Search: “hack back”

8 stories in the last 30d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll AI safety & security 38 Threat actor 30 Data breach 16 Policy & legal 16 Malware 12 AI industry 11 Exploit / PoC 8 Industry 7 Vulnerability 6 Phishing & fraud 4 AI policy 4 Research 3 Advisory 2 Ransomware 1

SeverityAll critical 6 high 50 medium 48 low 0 info 55

Critical ScreenConnect flaw now actively exploited in attacks

CISA confirms active exploitation of critical ConnectWise ScreenConnect flaw CVE-2026-84869, ordering federal agencies to mitigate within three days.

ConnectWise's ScreenConnect flaw CVE-2026-84869, an improper privilege management and missing authorization bug, lets attackers with basic privileges transfer or execute files through active remote sessions in low-complexity attacks without user interaction. It is patched in ScreenConnect 26.6.5; CISA added it to the KEV catalog and ordered US federal agencies to secure systems within three days. Shadowserver tracks over 1,000 unpatched exposed instances, mostly in North America (758) and Europe (180). This is the fourth actively exploited ScreenConnect flaw since 2024; earlier issues were abused by Kimsuky and ransomware gangs.

BleepingComputer11:14 UTC · 2h agoExploit / PoC in the wild 4 sources CVE-2026-84869 CVE-2024-1709 CVE-2025-3935+1 CVEs1

NSA, CISA, FBI, DOE, and EPA Warn of Active AI

Five US agencies warn of active AI-assisted attacks on internet-exposed Siemens S7 PLCs across critical infrastructure, using disguised snap7 scripts for pre-positioning reconnaissance.

NSA, CISA, FBI, DOE, and EPA issued joint advisory CISA AA26-231A warning of an active hacking campaign against Siemens S7-series PLCs, from S7-200 through S7-1500 F-series, across US critical infrastructure. Threat actors use internet scanning services such as Censys and ZoomEye to locate exposed controllers, then perform read operations over S7comm on TCP port 102 using the legitimate snap7.dll and python-snap7 libraries, disguising AI-generated exploitation scripts as monitoring tools. The agencies assess the activity as pre-positioning ahead of possible process disruption, equipment damage, or safety incidents in Energy, Water, Critical Manufacturing, Chemical, Food and Agriculture, and Commercial Facilities sectors.

Security AffairsAug 20, 17:36 UTC · 26d agoExploit / PoC in the wild

Hackers Drain $320 Million From Liquid Network, Then Return Most of It

Hackers exploited an Elements bug to drain about 4,000 BTC (~$320M) from Liquid Network's federation wallet, then returned 3,400 BTC after Blockstream patched.

An attacker drained roughly 4,000 of 4,200 BTC (~$320M) from Bitcoin's Liquid Network federation wallet on September 6 by exploiting a bug in Elements, the open-source code powering the sidechain, which allowed unbacked L-BTC tokens that were redeemed for real Bitcoin through SideSwap's authorized peg-out mechanism. The self-described white-hat attackers negotiated publicly via OP_RETURN on-chain messages, demanding the bridge nodes be patched before returning 3,400 BTC (~$262.6M) and keeping about 598 BTC (~$47M). Blockstream confirmed the affected bridge nodes were patched; the network remains paused while federation members complete security work, and experts debate whether the act legally constitutes extortion.

Security AffairsSep 8, 20:35 UTC · 7d agoExploit / PoC in the wild

Poland's CERT Warns of Active Exploitation of Critical Zimbra Collaboration Suite Flaw

CERT Polska confirms active exploitation of critical unauthenticated RCE CVE-2026-73570 in Zimbra Collaboration Suite, patched July 20.

CERT Polska confirmed threat actors are actively exploiting CVE-2026-73570, an unauthenticated OS command injection in Zimbra Collaboration Suite allowing arbitrary shell commands as the zimbra user. Exploitation requires the SNMP trap service via snmp_notify with swatchdog running, which is enabled by default; Shadowserver tracks over 12,100 internet-exposed Zimbra servers. Zimbra fixed the flaw in version 10.1.20 on July 20, 2026, 28 days before exploitation was confirmed. Historical Zimbra targeting includes Winter Vivern, APT29, and APT28 campaigns.

Security AffairsAug 21, 09:14 UTC · 26d agoExploit / PoC in the wildCVE-2026-73570

Attackers Exploit Critical Cisco FMC Flaw to deploy Qilin ransomware

Three threat groups, including Qilin ransomware operators, exploit critical Cisco FMC flaws CVE-2026-20079 and CVE-2026-20316 for root access, credential theft, and ransomware.

Cisco Talos identified three post-compromise clusters exploiting recently patched Cisco Secure Firewall Management Center flaws. UAT-12197 deploys JSP web shells and harvests credentials; UAT-11823 (with Sandworm-overlapping tooling) installs Cyclops Blink for persistence; UAT-11988 (Qilin) uses static credentials, extensive reconnaissance, SOCKS5 proxies, reverse-SSH tunnels, AV killers, and ransomware deployment. CISA added CVE-2026-20079 to the KEV catalog with a September 12, 2026 patch deadline for federal agencies; Cisco urges immediate hotfix application.

Security Affairsupdated Sep 14, 09:27 UTC · 2d agofirst Sep 11, 10:14 UTC · 5d agoExploit / PoC in the wild 14 sources CVE-2026-20079 CVE-2026-203165· 2 reads

Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity

Huntress observed rogue ScreenConnect deployments with worm-like VBScript propagation across unrelated organizations, prompting a ConnectWise advisory on file transfer behavior.

Huntress identified multiple incidents in late August 2026 where social engineering led to rogue ScreenConnect remote access clients deployed on victim machines, which then spawned wscript.exe to run four VBScript payloads (1.vbs through 4.vbs) for profiling, telemetry collection, and persistence via a WindowsServiceHost Run key. Modified ScreenConnect clients propagated the VBScript chain to connected endpoints, creating worm-like spread. ConnectWise published an advisory on September 3, 2026, confirming an issue affecting file transfer behavior in both cloud and on-premises ScreenConnect deployments, with a CVE and fix expected within the week; partners were advised to review and disable TransferFiles permissions in the interim.

HuntressSep 3, 08:50 UTC · 13d agoExploit / PoC in the wild1

⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More

Weekly recap: suspected China-nexus APT exploited VMware vCenter CVE-2026-59310, Lazarus used Windows zero-day CVE-2026-68820, and macOS flaw dropped Monero miners.

The week's top stories included a suspected China-nexus APT exploiting VMware vCenter CVE-2026-59310 (CVSS 9.8), a directory-traversal flaw enabling arbitrary code execution, with backdoors, reverse SSH and Babuk-derived ransomware deployed, per QUIRSO. NCSC-NL reported active exploitation of macOS Screen Sharing flaw CVE-2026-65400 (CVSS 9.8) to install Monero miners on systems with port 5900 exposed. Lazarus Group exploited Windows zero-day CVE-2026-68820 (CVSS 7.0) in Operation Dream Job, delivering ForestTiger and Troy backdoors to defense and aerospace targets. GeoServer patched a critical SQL injection flaw exploited within hours of disclosure, and Jamf analyzed the new Amnesia Stealer for macOS with live browser control.

The Hacker NewsAug 17, 17:57 UTC · 29d agoExploit / PoC in the wildCVE-2026-59310 CVE-2026-65400 CVE-2026-688201

Four Nation-State Actors Used the Same Chrome Zero-Day Exploit Kit Within 12 Days

Proofpoint reports four nation-state actors, mostly China-nexus, adopted the BlueMoon Chrome and Windows zero-day exploit kit within 12 days, targeting US organizations.

Proofpoint tracked an exploit kit dubbed BlueMoon that chains CVE-2026-85046, a Chrome V8 type-confusion bug, with an unnamed V8 sandbox escape and CVE-2026-85880, a Windows kernel privilege escalation using ALPC and the Windows Notification Facility. The first observed use was by China-nexus TA412 (APT31, Violet Typhoon, JungleBamboo) on August 28, 2026 against US NGOs, mining companies, and commodity trading firms, followed by UNK_LateNight targeting US aerospace and defense companies on September 2. Both V8 bugs were patch-gap zero-days: the fix was committed to Chromium on August 7 but reached stable Chrome on September 3, enabling rapid weaponization from public patches. TA412's post-exploitation payload, GemStone, is a malicious browser extension posing as an AI-powered Google Gemini companion that captures keystrokes, cookies, screenshots, and browsing history via a Cloudflare Worker C2.

Security Affairsupdated Sep 15, 10:17 UTC · 1d agofirst Sep 10, 05:35 UTC · 6d agoExploit / PoC in the wild 23 sources CVE-2026-85046 CVE-2026-858801