57
42
47
57
FBI Disrupts China-Linked QTFY Infrastructure Used to Steal Data From U.S. Organizations
FBI and Lumen disrupted QTFY's QScan and QTRouter botnet platforms used by Chinese state-sponsored hackers to conceal intrusions into U.S. agencies.
The U.S. DoJ announced court-authorized seizure of domains behind QScan and QTRouter, operated by the Chinese state-sponsored group QTFY and employed by Nanjing Xinjiuwei Network Technology Company. QTFY has been active since May 2018 and targeted NASA, the Federal Reserve, the Department of Energy, DoJ, HHS, NIH, the U.S. Senate, and academic institutions. QScan exploits vulnerable IoT devices, feeding them into QTRouter, an OpenWrt-based proxy obfuscation network likened to an operational relay box (ORB) that masks attack origins. The group exploited zero-days such as Ivanti CSA flaws CVE-2024-8190, CVE-2024-8963, and CVE-2024-9380, plus numerous N-days, and maintained persistence with RATs, web shells, and legitimate credentials.
78
DoJ Corrects China Hacking Claim, Says U.S. Agencies Were Targets, Not Victims
DoJ corrected its statement to say US federal agencies were targets, not confirmed victims, of China-linked group QTFY's intrusions.
The US Department of Justice revised its press release to list NASA, the Federal Reserve, Department of Energy, DoJ, HHS, NIH and the US Senate as 'among the targets' of QTFY (aka QT AND QTCYBER), rather than victims. QTFY, active since 2018 and linked to Nanjing Xinjiuwei Network Technology Co with payments suggesting MSS sponsorship, operates the QScan vulnerability scanning platform and QTRouter obfuscation network, which underpin the Fast Labyrinth encrypted ORB relay network built from infected IoT devices and leased VPSs. The FBI seized qtproxy[.]xyz, qt-proxy[.]org and qt-team[.]com, disrupting QScan and QTRouter, while Lumen Black Lotus Labs reported the actor industrialized ORB networks for China-linked espionage. A 2019 NASA intrusion attempt exploited CVE-2019-11510, a critical Pulse Secure VPN flaw.
70
NASA AIT-GUI Flaws Could Let Unauthenticated Attackers Issue Spacecraft Commands
Researchers disclosed 9.4-CVSS flaws in NASA/JPL's AIT-GUI allowing unauthenticated attackers to issue arbitrary spacecraft commands via exposed command endpoints.
Cycode disclosed a flaw chain in AIT-GUI, the browser-based operator console for NASA/JPL's open-source AMMOS Instrument Toolkit, tracked as GHSA-p9r8-2q67-fp86 with CVSS 9.4, affecting versions 2.5.1 and earlier. The server binds to 0.0.0.0:8080, issues sessions without credential checks, and lets unauthenticated users issue spacecraft commands via POST /cmd and reach files outside intended directories via /script/run and /seq (CWE-306, CWE-352, CWE-22). Version 2.5.2 adds host binding and same-origin checks but does not add authentication, and a related missing-authentication flaw was published separately as CVE-2026-60112 with CVSS 9.3.
50
60
42
42
42
42
42
57
47
42
57
42
42
47
47
57
42
57
42
Google researchers uncover criminal zero-day exploit likely built with AI
Google links a likely LLM-built criminal zero-day for an open-source admin tool to planned mass exploitation and maps AI-assisted threats.
Google Threat Intelligence Group linked a zero-day exploit for a popular open-source web-based administration tool, enabling 2FA bypass with valid credentials via a semantic logic error, to a criminal group, citing educational docstrings, a hallucinated CVSS score, and textbook Python as signs of LLM authorship; the vendor was notified before a planned mass exploitation campaign. The report also details Russia-nexus malware families CANFAIL and LONGSTREAM using AI-generated decoy code, the PROMPTSPY Android backdoor driving the UI through the Gemini API, APT27 using Gemini to build relay tooling, and the TeamPCP (UNC6780) supply chain compromise of LiteLLM and Trivy repositories that planted the SANDCLOCK credential stealer.
78
Ongoing exploitation of Cisco Catalyst SD
60
42
47
57
⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More
Weekly recap: suspected China-nexus APT exploited VMware vCenter CVE-2026-59310, Lazarus used Windows zero-day CVE-2026-68820, and macOS flaw dropped Monero miners.
The week's top stories included a suspected China-nexus APT exploiting VMware vCenter CVE-2026-59310 (CVSS 9.8), a directory-traversal flaw enabling arbitrary code execution, with backdoors, reverse SSH and Babuk-derived ransomware deployed, per QUIRSO. NCSC-NL reported active exploitation of macOS Screen Sharing flaw CVE-2026-65400 (CVSS 9.8) to install Monero miners on systems with port 5900 exposed. Lazarus Group exploited Windows zero-day CVE-2026-68820 (CVSS 7.0) in Operation Dream Job, delivering ForestTiger and Troy backdoors to defense and aerospace targets. GeoServer patched a critical SQL injection flaw exploited within hours of disclosure, and Jamf analyzed the new Amnesia Stealer for macOS with live browser control.
78
42
North Korean Lazarus Group Uses Windows Zero
Check Point links Lazarus Group's Operation Dream Job to a new Windows zero-day, CVE-2026-68820, targeting defense workers with fake Lockheed Martin job offers.
Check Point Research documented a new wave of Operation Dream Job, a North Korean Lazarus Group campaign targeting defense and aerospace professionals in France, Germany, Brazil, and India with fake Lockheed Martin job offers. The attacks chain a previously unknown Windows privilege escalation flaw in AFD.sys, CVE-2026-68820, which Microsoft patched on August 11, 2026, to deploy the MISTPEN downloader, ForestTiger backdoor, and updated FudModule 3.1 kernel rootkit. Check Point also discovered a new Troy backdoor DLL with 17 operator commands and a RelayShell PHP webshell deployed on compromised Roundcube and WordPress servers used as command relays, some infected via CVE-2025-49113 or leaked credentials. Defenders are urged to apply the August 2026 Patch Tuesday update and review Check Point's indicators of compromise.
84
42
57
42
Schneider Electric Easergy, EcoStruxture, PowerLogic, and Saitel Products (Update A)
CISA updated ICSA-26-169-07: CVE-2026-4827 (CVSS 8.3) insufficient entropy enables session hijacking across dozens of Schneider Electric grid products; fixes available.
CISA republished advisory ICSA-26-169-07 (Update A) for CVE-2026-4827, CWE-331 insufficient entropy in session management, scored CVSS 8.3. Affected lines include Easergy MiCOM relays and C5, EcoStruxure Power Automation (EPAS-GTW, EPAS-UI, iPMFLS), EcoStruxure Power Operation, PowerLogic P5/P7/T300/T500, and Saitel DP/T150 RTUs, with dozens of fixed versions listed. Successful exploitation could enable session hijacking and unauthorized operations on systems in energy, chemical, critical manufacturing, and water sectors. Fixes are available; no exploitation is reported.
48
57
42
57