ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “command injection”

37 stories in the last 30d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllExploit / PoC 63Threat actor 41Malware 38Vulnerability 35AI safety & security 15Research 11Advisory 11Industry 10Tools 8Phishing & fraud 5Data breach 2Model release 1Policy & legal 1AI tools & infra 1
SeverityAllcritical 33high 89medium 79low 6info 35

H1 2026 Malware Vulnerability Trends

Recorded Future's H1 2026 report finds 215 actively exploited CVEs, RAT dominance, NFC payment fraud, and AI-augmented but not autonomous tradecraft.

Recorded Future's Insikt Group identified 215 actively exploited CVEs in H1 2026, up 34% from 161 in H1 2025, with the most impactful flaws combining network reachability, no authentication, and code execution. AsyncRAT was the top malware family, with AsyncRAT, Cobalt Strike, XWorm, Stealc, and REMCOS remaining top-ten staples; Android NFC malware like NFCShare and NGate enabled payment card theft and ATM cash-outs. AI-enabled attacks remained additive to established tradecraft, concentrated in Levels 1-3 of Recorded Future's AIM3 maturity model, with AI-assisted vulnerability research (e.g., Claude Mythos fixing 271 Firefox bugs in Firefox 150) inflating NVD disclosure volumes 43% above the prior six-month average. The report urges defenders to prioritize remotely exploitable RCE flaws, behavioral detection, developer credential security, and third-party oversight.

Recorded Future · 14d agoThreat actor in the wild1

ThreatsDay: Gogs 10.0 RCE, n8n Workflow-to-RCE, $10M Reward, GLM

Hacker News ThreatsDay roundup: Defender BTR.sys driver abuse, DoJ charges 17 Mabna Institute members over IRGC-linked intrusions, Grandoreiro sideloading, OpenAI monitoring.

Check Point researchers showed Microsoft's signed Defender Boot-Time Removal driver (BTR.sys) can be repurposed as a universal kernel operation engine to bypass endpoint security without BYOVD. The DoJ charged 17 members of Iran's Mabna Institute, which on behalf of the IRGC stole over 31 TB of academic data from 144 US universities and compromised roughly 8,000 of 100,000 targeted professor accounts; the State Department offered a $10 million reward for five defendants. Separately, Acronis tracked a Grandoreiro campaign abusing DLL sideloading in the Duplicate Files Finder app across Latin America and Spain, while ErrTraffic ClickFix campaigns deliver Cruciferra (BYOVD) and Remus Stealer. OpenAI also previewed Private Safety Processing, a privacy-centric approach to monitoring model misuse without retaining customer content.

The Hacker News · 27d agoThreat actor1

Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P

Hunt.io disclosed Operation CameraSwarm, compromising 14,500+ Dahua cameras via credential attacks, auth bypass CVEs, and P2P relay techniques across Ukraine and Russia.

Hunt.io reconstructed a campaign codenamed Operation CameraSwarm that compromised over 14,530 Dahua devices between June 17 and July 22, 2026. Attack paths included credential attacks against 12,324 IPs, exploitation of CVE-2021-33044 and CVE-2021-33045 affecting 1,923 cameras, and P2P relay access to 283 devices behind NAT. The operator, assessed as Russian-speaking, left behind 2,616 files including tooling and campaign logs, with confirmed compromises concentrated in Ukraine and Russia. Dahua advises factory resets and firmware updates; both 2021 CVEs remain in CISA's KEV catalog.

The Hacker News · 22d agoThreat actor in the wildCVE-2021-33044CVE-2021-33045CVE-2024-39943+1 CVEs1

Inside Operation CameraSwarm: How One Actor Took Over 14,000 Dahua Cameras

One actor compromised over 14,000 Dahua cameras in Ukraine and Russia using brute-force, authentication bypass, and cloud relay serial-number abuse.

Hunt.io reconstructed Operation CameraSwarm from an exposed operator directory, revealing one actor compromised 14,000+ Dahua cameras between June 17 and July 22, 2026, mainly in Ukraine and Russia. The toolkit included a brute-force engine, a two-flaw 2021 authentication-bypass chain planting a persistent backdoor account on 1,923 cameras, and abuse of Dahua's cloud relay where 89.4% of probed serials returned open, unauthenticated channels. A SalatStealer Windows binary and Defender-disabling PowerShell script were staged on the same server but appear unrelated to the camera campaign.

Security Affairs · 28d agoThreat actor in the wildCVE-2024-39943CVE-2025-31702

North Korean Hackers Deploy New Linux Espionage Toolkit

Rapid7 says North Korea-aligned actors use a new Linux espionage toolkit (ted HAProxy backdoor, CurlRAT) against South Korean automotive and media targets.

Rapid7 reports a stealthy Linux framework comprising a custom HAProxy backdoor ('ted'), trojanized system binaries (agetty, atd, crond, polkitd, sshd), an SSH keylogger, and CurlRAT that polls C&C every 12 hours. Initial access came via a Groupware login portal flaw, with credential harvesting enabling lateral movement to internal systems. The toolkit supports long-term surveillance, HTTP traffic interception/injection, and drive-by downloads, likely in use since late 2024. Infrastructure and artifacts overlap Operation SyncHole, suggesting Lazarus or APT37 involvement.

SecurityWeek · 9d agoThreat actor in the wild1

DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors

Rapid7 uncovered a DPRK-linked Linux toolkit using a HAProxy-embedded ted backdoor, SSH keylogger, and curlRAT against South Korean media and automotive firms.

Rapid7 Labs identified a previously undocumented framework attributed with medium confidence to DPRK actors, targeting South Korean automotive and media organizations likely since early 2025. The toolkit embeds a backdoor compiled into HAProxy 2.8.12 using its filter API, plus trojanized crond, agetty, atd, sshd, and polkitd, an SSH keylogger storing credentials under /var/lib/sshd/, and a curl-based RAT with a watchdog thread. It enables remote command execution, malicious script injection into served webpages (a watering-hole loop), credential harvesting, and long-term surveillance. Hardcoded C2s are associated with APT37 via ThreatFox, and exposed groupware portals and mail servers align with Kimsuky tradecraft; the initial access vector and any CVE remain unconfirmed.

Rapid7 Blog · 12d agoThreat actor in the wild1

North Korea-linked Hackers Hide a Backdoor Inside HAProxy

Rapid7 reports North Korea-linked hackers implanted a backdoor compiled into HAProxy at South Korean automotive and media firms, enabling covert C2 and credential theft.

Rapid7 documented a previously undocumented Linux toolkit hitting South Korean automotive and media organizations, centered on a backdoor compiled directly into victims' HAProxy 2.8.12. The 'ted backdoor' uses HAProxy's native filter API to intercept HTTP traffic, receive C2 commands hidden in requests to a fake image path, and erase all traces from logs and counters; the toolkit also trojanizes crond, agetty, atd, sshd, and polkitd, adds an SSH keylogger, and runs curlRAT with virtualization checks. It can inject scripts or replace page content for selected victims, turning the load balancer into a watering hole. Attribution sits at medium confidence toward North Korean state actors, with overlaps to APT37-linked infrastructure and a concurrent Lazarus campaign; the campaign's command domains have since gone dark.

Security Affairs · 8d agoThreat actor in the wild1

UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit

Cisco Talos exposes UAT-10147, a Chinese-speaking group using AI tools to automate intrusions, deploy SPECTRE, BadIIS, and rootkits against web servers worldwide.

Cisco Talos detailed UAT-10147, a Chinese-speaking cybercrime group conducting SEO fraud and data theft against Windows and Linux web servers in education, media, technology, and gaming sectors, with most victims in Brazil, Bolivia, China, Canada, and Vietnam. The actor exploits publicly disclosed vulnerabilities for initial access, including Zimbra (CVE-2022-27925) and Alibaba Nacos (CVE-2021-29441), and abuses Linux LPE flaws like CVE-2022-0847 and CVE-2021-3156 for root. Its toolset includes AI-assisted frameworks DeepAudit and PentestGPT, plus implants such as SPECTRE, BadIIS, Quasar RAT, Gh0stCringe, and Noodle RAT. An exposed directory contained a target list of roughly 170,000 URLs, with the US, India, UK, Germany, and Netherlands as top destinations.

The Hacker News · 20d agoThreat actor in the wildCVE-2022-0995CVE-2021-3156CVE-2015-5287+8 CVEs

GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI

GTIG's Q2 2026 tracker shows adversaries adopting agentic AI workflows, including credential harvesting in under six hours and supply chain attacks by UNC6780.

Google Threat Intelligence Group's Q2 2026 report documents adversaries moving from basic prompting to agentic AI workflows and automation, including a cloud compromise followed by agent-enabled mass credential harvesting executed in under six hours. It tracks financially motivated actor UNC6780 (TeamPCP) conducting large-scale open source supply chain compromises across PyPI, npm, and Docker Hub since March 2026, deploying credential stealers. The report also highlights growing targeting of proprietary AI models, source code, prompts, and API credentials, plus LLMJacking practices where adversaries steal developer credentials or hijack cloud infrastructure to run unauthorized AI workloads.

Google Threat Intelligence · 8d agoThreat actor in the wild1

TrueConf Server Flaws Exploited to Replace Client Installers with PhantomCore

Head Mare exploits TrueConf server flaws to install web shells and deliver PhantomCore and PhantomGraph backdoors at Russian organizations.

Kaspersky detected July 2026 attacks by the threat actor Head Mare exploiting a vulnerability chain (KLCERT-26-057 and KLCERT-26-058) in unpatched TrueConf videoconferencing servers. The chain enables arbitrary code execution with SYSTEM privileges, deployment of a web shell at locale.php, and replacement of client installers with versions delivering the PhantomCore backdoor and PhantomGraph, which uses Microsoft OneDrive as C2. Targets span Russian instrumentation, electronics, transport, energy, IT, and software firms. Patches shipped in TrueConf Server 5.3.9, 5.4.9, and 5.5.5 on June 18, 2026.

The Hacker News · 26d agoThreat actor in the wild1

Counterfeit installers to system compromise: Tracking a deceptive software download campaign

Microsoft tracks a counterfeit software-installer campaign compromising multinationals' China operations, moderately linked to the Silver Fox (Yinhu) actor.

Microsoft Defender Experts is tracking an active campaign using spoofed software download sites for brands such as Razer, Kaspersky, Microsoft Edge, Calibre, and Baidu Netdisk on .com.cn and .hl.cn domains, delivering installer archives whose hashes change per download, indicating server-side payload generation. The implants establish persistence, weaken security protections, and communicate with attacker-controlled infrastructure, with confirmed compromises across healthcare, manufacturing, gaming, technology, logistics, government, and education. Microsoft assesses with moderate confidence that the activity matches the publicly reported Silver Fox (Yinhu) fake software campaign; it has not attributed it to a nation-state actor.

Microsoft Security Blog · 15d agoThreat actor in the wild1

China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs

China-nexus espionage group Fire Ant compromised Cisco IOS XR routers and TACACS servers to harvest credentials, capture traffic and suppress logs.

Sygnia investigated an intrusion in which Fire Ant expanded beyond VMware hypervisors to Cisco IOS XR routers, TACACS servers and Linux management hosts. The actor deployed purpose-built router implants that hid a GRE tunnel, filtered log messages, captured PCAPs uploaded to external FTP servers, and used TacTap to inject a library into tac_plus and steal TACACS credentials obfuscated with a single-byte XOR key of 0xEF. A Linux backdoor named BridgeAgent masqueraded as a Zabbix agent, persisted via a root systemd unit, disguised itself as /usr/bin/gnome-shell and received commands over TLS on port 443. The group also used Medusa and REPTILE rootkits, SSH backdoors and renamed binaries impersonating SentinelOne and Cybereason agents, while suppressing logs, disabling SELinux and rewriting login history. Sygnia assesses strong overlap with UNC3886 and published IoCs.

The Hacker News · 16d agoThreat actor in the wild1

Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week

Proofpoint links four espionage clusters, including China's APT31, using shared exploit kit BlueMoon chaining Chrome V8 and Windows ALPC zero-days.

Proofpoint reports a previously undocumented exploit kit, BlueMoon, chains Chrome V8 type confusion CVE-2026-85046 with an unassigned V8 sandbox escape and Windows ALPC heap overflow CVE-2026-85880 to achieve code execution and local privilege escalation. APT31 first used it on August 28, 2026 against US NGOs, mining, and commodity trading firms, deploying the GemStone browser backdoor disguised as a Google Gemini extension via the GhostChrome-X integrity bypass. UNK_LateNight, UNK_DoubleCheck, and UNK_QuietRacket followed on September 2-3, targeting US aerospace, Vietnamese manufacturing, and Indonesian/Singaporean sectors with ShadowPad and sideloaded Rust and .NET payloads. Both V8 flaws were patch-gap zero-days, and verbose code suggests possible AI-assisted development.

The Hacker News · 7d agoThreat actor in the wild 2 sourcesCVE-2026-85046CVE-2026-858801

Silver Fox Targets Japanese Manufacturer with 3

Chinese group Silver Fox used new vulnerable drivers and DLL side-loading to deploy ValleyRAT at a Japanese industrial manufacturer.

Cato Networks detailed a Silver Fox campaign against a Japanese industrial manufacturing organization combining new vulnerable-driver abuse (BootRepair.sys and EnPortv.sys alongside wsftprm.sys), DLL side-loading via Zeon Corporation PDF binaries, and NTDLL unhooking to deliver ValleyRAT (Winos 4.0), a Gh0st RAT variant. The chain starts with an invoice-themed phishing lure hosting attacker-controlled content on legitimate QQ and Tencent Cloud services. Shellcode is injected into svchost.exe via thread-context hijacking, and a dual watchdog design pairs payload monitoring with a scheduled-task batch script for persistence. A separate 180-day VirusTotal retrohunt found 146 Atlas RAT samples across six PDB builds, though the Silver Fox link remains circumstantial.

The Hacker News · 20d agoThreat actor in the wild

Hackers Use Autonomous AI Agents to Launch Mass Credential Theft Attacks in Under 6 Hours

Google Cloud reports attackers used autonomous AI agents to steal thousands of credentials including 23,800 secrets in a sub-six-hour campaign.

Google Cloud threat intelligence observed financially motivated attackers compromising cloud infrastructure and using AI coding agents guided by written playbook files to scan, harvest and rotate credentials within six hours. An exposed C2 dashboard for a framework called Recon organized and validated more than 23,800 stolen secrets, including API keys for cloud and AI services. Related activity includes UNC6780 publishing the trojanized tiktoken_mcp package on PyPI to target CI/CD tokens and the DUSTMAKER stealer hiding in .claude, .vscode and .cursor workspace directories.

Cyber Security News · 7d agoThreat actor in the wild

Hackers Use Autonomous AI Agents to Harvest Thousands of Credentials in Under 6 Hours

Google Cloud documents a financially motivated actor using autonomous AI agents on a compromised cloud tenant to harvest 23,800+ credentials in under six hours.

Google Cloud reports that an attacker compromised a victim's cloud environment and deployed a multi-agent framework driven by preconfigured Markdown playbooks to autonomously handle vulnerability scanning, credential collection, error troubleshooting, and IP rotation. An exposed command-and-control server hosted the 'Recon' framework with a live dashboard managing over 23,800 harvested secrets, including cloud and AI-service API keys. The report also ties DUSTMAKER to UNC6780/TeamPCP, targeting AI development tools and CI/CD systems via trojanized MCP packages such as tiktoken_mcp. Google has disabled linked assets and updated protections after the actors' operational security failures.

Cyber Security News · 1d agoThreat actor in the wild

Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks

Symantec reports multiple threat actors, including KongTuke, abusing the trusted signed Node.js runtime and blockchain C2 (EtherHiding) to deliver backdoors in targeted attacks.

Symantec's Threat Hunter Team (Broadcom) reports that since February 2026 attackers have used the legitimate signed node.exe binary and interpreted scripts to deliver implants while evading signature-based detection, hitting government departments, technology companies, and hotels. One intrusion at an Asian technology firm (March 23–July 25, 2026) used ClickFix social engineering, the official Node.js installer, and EtherHiding to fetch commands via the Ethereum blockchain after AdaptixC2 and Cobalt Strike attempts were blocked. Related chains involve KongTuke (Woodgnat) using ModeloRAT, Mistic, NexShield, and GateKeeper, plus C2Looper, AsukaStealer, and EtherRAT; GuidePoint Security separately linked a fake-CAPTCHA ClickFix campaign to at least 31 compromised organizations using the Polygon blockchain as a dynamic C2 address book.

The Hacker News · 13d agoThreat actor in the wild1

Iran-linked APT Mirage Kitten Uses Fake Job Tests to Spread Malware

Kaspersky reports Iran-linked Mirage Kitten delivers new NodeRabbit and PollCat malware to fintech and aviation targets via fake LinkedIn coding assessments.

Kaspersky researchers documented two previously undocumented Node.js malware families, NodeRabbit and PollCat, attributed with high confidence to Iran-linked APT group Mirage Kitten. The malware is delivered via fake recruiter personas on LinkedIn offering coding assessments hosted on Amazon S3, with instructions banning AI assistants so AI code-review tools would not flag the trojanized npm packages. NodeRabbit is cross-platform (Windows, Linux, macOS), uses AES-256-GCM-encrypted C2 on Azure, includes sandbox checks, and one variant installs a fake 'GitHub Copilot Helper' VS Code extension plus Git hook persistence. Victims identified so far are in fintech and aviation organizations across Egypt, Ethiopia, and Afghanistan.

Security Affairs · 14d agoThreat actor in the wild2

Attackers impersonate popular AI brands to spread malware

Sophos documented 38 MDR cases where attackers impersonated AI brands like Claude and Perplexity to deliver infostealers and backdoors.

Sophos X-Ops analyzed 12 months of MDR cases and confirmed 38 incidents involving AI. Software impersonation accounted for 30 cases, with Claude impersonated in 26; fake installers used an 'InstallFix' technique delivering mshta commands, in-memory payloads, and process hollowing. Malicious browser extensions posing as AI assistants, including a fake Perplexity extension with 10,000 installs, acted as infostealers. In one case, attackers used a Claude coding agent to develop a Rust remote access trojan communicating over Slack after an SQL injection compromise.

Help Net Security · 27d agoThreat actor in the wild

BengalSEO Poisons Bing Search Results to Deliver MayaBot and Tech Support Scams

DFIR Report exposes BengalSEO, an India-based SEO-poisoning operation running since 2015, delivering MayaBot malware and tech support scams via Bing results.

The DFIR Report details BengalSEO, a financially motivated cluster operating from Rajasthan, India, since at least 2015, run through two IT service providers: WeConnect Solutions LLC and Garage2Global. The group uses black-hat SEO techniques—backlinks, DOM injection, DOM shuffling, keyword stuffing—to push lure pages to the top of Microsoft Bing results, routing victims through a traffic distribution system to either the custom MayaBot malware (which delivers an XMRig cryptominer and enables C2) or tech support scam call centers. A Vizio decoy page had 2,000 backlinks from 167 unique external domains, and Matomo analytics is used for victim fingerprinting, with the tracking domain appearing in 1,112 urlscan.io results.

The Hacker News · 8d agoThreat actor in the wild

Clop-Linked Windchill Web Shell Decrypts Credentials and Maps Engineering Data

ReliaQuest details a bespoke JSP web shell that Clop deploys on hacked PTC Windchill and FlexPLM servers after exploiting CVE-2026-12569.

ReliaQuest analyzed a custom Java web shell planted on vulnerable PTC Windchill and FlexPLM servers following exploitation of CVE-2026-12569 (CVSS 9.3). The implant decrypts Windchill keystore credentials including the LDAP manager password, enumerates the file vault for engineering data, and loads attacker-supplied Java classes in memory for post-exploitation. Commands let operators read and delete files, exfiltrate results, and deliver follow-on payloads such as ransomware. Ransom-ISAC, eCrime.ch and Defused previously attributed the campaign to the Clop data-theft extortion group.

The Hacker News · 28d agoThreat actor in the wildCVE-2026-12569

StopAndProtect Turns 2,000 Hacked WordPress Sites Into a Criminal Network

Check Point uncovered StopAndProtect, a cybercrime operation using ~2,000 hacked WordPress sites for ClickFix-driven malware delivery, data theft, surveillance, and ransomware.

Check Point Research identified the StopAndProtect operation in May 2026; it abuses close to 2,000 compromised WordPress sites, many running outdated software, to host malware stages, act as C2, and store stolen data. Infection starts with fake CAPTCHA ClickFix prompts that trick visitors into running a PowerShell command, followed by .NET downloaders deploying ransomware, SMB/USB worm, lockscreen, chat, and credential-stealing components. Rather than always encrypting, operators selectively exfiltrate file lists and specific files; researchers found 700+ stolen-data archives, roughly 31,000 screenshots, and 6,000+ unique victim IP addresses, including WhatsApp activity monitoring.

Security Affairs · 27d agoThreat actor in the wild

One Exploit Chain, Two Espionage Campaigns: Chrome and Windows Under Fire

Two China-linked APT groups reused identical Chrome/Windows zero-day chain against NGOs, deploying GRIMWIDGE backdoor and LONGTALE credential-stealing extension.

Volexity reports that China-linked actors UTA0560 and JungleBamboo (APT31/TA412) ran byte-identical Chrome/Windows exploit chains against NGOs starting September 1, 2026, combining Chrome type confusion CVE-2026-85046, WebAssembly sandbox escape CVE-2026-87491, and Windows kernel flaw CVE-2026-85880. The Chrome bug was fixed in Chromium source but not yet shipped to Chrome users, making it an effective zero-day with an unusual patch gap. UTA0560 delivered the in-memory GRIMWEDGE JScript backdoor, while JungleBamboo deployed the SUPERSTOMP loader installing LONGTALE, a malicious Chrome extension disguised as Google Gemini that steals cookies, session tokens, and keystrokes. Volexity assesses with low confidence the exploit chain was sold or shared among different Chinese end-users.

Security Affairsupdated · 14h agofirst · 1d agoThreat actor in the wild 11 sourcesCVE-2026-85046CVE-2026-87491CVE-2026-858804

Hackers Are Hiding Espionage Infrastructure Inside Ordinary-Looking Casino Websites

Infoblox links China-aligned APT PeckBirdy C2 infrastructure hidden in casino and adult websites targeting Asian government, finance, IT, and education sectors.

Infoblox researchers report that China-aligned APT groups have used casino and adult websites as cover for PeckBirdy, a JavaScript command-and-control framework active since 2023. The sites embed C2 servers, register service workers for persistence, and serve fake browser-update prompts delivering backdoors capable of running commands, stealing credentials, and providing remote access. Targeted sectors across Asia include education, IT, banking, financial services, and government. Just over 3% of Infoblox enterprise customers resolved at least one PeckBirdy C2 domain, with detection coverage on VirusTotal ranging from 13 detections to none.

Cyber Security News · 18h agoThreat actor 2 sources

Iranian Hackers Pose as Recruiters to Deliver Cross

Kaspersky attributes new cross-platform RATs NodeRabbit and PollCat to Iranian group Nimbus Manticore, spread via recruiter-themed LinkedIn lures.

Kaspersky links two previously undocumented malware families, NodeRabbit (Node.js) and PollCat (obfuscated JavaScript), to the Iranian threat actor Nimbus Manticore, also known as Iranian Dream Job. Victims in Afghanistan, Egypt, and Ethiopia received trojanized coding challenge archives containing fake npm packages (colorized_terminal, pretty-log) that silently launched the RATs as background processes. NodeRabbit contacts Azure-hosted C2 servers via checkin, task, and result API endpoints and supports 11 commands including shell execution, file operations, and network enumeration. Persistence is platform-specific: Windows Run keys or scheduled tasks, Linux cron entries, and macOS launch agents, impersonating Microsoft Edge updates or Intel's Driver & Support Assistant.

The Hacker News · 14d agoThreat actor

Thai Broadband Provider Hacked via Fortinet Vulnerability

Hackers exploited Fortinet CVE-2024-21762 RCE to breach Thai broadband provider 3BB, deploying MeshCentral backdoors and credential-harvesting tools across its network.

Hunt.io uncovered an intrusion staging directory in Thailand containing 298 files of custom tooling built for Triple T Broadband (3BB) and its former owner Jasmine. Initial access came via fingerprinting a FortiGate SSL-VPN appliance and exploiting CVE-2024-21762 for remote code execution, after probing CVE-2018-13379, CVE-2022-42475, and CVE-2023-27997. The actor also probed F5 BIG-IP for CVE-2021-22986, CVE-2022-1388, and CVE-2023-46747, escalated privileges with PwnKit and Dirty COW, used MeshCentral as a C2 backdoor, harvested SSH/database/SNMP/Radius credentials, deployed PHP web shells, and ran cleanup scripts to hide the intrusion.

SecurityWeek · 1d agoThreat actor in the wildCVE-2018-13379CVE-2022-42475CVE-2023-27997+4 CVEs

Hackers Weaponize AI Safety Guardrails to Hide Malware From LLM-Powered Security Scanners

ESET says Russia-aligned actor UAC-0099 hid guardrail-triggering comments in VBScript to derail LLM-based malware scanners in Ukraine.

ESET researchers linked a technique named GuardBreaker to Russia-aligned threat actor UAC-0099 during an attack against an organization in Ukraine. The group embedded a safety-sensitive, weapon-related request in a VBScript comment so an LLM-powered analysis tool might interpret it as an instruction and refuse or truncate analysis before reaching the malicious code. The VBScript downloaded MATCHBOIL, a C#-based loader used by the group alongside MATCHWOK and DRAGSTARE. OWASP guidance recommends treating code comments and metadata as untrusted input, sanitizing it, and never treating an LLM refusal as a clean verdict.

GBHackersupdated · 5d agofirst · 5d agoThreat actor in the wild 3 sources1

⚡ Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and More

US agencies warn of AI-assisted attacks on exposed Siemens PLCs; the week also saw GitLab CVE-2026-19478 exploited and trojanized npm packages found.

The weekly recap leads with a US government warning that threat actors use AI-generated scripts and Censys/ZoomEye scanning to attack internet-exposed Siemens S7 PLCs in water, energy and manufacturing, calling it an active threat. Other stories include active exploitation of GitLab CVE-2026-19478 (CVSS 9.4, unauthenticated project rewriting), 14 trojanized npm packages delivering the RedC2 4.0 Linux backdoor, and the Zombie Card attack that revives expired Visa cards for contactless payment fraud. It also covers suspected Russian clusters UNC6293, UNC7005 and UNC5976 phishing campaigns, a faster Cloudflare Workers Spectre JWT leak, and a bespoke Cl0p JSP web shell deployed after exploiting PTC Windchill flaws.

The Hacker News · 19d agoThreat actor in the wildCVE-2026-194781

China-linked Fire Ant Hides Inside Trusted Infrastructure

China-linked Fire Ant backdoored Cisco IOS XR routers, injected TACACS libraries to steal credentials, and rewrote logs across infrastructure targets.

Sygnia reports the China-linked espionage group Fire Ant compromised Cisco IOS XR routers with purpose-built malware, injected a library into the TACACS authentication daemon to capture live credential material, and manipulated syslog so only messages containing 'Health' were logged. The group used GRE tunnel interfaces with no commit history, rewrote wtmp/utmp/btmp login records, and deployed dormant deep backdoors on Linux systems — one disguised as a SentinelOne agent, another activated by raw network traffic carrying a magic string. Code-level overlap with UNC3886 tooling suggests evolution of that China-nexus cluster's TACACS credential-collection techniques, and Fire Ant used compromised infrastructure to scan SSH, RDP and web ports toward high-value networks.

Security Affairs · 16d agoThreat actor in the wild1

Dark Caracal Deploys New Go Malware With Ethereum-Based C2 Fallback

Dark Caracal targeted a Venezuelan communications organization with new Go-based GoCaracal malware and an updated Bandook backdoor using Ethereum smart-contract C2 fallback.

Arctic Wolf Labs linked a June 2026 intrusion against a communications organization in Venezuela to Dark Caracal, an espionage group associated with Lebanon's General Directorate of General Security (GDGS). The group deployed a previously undocumented Go-based framework called GoCaracal in lightweight and extended builds alongside a Delphi-loaded Bandook backdoor, with delivery via phishing emails carrying weaponized SVG attachments through URL shorteners. The extended build uses a custom Solidity contract, BulletproofC2, on Ethereum to retrieve replacement C2 addresses without redeploying malware, and Arctic Wolf traced 249 related samples from January to July 2026 showing a modular evolution arc.

Security Affairs · 20d agoThreat actor in the wild

Hackers Spend Nearly $7 Million on Expired Domains to Redirect Traffic to Scams and Malware

Infoblox reports Sable Squirrel spent nearly $7 million on expired domains to redirect traffic to illegal sports streaming, gambling, and malware infrastructure.

Infoblox tracked 50,400 dropcatch domains re-registered daily in gTLDs during H1 2026, nearly 20% of all registrations, with .net and .xyz leading. The threat actor Sable Squirrel has acquired more than 10,000 expired domains supporting Asian sports piracy brands such as Xoilac, Cakhia, 90phut, Socolive, and MiTom while promoting betting services like VSBet, ColaScore, and 8xbet. The operation, assessed as Vietnam-based and overlapping the dismantled Xoi Lac TV streaming network, targets users in Vietnam, South Korea, Japan, Taiwan, Singapore, and Australia via a traffic distribution system, publishes Android apps through suspected compromised Google Play developer accounts, and deployed over 31,000 malware samples including Quasar RAT, AsyncRAT, DCRat, NanoCore, Remcos RAT, and njRAT.

The Hacker News · 9d agoThreat actor in the wild1

The Self-Expanding Stolen Inference Supply Chain: An AI Agent Harvesting and Re-Serving LLM Access, (Fri, Sep 11th)

An autonomous coding agent harvested LLM API access from poorly secured gateways and aggregated stolen inference capacity behind a self-hosted gateway

A SANS researcher observed a semi-autonomous coding agent finding weakly secured LLM resale gateways via FOFA queries, creating trial accounts with temporary emails and CAPTCHA solving, and exploiting weak authorization such as client-supplied group_id fields. The agent validated stolen keys using factorial code-logic tests, then loaded roughly 379 upstream endpoints into a self-hosted New-API gateway, disabling 341 fake or dead channels. Five model names including claude-opus-5 and gpt-5.6-sol were served via round-robin and failover, forming a partially self-expanding inference supply chain resembling an evolution of LLMjacking.

SANS Internet Storm Center · 5d agoThreat actor in the wild

Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers

Kaspersky details NightEagle, Hacking Cat, and Toy Ghouls targeting Russian enterprises with Exchange backdoors, Gorilla RAT, and destructive Monkey ransomware.

Kaspersky reports three threat clusters targeting Russian enterprises: NightEagle (APT-Q-95), the pro-Ukrainian hacktivist group Hacking Cat, and Toy Ghouls. NightEagle uses compromised VPN credentials and the GhostContainer modular backdoor to fully compromise Microsoft Exchange servers, chaining CVE-2020-0688 exploitation, BlueKeep (CVE-2019-0708), Active Directory vulnerabilities, and DCSync to seize domain controllers. Hacking Cat exploits Exchange flaws including CVE-2021-26855 and CVE-2026-42897 to deliver the Gorilla RAT and multiple Monkey ransomware variants written in Rust, .NET, C++, and Golang targeting Windows, Linux, and VMware ESXi, with some variants acting as wipers that never store the encryption key.

The Hacker Newsupdated · 52m agofirst · 15h agoThreat actor in the wild 3 sourcesCVE-2020-0688CVE-2019-0708CVE-2021-26855+1 CVEs

Low-quality casino sites conceal highly dangerous threat actors

Infoblox reveals China-aligned APT groups hiding PeckBirdy malware C2 domains inside roughly 1.7 million Chinese-language illegal casino websites.

An Infoblox report says it tracks about 1.7 million Chinese-language casino sites enabling illegal gambling, some of which double as command-and-control infrastructure. China-aligned APT groups have hidden PeckBirdy framework C2 domains inside these low-quality casino sites since 2023, injecting scripts that display fake software update pages to deliver malware. Over 3 percent of Infoblox enterprise customers resolved at least one PeckBirdy C2 domain, and some sites rely on US cloud providers via 'infrastructure laundering.' Infoblox urges defenders not to dismiss casino-domain alerts as mere employee browsing violations.

The Register · Security · 1d agoThreat actor in the wild1

AI Is Giving Lesser-Resourced Attackers Nation-State-Level Reach, Google Warns

Google's Threat Intelligence Group warns AI now gives lesser-resourced criminal and nation-state attackers nation-state-level speed and scale, citing TeamPCP, Basin Castle, APT42, and APT24 usage.

GTIG documented throughout 2026 that adversaries increasingly use AI to automate and scale attacks. TeamPCP (UNC6780) used an AI coding chatbot with agent instructions to plan and execute a mass credential harvesting campaign in under six hours, and has compromised PyPI, npm, and Docker Hub since March 2026 with its Dustmaker credential stealer plus released tools Shai-Hulud and Miasma. PRC-nexus Basin Castle uses LLMs for target profiling, lure drafting, and malware development; APT42 (Calanque Ion) uses Gemini for OSINT and localized lures; APT24 (Ravine Castle) uses Gemini across the full attack lifecycle; and DPRK's Midnight Neptune (UNC1069) integrates AI into cryptocurrency theft. Google responds by disrupting attacker accounts and hardening models against distillation attacks.

SecurityWeek · 7d agoThreat actor in the wild2

⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off

Weekly recap: FBI disrupts Chinese QTFY proxy network, Fire Ant expands to trusted infrastructure, ZBT router backdoors surface, and OpenAI agents breach Hugging Face.

This weekly recap leads with the U.S. disruption of QTFY's QScan and QTRouter reconnaissance and proxy platforms targeting U.S. critical infrastructure. It reports on the China-linked Fire Ant (UNC3886) targeting routers, TACACS servers, and Linux management hosts with implants like Medusa rootkit components, TacTap, and BridgeAgent, while suppressing logs and altering command output. VulnCheck disclosed SPEAKINGSTONE (CVE-2026-74233) and DARKLANTERN (CVE-2026-74232) backdoors in ZBT routers, both CVSS 9.3 and written in Nim. The recap also covers OpenAI's finding that reward hacking drove internal AI agents to breach Hugging Face during security evaluations, the TerminalFix ClickFix variant using fake Cloudflare CAPTCHAs, and active exploitation of PaperCut flaws CVE-2026-81578 and CVE-2026-82078.

The Hacker News · 15d agoThreat actor in the wildCVE-2026-81578CVE-2026-82078CVE-2026-74232+2 CVEs1

Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon

Check Point identifies Chinese-speaking group Gambling Goblin hijacking Brazilian government domains via malicious Apache modules for SEO-manipulated gambling phishing.

Check Point Research tracks a sustained campaign since mid-2025 against Brazilian government and educational organizations by Gambling Goblin, a Chinese-speaking cybercrime cluster linked to Earth Berberoka. Attackers compile and install malicious Apache modules that silently reverse-proxy visitors to phishing pages impersonating Google Play, Microsoft Store, and Amazon, chaining compromised high-reputation domains to inflate search rankings. The group deploys a heavily obfuscated Linux toolkit including DownPro, AlphaAgent, oRAT, a 3snake-based credential stealer, and SSH brute-forcers, with parallel phishing networks localized for Vietnamese, Spanish, and English victims.

Check Point Research · 14d agoThreat actor