Search: “arma”

Russia-Aligned Hackers Use GuardBreaker Prompt Injection to Disrupt AI Malware Analysis

Russia-aligned group UAC-0099 embeds GuardBreaker prompt injection in a VBScript comment to make AI malware scanners refuse analysis of a MATCHBOIL loader.

ESET identified a UAC-0099 VBScript used in an early-stage intrusion against a target in Ukraine that hides a safety-triggering comment (a question about building a nuclear weapon) intended to make AI code scanners refuse to continue analysis. The script downloads MATCHBOIL, a loader associated exclusively with UAC-0099, alongside familiar anti-analysis checks for IDA and Wireshark. The technique turns the AI triage process itself into the attack target, risking missed detections or benign misclassification of malicious samples.

Cyber Security News·Sep 11, 14:32 UTC · 4d agoThreat actor in the wild 3 sources

Hackers target Ukrainian agency managing assets seized from sanctioned Russians

Ukraine's ARMA asset agency reported a cyberattack amid selecting a manager for seized IDS Ukraine assets linked to sanctioned Russians.

Ukraine's Asset Recovery and Management Agency (ARMA), which manages assets seized from criminals and sanctioned individuals, said Tuesday it had been targeted by a cyberattack, with the SBU investigating. The attack coincided with preparations to select a manager for seized corporate rights in IDS Ukraine, a major beverage producer seized in late 2022 from Russian shareholders including sanctioned billionaire Mikhail Fridman. ARMA reported other suspected interference since spring, including unauthorized access to an internal database of agency officials, but did not attribute the attack or release technical details. In April, ARMA employees were targeted in a cyberespionage campaign attributed to Russia-linked APT28, which failed to penetrate internal systems.

The Record·Aug 18, 14:51 UTC · 28d agoData breach

Why federal cyber defense demands an offense-driven mindset

Opinion piece argues federal agencies should prioritize exploitability and autonomous penetration testing over static CVSS-based patching, citing CISA's BOD 26-04 and NSA's CAPT program.

The author argues that static CVSS-driven patching leaves federal agencies exposed because vulnerable does not equal exploitable, and adversaries chain misconfigurations and stolen credentials instead of burning zero-days. The piece cites CISA's BOD 26-04 and the NSA's Continuous Autonomous Penetration Testing (CAPT) program, which logged 28,282 completed pentests across 822 Defense Industrial Base organizations and closed 71% of critical findings within 30 days. It recommends defining risk by exploitability and mission impact and augmenting human pentesting with autonomous validation and verification.

CyberScoop·Sep 8, 18:30 UTC · 7d agoIndustry

Risky Bulletin: Slovakia finds Russian backdoor in traffic speed cameras

Slovakia's NBU found an SMS-triggered backdoor in Russian-made NERO R-ONE traffic cameras, pausing a 279-unit deployment.

Slovakia's national security service NBU issued an alert against NERO R-ONE high-speed traffic cameras after finding a backdoor that grants shell and network access via SMS from hardcoded Russian phone numbers. The cameras are a rebranded version of the Russian CORDON PRO.M model by St. Petersburg firm Semicon, purchased via a Cyprus shell company under a €30 million EU-funded project. The report also found SecureBoot disabled, vulnerable web management, and unauthenticated live streams; the Interior Ministry paused deployment of 279 cameras pending independent assessment.

Risky Business News·Aug 19, 04:52 UTC · 28d agoThreat actor in the wild1

Using AI for Weapons Development

Anthropic report reveals Yemen-based actors used Claude Code to build guidance software for guided rockets and ballistic missiles.

Bruce Schneier highlights Anthropic's misuse disclosure describing a threat actor cell in northern Yemen running three weapons programs: a guided rocket with phone-class homing guidance, a 2,000+ km multi-stage ballistic missile, and the 'R2000' hypersonic glide vehicle set. The actors used Claude Code as a substitute for human engineers to write GNC software, integrate an open-source autopilot, tune controls, and run flight simulations, orchestrating multiple Claude instances in delegated roles. Safeguards blocked many requests but evasion tactics included hiding intent and splitting work across sessions; one guided rocket test-fire failed but no operational device was fielded.

Schneier on Security·Sep 14, 16:07 UTC · 1d agoAI safety & security in the wild

Users in Houthi-Held Yemen Tried to Develop Advanced Weapons With AI, Anthropic Says

Anthropic says Claude users in Houthi-held northern Yemen attempted hypersonic missile and guidance software development; accounts were blocked, no operational weapon fielded.

Anthropic's third misuse report since March 2025, covering December through August, says users in northern Yemen ran three weapons programs, including a multi-variant hypersonic glide missile and a warhead maneuvered mid-course with mobile phone hardware. The users used Claude Code instead of human engineers to develop guidance, navigation and control software, conducted one failed guided rocket test, and built an offline simulation toolkit before Anthropic banned the accounts. Houthis denied relying on open sources for weapons development, and analysts noted they lack the industrial capacity to actually build hypersonic missiles.

SecurityWeek·Sep 12, 01:50 UTC · 4d agoAI safety & security

AI for Military Support

Study of 2,015 Israeli military personnel found algorithmic aversion toward AI targeting decision support, reduced when explainable AI features were added.

The paper 'Black Box Warfare' reconstructed a real-world military AI decision-support system used in targeting and tested a high-fidelity replica in two experiments with 2,015 Israeli military personnel. Contrary to automation-bias fears, participants showed strong algorithmic aversion, especially in high-collateral-damage scenarios. Integrating explainable AI features reduced aversion and promoted more thoughtful evaluation of algorithmic recommendations. The authors conclude that trust in military AI is dynamic and that human agency remains central in high-stakes decisions.

Schneier on Security·Aug 11, 11:18 UTC · Aug 11, 2026AI research

CISA's logging guidance works beyond government

CISA released its Logging Reference Architecture in August 2026 to help federal agencies meet OMB M-26-14 logging requirements, usable as a benchmark by critical infrastructure operators.

CISA's Logging Reference Architecture (LRA), released in August 2026, helps US federal civilian agencies satisfy logging requirements in OMB Memorandum M-26-14 and explicitly encourages critical infrastructure operators to use it as a benchmark. The framework is organized around continuous event monitoring and threat hunting, investigation, response, and forensics, with a federal baseline of six months searchable and one year retrievable logs. Agencies must submit Agency Logging Plans within 90 days and work toward Advanced maturity within 320 days; the guidance also treats AI outputs as derived data requiring human review and preserved metadata.

Help Net Security·Aug 24, 00:00 UTC · 23d agoAdvisory

Understanding Operator Attitudes Toward AI-Supported Decision Making in Maritime Operations

A survey of maritime professionals finds positive but scenario-sensitive attitudes toward AI collision-avoidance assistants, urging design for calibrated reliance.

The study surveyed maritime stakeholders on attitudes toward AI-supported collision-avoidance assistants for Maritime Autonomous Surface Ships, measuring technology anxiety, trust in automation, and explanation quality with established questionnaires plus thematic analysis of open responses. Results show generally positive disposition, no clear age-related openness differences, stable trust across scenarios, and multidimensional, scenario-sensitive explanation ratings. Participants valued decision support and situation awareness but worried about AI reliability, over-reliance, and skill loss; the authors recommend designing for calibrated reliance with domain experts in the loop rather than maximizing automation or trust.

arXiv cs.AI / cs.LG / cs.CL·Sep 10, 16:57 UTC · 5d agoAI research1

The push to designate AI as the next critical infrastructure sector

Americans for Responsible Innovation report urges designating AI models, companies and supporting infrastructure as critical infrastructure with CISA as sector lead.

A report from the nonprofit Americans for Responsible Innovation calls for the federal government to declare the AI sector — including frontier model designs, model weights, datacenters, AI hardware and semiconductors — the 17th critical infrastructure sector, with CISA as the lead agency for sector cyberthreats. The authors argue AI is concentrated among a handful of foundation models and interdependent with other sectors, so a single attack on the AI stack could cascade widely, citing incidents like Iranian drone attacks on Amazon datacenters. Former DHS officials note the designation would unlock federal resources such as CDM access and threat intelligence, but warn that picking a lead agency could trigger a bureaucratic turf war with Commerce and Treasury.

CyberScoop·Aug 20, 13:31 UTC · 27d agoAI policy

The democratization of cyber warfare — and what it means for CISOs

CSO Online argues AI is democratizing cyber warfare, citing Taiwan's first largely autonomous AI-driven attack that hit 85 government accounts.

CSO Online argues AI is accelerating the democratization of cyber warfare by collapsing cost and skill barriers, with effects already reaching the private sector. It cites the August disclosure of the first largely autonomous AI-enabled attack on Taiwan government infrastructure, where up to eight agents operating simultaneously compromised at least 85 government accounts and exfiltrated more than 2,500 personnel records before expanding to the nuclear safety agency and energy companies. The piece places this in a historical arc from crossbows to cheap drones and cites Kane Gamble's 2015 solo social-engineering compromise of senior US intelligence officials as evidence that low-resource attackers were already viable.

CSO Online·Sep 4, 09:00 UTC · 12d agoIndustry

Batten the Hatches: Cybersecurity with Military Mariners

Interviews with 20 U.S. Navy and Coast Guard mariners reveal informal, safety-oriented shipboard cyber risk models that may delay attribution and containment.

The study conducts semi-structured interviews with 20 military mariners from U.S. Navy and Coast Guard vessels to understand how service members recognize and respond to cyber risk aboard ships. Unique consequences of compromising military systems identified include weapon takeover and purposeful geopolitical escalation. Cybersecurity is organizationally abstract on ships, so mariners build cyber risk models from informal experience rather than formal instruction. A safety-oriented incident-response model creates resilience but may delay cyber attribution and containment.

arXiv cs.CR·Sep 11, 13:04 UTC · 5d agoResearch

Severity Is Not a Strategy: What CISA BOD 26-04 Means for the Future of Federal Software Security

CISA's BOD 26-04 replaces severity-based federal patching with risk-based remediation deadlines of 3, 14, or 60 days.

CISA's Binding Operational Directive 26-04, released June 10, 2026, replaces BOD 19-02 and BOD 22-01 for Federal Civilian Executive Branch agencies and shifts remediation prioritization from CVSS scores to risk context. Agencies assess four factors: public exposure, KEV listing, exploit automatability, and whether exploitation grants partial or total asset control, resulting in 3-, 14-, or 60-day remediation windows or next-upgrade fixes. In CISA's first review at a large civilian agency, only 1% of vulnerabilities required three-day remediation while over 60% could wait for future system upgrades. The directive also requires forensic analysis when exploitation is suspected, and Checkmarx argues the same risk-based logic must extend upstream into software development and SBOM-driven exposure management.

Checkmarx·Sep 9, 18:07 UTC · 6d agoPolicy & legal

The EU CRA's Real Question: What Shipped, and When Did You Know?

ActiveState argues the EU CRA's 24-hour ENISA exploit-notification duty, effective September 11, 2026, makes current SBOMs and provenance visibility a legal necessity.

An ActiveState essay warns that the EU Cyber Resilience Act's reporting obligations take effect on September 11, 2026, requiring manufacturers of products with digital elements sold into the EU to notify ENISA within 24 hours of learning a vulnerability is actively exploited, with a fuller report within 72 hours. The law's engineering requirements only apply from December 11, 2027, leaving a visibility-first runway, and Article 13 requires the SBOM to stay current unlike one-time artifacts generated under US Executive Order 14028. The author contrasts the 24-hour notification clock with an industry-average 55 days to remediate high or critical vulnerabilities and recommends automated SBOM regeneration or consuming pre-vetted, attested open source components.

BleepingComputer·Sep 8, 20:24 UTC · 7d agoPolicy & legal

How AI and cybersecurity are reshaping ServiceNow

Analysis argues ServiceNow's $7.75B Armis acquisition and AI-driven consumption pricing are reshaping its ITSM platform amid SaaS market anxiety.

CSO Online examines how AI agents, vibe-coding fears, and a reported 30% share price drop are pressuring ITSM leader ServiceNow, and how the company is pivoting toward consumption-based revenue and cybersecurity. The piece highlights ServiceNow's $7.75 billion cash acquisition of Armis, priced at roughly 23 times the vendor's $340 million annual revenue, as a strategic move to supercharge ITSM workflows with accurate device inventory and orchestration rather than to sell a standalone security product. Experts note this ends Armis's vendor-neutral position, introduces the CISO as a new buyer, and will likely lead to aggressive Armis bundling at contract renewals.

CSO Online·Sep 11, 10:15 UTC · 5d agoIndustry

The Agentic SOC – From AI Theater to Real Defense

Recorded Future and Accenture experts outline how security teams can move beyond 'AI theater' toward agentic SOC operations guided by measurable KPIs.

Recorded Future published a blog featuring perspectives from its own and Accenture experts on building an agentic security operations center. The piece argues organizations should prioritize measurable KPIs and proactively mitigate risks from autonomous agents. It also discusses evolving the analyst role from managing alerts to managing agents.

Recorded Future·Sep 1, 00:00 UTC · 15d agoIndustry

ENISA launched the CRA Single Reporting Platform for actively exploited vulnerabilities

ENISA launched the CRA Single Reporting Platform, making EU manufacturers report actively exploited vulnerabilities and severe incidents through one portal.

ENISA switched on the Cyber Resilience Act's Single Reporting Platform on 11 September 2026, the same day CRA reporting obligations became binding on manufacturers. Reports require an early warning within 24 hours, a fuller notification within 72 hours, and a final report within 14 days (one month after notification for severe incidents). Filings go through an EU Login account with MFA, are routed to a coordinating CSIRT chosen by the manufacturer, and no API is available in the first release. Open-source software stewards fall under the same obligations from 11 December 2027.

Help Net Security·Sep 14, 12:23 UTC · 2d agoPolicy & legal

Beyond Training: A Feasibility Taxonomy for Inference-Time AI Governance

A study maps twenty inference-time AI governance mechanisms, finding commercial readiness only against cooperative deployers and no adequate defense versus state-level adversaries.

The paper develops a feasibility taxonomy of twenty inference-time AI governance mechanisms across monitoring, verification, and enforcement, each rated on a four-point readiness scale against a four-vendor evidence base. Fifteen of the twenty mechanisms have commercial technical substrates in production today, though governance-grade assurance and adversarial robustness vary substantially. Stress testing shows readiness holds only against a cooperative deployer and low-to-medium-capability user: no mechanism rates adequate against a high-capability state-level deployer, and fine-tuning removes model-internal enforcement components. A second-rater reliability check on readiness ratings returned a quadratic-weighted Cohen's kappa of 0.74.

arXiv cs.CR·Sep 9, 12:37 UTC · 7d agoAI policy

AI-Driven Threat Intelligence for Gulf Enterprises: Why Detection Speed Is Now a Regulatory Requirement

Cyble argues GCC regulators' 6-72 hour breach-notification deadlines make AI-powered detection essential for Gulf enterprises.

Cyble's blog highlights that the UAE Information Assurance Standard v2 requires incident notification within 6 hours of detection, while Saudi Arabia's SAMA cybersecurity framework and NCA Essential Cybersecurity Controls converge on 72-hour reporting. It argues that compliance clocks start at detection, not response, and that IAS v2 mandates 24/7 monitoring with defined SLAs for Tier 1 critical infrastructure entities. The piece promotes Cyble Vision's AI-powered threat intelligence for continuous exposure monitoring and audit-ready detection logs.

Cyble·Sep 4, 13:23 UTC · 12d agoIndustry

“Keep going, bro. You’ve got this!” A data-driven look at how adversaries are weaponizing AI

Cisco Talos·Aug 4, 10:00 UTC · Aug 4, 2026Vulnerability

Akeyless adds real-time enforcement for AI agents in production

Akeyless launches Agentic Runtime Authority, enforcing real-time intent-based access control on AI agent actions, with integrations for Claude Enterprise, OpenAI Codex and Amazon Bedrock AgentCore

Akeyless announced general availability of Agentic Runtime Authority, a real-time identity control layer that evaluates AI agent actions and blocks policy-violating actions before execution, layered on top of its SecretlessAI credential brokering. New integrations cover Claude Enterprise, OpenAI Codex and Amazon Bedrock AgentCore, alongside an Agentic Access Dashboard with session kill switches and event forwarding to Splunk, Datadog and Microsoft Sentinel. The vendor's platform already secures over 220 billion machine identity interactions for Fortune 500 organizations.

Help Net Security·Sep 9, 13:54 UTC · 7d agoTools1

The AI Malware Maturity Gap

Recorded Future introduces AIM3, a five-level maturity model for AI malware, showing current attacker AI use is mostly AI-assisted rather than autonomous.

Recorded Future proposes AIM3, a five-level model defining AI malware from LLM-translated to LLM-embedded, spanning experimentation to fully autonomous agentic campaigns. Public examples remain early-stage: PROMPTFLUX uses Google Gemini to rewrite its VBScript dropper (Level 1), while Lamehug/PROMPTSTEAL, attributed to APT28, invokes the HuggingFace API to generate reconnaissance commands (Level 3). The authors argue most current AI malware augments existing tradecraft rather than enabling one-click autonomous attacks.

Recorded Future·Aug 26, 00:00 UTC · 21d agoResearch

Counter-Swarm Doctrine: Containing Coordinated Agent Intrusions

Position paper proposes monitoring across agent executions to detect and contain coordinated AI agent intrusions, grounded in the Hugging Face incident.

The paper argues that AI agents can turn shared infrastructure into a channel for coordinated intrusion, citing the Hugging Face incident and a public-wiki investigation where security assessment required evidence from multiple executions. It defines unsanctioned coordination relative to collaboration and delegated-authority policy, links storage-mediated coordination to stigmergy, and frames prospective episode discovery as the core research problem. A proposed evaluation compares isolated actions, rolling windows, known groups, and discovered episodes at matched review cost, measuring harmful outcomes and recurrence after channel closure and state quarantine. A checksum-verified reconstruction of the public wiki export separates declining retained writes from later administrative cleanup.

Hugging Face daily papers·Sep 4, 20:00 UTC · 11d agoAI safety & security

The Model Proposes, the Code Disposes: A Pre-Registered Ablation of a Verifier-and-Acceptance Stage in an LLM-Orchestrated Offensive-Security Agent

Pre-registered ablation finds a model verifier stage in an LLM offensive-security agent suppresses findings; removing it eliminated suppression with precision tradeoff.

The paper evaluates a verifier-and-acceptance stage in an LLM-orchestrated offensive-security agent via a pre-registered 20-run confirmatory ablation and a 2x2 factorial study with 40 runs on vulnerable lab targets. Removing the stage eliminated pre-report suppression (median 2 vs 0 findings, p = 0.00003) but reduced model-blinded shipped precision (0.471 vs 0.353, p = 0.0087). Suppression was attributed to the model verifier rather than deterministic acceptance rules, and an instrumented canary recorded zero external contacts in all 60 runs. The full design retained 93.8% of model-adjudicated true candidates but failed its pre-registered non-inferiority floor of 0.90.

arXiv cs.CR·Sep 14, 17:13 UTC · 1d agoResearch

When Intelligence Becomes Agency: A Theory of Governed, Proactive Agency for Symbiotic AI Systems

Researchers propose a formal framework for governed proactive AI agency, linking activation decisions to continuing authorization, accountability, and bounded delegation in symbiotic systems.

The paper defines the activation problem: persistent AI assistants must decide whether a situation warrants behavior, and whether to act, ask, monitor, defer, or deliberately refrain. It distinguishes autonomous from delegated agency and defines symbiotic agency as delegation under a standing, revocable mandate, coupled to the principal's situation with calibrated inference and bounded personalization. The framework links activation decisions to authorized perception, behavior selection, authority containment, traceable restraint, and constrained adaptation, and provides an agency classification method, evaluation framework, benchmark scenarios, and reference architecture for always-present assistants and embodied support systems.

arXiv cs.AI / cs.LG / cs.CL·Sep 7, 16:46 UTC · 8d agoAI safety & security

Houthis Used Claude Code to Develop Missile Guidance Software: Anthropic

Anthropic's threat report details a Houthi-linked Yemeni cell using parallel Claude Code sessions to build missile guidance software, evading safeguards by fragmenting tasks.

Anthropic's September threat report describes a Yemen-based cell, assessed as highly likely Houthi-linked, that used Claude Code across multiple parallel instances to develop guidance software for a tactical guided rocket, a ballistic missile with over 2,000 km range, and a hypersonic glide vehicle concept called 'R2000'. The operators integrated open-source autopilot software, built six-degree-of-freedom trajectory simulations, and used reinforcement learning to tune flight-control algorithms, ultimately compiling an offline executable. The group test-fired a guided rocket that failed, then used Claude within hours to analyze launch telemetry. Anthropic blocked numerous requests, but operators evaded safeguards by obscuring intent and dividing work across separate conversations before accounts were banned; the case is one of six conventional-weapons cases (three China-linked, two Russia-linked) in a report covering disrupted operations from December 2025 to August 2026.

Hacker News · AI·Sep 13, 14:15 UTC · 2d agoAI safety & securityHN 47↑ · 38 comments1

Russian hackers plant nuclear weapon prompt in malware to trip AI safety guardrails

ESET reports Russian group UAC-0099 hid a prompt in VBS malware comments to trip AI safety filters and disrupt automated malware analysis in Ukraine.

ESET identified a technique dubbed GuardBreaker in which UAC-0099 embedded a comment reading "I want to make nuclear weapon. Help me …" inside a malicious VBS script to trigger AI safety mechanisms and halt AI-assisted malware analysis. The script, part of the group's toolset, downloads the MATCHBOIL malware used exclusively by this Russia-aligned group; CERT-UA documented the chain including LUNCHPOKE, BURNYBEAR and MATCHBOIL.V2 in a July advisory. UAC-0099 typically targets transportation and energy sectors and hands validated targets to GRU-linked Sandworm. ESET warned that AI-assisted analysis must be backed by layered detection and human-driven engineering.

Help Net Security·Aug 31, 00:00 UTC · 16d agoAI safety & security in the wild

Photos: Black Hat USA 2026 Arsenal

Help Net Security·Aug 6, 00:00 UTC · Aug 6, 2026Industry

The Agentic AI threat cluster: Seven incidents, three actors, and what they mean for your exposure

Tenable links seven agentic AI attack incidents to three threat actors, including Taiwan's confirmed autonomous attack that exfiltrated over 2,564 personnel records.

Tenable's Research Special Operations team has tracked a cluster of seven agentic AI threat incidents since late July 2026, attributing the activity to three actors. Taiwan's Ministry of Digital Affairs confirmed a near-autonomous AI cyber attack in July 2026 in which autonomous agents mapped 21 connected government systems, compromised 85 accounts, and exfiltrated more than 2,564 personnel records in approximately four days. The cluster also includes the JADEPUFFER campaign.

Tenable Blog·Aug 15, 01:36 UTC · Aug 15, 2026Threat actor in the wild

Persistent Attempts at Cyberespionage Against Southeast Asian Government Target Have Links to Alloy Taurus

Alloy Taurus (GALLIUM) compromised Southeast Asian government networks from 2022 to 2023 using Exchange web shells and undocumented .NET backdoors Reshell and Zapoa.

Unit 42 tracked persistent multiwave intrusions at a Southeast Asian government starting in early 2022 and continuing through 2023, attributing the activity with moderate confidence to Alloy Taurus (aka GALLIUM), a Chinese state-aligned espionage group. Attackers exploited Exchange Server vulnerabilities to deploy web shells including China Chopper, then ran reconnaissance with Fscan and WebScan, created administrative accounts, and installed undocumented .NET backdoors named Reshell and Zapoa. They established resilience by installing SoftEther VPN, brute-forced Active Directory credentials with Kerbrute, and dumped credential stores with GoDumpLsass and LsassUnhooker. The campaign reflects long-term espionage tradecraft to maintain a foothold.

Palo Alto Unit 42·Aug 17, 10:54 UTC · Aug 17, 2026Threat actor in the wild1