of virtualization software and specific security programs before decrypting and launching the stealer malware in memory. Outside of ClickFix, websites advertising cracked software and pirated movies serve as bait for CastleLoader-based attack chains, deceiving users into downloading rogue installers or executables masquerading as MP4 media files. Other CastleLoader campaigns have also leveraged websites promising cracked software downloads as a starting point to distribute a fake NSIS installer that also runs obfuscated VBA scripts prior to running the AutoIt script that loads Lumma Stealer. The VBA loader is designed to run scheduled tasks responsible for ensuring persistence. "Despite significant law enforcement disruption efforts in 2025, Lumma Stealer operations continued, demonstrating resilience by rapidly migrating to new hosting providers and adapting alternative loaders and delivery techniques," the Romanian cybersecurity company said. "At the core of many of these campaigns is CastleLoader, which plays a central role in helping LummaStealer spread through delivery chains." Interestingly, one of the domains on CastleLoader's infrastructure ("testdomain123123[.]shop") was flagged as a Lumma Stealer command-and-control (C2), indicating that the operators of the two malware families are either working together or sharing service providers. The majority of Lumma Stealer infections have been recorded in India, followed by France, the U.S., Spain, Germany, Brazil, Mexico, Romania, Italy, and Canada. "The effectiveness of ClickFix lies in its abuse of procedural trust rather than technical vulnerabilities," Bitdefender said. "The instructions resemble troubleshooting steps or verification workarounds that users may have encountered previously. As a result, victims often fail to recognize that they are manually executing arbitrary code on their own system." CastleLoader is not the only loader that's being used to distribute Lumma Stealer. Campaigns observed as early as March 2025 have leveraged another loader dubbed RenEngine Loader, with the malware propagated under the guise of game cheats and pirated software like CorelDRAW graphics editor. In these attacks, the loader makes way for a secondary loader named Hijack Loader, which then deploys Lumma Stealer. According to data from Kaspersky, RenEngine Loader attacks have primarily affected users in Russia, Brazil, Turkey, Spain, Germany, Mexico, Algeria, Egypt, Italy, and France since March 2025. The developments coincide with the emergence of various campaigns using social engineering lures, including ClickFix, to deliver a variety of stealers and malware loaders - A macOS campaign that has used phishing and malvertising ploys to deliver Odyssey Stealer, a rebrand of Poseidon Stealer, which itself is a fork of Atomic macOS Stealer (AMOS). The stealer exfiltrates credentials and data from 203 browser wallet extensions and 18 desktop wallet applications to facilitate cryptocurrency theft. "Beyond credential theft, Odyssey operates as a full remote access trojan," Censys said. "A persistent LaunchDaemon polls the C2 every 60 seconds for commands, supporting arbitrary shell execution, reinfection, and a SOCKS5 proxy for tunneling traffic through victim machines." A ClickFix attack chain targeting Windows systems that uses fake CAPTCHA verification pages on legitimate-but-compromised websites to trick users into executing PowerShell commands that deploy the StealC information stealer. An email phishing campaign that uses a malicious SVG file contained within a password‑protected ZIP archive to instruct the victim to run a PowerShell command using ClickFix, ultimately resulting in the deployment of an open-source .NET infostealer called Stealerium. A campaign that exploits the public sharing feature of generative artificial intelligence (AI) services like Anthropic Claude to stage malicious ClickFix instructions on how to perform a variety of tasks on macOS (e.g., "online DNS resolver"), and distribute these links via sponsored results on search engines like Google to deploy Atomic Stealer and MacSync Stealer. A campaign that directs users searching for "macOS cli disk space analyzer" to a fake Medium article impersonating Apple's Support Team to deceive them into running ClickFix instructions that deliver next-stage stealer payloads from an external server "raxelpak[.]com." "The C2 domain raxelpak[.]com has URL history going back to 2021, when it appeared to host a safety workwear e-commerce site," MacPaw's Moonlock Lab said. "Whether the domain was hijacked or simply expired and re-registered by the [threat actor] is unclear, but it fits the broader pattern of leveraging aged domains with existing reputation to avoid detection." A variation of the same campaign that stages ClickFix instructions for supposedly installing Homebrew on links associated with Claude and Evernote and distributes them through sponsored results to install stealer malware. "The ad shows a real, recognized domain (claude.ai), not a spoof or typo-squatted site," AdGuard said. "Clicking the ad leads to a real Claude page, not a phishing copy. The consequence is clear: Google Ads + a well-known trusted platform + technical users with high downstream impact = a potent malware distribution vector." A macOS email phishing campaign that prompts recipients to download and run an AppleScript file to address supposed compatibility issues, resulting in the deployment of another AppleScript designed to steal credentials and retrieve additional JavaScript payloads. "The malware does not grant permissions to itself; instead, it forges TCC authorizations for trusted Apple-signed binaries (Terminal, osascript, Script Editor, and bash) and then executes malicious actions through these binaries to inherit their permissions," Darktrace said. A ClearFake campaign that employs fake CAPTCHA lures on compromised WordPress sites to trigger the execution of an HTML Application (HTA) file and deploy Lumma Stealer. The campaign is also known to use malicious JavaScript injections to take advantage of a technique known as EtherHiding to execute a contract hosted on the BNB Smart Chain and fetch an unknown payload hosted on GitHub. EtherHiding offers attackers several advantages. It allows malicious traffic to blend with legitimate Web3 activity. Because blockchain is immutable and decentralized, it also offers increased resilience in the face of takedown efforts. The use of ClickFix techniques to target macOS underlines a broader trend where threat actors are increasingly seeking out machines that run Apple's operating system to infect them with infostealers and sophisticated tools, per a recent analysis published by Flare. No less than 103 Chrome crypto extensions are targeted by macOS stealers, with attackers obtaining valid Apple developer signatures to bypass Gatekeeper protections. "Nearly every macOS stealer prioritizes cryptocurrency theft above all else," the company said. "This laser focus reflects economic reality. Cryptocurrency users disproportionately use Macs. They often hold significant value in software wallets. Unlike bank accounts, crypto transactions are irreversible. Once seed phrases are compromised, funds disappear permanently with no recourse." "The 'Macs don't get viruses' assumption is not just outdated but actively dangerous. Organizations with Mac users need detection capabilities for macOS-specific TTPs: unsigned applications requesting passwords, unusual Terminal activity, connections to blockchain nodes for non-financial purposes, and data exfiltration patterns targeting Keychain and browser storage."

thehackernews.comFeb 15, 2026extracted

Darktrace / Email strengthens behavioral detection, DLP, and SOC integrations

Darktrace / Email strengthens behavioral detection, DLP, and SOC integrations Darktrace announced a series of enhancements to Darktrace / EMAIL designed to detect and stop attacks spanning communications channels, strengthen outbound email protections, and streamline SOC integrations. The new capabilities will help security teams catch sophisticated attacks that evade existing email tools, protect sensitive data, and preserve trust in digital communications, all while reducing operational complexity. New Darktrace research shows that even with multiple layers of email security in place, a significant share of dangerous messages still gets through. Across real-world deployments, Darktrace / EMAIL immediately identified the 17% of threats that bypassed SEGs, including highly targeted social engineering messages that appear routine or urgent, but contain no obvious payloads, such as impersonation attempts, fake payment or vendor change requests. Traditional methods miss these threats because they’re built to stop obvious spam and malware and, to avoid false positives, default to trusting emails that appear routine. Darktrace / EMAIL can stop these threats because its Self-Learning AI engine understands how each organization communicates and spots subtle changes in sender, tone, timing, and behavior that signal a threat, even when conventional tools see nothing unusual. Enhanced protection against cross-channel attacks Attacks targeting users across their communications channels, like email bombing campaigns, are on the rise. Between April and July 2025, the volume of email bombing messages surged 100x, growing from 200,000 emails to more than 20 million observed across Darktrace’s email customer base. These campaigns flood inboxes with benign messages to create noise and confusion, then an attacker reaches out via other channels like Teams or a phone call, posing as IT support offering to resolve the issue, and uses that trust to gain access or carry out further malicious activity. Because these emails often originate from legitimate services and contain no malicious payloads, traditional email tools struggle to detect them until the attack is already well underway, leaving organizations exposed. To tackle the rise of multi-channel campaigns, Darktrace introduced a new integration between Darktrace / EMAIL and Darktrace / IDENTITY for stronger multi-domain detection and response. When Darktrace / EMAIL detects suspicious patterns like an email bombing campaign, it can now share that signal with Darktrace / IDENTITY to increase sensitivity around the targeted user and more quickly spot attempted account takeovers or impersonation to stop attacks from progressing. The same cross-domain understanding and correlation extends into business applications such as Salesforce, where Darktrace can assess and action potentially malicious tickets created from email, giving security teams faster and more coordinated response across the environments they rely on most. Darktrace has also strengthened detection accuracy by layering its behavioral insights with threat intelligence, using integrated antivirus verdicts and structured feeds to enrich alerts with deeper context and enable faster, more confident triage. These enhancements build upon Darktrace / EMAIL’s existing ability to combine behavioral and content analysis across inbound, outbound, and lateral email, as well as Microsoft Teams messaging to identify threats across the entire attack chain. It learns the normal communication patterns of every user and organization, analyzing thousands of data points for each message including language, tone, links, sender profile, historical behavior of sender and recipient, and activity across other digital channels. As a result, Darktrace spots the subtle, context-driven deviations that define modern attacks and provides earlier, more precise detections. Securing outbound communications and data Darktrace observed a 1,317% month-over-month rise in phishing attacks targeting Black Friday in November, as attackers used seasonal targeting to exploit customer trust. This surge shows how attackers are weaponizing impersonation and trusted channels, making securing outbound communications just as important as blocking inbound threats. To help organizations tackle brand abuse and reinforce trust in their outbound messages, Darktrace / EMAIL–DMARC now includes Brand Indicators for Message Identification (BIMI) support. BIMI enables organizations to display a verified brand logo directly in recipients’ inboxes, making legitimate communications easier to recognize. By pairing BIMI enforcement with Darktrace’s behavioral detection capabilities, organizations can authenticate outbound messages while identifying inbound emails that attempt impersonation, helping to protect both their brand and their users. At the same time, not all outbound risk comes from attackers. Human error remains a leading cause of data exposure, with mis-delivery accounting for 72% of all actions involving end users in internal breaches. To address this, Darktrace created the behavioral data loss prevention (DLP) powered by a proprietary domain-specific language model within Darktrace / EMAIL. The solution can identify over 35 new categories of Personally Identifiable Information (PII) and Protected Health Information (PHI) across emails and attachments including personal, financial, and health data. By learning how each user handles sensitive information, and intervening when outbound behavior deviates from expected patterns, this behavioral approach adds a real-time, contextual safeguard against misaddressed messages and unintended data sharing. Together, BIMI support and behavioral DLP help organizations secure both who appears to be sending an email and what is being sent, strengthening trust in outbound communications while reducing the risk of sensitive data exposure. New integrations help reduce friction and accelerate investigations To help SOC teams move faster without adding operational complexity, Darktrace / EMAIL now includes new integrations that streamline investigations and plug into existing workflows: Jira and ServiceNow integrations: Darktrace can now automatically create a Jira or ServiceNow ticket, so every report is captured, tracked, and routed through the organization’s established processes. Sandbox Analysis integration: Analysts can analyze payload behavior in isolated environments directly within the Darktrace UI to quickly validate threats and close cases with confidence. These new capabilities build on Darktrace / EMAIL’s existing ecosystem integrations, including recent integration with Microsoft Defender for Office 365, that delivers unified quarantine management, so security teams can see and control emails actioned by both products in one place, with Darktrace visibility in Microsoft 365, and the Darktrace Email Analysis Agent for Microsoft Security Copilot. The agent lets analysts ask questions in plain language and pulls Darktrace / EMAIL insights, including alerts, device details, Cyber AI Analyst incidents, and email-related threats, directly into their Copilot investigations. This helps teams see what’s happening, where, and who is involved, all from a single conversational view. Together, these integrations give security teams consolidated visibility and faster investigations, streamlining workflows for organizations managing complex, multi-tool environments. “Email is the starting point for attacks that quickly expand into other parts of the digital ecosystem and can escalate into compromised identities, cloud access abuse, or manipulation of collaboration tools – well beyond what traditional email defenses are built to handle,” said Connie Stride, SVP of Product, Darktrace. “With our latest Darktrace / EMAIL innovations, we extend multi-domain detection by linking behavioral signals across email, identity, and SaaS to uncover advanced attacks that move across channels, while strengthening safeguards on outbound messages. These capabilities give security teams the visibility and precision to stop modern attacks before they progress and preserve trust in every interaction.”

helpnetsecurity.comDec 4, 2025extracted

Three Black Friday Scams to Watch Out For This Year

Phishing attacks happen all year round but are especially prominent around the end of November, with Christmas approaching and many people making purchases around Black Friday and Cyber Monday. This year, UK cybersecurity firm Darktrace observed a 620% spike in Black Friday-themed phishing campaigns in the weeks leading up to both sales days. The security firm also said it expects an additional 20% to 30% jump in phishing during the Black Friday week itself, which includes Thanksgiving and is followed by a holiday weekend in the US. In a report published on November 27, Darktrace warned consumers of three types of typical Black Friday phishing scam tactics: brand impersonation, fake marketing domains and generative AI-powered fake advertisements. Brand Impersonation Emails Brand impersonation was one of the techniques that stood out to Darktrace analysts in 2025, with 201% more phishing attempts mimicking US retailers during the week before Thanksgiving and Black Friday (November 15-21) compared to the same week in October. Amazon was the most impersonated brand, making up 80% of phishing attempts in Darktrace’s analysis of global consumer brands, which also included Apple, Alibaba and Netflix. Additionally, fake emails that look like they’re from well-known US retailers like Macy’s, Walmart and Target were up by 54% during the same reported week. Fake Marketing Domains Another prominent Black Friday phishing campaign observed by Darktrace used fake domains purporting to be from marketing sites like ‘Pal.PetPlatz.com’ and ‘Epicbrandmarketing.com.’ Some of these malicious emails contain ‘deals’ for luxury items, such as Rolex watches or Louis Vuitton handbags, designed to tempt readers into clicking. Others promote a made-up brand called Deal Watchdogs tied to “can’t-miss” Amazon Black Friday offers designed to lure readers into acting fast to secure legitimate time-sensitive deals. Users who click on a link are redirected to a fake Amazon website where they are tricked into inputting sensitive data and payment details. GenAI-Powered Emails Finally, generative AI-powered phishing emails are “the biggest shift seen in phishing in recent years,” said Darktrace, with 27% of phishing emails observed in 2024 containing over 1000 characters, suggesting LLM use in their creation. In one proof-of-concept (PoC) example, a Darktrace analyst with no technical background created an email that looks and feels like a genuine Black Friday offer with only two prompts given to a general purpose chatbot relying on a large language model (LLM). “Anyone can now create convincing brand spoofs, and they can do it at scale. That makes it even more important for email users to pause, check the sender, and think before they click,” the Darktrace blog noted.

infosecurity-magazine.comNov 28, 2025extracted

Hackers Used Snappybee Malware and Citrix Flaw to Breach European Telecom Network

A European telecommunications organization is said to have been targeted by a threat actor that aligns with a China-nexus cyber espionage group known as Salt Typhoon. The organization, per Darktrace, was targeted in the first week of July 2025, with the attackers exploiting a Citrix NetScaler Gateway appliance to obtain initial access. Salt Typhoon, also known as Earth Estries, FamousSparrow, GhostEmperor, and UNC5807, is the name given to an advanced persistent threat actor with ties to China. Known to be active since 2019, the group gained prominence last year following its attacks on telecommunications services providers, energy networks, and government systems in the U.S. The adversary has a track record of exploiting security flaws in edge devices, maintaining deep persistence, and exfiltrating sensitive data from victims in more than 80 countries across North America, Europe, the Middle East, and Africa. In the incident observed against the European telecommunications entity, the attackers are said to have leveraged the foothold to pivot to Citrix Virtual Delivery Agent (VDA) hosts in the client’s Machine Creation Services (MCS) subnet, while also using SoftEther VPN to obscure their true origins. One of the malware families delivered as part of the attack is Snappybee (aka Deed RAT), a suspected successor to the ShadowPad (aka PoisonPlug) malware that has been deployed in prior Salt Typhoon attacks. The malware is launched by means of a technique called DLL side-loading, which has been adopted by a number of Chinese hacking groups over the years. "The backdoor was delivered to these internal endpoints as a DLL alongside legitimate executable files for antivirus software such as Norton Antivirus, Bkav Antivirus, and IObit Malware Fighter," Darktrace said. "This pattern of activity indicates that the attacker relied on DLL side-loading via legitimate antivirus software to execute their payloads." The malware is designed to contact an external server ("aar.gandhibludtric[.]com") over HTTP and an unidentified TCP-based protocol. Darktrace said the intrusion activity was identified and remediated before it could escalate further. "Salt Typhoon continues to challenge defenders with its stealth, persistence, and abuse of legitimate tools," the company added. "The evolving nature of Salt Typhoon’s tradecraft, and its ability to repurpose trusted software and infrastructure, ensures it will remain difficult to detect using conventional methods alone." Update Cybersecurity company Silent Push, in a follow-up analysis on October 24, 2025, said it first observed the C2 domain "aar.gandhibludtric[.]com" resolving to the IP address 38.54.63.75 starting May 5, 2025. "Salt Typhoon leveraged LightNode VPS infrastructure, using both HTTP and a custom TCP protocol to communicate," it said. "Their HTTP traffic included POST requests with Internet Explorer user agents and URI patterns like /17ABE7F017ABE7F0, aligning with known Salt Typhoon behavior."

thehackernews.comOct 21, 2025extracted

China-linked Salt Typhoon hackers attempt to infiltrate European telco

China-linked Salt Typhoon hackers attempt to infiltrate European telco Salt Typhoon, the China-linked APT group that has a penchant for targeting telecommunications companies, has been spotted trying to sneak into yet another one. The intrusion “Darktrace observed activity in a European telecommunications organisation consistent with Salt Typhoon’s known tactics, techniques and procedures (TTPs), including dynamic-link library (DLL) sideloading and abuse of legitimate software for stealth and execution,” the British cybersecurity company shared on Monday. Other attack elements indicating Salt Typhoon’s involvement include: The exploitation of a vulnerability in a Citrix NetScaler Gateway appliance for initial access (Salt Typhoon is known for exploiting publicly known vulnerabilities in network equipment) The use of the SNAPPYBEE (aka Deed RAT) backdoor, which is a tool shared by different Chinese APT groups The use of command and control (C2) infrastructure previously linked to the group and the use of non-standard and layered protocols to evade detection (the backdoor used LightNode VPS endpoints for C2, communicating over both HTTP and an unidentified TCP-based protocol) After gaining initial access through the Citrix NetScaler Gateway appliance in July 2025, the attackers moved laterally to compromise Citrix Virtual Delivery Agent hosts in the client’s Machine Creation Services (MCS) subnet. “The backdoor was delivered to these internal endpoints as a DLL alongside legitimate executable files for antivirus software such as Norton Antivirus, Bkav Antivirus, and IObit Malware Fighter,” Darktrace analysts explained. “This pattern of activity indicates that the attacker relied on DLL side-loading via legitimate antivirus software to execute their payloads. Salt Typhoon and similar groups have a history of employing this technique, enabling them to execute payloads under the guise of trusted software and bypassing traditional security controls.” Fortunately, the intrusion was spotted before the attackers managed to burrow deeper into the target telco’s network. Thwarting Salt Typhoon Salt Typhoon, aka Earth Estries and UNC2286, has been active for more than five years. Its most high-profile compromises were revealed nearly a year ago, when it was discovered that they successfully breached a number of US telcos. According to FBI and CISA officials, during these intrusions they managed to steal subscribers’ call records, intercept phone calls and text messages of governmental employees and politicians, and access wiretap systems set up for lawful communication interception. Earlier this year, the threat actor was linked to hacks at an unnamed Canadian telecommunications provider, as well as Viasat, a California-based provider of satellite broadband services and secure networking systems. Salt Typhoon’s activities have been linked by Western cybersecurity agencies to several China-based firms. “These companies provide cyber-related products and services to China’s intelligence services, including multiple units in the People’s Liberation Army and Ministry of State Security,” the cybersecurity bodies said in a recent joint advisory. “The data stolen through this activity against foreign telecommunications and Internet service providers (ISPs), as well as intrusions in the lodging and transportation sectors, ultimately can provide Chinese intelligence services with the capability to identify and track their targets’ communications and movements around the world.” Gregory Richardson, Vice President and Advisory CISO Worldwide at BlackBerry, warns that communications networks have become prime targets for cyber attackers driven by motives ranging from corporate espionage to geopolitical leverage. While Darktrace shared more recent indicators of compromise, the agencies’ very comprehensive advisory contains: Indicators associated with the Salt Typhoon’s activities from August 2021 to June 2025 Information about custom software leveraged by the group Threat hunting guidance, and Lays out mitigations and general security recommendations for defenders to keep this threat actor out of their networks and systems. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

helpnetsecurity.comOct 20, 2025extracted

Salt Typhoon Uses Citrix Flaw in Global Cyber-Attack

A cyber intrusion linked to the China-based group Salt Typhoon has been identified by cybersecurity researchers, involving the exploitation of a Citrix NetScaler Gateway vulnerability. The operation, observed by Darktrace, involved advanced methods such as DLL sideloading and zero-day exploits – known techniques the group uses to infiltrate systems while avoiding standard detection measures. A Persistent Global Threat Salt Typhoon, also known as Earth Estries, GhostEmperor and UNC2286, has been active since at least 2019. The group is associated with a series of high-impact cyber campaigns directed at critical sectors, including telecommunications, energy and government systems, across more than 80 countries. While the United States has been a frequent target, recent activity shows a broader reach across Europe, the Middle East and Africa. Its operations typically exploit vulnerabilities in technologies from vendors such as Citrix, Fortinet and Cisco. The group has demonstrated long-term persistence in victim networks, using custom malware and advanced evasion techniques to collect sensitive data and, in some cases, disrupt essential services. European Telecoms Under Fire In a new advisory published today, Darktrace said it recorded intrusion activity within a European telecommunications organization that matched Salt Typhoon’s known tactics, techniques and procedures (TTPs). The incident began in July 2025, when attackers exploited a Citrix NetScaler Gateway appliance. From there, they moved laterally to Citrix Virtual Delivery Agent hosts within the organization’s internal network. Infrastructure linked to the SoftEther VPN service was used to obscure the attackers’ origin. The threat actors deployed a backdoor identified as SNAPPYBEE (also known as Deed RAT) through DLL sideloading, embedding malicious files alongside legitimate executables from antivirus products such as Norton, Bkav and IObit. This approach enabled the attackers to execute malicious code under trusted software, reducing the likelihood of detection. The deployed backdoor established communication with command-and-control (C2) servers using both HTTP and unidentified TCP-based protocols. HTTP traffic included Internet Explorer User-Agent headers and URI patterns such as “/17ABE7F017ABE7F0.” One of the C2 domains, aar.gandhibludtric[.]com, was previously associated with Salt Typhoon infrastructure. Broader Implications Based on overlaps in tactics, infrastructure and malware, researchers assessed the activity as consistent with Salt Typhoon’s previous operations. The case reflects the group’s continued focus on stealth and persistence through the abuse of legitimate software and layered communication methods. “As attackers increasingly blend into normal operations, detecting behavioral anomalies becomes essential for identifying subtle deviations and correlating disparate signals,” Darktrace warned. “This intrusion highlights the importance of proactive defense, where anomaly-based detections, not just signature matching, play a critical role in surfacing early-stage activity.”

infosecurity-magazine.comOct 20, 2025extracted

Experts Warn of Widespread SonicWall VPN Compromise Impacting Over 100 Accounts

Cybersecurity company Huntress on Friday warned of "widespread compromise" of SonicWall SSL VPN devices to access multiple customer environments. "Threat actors are authenticating into multiple accounts rapidly across compromised devices," it said. "The speed and scale of these attacks imply that the attackers appear to control valid credentials rather than brute-forcing." A significant chunk of the activity is said to have commenced on October 4, 2025, with more than 100 SonicWall SSL VPN accounts across 16 customer accounts having been impacted. In the cases investigated by Huntress, authentications on the SonicWall devices originated from the IP address 202.155.8[.]73. The company noted that in some instances, the threat actors did not engage in further adversarial actions in the network and disconnected after a short period of time. However, in other cases, the attackers have been found conducting network scanning activity and attempting to access numerous local Windows accounts. The disclosure comes shortly after SonicWall acknowledged that a security incident resulted in the unauthorized exposure of firewall configuration backup files stored in MySonicWall accounts. The breach, according to the latest update, affects all customers who have used SonicWall's cloud backup service. "Firewall configuration files store sensitive information that can be leveraged by threat actors to exploit and gain access to an organization's network," Arctic Wolf said. "These files can provide threat actors with critical information such as user, group, and domain settings, DNS and log settings, and certificates." Huntress, however, noted that there is no evidence at this stage to link the breach to the recent spike in compromises. Considering that sensitive credentials are stored within firewall configurations, organizations using the MySonicWall cloud configuration backup service are advised to reset their credentials on live firewall devices to avoid unauthorized access. It's also recommended to restrict WAN management and remote access where possible, revoke any external API keys that touch the firewall or management systems, monitor logins for signs of suspicious activity, and enforce multi-factor authentication (MFA) for all admin and remote accounts. The disclosure comes amid an increase in ransomware activity targeting SonicWall firewall devices for initial access, with the attacks leveraging known security flaws (CVE-2024-40766) to breach target networks for deploying Akira ransomware. Darktrace, in a report published this week, said it detected an intrusion targeting an unnamed U.S. customer in late August 2025 that involved network scanning, reconnaissance, lateral movement, privilege escalation using techniques like UnPAC the hash, and data exfiltration. "One of the compromised devices was later identified as a SonicWall virtual private network (VPN) server, suggesting that the incident was part of the broader Akira ransomware campaign targeting SonicWall technology," it said. "This campaign by Akira ransomware actors underscores the critical importance of maintaining up-to-date patching practices. Threat actors continue to exploit previously disclosed vulnerabilities, not just zero-days, highlighting the need for ongoing vigilance even after patches are released."

thehackernews.comOct 11, 2025extracted

⚡ Weekly Recap: Cisco 0-Day, Record DDoS, LockBit 5.0, BMC Bugs, ShadowV2 Botnet & More

Cybersecurity never stops—and neither do hackers. While you wrapped up last week, new attacks were already underway. From hidden software bugs to massive DDoS attacks and new ransomware tricks, this week’s roundup gives you the biggest security moves to know. Whether you’re protecting key systems or locking down cloud apps, these are the updates you need before making your next security decision. Take a quick look to start your week informed and one step ahead. ⚡ Threat of the Week Cisco 0-Day Flaws Under Attack — Cybersecurity agencies warned that threat actors have exploited two security flaws affecting Cisco firewalls as part of zero-day attacks to deliver previously undocumented malware families like RayInitiator and LINE VIPER. The RayInitiator and LINE VIPER malware represent a significant evolution on that used in the previous campaign, both in sophistication and its ability to evade detection. The activity involves the exploitation of CVE-2025-20362 (CVSS score: 6.5) and CVE-2025-20333 (CVSS score: 9.9) to bypass authentication and execute malicious code on susceptible appliances. The campaign is assessed to be linked to a threat cluster dubbed ArcaneDoor, which was attributed to a suspected China-linked hacking group known as UAT4356 (aka Storm-1849). Future-Ready Protection for Microsoft Rising attacks demand a plan. Get Veeam’s Cyber Resilience Playbook for Microsoft 365 & Entra ID and learn 10 steps to stay future-ready and secure your SaaS data. Download the playbook now! Read Now ➝ 🔔 Top News Nimbus Manticore Uses MiniJunk in Critical Infra Attacks — An Iran-aligned cyber espionage group has expanded its operations beyond its traditional Middle Eastern hunting grounds to target critical infrastructure organizations across Western Europe using constantly evolving malware variants and attack tactics. Nimbus Manticore, which overlaps with UNC1549 or Smoke Sandstorm, has been observed targeting defense manufacturing, telecommunications, and aviation companies in Denmark, Portugal, and Sweden. Central to the campaign are MiniJunk, an obfuscated backdoor that gives the attacker persistent access to infected systems, and MiniBrowse, a lightweight stealer with separate versions for stealing credentials from Chrome and Edge browsers. MiniJunk is an updated version of MINIBIKE (aka SlugResin), with the emails directing victims to fake job-related login pages that appear to be associated with companies like Airbus, Boeing, Flydubai, and Rheinmetall. In a further escalation of its tactics, Nimbus Manticore has been observed using the service SSL.com starting around May 2025 to sign their code and pass off malware as legitimate software programs, leading to a "drastic decrease in detections." ShadowV2 Targets Docker for DDoS Attacks — A novel ShadowV2 bot campaign is turning distributed denial-of-service (DDoS) attacks into a full-blown for-hire business by targeting misconfigured Docker containers on AWS. Instead of relying on prebuilt malicious images, the attackers build containers on the victim’s machine itself to launch a Go-based RAT that can launch DDoS attacks. The exact rationale of the approach is unclear, though Darktrace researchers suggest it may have been a way to reduce forensic traces from importing a malicious container. Once installed, the malware sends a heartbeat signal to the C2 server every second, while also polling for new attack commands every five seconds. Cloudflare Mitigates Largest DDoS Attack on Record — Web performance and security company Cloudflare said its systems blocked a record-breaking distributed denial-of-service (DDoS) attack that peaked at 22.2 terabits per second (Tbps) and 10.6 billion packets per second (Bpps), and lasted only 40 seconds. The attack was aimed at a single IP address of an unnamed European network infrastructure company. It's believed that the attack may be powered by the AISURU botnet. Vane Viper Linked to Malicious Campaigns Distributing Malware — A high-volume cybercrime operation known as Vane Viper that's been active for more than a decade is supported by a commercial digital advertising platform with a checkered past. Vane Viper takes advantage of hundreds of thousands of compromised websites and malicious ads that redirect unsuspecting Web users to destinations such as exploit kits, malware, and sketchy websites. The findings suggest that Vane Viper is not acting as an unwitting intermediary but is a complicit enabler and active participant in malicious operations. It also shares parallels with VexTrio Viper in that both emerged from Eastern Europe around 2015 and are controlled by the Russian diaspora in Europe and Cyprus. "URL Solutions, Webzilla, and AdTech Holding form a closely connected trio of firms: domains registered en masse via a registrar steeped in cybercrime, hosted on infrastructure operated by a company that's hosted everything from Methbot to state-sponsored disinformation, and payloads delivered via an ad network long implicated in malvertising," Infoblox said. "Not only has PropellerAds turned a 'blind eye' to criminal abuse of their platform, but indicators [...] suggest – with moderate-to-high confidence – that several ad-fraud campaigns originated from infrastructure attributed to PropellerAds." 2 New Supermicro BMC Bugs Allow Implanting Malicious Firmware — Servers running on motherboards sold by Supermicro contain medium-severity vulnerabilities that can allow hackers to remotely install malicious firmware that runs even before the operating system, providing unprecedented persistence. That said, the caveat is that the threat actor needs to have administrative access to the BMC control interface to perform the update, or distribute them as part of a supply chain attack by compromising the servers used to host firmware updates and replacing the original images with malicious ones, all while keeping the signature valid. Supermicro said it has updated the BMC firmware to mitigate the vulnerabilities, adding that it's currently testing and validating affected products. The current status of the update is unknown. ️🔥 Trending CVEs Hackers don't wait. They exploit newly disclosed vulnerabilities within hours, transforming a missed patch or a hidden bug into a critical point of failure. One unpatched CVE is all it takes to open the door to a full-scale compromise. Below are this week's most critical vulnerabilities, making waves across the industry. Review the list, prioritize patching, and close the window of opportunity before attackers do. This week's list includes — CVE-2025-20362, CVE-2025-20333, CVE-2025-20363 (Cisco), CVE-2025-59689 (Libraesva ESG), CVE-2025-20352 (Cisco IOS), CVE-2025-10643, CVE-2025-10644 (Wondershare RepairIt), CVE-2025-7937, CVE-2025-6198 (Supermicro BMC), CVE-2025-9844 (Salesforce CLI), CVE-2025-9125 (Lectora Desktop), CVE-2025-23298 (NVIDIA Merlin), CVE-2025-59545 (DotNetNuke), CVE-2025-34508 (ZendTo), CVE-2025-27888 (Apache Druid Proxy), CVE-2025-10858, CVE-2025-8014 (GitLab), and CVE-2025-54831 (Apache Airflow). 📰 Around the Cyber World Microsoft Offers ESU for Free in the E.U. — Microsoft has decided to offer free extended security updates for Windows 10 users in the European Economic Area (EEA), following pressure from the Euroconsumers group. "We are pleased to learn that Microsoft will provide a no-cost Extended Security Updates (ESU) option for Windows 10 consumer users in the European Economic Area (EEA)," Euroconsumers said. In other regions, users will need to either enable Windows Backup or pay $30 for the year or redeem 1,000 Microsoft Reward points. It's worth noting that Windows 10 reaches end of support (EoS) on October 14, 2025. Olymp Loader Spotted in the Wild — A new malware loader called Olymp Loader has been spotted in the wild, being propagated via GitHub repositories, or through tools disguised as popular software such as PuTTY, OpenSSL, Zoom, and even a Counter Strike mod called Classic Offensive. Written in assembly language, the malware-as-a-service (MaaS) solution provides built-in stealer modules, including a custom version of BrowserSnatch that's available on GitHub. Campaigns using Olymp have been found to deliver an array of information stealers and remote access trojans like Lumma, Raccoon, WebRAT (aka SalatStealer), and Quasar RAT. The tool was first advertised by a seller named OLYMPO in HackForums on June 5, 2025, as a botnet, before evolving into a loader and a crypter. "The malware seller has published a roadmap that treats Olymp as a bundle comprising Olymp Botnet, Olymp Loader, Olymp Crypter, an install service, and a file‑scanning tool for antivirus testing," Outpost24 said. "It remains to be seen whether OLYMPO can sustain and support a broader malware product suite over time." Regardless, the emergence of yet another bundled crimeware stack can further lower the entry barrier for less experienced threat actors, allowing them to mount widespread campaigns at scale within a short amount of time. Malicious Facebook Ads Lead to JSCEAL Malware — Cybersecurity researchers have disclosed an ongoing campaign that's using bogus ads on Facebook and Google to distribute premium versions of trading platforms like TradingView for free. According to Bitdefender, the activity has also expanded to YouTube, where sponsored ads on the platform are being used to direct users to malware-laced downloads that steal credentials and compromise accounts. These ads are posted via legitimate-but-compromised verified YouTube accounts to serve the ads. The attackers take pains to ensure that the hijacked channels mimic the official TradingView channel by reusing the latter's branding and playlists to build credibility. An unlisted video uploaded by the rebranded channel, titled "Free TradingView Premium – Secret Method They Don’t Want You to Know," is estimated to have racked up more than 182,000 views through aggressive advertising. "The unlisted status is deliberate, of course. By not being publicly searchable, these malicious videos avoid casual reporting and platform moderation," Bitdefender said. "Instead, they are shown exclusively through ad placements, ensuring they reach their targets while remaining hidden from public view." The attacks ultimately led to the deployment of malware known as JSCEAL (aka WEEVILPROXY) to steal sensitive data. LockBit 5.0 Analyzed — The threat actors behind the LockBit ransomware have released a "significantly more dangerous" version, LockBit 5.0, on its sixth anniversary, with advanced obfuscation and anti-analysis techniques, while being capable of targeting Windows, Linux, and ESXi systems. "The 5.0 version also shares code characteristics with LockBit 4.0, including identical hashing algorithms and API resolution methods, confirming this is an evolution of the original codebase rather than an imitation," Trend Micro said. "The preservation of core functionalities while adding new evasion techniques demonstrates the group's strategy of incremental improvement to their ransomware platform." LockBit may not be the most prolific ransomware group it once was ever since its infrastructure was disrupted in a law enforcement operation early last year, but the findings show that it continues to be as aggressive as ever when it comes to refining and retooling its tactics. "The Windows binary uses heavy obfuscation and packing: it loads its payload through DLL reflection while implementing anti-analysis techniques like ETW patching and terminating security services," the company said. "Meanwhile, the newly discovered Linux variant maintains similar functionality with command-line options for targeting specific directories and file types. The ESXi variant specifically targets VMware virtualization environments, designed to encrypt entire virtual machine infrastructures in a single attack." Microsoft Blocks Access to Services Used by Israeli Military Unit — Microsoft has revealed that it "ceased and disabled" a set of services to Unit 8200 within the Israel Ministry of Defense (IMOD) that were used to enable mass surveillance of civilians in Gaza and the West Bank. It said it found evidence "relating to IMOD consumption of Azure storage capacity in the Netherlands and the use of AI services." The secretive contract came to light last month following a report by The Guardian, along with +972 Magazine and Local Call, that revealed how Microsoft's Azure service was being used to store and process millions of Palestinian civilian phone calls made each day in Gaza and the West Bank. The newspaper reported that the trove of intercepted calls amounted to 8,000 terabytes of data and was held in a Microsoft data center in the Netherlands. The collected data has been moved out of the country and is being planned to be transferred to the Amazon Web Services cloud platform. Ransomware Groups Use Stolen AWS Keys to Breach Cloud — Ransomware gangs are using Amazon Web Services (AWS) keys stored in local environments, such as Veeam backup servers, to pivot to a victim's AWS account and steal data with the help of the Pacu AWS exploitation framework, turning what started as an on-premise event into a cloud compromise. "Threat actors are becoming increasingly adept at exploiting cloud environments — leveraging compromised AWS keys, targeting backup servers, and using advanced attack frameworks to evade detection," Varonis said. Meta Unveils Ad-Free Option in the U.K. — Meta has launched an ad-free experience for Facebook and Instagram in the U.K., allowing users to pay £2.99 a month to access the platforms without ads on the web, and £3.99 a month for Android and iOS. "We will notify UK users over the age of 18 that they have the choice to subscribe to Facebook and Instagram for a fee to use these services without seeing ads," the company said. "A reduced, additional fee of £2/month on the web or £3/month on iOS and Android will automatically apply for each additional account listed in a user's Account Center." Meta has significant hurdles in rolling out the scheme in the E.U., causing it to walk back its ad model, offering users the choice to receive "less personalized ads" that are full-screen and temporarily unskippable. Earlier this May, the European Commission said the model does not comply with the Digital Markets Act (DMA) and fined Meta €200 million. In response, the company said it would need to make modifications to the model that "could result in a materially worse user experience for European users and a significant impact." In a report published in July 2025, privacy non-profit noyb said: "'Pay or Okay' has spread throughout the E.U. in recent years and can now be found on hundreds of websites. However, data protection authorities still haven't adopted a consistent E.U.-wide approach to deal with these systems. They should have agreed on this long ago." Dutch Teen Duo Arrested Over Alleged 'Wi-Fi Sniffing' for Russia — Two teenagers have been arrested in the Netherlands on suspicion of espionage, reportedly on behalf of Russian intelligence agencies. The boys, both aged 17, were arrested on Monday. One has been remanded in custody while the other has been released on home bail. The arrests are related to laws regarding state-sponsored interference, but additional details have been withheld due to the age of the suspects and the ongoing investigation. The teens are alleged to have been tasked with carrying a "Wi-Fi sniffer" along a route past buildings in The Hague, including the headquarters of Europol and Eurojust, as well as several embassies. Akira Ransomware Breaching MFA-Protected SonicWall VPN Accounts — Cybersecurity researchers have warned about an "aggressive" Akira ransomware campaign targeting SonicWall VPNs to rapidly deploy the locker as part of an attack wave that began on July 21, 2025. "In almost all intrusions, ransomware encryption took place in under four hours from initial access, with a staging interval as short as 55 minutes in some instances," Arctic Wolf said in a new report. Other commonly observed post-exploitation activities include internal network scanning, Impacket SMB activity tied to discovery, Active Directory discovery, and VPN client logins originating from Virtual Private Server (VPS) hosting providers. Targeting firewall and LDAP-synchronized, several intrusions have involved the threat actors leveraging the dedicated account used for Active Directory synchronization to log in via SSL VPN, despite not being intentionally configured for such access. In more than 50% of the analyzed intrusions, login attempts were observed against accounts with the One Time Password (OTP) feature enabled. "Malicious logins were followed within minutes by port scanning, Impacket SMB activity, and rapid deployment of Akira ransomware," the company noted. "Victims spanned across multiple sectors and organization sizes, suggesting opportunistic mass exploitation." Four People to Face Trial Over Greece Spyware Scandal — Four individuals, two Israeli and two Greek employees of spyware vendor Intellect, are expected to face trial in Greece over the use of the Predator surveillance tool by the ruling government in 2022 to eavesdrop on judges, senior military officers, journalists, and the opposition. But to date, no government officials have been charged in connection with the scandal. Phishing Emails Lead to DarkCloud Stealer — The information stealer known as DarkCloud is being distributed via phishing emails masquerading as financial correspondence that trick recipients into opening malicious ZIP archives. The stealer, besides adding new layers of encryption and evasion, targets web browser data, keystrokes, FTP credentials, clipboard contents, email clients, files, and cryptocurrency wallets. Stolen credentials/data are sent to attacker-controlled Telegram, FTP, SMTP, or Web Panel (PHP) endpoints. It's marketed on Telegram by a user named @BluCoder and on the clearnet through the domain darkcloud.onlinewebshop[.]net. It's advertised as the "best surveillance software for parents, spouses, and employers." Cybersecurity company eSentire said: "DarkCloud is an information-stealing malware written in VB6 and is actively being updated to target a wide range of applications, including email clients, FTP clients, cryptocurrency wallets, web browsers and supports numerous other information-stealing capabilities like keystroke/clipboard harvesting, clipboard hijacking, and file collection." Nupay Plugs "Configuration Gap" — Indian fintech company Nupay said it addressed a configuration gap after UpGuard flagged an unprotected Amazon S3 storage bucket containing more than 270,000 documents related to bank transfers of Indian customers. The exposed information included bank account numbers, transaction amounts, names, phone numbers, and email addresses. The data was linked to at least 38 different banks and financial institutions. It's currently not known how long the data was left publicly accessible on the internet, although misconfigurations of this kind are not uncommon. Nupay told TechCrunch the bucket exposed a "limited set of test records with basic customer details," and that a majority of the details were "dummy or test files." Top AI Chatbots Provide Answers with False Claims — Some of the top AI chatbots' tendency to repeat false claims on topics in the news increased nearly twice as much as they did last year, according to an audit by NewsGuard. The disinformation rates of the chatbots have almost doubled, going from 18% in August 2024 to 35% a year later, with the tools providing false claims to news prompts more than one-third of the time. "Instead of citing data cutoffs or refusing to weigh in on sensitive topics, the LLMs now pull from a polluted online information ecosystem — sometimes deliberately seeded by vast networks of malign actors, including Russian disinformation operations — and treat unreliable sources as credible," it said. Israel's PM Says His U.N. Speech Streamed Directly to Gaza Cellphones — Israeli Prime Minister Benjamin Netanyahu said his speech at the United Nations last week was also pushed to mobile phones of Gaza residents in an unprecedented operation. "Ladies and gentlemen, thanks to special efforts by Israeli intelligence, my words are now also being carried," Netanyahu said. "They're streamed live through the cell phones of Gaza." There is no evidence for how it would've worked or if this actually took place. Fake Teams Installers Lead to Oyster Malware — Threat actors are abusing SEO poisoning and malvertising to lure users searching for Teams online into downloading a fake installer that leads to malware called Oyster (aka Broomstick or CleanUpLoader). "Oyster is a modular, multistage backdoor that provides persistent remote access, establishes Command and Control (C2) communications, collects host information, and enables the delivery of follow-on payloads," Blackpoint said. "By hiding behind a widely used collaboration platform, Oyster is well positioned to evade casual detection and blend into the noise of normal enterprise activity." The activity has been attributed by Conscia to Vanilla Tempest (aka Storm-0832 or Vice Society). Flaw in Streamlit Framework Patched — Cybersecurity researchers discovered a vulnerability in the Streamlit app deployment framework that can allow attackers to hijack underlying cloud servers. "To do that, threat actors bypass file type restrictions and take full control of a misconfigured cloud instance running Streamlit applications," Cato Networks said. In a hypothetical attack scenario, bad actors can exploit a file upload vulnerability in the framework to rewrite server files and deploy new SSH configurations. Streamlit released a security patch in March. 🎥 Cybersecurity Webinars Beyond the Hype: Practical AI Workflows for Cybersecurity Teams — AI is transforming cybersecurity workflows, but the best results come from blending human oversight with automation. In this webinar, Thomas Kinsella of Tines shows how to pinpoint where AI truly adds value, avoid over-engineering, and build secure, auditable processes that scale. Halloween Special: Real Breach Stories and the Fix to End Password Horrors — Passwords are still a prime target for attackers—and a constant pain for IT teams. Weak or reused credentials, frequent helpdesk resets, and outdated policies expose organizations to costly breaches and reputational damage. In this Halloween-themed webinar from The Hacker News and Specops Software, you’ll see real breach stories, discover why traditional password policies fail, and watch a live demo on blocking compromised credentials in real time—so you can end password nightmares without adding user friction. From Code to Cloud: Learn How to See Every Risk, Fix Every Weak Link — Modern AppSec needs end-to-end visibility from code to cloud. Without it, hidden flaws delay fixes and raise risk. This webinar shows how code-to-cloud mapping unites dev, DevOps, and security to prioritize and remediate faster, forming the backbone of effective ASPM. 🔧 Cybersecurity Tools Pangolin — It is a self-hosted reverse proxy that securely exposes private services to the internet without opening firewall ports. It creates encrypted WireGuard tunnels to connect isolated networks and includes built-in identity and access management, so you can control who reaches your internal apps, APIs, or IoT devices. Ideal for developers, DevOps teams, or organizations needing safe remote access, Pangolin simplifies sharing internal resources while keeping them protected behind strong authentication and role-based permissions. AI Red Teaming Playground — Microsoft’s AI Red Teaming Playground Labs offers hands-on challenges to practice probing AI systems for security gaps. Built on Chat Copilot and powered by the open-source PyRIT framework, it lets you simulate prompt injections and other adversarial attacks to identify hidden risks in generative AI before deployment. Disclaimer: The tools featured here are provided strictly for educational and research purposes. They have not undergone full security audits, and their behavior may introduce risks if misused. Before experimenting, carefully review the source code, test only in controlled environments, and apply appropriate safeguards. Always ensure your usage aligns with ethical guidelines, legal requirements, and organizational policies. 🔒 Tip of the Week Hardening Active Directory Against Modern Attacks — Active Directory is a prime target—compromise it and attackers can own your network. Strengthen its defenses starting with Kerberos FAST (Flexible Authentication Secure Tunneling), which encrypts pre-authentication traffic to block offline password cracking and relay attacks. Deploy it in “Supported” mode, monitor KDC events (IDs 34, 35), then enforce “Required” once all clients are ready. Run PingCastle for a rapid forest health check and use ADeleg/ADeleginator to uncover dangerous over-delegation in OUs or service accounts. Harden password security with Fine-Grained Password Policies (FGPP) and automate local admin password rotation using LAPS or Lithnet Password Protection to block breached credentials in real time. Tighten other control layers: use AppLocker Inspector/Gen to lock down application execution and GPOZaurr to detect orphaned or risky Group Policy Objects. Scan AD Certificate Services with Locksmith to close misconfigurations and use ScriptSentry to catch malicious logon scripts that enable stealthy persistence. Finally, apply CIS or Microsoft security baselines and generate custom Attack Surface Reduction rules with ASRGen to block exploit techniques that bypass standard policies. This layered, rarely implemented strategy raises the cost of compromise and forces even advanced adversaries to work far harder. Conclusion These headlines show how tightly connected our defenses must be in today’s threat landscape. No single team, tool, or technology can stand alone—strong security depends on shared awareness and action. Take a moment to pass these insights along, spark a conversation with your team, and turn this knowledge into concrete steps. Every patch applied, policy updated, or lesson shared strengthens not just your own organization, but the wider cybersecurity community we all rely on.

thehackernews.comSep 29, 2025extracted

ShadowV2: la nuova botnet MaaS per attacchi DDoS sfrutta i container

Betti RHC, la prima graphic novel al mondo dedicata alla cybersecurity awareness, ha finalmente il suo sito ufficiale. Uno spazio tutto suo dove scoprire il progetto, sfogliare le copertine degli episodi e immergersi nel mondo di Betti: la giovane laureanda in informatica che, dopo la morte misteriosa del padre, si trasforma nell'hacker più potente del mondo. Una storia avvincente che, episodio dopo episodio, affronta una minaccia digitale diversa — dal phishing al ransomware, fino al cyberbullismo — e insegna a riconoscerla e a difendersi, senza che sembri mai una lezione. Sul sito trovate tutto ciò che rende Betti un progetto diverso dal solito: la sua filosofia, le anteprime delle tavole e il racconto di come nasce ogni volume. Perché dietro Betti RHC c'è solo lavoro umano: ogni tavola è disegnata interamente a mano dagli artisti del Gruppo Arte di Red Hot Cyber, senza alcun uso di intelligenza artificiale. E a garantire che ogni storia sia realistica e tecnicamente corretta c'è la supervisione degli hacker etici del gruppo HackerHood, che mantengono il racconto fedele al mondo reale della sicurezza informatica. C'è spazio anche per le aziende, che possono usare Betti come strumento di awareness diverso dai soliti corsi: acquistare i volumi, personalizzarli con il proprio brand o sponsorizzare nuovi episodi. E come primo regalo, l'episodio "Byte the Silence", dedicato al cyberbullismo, è scaricabile gratuitamente per uso personale. Perché la miglior difesa, in fondo, è una bella storia. 👉 Scopri tutto su https://betti.redhotcyber.com/

redhotcyber.comSep 24, 2025extracted

AI Emerges as the Hope—and Risk—for Overloaded SOCs

The problems faced by SOCs are well known, understood, and quantified – but not yet solved. SMEs get around 500 security alerts every day; larger enterprises receive nearer 3,000. Forty percent of these are never investigated, while 57% of companies suppress their detection rules to lessen the load. Most SOCs cannot cope with the existing alert load, while others seek to reduce it by consciously accepting unknown risk (often in the cloud and identity spheres). These figures come from a Prophet Security analysis (PDF) that canvassed 282 security leaders (CISOs, security directors, managers, and analysts) from companies with more than 1,000 employees, primarily in the United States. Fifty-five percent of the same respondents say they already use some form of AI for alert triage and investigation, while 60% plan to evaluate an AI SOC solution within the next year. Moreover, 83% of security leaders today believe that more than half of the SOC workload will be completed by AI in the next three years. The three main use cases expected for AI in the SOC are ‘alert triage and investigation’ (67% of respondents), ‘detection engineering and tuning’ (65%), and ‘threat hunting’ (64%). ‘Remediation and incident containment’ came in lower, with 43% of respondents. “This suggests that while security leaders recognize AI’s power in identification and analysis, there’s a current tendency to view human intervention as crucial in response and containment phases,” suggests Prophet. Prophet Security provides Prophet AI – an agentic AI SOC Platform aimed at solving the issues that cause alert fatigue in SOC analysts, and the problems that result from alert fatigue. The underlying cause of alert fatigue is too much data. Prophet notes that organizations have an average of 17 alert generating tools, while larger companies have more than 20 such tools. “Organizations equate more data with better visibility,” comments Marco Giuliani (VP, head of research with ThreatDown at Malwarebytes). But the opposite happens. “Too much data equals zero visibility – analysts simply don’t know where to look anymore, and the signal gets completely lost in the noise.” Peter Coroneos (founder at Cybermindz) agrees: too much data and too much noise leads to habituation and vigilance decrement. “In other words,” he says, “SOC analysts’ ability to spot the real threat among the false positives declines over time.” To cope with the noise, 57% of organizations deliberately suppress detection rules, accepting higher risk just to stay afloat, says Francis Odum (founder and CEO of Software Analyst Cyber Research). “When teams suppress alerts, they trade short-term survivability for long-term visibility debt. Every silenced rule becomes a gap attackers can probe and commoditize. Based on SACR research, the remedy is not ‘more analysts,’ but smarter detection engineering and automation.” Manoj Bhatt (founder at Cyberhash) expands on the suppression issue. “We are finding that large volumes of alerts are flagged – however, most people tune these down to a manageable level which means that alerts might be missed. There is a very real problem that not all alerts are being actioned, and SOC teams are missing them.” It’s not only the business that is at risk – the human suffers equally. Lisa Ventura (chief executive and founder at AI and Cyber Security Association) continues: “Alert fatigue is crushing the morale and effectiveness of our cyber security professionals.” The people who should be the first line of defense are being worn down by the relentless noise. “They’re becoming desensitized to alerts, rushing through investigations, and frankly, some are leaving the industry altogether because of burnout.” Alert fatigue is caused by too much data with far too much noise. Manual triaging becomes hit and miss – false positives wear down the analyst while potential false negatives are not investigated. “Alert fatigue really isn’t just a buzzword,” explains Nikki Webb (director at Custodian360). “It burns out analysts and gives organizations a dangerous illusion of safety. Dashboards full of alerts mean nothing if no one has time to investigate them properly.” Alessandro Di Carlo (senior product manager at ThreatDown) expands on the problem: “The effects are pretty clear: slower triage and response, higher analyst fatigue and turnover, and ultimately a dip in service quality because time is wasted chasing benign events.” Criminal adoption and skill in using AI is making matters worse: attacks are increasing in speed, complexity and stealth. This is introducing a new problem – a cybersecurity version of the uncertainty principle. “Consider an organization going through an after-breach forensics process, determining what the vector was and how the breach was conducted,” says Kris Bondi (CEO and co-founder at Mimoto). “Then, it creates a plan of action of how to recognize and respond to this type of attack in the future. In the time it took the organization to go through these steps, the AI-enhanced attack has evolved several times. The organization is preparing for a version of an attack that is generations old.” The more we understand the last attack, the less we know about the next attack – and that’s all down to the criminal use of AI. The next question, then, is whether the defenders can solve long standing alert fatigue, the increasing cause of alert fatigue, and the potentially disastrous effect of alert fatigue, by employing their own AI? The consensus appears to be, ‘Yes, but only with care…’ Grant Oviatt (Prophet Security co-founder and head of security operations) is an enthusiast. “SOC analysts are overwhelmed with security alerts that need investigation, leading to fatigue and eventually missed detections. AI provides a way to handle repetitive and tedious tasks at a fraction of the time, ultimately freeing up analysts’ time to focus on high-value work.” Albert Estevez Polo (field CTO global at Zero Networks) explains the ‘yes’ part of an AI solution. “There are many manual tasks in a SOC and of course AI is good at automating certain types of tasks. In fact, we see more companies built around this concept of AI-SOC just because AI can be called with API, and you can build agents to correlate alerts and discard false positives by implementing other logics. This is great for SOC analysts because now they have an AI-Assistant to do all the homework and save tons of human hours that can finally be used to review the reports/tasks run by the AI Agents.” SOC AI can reduce the workload to improve human efficiency. This also introduces the ‘but’ part of the solution. “AI acts as a force multiplier in the SOC. It can automate tasks like triage and even perform autonomous investigation, allowing security teams to pivot from reactive alert-handling to more strategic initiatives like threat hunting, cyber resilience planning, and risk mitigation,” explains Nicole Carignan (Senior VP security & AI strategy, and field CISO at Darktrace). “However,” she adds, “realizing this benefit requires a workforce that understands how to effectively use, operationalize, govern, and most importantly trust these technologies. It’s not enough to simply deploy an AI solution – security practitioners must understand how the underlying machine learning techniques function, what their strengths and limitations are, and how to evaluate their outputs. Without explainability and trust, AI risks exacerbating alert fatigue rather than solving it.” It would be a mistake to simply install or create an AI SOC and expect the existing analysts to just get on with it. “SOC analysts must understand how AI models work, their limits, and how to understand AI-driven insights,” adds Casey Ellis (founder at Bugcrowd). “This isn’t about turning analysts into data scientists. It’s about equipping them to work alongside AI effectively – understanding when to trust it, when to question it, and how to leverage it to decrease noise and focus on high-priority threats. Training should focus on integrating AI into workflows, emphasizing its role in augmenting human decision-making rather than replacing it.” SOC AI will be good at the ‘heavy lifting’ on initial triage, enriching alerts with context, and helping prioritize what really needs human attention. “This could free up our analysts to do what they do best – the complex thinking, strategic analysis, and decision-making that humans excel at,” says Ventura. “However, we need to be honest about AI’s limitations. It’s only as good as the data we train it on, and it can perpetuate biases. More importantly, cybercriminals aren’t sitting still, they’re already working on ways to evade AI detection.” The current situation is that criminal AI is rapidly increasing the workload on SOC analysts. Those analysts must simultaneously learn and employ their own defensive AI to counter this. Whether the latter can cancel out the former remains an open question. SOC AI is essential, but not a panacea. The human wellness side of the SOC will remain paramount. Coroneos comments on this. AI can help in system defense, “For example by filtering noise, clustering alerts and helping to prioritize what matters most.” But it is not a cure-all; attackers are adapting quickly using AI offensively. The mental stress on defenders will remain high. “The resolution lies in a hybrid approach by combining AI-driven efficiencies with human resilience strategies such as attention training and vigilance preservation.” Webb, a user of SOC AI, summarizes: “AI can filter and enrich, but it cannot replace human judgment. In our SOC, every single alert gets human eyes. That is non-negotiable,” she says. “Machines do not and cannot understand nuance, intent, or business context the way an experienced analyst does. We are a long way from trusting AI alone with that responsibility. The future is not about replacing people with AI, it is about AI supporting people. Analysts must stay at the center of SOC operations, because only humans can truly separate noise from risk.” The conclusion is simple. Prophet’s survey demonstrates that SOCs are not coping. Criminal use of AI will worsen this. Defensive use of AI by the SOC is not an option but an inevitable necessity; but whether this will give defenders a new advantage or simply rebalance the status quo is yet to be seen. Related: Dropzone AI Raises $37 Million for Autonomous SOC Analyst Related: SentinelOne’s Purple AI Athena Brings Autonomous Decision-Making to the SOC Related: Exaforce Banks Hefty $75 Million for AI-Powered SOC Remake Related: Google Targets SOC Overload With Automated AI Alert and Malware Analysis Tools

securityweek.comSep 11, 2025extracted

Attackers Abuse Virtual Private Servers to Compromise SaaS Accounts

Threat actors are abusing virtual private servers (VPS) to compromise software-as-a-service (SaaS) accounts, according to an investigation by Darktrace. The cybersecurity vendor identified coordinated SaaS account compromises across multiple customer environments, all of which involved logins from IP addresses linked to various VPS providers. The compromised accounts were used to conduct follow-on phishing attacks, with threat actors taking steps to avoid detection and enable persistent access. A VPS is a legitimate virtualized server widely used by businesses to provide dedicated resources and control on a shared physical device. However, they can be abused by attackers to bypass geolocation-based defenses by mimicking local traffic, evading IP reputation checks with clean, newly provisioned infrastructure and blending into legitimate behavior. “VPS providers like Hyonix and Host Universal offer rapid setup and minimal open-source intelligence (OSINT) footprint, making detection difficult. These services are not only fast to deploy but also affordable, making them attractive to attackers seeking anonymous, low-cost infrastructure for scalable campaigns,” the Darktrace researchers warned in a blog published on August 21. “Such attacks tend to be targeted and persistent, often timed to coincide with legitimate user activity, a tactic that renders traditional security tools largely ineffective,” they continued. How Attackers Compromise SaaS Via VPS Infrastructure A number of incidents impacting Darktrace customer SaaS accounts were observed in May 2025. Many alerts linked back to VPS provider Hyonix and included brute-force attempts, anomalous logins and phishing campaign-related inbox rule creation. In one case two internal devices on a customer environment-initiated logins from rare external IPs associated with the VPS providers Hyonix and Host Universal. These logins occurred within minutes of legitimate user activity from distant geolocations, indicating session hijacking had occurred. Shortly after the logins, the threat actor deleted emails referring to invoice documents from the user’s ‘Sent Items’ folder, suggesting an attempt to hide phishing emails that had been sent from the compromised account. The researchers also observed a series of suspicious SaaS activities had taken place, including the creation of new email rules. These rules were given vague or generic names, likely to reduce the likelihood of detection while quietly redirecting or deleting incoming emails to maintain access and conceal malicious mailbox activity from legitimate users. Although no lateral movement was detected from the compromised SaaS accounts, multiple user devices mirrored this activity, suggesting a coordinated campaign. “Notably, three users had near identical similar inbox rules created, while another user had a different rule related to fake invoices, reinforcing the likelihood of a shared infrastructure and technique set,” the researchers noted. On one account, attempts to modify account recovery settings were observed, while on another, the attacker reset passwords or updated security information from rare external IPs. These actions suggested an intent to remain undetected while potentially setting the stage for data exfiltration or spam distribution.

infosecurity-magazine.comAug 22, 2025extracted

Managing the Trust-Risk Equation in AI: Predicting Hallucinations Before They Strike

Hallucinations are a continuing and inevitable problem for LLMs because they are a byproduct of operation rather than a bug in design. But what if we knew when and why they happen? “Hallucinations – the generation of plausible but false, fabricated, or nonsensical content – are not just common, they are mathematically unavoidable in all computable LLMs… hallucinations are not bugs, they are inevitable byproducts of how LLMs are built, and for enterprise applications, that’s a death knell,” wrote Srini Pagidyala(co-founder of Aigo AI) on LinkedIn. Neil Johnson (professor of physics at GWU), goes further, “More worrying,” he says, “is that output can mysteriously tip mid-response from good (correct) to bad (misleading or wrong) without the user noticing.” The use of AI is a trust / risk balance. Its benefits to cybersecurity cannot be ignored, but there is always the potential for the response to be wrong. Johnson is trying to add predictability to the unpredictable hallucination with the help of mathematics. His latest paper (Multispin Physics of AI Tipping Points and Hallucinations) extends arguments expressed in an earlier paper. “Establishing a mathematical mapping to a multispin thermal system, we reveal a hidden tipping instability at the scale of the AI’s ‘atom’ (basic Attention head),” he writes. That tipping is the point at which the mathematical inevitability becomes the practical reality. His work will not eliminate hallucinations but could add visibility and potentially reduce the incidence of hallucinations in the future. Given the increasing use of AI and the tendency to believe AI output above human expertise, “Harms and lawsuits from unnoticed good-to-bad output tipping look set to skyrocket globally across medical, mental health, financial, commercial, government and military AI domains.” His solution is to “derive a simple formula that reveals, explains and predicts its output tipping, as well as the impact of the user’s prompt choice and training bias.” The basis is a multispin thermal system, which is a concept from theoretical physics. A ‘spin’ is the quantum property or state of a particle. A multispin system models how a collection of these particles interact with each other. A thermal system adds ‘heat’ to the process, causing individual ’spins’ to flip their state in a binary fashion. Johnson established a mathematical equivalence between gen-AI’s Attention engine and a multispin thermal system. The spins equate to the AI’s tokens; the thermal element equates to the degree of randomness built into the Attention engine, and the interactions involved correspond to how the tokens affect each other. The resulting model allowed Johnson to develop a formula able to predict the point at which the token/spins become unstable and result in hallucinations. Simple is a relative word, but the formula demonstrates the tipping point to D (bad token; that is, hallucination) type output given an initial prompt P1 P2 etc., will occur immediately after this number of B (good token; that is, correct) outputs. If Johnson is correct, this knowledge won’t stop hallucinations, but could help AI designers reduce their incidence by being aware of the tipping point, and could theoretically help users know when one occurs. “This is different from most of the hallucination detection / fixing approaches which require the response to be complete before you can evaluate it,” comments Brad Micklea (CEO and co-founder of Jozu. “For example, Uncertainty Quantification is well proven (~80% success rate), but it cannot run until the response is generated.” If Johnson’s formula is correct however, LLMs could be built to monitor their own responses in real time and stop bad responses as they are happening. Implementation would be tricky, demanding increased compute power and decreased response times – and that might not suit the foundation models’ business plans. Diana Kelley (CISO at Noma Security) notes that OpenAI’s own research shows improved performance comes at the cost of increased hallucinations: GPT o3 hallucinated in a third of the benchmark tests while GPT o4 did so in almost half of them. It is difficult to see the foundation models reducing performance and increasing costs in future models. “It might be more valuable, though,” adds Micklea, “for self-hosted models where the risks of hallucinations justify the added cost, such as medical or defense applications.” Johnson believes two new design strategies suggested by his research could improve model performance in the future. The first he calls ‘gap cooling’: “Increase the gap between the top two pairs of interactions when they become too close (that is, just before tipping).” The second he calls ’temperature annealing’: “Control the temperature dial T′ to balance between the risks of output tipping and excessive output randomness.” “If we could predict when AI models might start giving unreliable responses – like when they’re close to ‘tipping points’ or more likely to hallucinate – it would be a game changer for keeping digital conversations safe and accurate. Automated tools that can spot these moments in real-time would help users trust what they see or read, knowing there’s an extra layer of detection watching out for sketchy responses before any harm is done,” says J Stephen Kowski (field CISO at SlashNext. “Having tech that flags risky AI behavior empowers people to make smarter choices online and stops threats before they turn into real headaches. That’s the kind of protection everyone should expect as AI gets even smarter.” However, Johnson’s work remains theory. It looks promising, but nobody should expect any dramatic elimination or even reduction of hallucinations in the immediate future. “Bottom line,” comments John Allen (SVP and field CISO at Darktrace): “While theoretically intriguing, organizations shouldn’t expect immediate practical applications – but this could help inform future model development approaches.” Related: AI Hallucinations Create a New Software Supply Chain Threat Related: ChatGPT Hallucinations Can Be Exploited to Distribute Malicious Code Packages Related: Epic AI Fails And What We Can Learn From Them Related: AI Hallucinated Packages Fool Unsuspecting Developers

securityweek.comAug 11, 2025extracted

Software di sicurezza informatica: soluzioni per aziende

cybersecurity360.itAug 8, 2025extracted

Black Hat USA 2025 – Summary of Vendor Announcements (Part 2)

Many companies are showcasing their cybersecurity products and services this week at the 2025 edition of the Black Hat conference in Las Vegas. To help cut through the clutter, the SecurityWeek team is publishing a digest summarizing some of the announcements made by vendors at Black Hat USA 2025, including new products and services, updates to existing offerings, reports, and other initiatives. This is part two of the roundup. The first part covers announcements made in the days leading up to the event, as well as some of the announcements made on Monday, August 4. 1Password study 1Password has announced new findings from a survey of North American security leaders on AI usage and emerging threats. Nearly two-thirds (63%) of security leaders feel the biggest internal security threat is their employees unknowingly giving AI agents access to sensitive data. Additionally, 50% say their organizations have experienced a confirmed or suspected cyber incident caused by AI or AI agents in the last six months. Arctic Wolf announces new integrations Arctic Wolf has announced new integrations with Microsoft, Oracle, OneLogin, and CyberArk. These new integrations expand the platform’s openness and flexibility, enabling organizations to address the challenges of fragmented security tools and increasingly dynamic environments. AttackIQ launches Watchtower Adversarial exposure validation firm AttackIQ has launched Watchtower, an AI-powered threat intelligence analyzer designed to provide visibility into the threat actors actively targeting enterprises. AttackIQ Watchtower hyperlocalizes threat intelligence and generates tailored emulation scenarios to deliver contextual insights. Black Duck unveils enhancements to application security assistant Black Duck Software has announced enhancements to Duck Assist, its AI-powered application security assistant. The new capabilities bring automated security scanning for AI-generated code and AI-driven code fixes directly into developer environments. Cyware launches open source AI integration server Cyware unveiled a major expansion to its AI-powered threat intelligence ecosystem with the launch of Cyware Model Context Protocol (MCP) Server, an open source capability that enables security teams to connect LLMs and AI assistants directly into their threat intel and automation workflows. The new MCP Server supports natural language-driven actions and investigations using secure AI agents, seamless integration with customer-owned LLMs, and full context and control across detection, enrichment, and response. Darktrace cyber threat landscape report Darktrace released a retrospective of the first six months of 2025, highlighting key trends across the threat landscape. Darktrace observed a wide range of tactics during this period, used by various types of threat actors, including APTs, Malware-as-a-Service (MaaS) and Ransomware-as-a-Service (RaaS) groups. Flashpoint releases new AI search and investigation capabilities Threat intelligence firm Flashpoint has released two new AI-powered capabilities for its flagship platform Flashpoint Ignite: AI Summarization for Search and AI Summarization for Investigations. AI Summarization for Search distills thousands of posts into clear, actionable insight in seconds. AI Summarization for Investigations is an automation that transforms investigations from an evidence-collection point into a dynamic, insight-generating engine. Menlo launches Secure Storage Menlo Security launched Menlo Secure Storage and Menlo Adaptive Web Modules. These two new offerings are designed to give organizations greater control over user experiences and sensitive data. Menlo Secure Storage allows users to upload and download files between trusted applications without saving anything locally. Menlo Adaptive Web Modules is a suite of cloud-based browser controls that gives organizations fine-grained control over how users interact with web content. NetRise platform update Software supply chain security firm NetRise has introduced a significant update to its core product platform to help users prioritize, mitigate, and remediate vulnerabilities found in the software they develop. New features include context on whether a vulnerability is reachable, SBOM editing, fix version data, and platform re-architecture. Netskope expands platform Network security company Netskope has unveiled two platform advancements. Netskope One Copilot for Private Access is an AI-powered assistant that optimizes universal zero trust network access deployment. Netskope Model Context Protocol (MCP) server, currently in preview, provides a secure bridge that enables LLMs like Microsoft Copilot, Claude Desktop, Google Vertex and Amazon Bedrock to interact directly and safely with Netskope APIs, enabling LLMs to gain context from a customer’s Netskope environment. PointGuard AI expands platform AI security and governance firm PointGuard AI announced an expansion of its platform to provide AI discovery, threat correlation, and protection across the full AI stack. The platform now scans GitHub and other source code repositories to identify AI-related components including models, datasets, notebooks, API calls, and libraries, along with connections to external applications or data sources. Reveal Security unveils platform Identity security company Reveal Security has launched the Reveal Platform, which provides complete visibility into identity actions, both human and non-human, across all SaaS, cloud, and custom applications. This complete view gives security teams the ability to preemptively take action before a security incident or breach occurs. SandboxAQ launches AQtive Guard Protect SandboxAQ announced AQtive Guard Protect, a solution designed to secure the full lifecycle of non-human identities and cryptographic assets. The solution provides deep observability into machine identities across multi-cloud, hybrid, and containerized environments. It also provides automation to reduce the overhead of managing and rotating secrets, as well as last-mile governance to ensure high-risk credentials don’t slip through the cracks. Semperis offering protects highly targeted non-human identities Semperis launched Service Account Protection Essential, a new edition of its Directory Services Protector, designed to tackle one of the most persistent threats in Active Directory environments: service accounts. The new tool helps organizations identify service accounts, build an inventory, and continually monitor them for security vulnerabilities. It also discovers unknown and misplaced service accounts, identifies risky configurations and critical exposures, detects stale and misconfigured accounts, and alerts on malicious and anomalous behavior. SOCRadar launches agentic threat intelligence platform SOCRadar launched SOCRadar Agentic Threat Intelligence, a new platform that automates threat intelligence through the deployment of autonomous AI agents that proactively detect, analyze, and respond to external threats with minimal human intervention. XM Cyber integration with Google Cloud XM Cyber announced that its Continuous Exposure Management (CEM) platform is now fully embedded into Google Security Operations, including its cloud-native SIEM and SOAR. This gives enterprises real-world exposure data to enrich threat detection—helping SOC teams cut through noise and act faster. Xona platform update Secure access solutions provider Xona announced the general availability of Xona Platform v5.4.2, a major update that extends centralized control, scalable auditability, and unified policy enforcement across globally distributed operational environments. ZEST Security adds AWS Service Control Policies ZEST Security announced the addition of AWS Service Control Policies (SCPs) as part of its broader exposure mitigation offering. This gives security teams a new, code-free way to proactively block attacker activity and reduce cloud exposure. By adding SCPs into its mitigation offering, ZEST is allowing security teams to proactively limit attacker activity and reduce exposure without waiting on patches and code changes.

securityweek.comAug 6, 2025extracted

Web-Based AI Usage Surge Shifts Global Internet Traffic Patterns

A significant increase in web traffic to AI-related websites has marked a shift in how users interact with artificial intelligence. Traffic to AI tool platforms rose from 7 billion visits in February 2024 to 10.53 billion in January 2025 (a 50% increase) according to new findings from Menlo Security. This shift is mainly due to the continued reliance on browsers to access generative AI (GenAI) tools. While some AI deployments have transitioned to desktop or private applications, approximately 80% of generative AI (GenAI) usage still occurs within browsers. This trend persists because browsers are universally available across devices, easily integrate with other services and platforms, and allow developers to launch AI tools quickly and at scale. “There has been a lot more information and awareness about the risks and threats with regard to AI provided over the last year,” said Satyam Sinha, CEO and co-founder at Acuvity. “In our discussions with customers, it is evident that they are overwhelmed about how to prioritize and tackle the issues.” The Current GenAI Landscape Menlo Security's recent study, which analyzed AI interactions from hundreds of organizations globally during 30 days in May and June 2025, provides key insights into the current GenAI landscape: 5.6 million GenAI site visits recorded in a single month 6500 unique GenAI domains versus 3000 apps 400 million weekly ChatGPT users, with more than 95% using the free tier 75% of organizations in the Asia-Pacific region adopting GenAI A 130% year-over-year increase in zero-hour phishing attacks, now driven by AI “Understanding the evolving threat landscape and the techniques adversaries are using to manipulate AI is key and critical for defenders [...] to effectively secure their AI systems,” said Nicole Carignan, senior vice president at Darktrace. “Cybersecurity plays a crucial role and is foundational to AI safety.” Security Risks Rise Alongside Adoption The rise in shadow AI use is also exacerbating concerns, according to the report, with 68% of employees using free-tier AI tools like ChatGPT via personal accounts and 57% inputting sensitive data. “The generative nature of shadow AI, and its lack of guardrails, makes it potentially more powerful and more dangerous than traditional shadow IT,” said Kris Bondi, CEO of Mimoto. “Its stealth usage adds to the risk associated with it.” Krishna Vishnubhotla of Zimperium warned that GenAI-powered phishing campaigns are escalating in both speed and realism. “Relying on outdated defenses is no longer enough – security must evolve as fast as the threats,” he added. As the AI landscape continues to expand at a rapid pace, so too must the security strategies designed to protect it.

infosecurity-magazine.comAug 4, 2025extracted

Il malware Auto-Color distribuito grazie ad una vulnerabilità di SAP NetWeaver

Betti RHC, la prima graphic novel al mondo dedicata alla cybersecurity awareness, ha finalmente il suo sito ufficiale. Uno spazio tutto suo dove scoprire il progetto, sfogliare le copertine degli episodi e immergersi nel mondo di Betti: la giovane laureanda in informatica che, dopo la morte misteriosa del padre, si trasforma nell'hacker più potente del mondo. Una storia avvincente che, episodio dopo episodio, affronta una minaccia digitale diversa — dal phishing al ransomware, fino al cyberbullismo — e insegna a riconoscerla e a difendersi, senza che sembri mai una lezione. Sul sito trovate tutto ciò che rende Betti un progetto diverso dal solito: la sua filosofia, le anteprime delle tavole e il racconto di come nasce ogni volume. Perché dietro Betti RHC c'è solo lavoro umano: ogni tavola è disegnata interamente a mano dagli artisti del Gruppo Arte di Red Hot Cyber, senza alcun uso di intelligenza artificiale. E a garantire che ogni storia sia realistica e tecnicamente corretta c'è la supervisione degli hacker etici del gruppo HackerHood, che mantengono il racconto fedele al mondo reale della sicurezza informatica. C'è spazio anche per le aziende, che possono usare Betti come strumento di awareness diverso dai soliti corsi: acquistare i volumi, personalizzarli con il proprio brand o sponsorizzare nuovi episodi. E come primo regalo, l'episodio "Byte the Silence", dedicato al cyberbullismo, è scaricabile gratuitamente per uso personale. Perché la miglior difesa, in fondo, è una bella storia. 👉 Scopri tutto su https://betti.redhotcyber.com/

redhotcyber.comAug 1, 2025extracted

Cybercriminals ‘Spooked’ After Scattered Spider Arrests

The notorious Scattered Spider group seems to have been rattled and its cybercriminal activity stalled following the arrest of four individuals linked to the group and suspected of orchestrating cyber-attacks. The arrests took place in the UK on July 10, with the four individuals suspected of Computer Misuse Act offences relating to cyber-attacks on three British retailers in April 2025. They were later bailed pending further enquiries. Since then, cybersecurity firm Mandiant, which tracks The Com-affiliated group as UNC3944, said it has not observed any new intrusions directly attributable to this specific threat actor. The Com is a loosely organized online criminal network involving thousands of English-speaking individuals. Commenting on the four individuals arrested, Charles Carmakal, CTO, Mandiant Consulting – Google Cloud, told Infosecurity, “They aren't the only members who are involved in Scattered Spider intrusions. But the arrests have spooked other members.” Anthony Freed, director of research at ransomware prevention firm Halcyon, concurred that since the arrests Scattered Spider activity has “gone quiet.” He noted that the last confirmed attack linked to UNC3944 hit in May 2025 when Darktrace observed the group’s hallmark social engineering tactics in action. Since then, several airlines, including Hawaiian Airlines in late June and WestJet in mid-June, were targeted with some suspecting links to Scattered Spider due to familiar tradecraft. These events have not been definitively attributed to Scattered Spider. “That said, the Scattered Spider threat has not diminished, it is likely they are being more cautious in light of the arrests,” Freed said. Christiaan Beek, senior director, threat analytics at Rapid7, told Infosecurity that the firm’s researchers had observed some aggressive phishing email and social engineering campaigns in the past two weeks. However, Beek said it was too early to determine if these were linked to Scattered Spider. Other Threat Actors Persist with Similar Tradecraft Other groups, like ShinyHunters (UNC6040), also affiliated to The Com, employ the same type of social engineering tactics as Scattered Spider, such as targeting IT help desks to gain initial access. “While one group may be temporarily dormant, others won't relent," said Carmakal. In June 2025, the Google Threat Intelligence Group (GTIG) highlighted ShinyHunters’ specialist vishing campaigns designed to compromise organizations' Salesforce instances for large-scale data theft and subsequent extortion. In recent months, the group has demonstrated repeated success in impersonating IT support personnel in telephone-based social-engineering engagements. It has been reported that the data breach that affected Qantas Airlines in June, which was linked by some cybersecurity professionals to Scattered Spider, is likely linked to ShinyHunter. The outfit has also been linked to a data breach that impacted Allianz Life in July. The insurer revealed that the attackers exfiltrated sensitive data after gaining access to a third-party, cloud-based CRM system. CISA Updates Scattered Spider Advisory The US Cybersecurity and Infrastructure Security Agency (CISA) updated it advisory on Scattered Spider on July 29. CISA and international partners said they had identified new tactics, techniques and procedures (TTPs) associated with the cybercriminal group. These included more sophisticated social engineering techniques. While Scattered Spider initially began their activity relying on broad phishing campaigns, the threat actors are now employing more targeted and multilayered spearphishing and vishing operations. One hallmark of their activity is targeting IT help desks via spearphishing calls which aim to convince personnel to reset passwords and/or transfer MFA tokens. The update also highlighted new legitimate remote access tools that are exploited by Scattered Spider including Teleport.sh and AnyDesk. Additional malware and ransomware variants have also been identified that have been used to exfiltrate data and encrypt target organizations’ systems. CISA confirmed the group deployed DragonForce ransomware alongside its usual TTPs. Deployment of this ransomware encrypts a target organization’s VMware Elastic Sky X integrated (ESXi) servers. Earlier in 2025, it is understood that DragonForce encryptors were used as part of a cyber-attack against UK retailer Marks & Spencer which disrupted the company’s operations and online retail arm. CISA also identified RattyRAT as another malware used by the hackers. This is a Java-based remote access trojan used for persistent, stealth access and initial reconnaissance. CISA’s latest advisory recommends that organizations employ enhanced monitoring against unauthorized account misuse and look for risky logins within environments where sign-in attempts have been flagged as potentially compromised due to suspicious activity or unusual behavior.

infosecurity-magazine.comJul 31, 2025extracted

Hackers Exploit SAP Vulnerability to Breach Linux Systems and Deploy Auto-Color Malware

Threat actors have been observed exploiting a now-patched critical SAP NetWeaver flaw to deliver the Auto-Color backdoor in an attack targeting a U.S.-based chemicals company in April 2025. "Over the course of three days, a threat actor gained access to the customer's network, attempted to download several suspicious files and communicated with malicious infrastructure linked to Auto-Color malware," Darktrace said in a report shared with The Hacker News. The vulnerability in question is CVE-2025-31324, a severe unauthenticated file upload bug in SAP NetWeaver that enables remote code execution (RCE). It was patched by SAP in April. Auto-Color, first documented by Palo Alto Networks Unit 42 earlier this February, functions akin to a remote access trojan, enabling remote access to compromised Linux hosts. It was observed in attacks targeting universities and government organizations in North America and Asia between November and December 2024. The malware has been found to hide its malicious behavior should it fail to connect to its command-and-control (C2) server, a sign that the threat actors are looking to evade detection by giving the impression that it's benign. It supports various features, including reverse shell, file creation and execution, system proxy configuration, global payload manipulation, system profiling, and even self-removal when a kill switch is triggered. The incident detected by Darktrace took place on April 28, when it was alerted to the download of a suspicious ELF binary on an internet-exposed machine likely running SAP NetWeaver. That said, initial signs of scanning activity are said to have occurred at least three days prior. "CVE-2025-31324 was leveraged in this instance to launch a second-stage attack, involving the compromise of the internet-facing device and the download of an ELF file representing the Auto-Color malware," the company said. "From initial intrusion to the failed establishment of C2 communication, the Auto-Color malware showed a clear understanding of Linux internals and demonstrated calculated restraint designed to minimize exposure and reduce the risk of detection."

thehackernews.comJul 30, 2025extracted

Hackers exploit SAP NetWeaver bug to deploy Linux Auto-Color malware

Hackers were spotted exploiting a critical SAP NetWeaver vulnerability tracked as CVE-2025-31324 to deploy the Auto-Color Linux malware in a cyberattack on a U.S.-based chemicals company. Cybersecurity firm Darktrace discovered the attack during an incident response in April 2025, where an investigation revealed that the Auto-Color malware had evolved to include additional advanced evasion tactics. Darktrace reports that the attack started on April 25, but active exploitation occurred two days later, delivering an ELF (Linux executable) file onto the targeted machine. The Auto-Color malware was first documented by Palo Alto Networks' Unit 42 researchers in February 2025, who highlighted its evasive nature and difficulty in eradicating once it has established a foothold on a machine. The backdoor adjusts its behavior based on the user privilege level it runs from, and uses 'ld.so.preload' for stealthy persistence via shared object injection. Auto-Color features capabilities such as arbitrary command execution, file modification, reverse shell for full remote access, proxy traffic forwarding, and dynamic configuration updating. It also has a rootkit module that hides its malicious activities from security tools. Unit 42 could not discover the initial infection vector from the attacks it observed, targeting universities and government organizations in North America and Asia. According to the latest research by Darktrace, the threat actors behind Auto-Color exploit CVE-2025-31324, a critical vulnerability in NetWeaver that allows unauthenticated attackers to upload malicious binaries to achieve remote code execution (RCE). SAP fixed the flaw in April 2025, while security firms ReliaQuest, Onapsis, and watchTowr reported seeing active exploitation attempts, which culminated only a few days later. By May, ransomware actors and Chinese state hackers had joined in the exploitation activity, while Mandiant reported unearthing evidence of zero-day exploitation for CVE-2025-31324 since at least mid-March 2025. Apart from the initial access vector, Darktrace also discovered a new evasion measure implemented on the latest version of Auto-Color. If Auto-Color cannot connect to its hardcoded Command-and-Control (C2) server, it suppresses most of its malicious behavior. This applies to sandboxed and air-gapped environments, where the malware would appear benign to analysts. "If the C2 server is unreachable, Auto-Color effectively stalls and refrains from deploying its full malicious functionality, appearing benign to analysts," explains Darktrace. "This behavior prevents reverse engineering efforts from uncovering its payloads, credential harvesting mechanisms, or persistence techniques." This is added on top of what Unit 42 documented previously, including privilege-aware execution logic, use of benign filenames, hooking libc functions, use of a fake logs directory, C2 connections over TLS, unique hashes for each sample, and the existence of a "kill switch." With Auto-Color now actively exploiting CVE-2025-31324, administrators should act quickly to apply the security updates or mitigations provided in the customer-only SAP bulletin. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

bleepingcomputer.comJul 29, 2025extracted

Auto-Color Backdoor Malware Exploits SAP Vulnerability

A new backdoor malware campaign targeting Linux systems and exploiting a critical vulnerability in SAP has been uncovered by cybersecurity researchers. The malware, known as Auto-Color, was deployed in a targeted intrusion against a US-based chemicals company in April 2025. Threat Exploits SAP NetWeaver Vulnerability According to an advisory published by Darktrace on July 29, the attack began when a threat actor exploited CVE-2025-31324, a critical flaw in SAP NetWeaver that allows remote file uploads and potential system compromise. Despite SAP disclosing the vulnerability on April 24, threat actors quickly moved to weaponize it. Jason Soroko, senior fellow at Sectigo said, "Organizations running SAP NetWeaver need to recognize that the Visual Composer Metadata Uploader flaw CVE-2025-31324 is now weaponized in the wild and that adversaries are using it to plant the Auto Color remote access trojan on Linux hosts." Using a ZIP file delivered through a malicious URI, the attacker initiated the intrusion on April 27. Darktrace detected signs of DNS tunneling and suspicious inbound connections, including downloads from known malicious infrastructure. Within 24 hours, the malware Auto-Color was delivered via an ELF file retrieved from a remote server. "Darktrace's thorough analysis and findings reveal the first documented case of threat actors exploiting the critical SAP NetWeaver vulnerability [...] to deploy Auto-Color backdoor malware," said Frankie Sclafani, director of cybersecurity enablement, Deepwatch. "This finding represents a significant escalation in multi-stage attack sophistication and warrants immediate attention from organizations." How Auto-Color Operates and Evades Detection Auto-Color functions as a Remote Access Trojan (RAT), capable of adapting its behavior based on system privileges. When run with root access, it installs a disguised shared object library, libcext.so.2, through preload manipulation, an advanced Linux persistence method. "The exploit requires no authentication and lets attackers upload helper scripts that pull an ELF payload which renames itself to /var/log/cross/auto-color," Soroko added, "and persists by adding a fake library called libcext.so.2 to ld.so.preload." Once embedded, exploit renames itself to mimic log files and obscure its presence. Its activity hinges on establishing an outbound connection over TLS to a hardcoded command-and-control (C2) server. If the C2 server is unreachable, the malware suppresses most behavior, appearing dormant to evade detection in sandboxed or offline environments. "CVE-2025-31324 is a wake-up call for every organization running SAP," said Jonathan Stross, SAP security analyst at Pathlock. "Darktrace's detailed research highlights how creatively and effectively attackers can leverage known vulnerabilities to advance along the cyber kill chain." Key characteristics of Auto-Color include: Privilege-aware execution paths Preload-based persistence using ld.so.preload Static, encrypted configuration embedded at compile time A modular C2 command set with capabilities like reverse shell, file execution and kill switch Darktrace stated that its Autonomous Response blocked outbound connections to the malware's command-and-control (C2) infrastructure, preventing the malware from progressing beyond its initial installation. "This is a clear example of why SAP security must be integrated into broader IT security operations," Stross explained. "Traditional SAP Basis teams often lack the experience dealing with RATs [...] SAP teams, IT operations and security must work together."

infosecurity-magazine.comJul 29, 2025extracted