45
45
57
45
60
60
45
60
45
45
45
45
45
45
Apple Warns Users in 110 Countries They May Be Targets of Mercenary Spyware
Apple sent mercenary spyware threat notifications to users in 110 countries, including Ukrainian military members, in what researchers call an unprecedented notification wave.
Apple notified an unspecified number of users in 110 countries that they may have been targeted by mercenary spyware attacks, bringing total notifications to over 150 countries since the program began in late 2021. Apple does not attribute the attacks but describes the alerts as high-confidence indicators of individual targeting against journalists, activists, politicians, and diplomats. Citizen Lab's John Scott-Railton called the geographic scale unprecedented, and Access Now reported a record number of help requests, with recipients including members of Ukraine's military. Apple advised users to update devices, enable 2FA and Lockdown Mode, and use Stolen Device Protection.
68
60
45
45
45
57
45
45
45
45
⚡ Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and More
US agencies warn of AI-assisted attacks on exposed Siemens PLCs; the week also saw GitLab CVE-2026-19478 exploited and trojanized npm packages found.
The weekly recap leads with a US government warning that threat actors use AI-generated scripts and Censys/ZoomEye scanning to attack internet-exposed Siemens S7 PLCs in water, energy and manufacturing, calling it an active threat. Other stories include active exploitation of GitLab CVE-2026-19478 (CVSS 9.4, unauthenticated project rewriting), 14 trojanized npm packages delivering the RedC2 4.0 Linux backdoor, and the Zombie Card attack that revives expired Visa cards for contactless payment fraud. It also covers suspected Russian clusters UNC6293, UNC7005 and UNC5976 phishing campaigns, a faster Cloudflare Workers Spectre JWT leak, and a bespoke Cl0p JSP web shell deployed after exploiting PTC Windchill flaws.
65
45
60
45
45
60
45
Threat Brief: 3CXDesktopApp Supply Chain Attack (Updated)
Trojanized 3CXDesktopApp installers for Windows and macOS loaded RC4-encrypted shellcode delivering a backdoor to hundreds of thousands of 3CX users.
Threat actors compromised the 3CXDesktopApp build process, adding malicious libraries (ffmpeg.dll, d3dcompiler_47.dll) to installers downloaded from the developer's website. The Windows MSI loader decrypts embedded shellcode with RC4, sleeps for a random 1-4 weeks, then beacons to C2 hidden in icon files on GitHub. Unit 42 fingerprinted 247,277 IPs across 199 countries using 3CX applications and blocked shellcode execution at 127 Cortex XDR customers between March 9-30, 2023.
72
Risky Bulletin: Slovakia finds Russian backdoor in traffic speed cameras
Slovakia's NBU found an SMS-triggered backdoor in Russian-made NERO R-ONE traffic cameras, pausing a 279-unit deployment.
Slovakia's national security service NBU issued an alert against NERO R-ONE high-speed traffic cameras after finding a backdoor that grants shell and network access via SMS from hardcoded Russian phone numbers. The cameras are a rebranded version of the Russian CORDON PRO.M model by St. Petersburg firm Semicon, purchased via a Cyprus shell company under a €30 million EU-funded project. The report also found SecureBoot disabled, vulnerable web management, and unauthenticated live streams; the Interior Ministry paused deployment of 279 cameras pending independent assessment.
72
57