60
60
Kaspersky Security Bulletin 2020
60
60
60
CISA tells operators to harden Siemens S7 PLCs. Here’s how to do it without disrupting production
CISA, NSA, FBI and other agencies warn of active targeting of internet-exposed Siemens S7 PLCs and urge patching, exposure removal and hardening.
Joint advisory AA26-231A from the NSA, CISA, FBI, Department of Energy and EPA warns that actors are actively targeting Siemens S7 PLCs using internet scanning, AI-assisted scripts and libraries such as Snap7 and python-snap7 over S7comm on TCP port 102. The advisory covers S7-200 through S7-1500 series controllers and recommends patching, removing internet exposure, access controls, monitoring and disabling unneeded services. Siemens states no new S7 vulnerabilities are involved, only misconfigurations addressed in existing ProductCERT guidance SSB-104599. The article details how to apply each measure without breaking production dependencies such as remote I/O, HMI links and diagnostics.
62
60
60
60
7th September – Threat Intelligence Report
Check Point weekly bulletin: exploited SonicWall SMA 1000 zero-days (CVE-2026-83548/49), JFrog Artifactory auth bypass, and a 2.8M-patient Baylor Genetics breach.
Check Point's weekly bulletin covers breaches including Thomson Reuters' C-Track platform (court records across 11 US states and Canada), Baylor Genetics (2.8M patients and employees, SSNs included), Hit casinos in Slovenia, and Dropbox (~5,000 accounts via abused Lenovo email verification). SonicWall patched two exploited SMA 1000 zero-days, including CVE-2026-83548, a CVSS 10.0 pre-authentication SSRF, while JFrog fixed exploited authentication bypass CVE-2026-82329 (CVSS 9.8). Malware and actor coverage includes Gambling Goblin, JSCeal, Mirage Kitten's NodeRabbit/PollCat campaign, and DPRK Contagious Interview macOS activity, plus a FalconFlank privilege-escalation PoC against CrowdStrike Falcon.
70
CISA Red Team Fully Compromised Two Critical Infrastructure Orgs
CISA red teams achieved full domain and cloud compromise at two critical infrastructure orgs; one SOC never detected the intrusion.
CISA advisory AA26-237A documents two simultaneous red team assessments. Organization A (Government Services sector) missed the intrusion entirely, as default credentials on a web app, ADCS ESC1 abuse, and thousands of false-positive alerts let the red team reach sensitive business systems and read SOC email. Organization B (Water/Wastewater sector) detected, isolated, and reimaged hosts quickly, but both orgs lacked Conditional Access for workload identities, and B still exposed DCSync, Golden Ticket, and OT network attack paths.
72
CISA Red Team Compromised Two Critical Infrastructure Orgs, One Detected Nothing
CISA red teams fully compromised two critical infrastructure orgs with similar tradecraft; one detected nothing, the other contained phishing within minutes.
CISA advisory AA26-237A, 'A Tale of Two SOCs,' describes two simultaneous red team assessments of a Government Services organization and a Water and Wastewater Systems organization, both compromised to the domain level. Organization A never detected the intrusion, enabled by default credentials, a misconfigured AD CS template (ESC1), cleartext credentials, non-expiring static AWS keys, and over-permissioned Entra ID applications. Organization B detected and isolated phishing within 2-20 minutes, though the red team still reached krbtgt via DCSync from cleartext SCCM credentials. CISA attributes the outcome gap to people and processes rather than the security tools themselves.
65
US agencies warn of AI-powered attacks on Siemens industrial controllers
NSA, CISA, FBI, DOE, and EPA warn threat actors use AI-assisted scripts and snap7 libraries to access internet-exposed Siemens S7 PLCs in critical infrastructure sectors.
NSA, CISA, FBI, DOE, and EPA issued a joint advisory warning that threat actors combine open-source snap7.dll/python-snap7 libraries with AI-generated scripts to gain read/write access to Siemens S7-200 through S7-1500 PLCs over the S7comm protocol. Actors use Censys and ZoomEye to find internet-exposed devices and abuse default or weak credentials, with activity assessed as persistent reconnaissance and positioning for future write operations. Agencies urge device inventory, patching, removing PLCs from the internet, and hardening; the pattern resembles Iran-linked CyberAv3ngers targeting of Rockwell, Schneider, and Siemens PLCs.
70
60
60
60
60
60
60
60
60
60
60
60