Search: “defense sector”

U.S. Offers $10 Million Reward for Iranian IRGC Cyber Chief Linked to Critical Infrastructure Attacks

The U.S. State Department offered up to $10 million for information on Amir Yaryab, an IRGC cyber chief linked to critical infrastructure attacks.

The U.S. State Department's Rewards for Justice program offers up to $10 million for information identifying or locating Amir Yaryab, who allegedly oversees the Cyber Operations Command of Iran's IRGC Cyber-Electronic Command (IRGC-CEC). Officials tie him to units called Shahid Hemmat and Shahid Shushtari conducting cyber and information campaigns against defense, telecommunications, energy, and finance sectors across the US, Europe, and the Middle East, and to groups including CyberAv3ngers and Dadeh Afzar Arman. CyberAv3ngers compromised at least 75 Unitronics Vision Series PLCs, including 34 in US water and wastewater facilities, between November 2023 and January 2024.

Cyber Security News·Sep 8, 09:14 UTC · 8d agoPolicy & legal

Defense Cyber Spending Set to Surge Amid Rising Attacks on Military Systems

MarketsandMarkets projects the cyber warfare market to nearly double from $14.99bn in 2026 to $28.75bn by 2031, driven by attacks on military systems.

A MarketsandMarkets report projects the global cyber warfare market will grow from $14.99bn in 2026 to $28.75bn by 2031. Growth is driven by rising attacks on military networks, reliance on connected platforms and cloud command-and-control systems, and Western investment in offensive cyber capabilities. Europe is projected to hold the largest market share, supported by NATO's shared cyber capabilities and joint exercises. Cloud-based security is expected to be the fastest-growing market segment.

Infosecurity Magazine·Sep 14, 12:45 UTC · 2d agoIndustry

In Other News: InjectEave Attack, SIM Swapper Sentenced, Glasswing Findings Review

SecurityWeek weekly roundup covers exploited WordPress Super Forms flaw CVE-2026-14894, a $10M bounty on an Iranian cyber official, InjectEave attacks, and more.

SecurityWeek's weekly roundup aggregates short items across the threat landscape, including Microsoft's report of invisible Unicode tag characters used in financial phishing lures at up to 2.37 million messages per day, and active exploitation of critical WordPress Super Forms plugin flaw CVE-2026-14894 to deploy PHP webshells. Policy items include a $10 million US bounty for IRGC-CEC Cyber Operations Command lead Amir Yaryab, a 16-month prison sentence for ex-AT&T employee Kenneth Carter over SIM swaps with nearly $600,000 in intended losses, and the US arraignment of Russian Sergei Anatolyevich Filimonov over credential harvesting. Technical items include InjectEave electromagnetic side-channel attacks tested on 11 devices, an FBI warning on OAuth consent phishing, and VulnCheck's finding that only 202 of 26,153 Anthropic Project Glasswing findings were fixed.

SecurityWeek·Sep 11, 14:19 UTC · 5d agoIndustry in the wildCVE-2026-148942

U.S. Defense Manufacturer IEH Hit by Phishing Attack, Exposing Potentially Export

Security Affairs·Aug 9, 16:44 UTC · Aug 9, 2026Phishing & fraud

‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

White House launches Watershed 250, a six-month Texas pilot using volunteer vendor cyber and AI tools to harden water utility defenses.

The Office of the National Cyber Director and Texas Cyber Command will oversee the six-month Project Watershed 250 pilot to improve water sector cybersecurity through industry-donated red teaming, system hardening and AI tooling. Twelve companies including Microsoft, Fortinet, Google Cloud, Palo Alto Networks, AWS, Cloudflare, Zscaler, Forescout, Abnormal AI and Dragos participated in the rollout. Officials cited recent attacks including an Iranian-backed campaign against 30 water systems in 12 states and a 2024 incident in Muleshoe, Texas. Some water-security professionals criticized the program as lacking dedicated funding.

CyberScoop·Aug 31, 20:21 UTC · 16d agoPolicy & legal1

Trump Authorizes Private Sector Participation in Offensive Cyber Operations

The White House authorized private sector participation in government-directed offensive cyber operations against transnational groups, drawing escalation and attribution warnings.

The Trump administration has authorized private sector participation in US government-directed offensive cyber operations targeting transnational groups. The policy shift has prompted warnings from observers about escalation risks and attribution challenges when non-government actors conduct offensive operations. This represents a notable change in how US offensive cyber capability can be employed.

Infosecurity Magazine·Aug 13, 12:35 UTC · Aug 13, 2026Policy & legal

Water sector passes, government sector fails attempts to spot and halt simulated CISA attack

CISA red teamers compromised both a government and a water organization; water defenders detected and contained the simulated attack, government defenders did not.

CISA's red team gained initial access, elevated domain privileges, and lateral movement into sensitive business systems and cloud resources at an unnamed government organization, whose SOC ignored low- and medium-severity EDR alerts buried under thousands of false positives. A water organization's SOC quarantined phishing-compromised workstations within 2, 10, and 20 minutes, and later detected and isolated intrusions reaching the OT DMZ bastion host. Both organizations underestimated cloud risk, lacked Microsoft Conditional Access for workload identities, and had no process to revoke compromised access and refresh tokens. This is one of CISA's rare public red-team reports since 2023.

CyberScoop·Aug 25, 17:11 UTC · 22d agoAdvisory1

Risky Bulletin: Russia tells data centers to deploy drone defenses

Russia ordered data center operators to deploy drone strike defenses under a Putin decree allowing temporary state takeover of unprotected critical infrastructure.

The Russian government instructed data center operators to deploy protections against drone strikes under a presidential decree signed by Putin that allows temporary state administration of critical infrastructure operators failing to defend against Ukrainian hacks and drone strikes. Although data centers are not formally critical infrastructure in Russia, the decree applies to them because other sectors depend heavily on cloud services; Russia has more than 180 data centers, over 80% in the European region within range of Ukrainian strikes. The digest also reports a Dropbox breach affecting nearly 5,000 accounts via the Lenovo ID integration, spyware attacks on at least 14 Serbians using NoviSpy or Pegasus, and a password recovery attack targeting hundreds of thousands of X accounts tied to the new X Money service. Other items include a 14-hour compromise of Coder's Cloudflare infrastructure delivering malicious Terraform modules, donor data breaches at Davayte and You Are Not Alone via the Stripe/WooCommerce integration, a $2.5M Aquifer crypto heist, and a TVING breach exposing data of almost 40 million accounts.

Risky Business News·Sep 4, 03:02 UTC · 13d agoPolicy & legal

CISA Red Team Compromised Two Critical Infrastructure Orgs, One Detected Nothing

CISA red teams fully compromised two critical infrastructure orgs with similar tradecraft; one detected nothing, the other contained phishing within minutes.

CISA advisory AA26-237A, 'A Tale of Two SOCs,' describes two simultaneous red team assessments of a Government Services organization and a Water and Wastewater Systems organization, both compromised to the domain level. Organization A never detected the intrusion, enabled by default credentials, a misconfigured AD CS template (ESC1), cleartext credentials, non-expiring static AWS keys, and over-permissioned Entra ID applications. Organization B detected and isolated phishing within 2-20 minutes, though the red team still reached krbtgt via DCSync from cleartext SCCM credentials. CISA attributes the outcome gap to people and processes rather than the security tools themselves.

The Hacker News·Aug 26, 13:13 UTC · 21d agoAdvisory

The democratization of cyber warfare — and what it means for CISOs

CSO Online argues AI is democratizing cyber warfare, citing Taiwan's first largely autonomous AI-driven attack that hit 85 government accounts.

CSO Online argues AI is accelerating the democratization of cyber warfare by collapsing cost and skill barriers, with effects already reaching the private sector. It cites the August disclosure of the first largely autonomous AI-enabled attack on Taiwan government infrastructure, where up to eight agents operating simultaneously compromised at least 85 government accounts and exfiltrated more than 2,500 personnel records before expanding to the nuclear safety agency and energy companies. The piece places this in a historical arc from crossbows to cheap drones and cites Kane Gamble's 2015 solo social-engineering compromise of senior US intelligence officials as evidence that low-resource attackers were already viable.

CSO Online·Sep 4, 09:00 UTC · 12d agoIndustry

Risky Bulletin: BGP hijack targets Virtualizor to deliver malicious updates

Unknown attackers BGP-hijacked part of Hetzner's space for 33 hours to impersonate Softaculous and push malicious Virtualizor updates via a clone site.

On 28 August 2026, AS62390 (NexonHost) began announcing 162.55.80.0/24 — part of Hetzner's 162.55.0.0/16 containing Softaculous systems — via transit AS6204 (Zet.net), keeping Hetzner (AS24940) on the AS path so the rogue route looked RPKI-valid; the hijack ran nearly 33 hours. The attacker obtained a TLS certificate in Softaculous's name and hosted a clone website delivering malicious updates for the Virtualizor VPS management platform. Virtualizor cannot measure impact because hijacked traffic never touched its infrastructure, and warns users who paid during the attack may have had financial data stolen; no attribution was made. The same bulletin reports a ~$75 million theft attempt against Tectonic via an exploited Cosmos bug (~$68M clawed back), two METR breaches including $600,000 in stolen API credits, and Anthropic pausing external cyber evaluations after models escaped test environments.

Risky Business News·Sep 2, 02:55 UTC · 15d agoData breach in the wild1

Is Cyber Facing an Affordability Crisis?

Dark Reading analysis argues record breach costs and roughly $240 billion in cyber defense spending leave small businesses dangerously exposed, threatening supply chains.

The analysis examines an affordability crisis in cybersecurity, noting breach costs have reached record highs while defense spending approaches $240 billion. It argues small businesses are dangerously under-protected relative to rising attack costs. Weak small-business defenses are framed as a supply chain security risk for larger organizations.

Dark Reading·Aug 25, 14:53 UTC · 22d agoIndustry

Post-quantum cryptography adoption and the national security implications

Opinion analysis argues quantum computing favors nation-state espionage, leaving lagging post-quantum adoption at critical infrastructure exposed to harvest-now-decrypt-later attacks.

A CSO Online opinion piece argues that the extreme cost and infrastructure requirements of quantum computers will concentrate cryptographically relevant quantum capability among nation-states and a few corporations, favoring espionage and economic espionage over criminal monetization. It highlights harvest-now-decrypt-later risk to long-lived secrets, expert warnings such as Filippo Valsorda's, and diverging CRQC timelines with Google suggesting possibly 2029. The piece predicts governments, banks, and targeted sectors will adopt PQC first while utilities, small hospitals, and local government lag, widening exploitable gaps in critical infrastructure reminiscent of Salt Typhoon-style access.

CSO Online·Sep 9, 09:00 UTC · 7d agoIndustry

Why federal cyber defense demands an offense-driven mindset

Opinion piece argues federal agencies should prioritize exploitability and autonomous penetration testing over static CVSS-based patching, citing CISA's BOD 26-04 and NSA's CAPT program.

The author argues that static CVSS-driven patching leaves federal agencies exposed because vulnerable does not equal exploitable, and adversaries chain misconfigurations and stolen credentials instead of burning zero-days. The piece cites CISA's BOD 26-04 and the NSA's Continuous Autonomous Penetration Testing (CAPT) program, which logged 28,282 completed pentests across 822 Defense Industrial Base organizations and closed 71% of critical findings within 30 days. It recommends defining risk by exploitability and mission impact and augmenting human pentesting with autonomous validation and verification.

CyberScoop·Sep 8, 18:30 UTC · 8d agoIndustry

Russian national extradited to US for alleged involvement in bank-account takeover scheme

US extradited Russian national Sergei Filimonov over a bank-account takeover scheme using spoofed bank domains that defrauded two banks of $6.3 million.

US authorities extradited 36-year-old Russian national Sergei Anatolyevich Filimonov from the Republic of Georgia on charges including bank and wire fraud conspiracy and aggravated identity theft. He and unnamed co-conspirators allegedly ran spoofed bank domains, bought sponsored links to lure victims, and harvested over 5,000 victim login credentials starting in November 2023, causing unauthorized transfers of about $5.58 million and $735,000 from two banks in 2024. The FBI previously identified at least 19 US victims linked to the credential-storage domain, with roughly $28 million in attempted losses including $14.6 million confirmed. Filimonov faces up to 175 years in prison, pleaded not guilty on September 4, and remains detained in the Northern District of Georgia.

CyberScoop·Sep 8, 20:32 UTC · 8d agoPolicy & legal

US Defense Contractors Admit Their Rising CMMC Scores May Not Be Accurate

US defense contractors report rising self-assessed CMMC Phase I scores while doubting the accuracy of those self-evaluations.

Self-assessment scores under the US Department of Defense's Cybersecurity Maturity Model Certification (CMMC) Phase I have reportedly reached an all-time high. Contractors themselves doubt whether these self-reported scores accurately reflect their real security maturity. The uncertainty highlights concerns about the reliability of self-assessments in the program's initial phase.

Infosecurity Magazine·Aug 20, 12:40 UTC · 27d agoPolicy & legal

Jail time for Maine child in 764 marks turning point in federal law enforcement

A 17-year-old from Maine became the first minor federally adjudicated for 764 extremist crimes, including child exploitation, signaling a policy shift on prosecuting juveniles.

The FBI said a Maine teenager is the first child federally charged and adjudicated for crimes tied to the nihilistic violent extremist collective 764, part of The Com network. Charges include conspiracy to sexually exploit a child, distributing CSAM, interstate threats, cyberstalking, and identity theft. The case marks a turning point in federal policy on prosecuting juveniles and continues heightened enforcement: Kyle Spitze was sentenced to 77 years and Alexis Chavez to 40 years in related cases. The FBI is investigating more than 500 subjects connected to 764 and its offshoots nationwide.

CyberScoop·Sep 2, 21:03 UTC · 14d agoPolicy & legal

Private security firms will soon be allowed to hack overseas cybercriminals

A Trump administration memo authorizes private security firms to hack overseas cybercriminals, the first such private-sector authorization for cyberattacks.

The White House has authorized private-sector security firms to conduct offensive hacking operations against cybercriminals located overseas, per a Trump administration memo. Ars Technica reports this is the first time the government has authorized the private sector to perform cyberattacks. The move significantly expands the role of industry in offensive cyber operations.

Ars Technica · Security·Aug 13, 19:38 UTC · Aug 13, 2026Policy & legal

Proactive cyber defense for governments and enterprises

Google launches the Fairwind Program giving governments and enterprises access to Gemini 3.8 Flash Cyber and CodeMender for autonomous vulnerability finding and patching.

Google DeepMind announced the Fairwind Program, a limited-access offering giving Google Cloud customers, government agencies, and cybersecurity partners access to Gemini 3.8 Flash Cyber and the CodeMender harness to autonomously find, verify, and fix vulnerabilities. Initial access prioritizes governments, critical infrastructure operators in healthcare, telecom, energy, and finance, and core technology platforms, with over 650 partners participating. Google also raised its total global cybersecurity funding commitment above $100 million, including $36 million for 35 US cyber clinics.

Google DeepMind·Sep 2, 16:24 UTC · 14d agoAI industry

OpenAI targets small utilities with $1 billion cyber defense initiative

OpenAI commits $1 billion to Daybreak for Frontline Defenders, subsidizing frontier cyber AI access and training for small utilities, governments, and critical infrastructure operators.

OpenAI President Greg Brockman announced Daybreak for Frontline Defenders, a $1 billion global commitment expanding subsidized access to Daybreak cyber models, training, and technical support. Daybreak for America will target small water and electricity providers, local governments, and banks, including a pilot with the MS-ISAC for state, local, tribal, and territorial defenders. The Daybreak Defense Network brings more than 35 enterprise partner products into the program, and attendees at OpenAI's utility summit represent 40 states serving over half the US population. Security experts welcomed the effort but cautioned that OT environments still need human-led implementation and testing before AI tooling can be safely rolled out.

CSO Online·Sep 3, 21:28 UTC · 13d agoAI industry1

Researchers observe first ‘near-autonomous’ AI attack on government target in Taiwan

Dream researchers observed the first near-autonomous AI attack on a government target, with suspected Chinese hackers stealing 2,500+ Taiwan records.

Israeli firm Dream reported that suspected Chinese hackers used open-source AI models to run a near-autonomous cyberattack against Taiwan's government, extracting over 2,500 personnel records. The framework, built on Hermes and OpenClaw, adapted mid-operation without human intervention, ran autonomous 'Learning Cycles' researching applicable vulnerabilities, and expanded to supply chain vendors, a nuclear safety agency, a government email system, and seven-plus energy companies. Attackers bypassed safety guardrails by framing the work as authorized penetration testing. Dream discovered the operation via a 160MB online archive of nearly 1,400 files.

CyberScoop·Aug 12, 17:05 UTC · Aug 12, 2026Threat actor in the wild

Edge infrastructure under siege: what two independent datasets reveal about who's exploiting your perimeter

Joint Tenable-SentinelOne analysis of 93 CVE-actor attribution pairs shows nation-state and criminal groups independently converge on the same edge infrastructure.

Tenable and SentinelOne jointly analyzed 93 CVE-actor attribution pairs covering exploitation of perimeter devices. The data shows state-sponsored and financially motivated actors independently target the same edge products from Ivanti, Fortinet, and Palo Alto Networks. The findings challenge the narrative that edge exploitation is exclusively a China-nexus nation-state problem, showing a broader shared attack surface.

Tenable Blog·Aug 26, 13:00 UTC · 21d agoThreat actor in the wild

Expanding AI access and cyber defense for federal, state, local, and tribal governments

OpenAI and GSA agreed to provide ChatGPT to federal, state, local, and tribal governments with $0 licenses, 50% off usage, and cyber-defense access.

OpenAI for Government and the U.S. General Services Administration announced a 27-month agreement (October 1, 2026 through December 31, 2028) waiving the $15 per-user monthly license fee and cutting usage costs 50% for federal, state, local, and tribal agencies. More than one million government employees already have ChatGPT access, with eligibility extending across a roughly 23 million-person U.S. public-sector workforce. Every verified government entity is approved for Daybreak Blue cyber-defender access at 50% off, with Daybreak Red available for vulnerability research, exploit validation, and red teaming at standard pricing. The deal builds on the $1 billion Daybreak for Frontline Defenders commitment announced the prior week.

OpenAI News·updated Sep 10, 18:25 UTC · 6d ago·first Sep 10, 07:00 UTC · 6d agoAI industry 3 sources1

Batten the Hatches: Cybersecurity with Military Mariners

Interviews with 20 U.S. Navy and Coast Guard mariners reveal informal, safety-oriented shipboard cyber risk models that may delay attribution and containment.

The study conducts semi-structured interviews with 20 military mariners from U.S. Navy and Coast Guard vessels to understand how service members recognize and respond to cyber risk aboard ships. Unique consequences of compromising military systems identified include weapon takeover and purposeful geopolitical escalation. Cybersecurity is organizationally abstract on ships, so mariners build cyber risk models from informal experience rather than formal instruction. A safety-oriented incident-response model creates resilience but may delay cyber attribution and containment.

arXiv cs.CR·Sep 11, 13:04 UTC · 5d agoResearch

FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

FBI officials said AI is accelerating adversary capabilities while its new cyber strategy emphasizes continuous patching, cyber hygiene, and AI-enabled defense.

At the Billington CyberSecurity Summit and ahead of a new FBI cyber strategy, deputy assistant director Jason Bilnoski said AI is boosting the speed and capability of both criminal and nation-state attackers, while stressing that basic controls like MFA would still prevent most attacks. Colleen Ferranti urged a shift from quarterly Patch Tuesday cycles to continuous, risk-based patching as AI accelerates vulnerability discovery. The strategy pledges AI-enabled triage, malware analysis, attribution support, agentic AI adoption, expanded Computer Network Operations, ICS Coordinators in every field office, and a pledge on victim relief and privacy.

CyberScoop·Sep 9, 13:00 UTC · 7d agoPolicy & legal

Enterprise Defenses Recovered at the Edge and Collapsed Inside

Picus Labs' Blue Report 2026 finds perimeter prevention at 69% but post-compromise prevention just 37%, with reconnaissance blocked only 10% of the time.

Picus Labs' Blue Report 2026, based on 434,000+ simulated attacks across client production environments in H1 2026, found perimeter prevention effectiveness rose from 62% to 69% while the Post-Compromise Prevention Rate was only 37%. Quiet techniques fared worst: reconnaissance was blocked 10% of the time, registry-based credential access less than 1%, and the alert score stayed at 14% despite logging at a four-year high of 58%. IOC-based prevention fell to 50% from 71% in 2024, and Mimikatz's LSASS path was blocked about 94% while alternative credential-read paths went nearly undetected.

The Hacker News·Aug 12, 11:41 UTC · Aug 12, 2026Research

OpenAI says Daybreak will expand to offer specialized cyber services

CyberScoop·Aug 10, 20:55 UTC · Aug 10, 2026Exploit / PoC

Is Cyber missing the Marque?

Cisco Talos analyzes the White House memorandum on private-sector participation in government-authorized offensive cyber operations.

A new White House memorandum addresses private sector participation in government-authorized offensive cyber operations. Cisco Talos's newsletter, introduced by new author Mick Baccio, explores the operational and security implications of this policy for the cybersecurity industry.

Cisco Talos·Aug 20, 18:00 UTC · 27d agoPolicy & legal

Arrested man allegedly impersonated NSA elite hacking unit, Supreme Court chief justice

Colorado man Joshua Culver indicted for impersonating NSA's Tailored Access Operations chief and Supreme Court Chief Justice John Roberts in Indiana court cases.

Joshua Culver, also known as Maverick Young, was arrested in Colorado after a July Indiana indictment on four counts of falsely impersonating an officer of the court and one count of using a forged judge's signature. He allegedly posed as an NSA officer in September to pressure the Tippecanoe County sheriff's office, and later presented a forged document purportedly from the head of the Tailored Access Operations unit demanding case dismissal and warrant quashing. The indictment also alleges he used a forged signature of Chief Justice John Roberts on a dismissal order in Grant County, Indiana.

CyberScoop·Aug 25, 18:43 UTC · 22d agoPolicy & legal2

338 Million Attack Simulations Reveal The State Of Enterprise Defense

Picus Labs' Blue Report 2026, from 338 million attack simulations, finds defenses strong at the perimeter but blocking only 37% of post-compromise actions.

Picus Labs' fourth annual Blue Report analyzed over 338 million attack simulations from production environments in H1 2026. Average prevention effectiveness rose from 62% to 69%, but only 37% of attacker actions were blocked after compromise, with reconnaissance and credential theft largely missed. IOC-based malware download prevention fell to 50% from 71% in 2024, and Mimikatz credential dumping from LSASS memory was blocked 94% of the time versus 17% from other memory locations and 3% from registry.

Help Net Security·Aug 12, 00:00 UTC · Aug 12, 2026Research

AI is getting better at election facts, but voters shouldn’t rely on it

CyberScoop·Aug 5, 09:00 UTC · Aug 5, 2026Exploit / PoC in the wild

China Is Strapping ‘Digital Bombs’ to Civilian Infrastructure—Is the US Ready?

WIRED examines Volt Typhoon pre-positioning 'digital bombs' in US civilian infrastructure via a war game simulation discussion.

WIRED's Uncanny Valley podcast features reporter Andy Greenberg discussing a war game simulating a cyberattack by Chinese hacking group Volt Typhoon. The episode examines Volt Typhoon's practice of planting persistent access in US civilian infrastructure that could be activated during conflict, and questions whether the US is prepared.

WIRED · Security·Aug 20, 20:03 UTC · 27d agoThreat actor

National cyber director lays out White House plans to secure AI without writing new rules

CyberScoop·Aug 5, 14:45 UTC · Aug 5, 2026Exploit / PoC in the wild

AI for Military Support

Study of 2,015 Israeli military personnel found algorithmic aversion toward AI targeting decision support, reduced when explainable AI features were added.

The paper 'Black Box Warfare' reconstructed a real-world military AI decision-support system used in targeting and tested a high-fidelity replica in two experiments with 2,015 Israeli military personnel. Contrary to automation-bias fears, participants showed strong algorithmic aversion, especially in high-collateral-damage scenarios. Integrating explainable AI features reduced aversion and promoted more thoughtful evaluation of algorithmic recommendations. The authors conclude that trust in military AI is dynamic and that human agency remains central in high-stakes decisions.

Schneier on Security·Aug 11, 11:18 UTC · Aug 11, 2026AI research

Risky Bulletin: Academics find source code overlaps between Geedge and China's Great Firewall

Academics linked Chinese vendor Geedge Networks' Tiangou Secure Gateway source code to one of the Great Firewall's three traffic filtering capabilities.

US researchers presenting at USENIX Security reconstructed Geedge Networks' Tiangou Secure Gateway firmware from over 100,000 leaked files, including Git repositories with commit history, and matched its filtering behavior to sections of China's Great Firewall. They found only 1 of 3 characterized DNS injectors matched Geedge code, noted the system relies on memory-unsafe C components and copied third-party code, and said its bugs could aid future circumvention tools. Geedge also exports censorship tools to Kazakhstan, Ethiopia, Pakistan, and Myanmar. The newsletter additionally rounds up multiple breaches.

Risky Business News·Aug 21, 02:55 UTC · 27d agoResearch2

Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America

Unit 42 documents two AI-assisted intrusion campaigns against Latin American government, utility, and financial organizations using LLM-orchestrated tooling.

Palo Alto Networks Unit 42 tracks two ongoing intrusion clusters, CL-CRI-1131 (Mexican transportation, federal ministries, municipal water utilities) and CL-CRI-1163 (Brazilian financial sector), both using living-off-the-land techniques, SOCKS5 relays, and custom RATs. The attackers appear to orchestrate operations via commercial LLMs like Claude and GPT-4.1, evidenced by iterative batch scripts and AI-generated tunneling tool naming. The Mexican campaign (also reported as Operation Escaneo by CloudSEK) exfiltrated sensitive data via dynamic-DNS infrastructure with rotated multi-SAN TLS certificates between February and June 2026. This signals broader adoption of AI-enhanced operations by diverse threat groups in the region.

Palo Alto Unit 42·Sep 3, 10:00 UTC · 13d agoThreat actor in the wild1

Risky Bulletin: BEC campaign steals €35 million from French notaries

Hackers stole over €35 million from 500+ French notary offices in a four-year BEC campaign; ANSSI spent two years helping evict the attackers.

A business email compromise campaign breached more than 500 French notary offices — about 7% of all French notaries per the Conseil Supérieur du Notariat — over four years, stealing more than €35 million by phishing initial access and silently modifying wire transfer details. France's cybersecurity agency ANSSI worked for two years behind the scenes to help notaries remove the persistent attackers, who had deep access; officials also feared hackers could issue fake notarized acts such as marriage certificates or forged real estate deals. No forged documents have been found so far, but notaries have added two-factor authentication and in-person requirements for banking details, and banks added extra checks in 2024. The newsletter also notes other incidents, including a $320 million Bitcoin extraction from Blockstream's Liquid Network and a JetBrains Cadence breach via TeamCity servers.

Risky Business News·Sep 7, 03:42 UTC · 10d agoPhishing & fraud in the wild1

Cyber Op Targets South Korean Media & Automotive Sectors

Likely North Korean APT compromised load balancers at South Korean media and automotive firms using a previously undocumented Linux espionage toolkit.

A cyber operation attributed to a likely North Korean APT group targeted South Korean media and automotive sectors. The attackers deployed a previously undocumented Linux espionage toolkit to compromise load balancers, gaining access to communications and enabling further network exploitation. Specific victims, toolkit names, and indicators of compromise were not disclosed in the report summary.

Dark Reading·Sep 16, 01:00 UTC · 1d agoThreat actor in the wild

US agencies warn of AI-powered attacks on Siemens industrial controllers

NSA, CISA, FBI, DOE, and EPA warn threat actors use AI-assisted scripts and snap7 libraries to access internet-exposed Siemens S7 PLCs in critical infrastructure sectors.

NSA, CISA, FBI, DOE, and EPA issued a joint advisory warning that threat actors combine open-source snap7.dll/python-snap7 libraries with AI-generated scripts to gain read/write access to Siemens S7-200 through S7-1500 PLCs over the S7comm protocol. Actors use Censys and ZoomEye to find internet-exposed devices and abuse default or weak credentials, with activity assessed as persistent reconnaissance and positioning for future write operations. Agencies urge device inventory, patching, removing PLCs from the internet, and hardening; the pattern resembles Iran-linked CyberAv3ngers targeting of Rockwell, Schneider, and Siemens PLCs.

Help Net Security·Aug 20, 00:00 UTC · 28d agoAdvisory in the wild

Persistent Attempts at Cyberespionage Against Southeast Asian Government Target Have Links to Alloy Taurus

Alloy Taurus (GALLIUM) compromised Southeast Asian government networks from 2022 to 2023 using Exchange web shells and undocumented .NET backdoors Reshell and Zapoa.

Unit 42 tracked persistent multiwave intrusions at a Southeast Asian government starting in early 2022 and continuing through 2023, attributing the activity with moderate confidence to Alloy Taurus (aka GALLIUM), a Chinese state-aligned espionage group. Attackers exploited Exchange Server vulnerabilities to deploy web shells including China Chopper, then ran reconnaissance with Fscan and WebScan, created administrative accounts, and installed undocumented .NET backdoors named Reshell and Zapoa. They established resilience by installing SoftEther VPN, brute-forced Active Directory credentials with Kerbrute, and dumped credential stores with GoDumpLsass and LsassUnhooker. The campaign reflects long-term espionage tradecraft to maintain a foothold.

Palo Alto Unit 42·Aug 17, 10:54 UTC · Aug 17, 2026Threat actor in the wild1