60
Researchers observe first ‘near-autonomous’ AI attack on government target in Taiwan
Dream researchers observed the first near-autonomous AI attack on a government target, with suspected Chinese hackers stealing 2,500+ Taiwan records.
Israeli firm Dream reported that suspected Chinese hackers used open-source AI models to run a near-autonomous cyberattack against Taiwan's government, extracting over 2,500 personnel records. The framework, built on Hermes and OpenClaw, adapted mid-operation without human intervention, ran autonomous 'Learning Cycles' researching applicable vulnerabilities, and expanded to supply chain vendors, a nuclear safety agency, a government email system, and seven-plus energy companies. Attackers bypassed safety guardrails by framing the work as authorized penetration testing. Dream discovered the operation via a 160MB online archive of nearly 1,400 files.
82
Shattering the Dream – When a Job Offer Becomes a Zero-Day Attack
Check Point details an Operation Dream Job wave using trojanized PDF viewers to hit defense, aerospace, and aviation targets since early 2026.
Since early 2026, Check Point Research has tracked a wave of the Operation Dream Job campaign primarily targeting the global defense sector, with emphasis on aerospace and aviation companies. The threat actor distributes modified PDF viewers that execute malicious payloads embedded in specially crafted files, delivered under fake job-offer pretexts. Check Point characterizes the operation as a zero-day attack.
72
Lazarus hackers pair fake job offers with Windows zero-day exploit
Lazarus' Operation Dream Job targets the defense sector with fake job offers, a Windows LPE zero-day (CVE-2026-68820), and new Troy and RelayShell backdoors.
Check Point documented two parallel infection chains in Lazarus' Operation Dream Job: a digitally signed PDF viewer with DLL sideloading delivering the MISTPEN in-memory downloader, and a trojanized SecurityPDF viewer, distributed via fake Enveil websites, installing the newly documented Troy backdoor. A component exploits CVE-2026-68820, a local privilege escalation zero-day in the Windows AFD.sys driver used since at least early July, which Microsoft patched on August 11, 2026, enabling deployment of the FudModule kernel-mode rootkit. Lazarus also compromised Roundcube webmail servers vulnerable to CVE-2025-49113 to deploy the RelayShell PHP web shell and relay C2 traffic, targeting defense-sector organizations primarily in Western Europe and India. Separately, CERT-UA documented Sandworm's UAC-0145 using fake job offers against IT professionals since May 2026.
82
Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor
Lazarus exploits Windows AFD.sys zero-day CVE-2026-68820 in Operation Dream Job to deploy Troy backdoor at defense firms.
Check Point attributes Operation Dream Job attacks to Lazarus Group exploiting CVE-2026-68820 (CVSS 7.0), a privilege escalation flaw in Windows AFD.sys patched in August 2026 Patch Tuesday. The campaign targets defense and aerospace firms in France, Germany, Brazil, and India via trojanized PDF viewers and DLL side-loading, deploying backdoors Troy, ForestTiger, and the FudModule 3.1 kernel rootkit. Attackers also compromise WordPress, SharePoint, and Roundcube servers as C2, using CVE-2025-49113 and the RelayShell PHP web shell.
78
China-Linked Hackers Use AI Agents in Autonomous Attack on Taiwan
Suspected Chinese hackers used eight AI agents to autonomously breach Taiwan government networks, compromising 85+ accounts and stealing 2,500 personnel records.
Israeli cybersecurity firm Dream documented what appears to be the first fully autonomous, end-to-end AI hacking operation against a government target, suspected to be Taiwan, in early July. The toolkit, built from open-source agent frameworks Hermes and OpenClaw, deployed up to eight agents that mapped 21 government systems, compromised at least 85 accounts, and extracted over 2,500 personnel records before expanding to a nuclear safety agency and at least seven energy companies. Operators bypassed the model's guardrails by framing the entire campaign as an authorized penetration test. Dream found a 160MB, 1,395-file archive containing the deliberately assembled multi-agent weapon.
86
60
60
CISA gives federal agencies two weeks to patch Microsoft bug exploited in DPRK campaign
CISA orders federal agencies to patch exploited Windows Winsock zero-day CVE-2026-68820 by August 25, used by Lazarus in Operation Dream Job.
CISA ordered federal agencies to patch Windows Winsock vulnerability CVE-2026-68820, rated 7/10, by August 25 after confirming exploitation; no workaround exists and a restart is required. Check Point found Lazarus Group hackers impersonated Lockheed Martin and Enveil recruiters on LinkedIn, sent malicious PDFs enabling long-term remote access, then used the zero-day to escalate from limited access to full system control. Targets spanned defense sectors including surveillance, drones and robotics in France, Germany, Brazil and India, as part of Operation Dream Job tracked since 2020.
82
60
60
AI-Generated Exploit Scripts Target Siemens S7 PLCs in U.S. Critical Infrastructure
NSA, CISA, FBI, DOE and EPA warn that actors use AI-generated Python scripts to exploit internet-exposed Siemens S7 PLCs at U.S. critical infrastructure.
A joint advisory from NSA, CISA, FBI, DOE and EPA describes an active threat in which AI-generated exploit scripts disguised as legitimate monitoring tools target Siemens S7 Series PLCs (S7-200 through S7-1500, including F-series safety controllers). The actors use Censys and ZoomEye scanning to find internet-exposed, outdated PLCs and a custom Python script using snap7 libraries over the S7comm protocol for initial access, credential access and denial of service; no attribution was given. Targeted sectors include Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture, and Commercial Facilities, with potential for process disruption and cascading impacts. A related Dream report details a near-autonomous AI-agent campaign (July 1-4, 2026, 12 waves) against Taiwan government entities, using Hermes and OpenClaw agents with eight parallel sub-agents to crack 85 accounts via password spraying and exfiltrate over 2,564 personnel records, SSO client secrets and database credentials.
80
North Korean Lazarus Group Uses Windows Zero
Check Point links Lazarus Group's Operation Dream Job to a new Windows zero-day, CVE-2026-68820, targeting defense workers with fake Lockheed Martin job offers.
Check Point Research documented a new wave of Operation Dream Job, a North Korean Lazarus Group campaign targeting defense and aerospace professionals in France, Germany, Brazil, and India with fake Lockheed Martin job offers. The attacks chain a previously unknown Windows privilege escalation flaw in AFD.sys, CVE-2026-68820, which Microsoft patched on August 11, 2026, to deploy the MISTPEN downloader, ForestTiger backdoor, and updated FudModule 3.1 kernel rootkit. Check Point also discovered a new Troy backdoor DLL with 17 operator commands and a RelayShell PHP webshell deployed on compromised Roundcube and WordPress servers used as command relays, some infected via CVE-2025-49113 or leaked credentials. Defenders are urged to apply the August 2026 Patch Tuesday update and review Check Point's indicators of compromise.
84
60
60
⚡ Weekly Recap: WSUS Exploited, LockBit 5.0 Returns, Telegram Backdoor, F5 Breach Widens
60
60
⚡ THN Weekly Recap: Top Cybersecurity Threats, Tools and Tips [13 January]
60
60
60
60
60
Multiple Chinese hacking groups seen using identical Chrome zero-day exploit
Four China-linked espionage groups share identical BlueMoon Chrome zero-day exploit kit targeting US defense contractors and Asian government agencies.
Proofpoint identified at least four Chinese-aligned espionage groups (TA412/RedBravo, UNK_LateNight, UNK_DoubleCheck, UNK_QuietRacket) using an identical Chrome zero-day exploit kit dubbed BlueMoon in late August through this week. Targets include US defense contractors, NGOs, mining companies, and Southeast Asian government agencies. The exploit chains a Chromium patch-gap vulnerability with a Windows flaw, delivering malware such as ShadowPad and a fake Gemini browser extension backdoor, with possible AI-assisted exploit development.
85
Nimbus Manticore Expands Toolset With TWOSTROKE
Group-IB found new infrastructure and TWOSTROKE-like malware used by IRGC-linked Nimbus Manticore, indicating expanded Middle East and Europe targeting.
Group-IB reported new Tortoiseshell infrastructure spanning Europe and the Middle East and two previously undocumented tools from IRGC-linked Nimbus Manticore (UNC1549): a reverse SSH tunneling utility connecting to 172.86.98.113 on port 443, and a C++ backdoor masquerading as wtsapi32.dll with three hard-coded C2 servers. The backdoor overlaps with TWOSTROKE and supports file transfer, execution, host information gathering, and persistence. Findings build on Kaspersky's report of the NightLedger backdoor and WebSocket tunnelers BridgeHead and ArcBridge, and suggest expanded targeting beyond the Middle East into Europe.
60
⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More
Weekly recap: suspected China-nexus APT exploited VMware vCenter CVE-2026-59310, Lazarus used Windows zero-day CVE-2026-68820, and macOS flaw dropped Monero miners.
The week's top stories included a suspected China-nexus APT exploiting VMware vCenter CVE-2026-59310 (CVSS 9.8), a directory-traversal flaw enabling arbitrary code execution, with backdoors, reverse SSH and Babuk-derived ransomware deployed, per QUIRSO. NCSC-NL reported active exploitation of macOS Screen Sharing flaw CVE-2026-65400 (CVSS 9.8) to install Monero miners on systems with port 5900 exposed. Lazarus Group exploited Windows zero-day CVE-2026-68820 (CVSS 7.0) in Operation Dream Job, delivering ForestTiger and Troy backdoors to defense and aerospace targets. GeoServer patched a critical SQL injection flaw exploited within hours of disclosure, and Jamf analyzed the new Amnesia Stealer for macOS with live browser control.
78
Microsoft patches 400+ vulnerabilities, one zero-day under attack (CVE-2026-68820)
Microsoft's August 2026 Patch Tuesday fixes 400+ vulnerabilities, including an actively exploited Windows zero-day (CVE-2026-68820) used by North Korean attackers.
Microsoft's August 2026 Patch Tuesday fixes over 400 vulnerabilities, including CVE-2026-68820, a use-after-free in the Windows Ancillary Function Driver exploited in the wild by North Korean actors deploying a kernel-mode rootkit in Operation Dream Job. Critical unauthenticated remote code execution flaws in Microsoft QUIC (CVE-2026-62815) and Windows DNS (CVE-2026-62878) were also patched, alongside a SharePoint RCE chain combining CVE-2026-63520 with CVE-2026-55040. Researcher Nightmare-Eclipse released ShieldBreak, a PoC bypassing the July RoguePlanet Microsoft Defender patch (CVE-2026-50656), confirmed working by Will Dormann on Windows 11.
82
Microsoft Patches 398 Flaws Including a Windows Driver Zero
Microsoft's August Patch Tuesday fixes 398 CVEs, including actively exploited Windows zero-day CVE-2026-68820 used by Lazarus for SYSTEM privilege escalation.
Microsoft's August 2026 Patch Tuesday release addresses 398 new vulnerabilities, 62 rated Critical by the Zero Day Initiative, with CVE-2026-68820 (CVSS 7.0), a use-after-free in the afd.sys Windows kernel driver, the only flaw flagged as actively exploited. Check Point Research attributed exploitation of the privilege escalation bug to Lazarus' Operation Dream Job campaign. Four unauthenticated remote code execution flaws rated 9.8 affect Windows DNS Server (CVE-2026-62878, called wormable by ZDI), Windows Deployment Services (CVE-2026-62893), Microsoft QUIC (CVE-2026-62815) and HPC Pack (CVE-2026-59124). The release also completes a two-part SharePoint fix with RCE component CVE-2026-63520, following July's authentication bypass fix CVE-2026-55040.
82
60
60
60
60
60
⚡ Weekly Recap: Drift Breach Chaos, Zero-Days Active, Patch Warnings, Smarter Threats & More
60
60
60
60
60
Week in review: Microsoft patches actively exploited 0-days, Amazon and HSBC employee data leaked
60
Week in review: PoC for Splunk Enterprise RCE flaw released, scope of Okta breach widens
60
July 2020 Patch Tuesday: Microsoft plugs wormable Windows DNS Server RCE flaw
60