Operationally this week a continued focus on Operation Technology and Industrial Control Systems connected to the internet. We released a note on Disruptive cyber activity highlights risk from internet-exposed systems and edge devices.

In the high-level this week:

• Disruptive cyber activity highlights risk from internet-exposed systems and edge devices - UK National Cyber Security Centre warns - “Targeting of operational technology reinforces the need for organisations to understand what is exposed to the internet, address avoidable vulnerabilities, and build long-term cyber resilience.”

• Five Country Ministerial Communiqué 2026 - Home Office publishes - “We, the Home Affairs, Interior and Security Ministers of Australia, Canada, New Zealand, the United Kingdom, and the United States (the ‘Five Countries’) convened under Australia’s Chairmanship, in Sydney on 25-26 August 2026, for the Five Country Ministerial (FCM). In a period marked by heightened global uncertainty, the Five Countries reaffirm our unwavering commitment to promoting shared values, and acting decisively to protect our borders, our economies, and the safety of our communities. In 2026, the Five Countries have driven coordinated action and practical cooperation on several key national security challenges, including the following national security priorities” - “We have committed to deepen collaboration with industry on shared national security priorities and public safety, including enabling timely access to frontier models to support secure innovation and strengthen cyber security. We will work together to ensure the safe, secure and responsible application of artificial intelligence to the benefit of our communities.”

• Cyber Security and Resilience (Network and Information Systems) Bill - Parliament updates - comment: various amendments being suggested and published

• Accelerating adoption of quantum enabled sensing and PNT - Innovate UK announces - “UK registered businesses can apply for a share of up to £14.3 million to accelerate the adoption of quantum enabled position, navigation, and timing (PNT) and sensing technologies by addressing specific technical and commercial barriers.” - comment: PNT is a critical enabler to modern resilient systems with reliable timing often underbaked.

• Declaring a National Emergency to Secure the United States Bulk-Power System - The White House (not me) announces - “During my first term, I found that the bulk-power system could be a target of those seeking to commit malicious acts against the United States, including malicious cyber activities, because of the significant risks that a successful attack would have on our economy, human health and safety, and national defense. Since my first term, the threat to the United States regarding foreign supply of bulk-power system electric equipment has become even more acute: The rapid growth of advanced manufacturing, data centers, artificial intelligence, and defense production has increased the Nation’s dependence on abundant, reliable electricity and magnified the consequences of a successful attack or supply disruption on the bulk-power system.”

• Treasury Announces the Quantum-Readiness Task Force - US Treasury announces - “This Task Force will help ensure our financial system remains strong, secure, and competitive as new technologies reshape the global landscape.”

• Defending American Information; US Communications Security Policy since 1945 - National Security Agency detail history - “Since the end of World War II, the United States has contended with the growing vulnerabilities and capabilities of an increasingly interconnected world. Maintaining the security and confidentiality of government communications has been a joint effort since 1945, and the fact that it is addressed through the President indicates an understanding of how critical information security is. In another sense, it also stands as an example of the interplay between communications intelligence and security.”

• New Zealanders urged to take care as cyber security incidents become more complex - NZ National Cyber Security Centre warns - “Of those reports, 92 incidents were triaged for specialist technical support due to their potential national significance, an increase from the 77 incidents recorded in the previous quarter. The remaining 1,037 reports did not require specialist technical support.”

• State-backed hackers targeted EU officials on WhatsApp, document shows - Politico reports - “The presentation, given to officials from EU national governments in July, lists “account takeover targeting high-ranking officials” as one of the top threats facing the bloc this year.”

• Why defence network visibility is increasingly critical to UK resilience - Moody’s opines - “As governments seek to reduce exposure to vulnerabilities and strengthen domestic or allied supply chains, they may discover that dependencies are often more complex than they first appear. Consider a defence procurement team evaluating a supplier for a strategically important programme. The supplier itself may appear low risk, but resilience challenges can emerge when ownership structures, critical subcontractors, financing arrangements, or technology dependencies are examined more closely and found to span multiple jurisdictions.”

• Worth a try: the US will authorise some companies for cyber counterattacks - Australian Strategic Policy Institute supports - “The White House is wisely not just outsourcing to privateers but creating an entire institutional framework. The co-executive directors (policymakers from the departments of Justice and Homeland Security) will vet and contract with companies and approve and retain operational control of their activities. Companies will have to report their activities to the government and can be ejected from the program if they fail to live up to standards.”

• Blue House Officials’ Personal Information Leaked, 102 Locations Including Media Attacked… Korean Computer Network Becomes a ‘Hacker Playground’ - Munhwa Ilbo reports - “The police are investigating the possibility that the North Korean hacking group 'Lazarus' is involved in the case handled by the Seoul Metropolitan Police Agency. In 2023, Lazarus hacked 207 computers across 61 domestic institutions, including eight media outlets. However, the security industry points out that the Blue House personnel scandal could also be the work of Lazarus.”

• Reporting on/from China

  • China Axing Microsoft Windows From State Agencies Ahead of Plan - Bloomberg reports - “China has been pushing the use of homemade technologies in sectors handling sensitive data, including military and state-owned firms. Several Chinese companies, including Kylin Software Co. and Tongxin Software Technology Co., have introduced their own versions of operating systems for computers to replace Windows.”

  • Chery’s robot affiliate AiMOGA eyes IPO, targets overseas market - Reuters reports - “Incubated by Chery in January 2025, AiMOGA has delivered more than 3,000 robots globally, with 2,000 overseas, and operates in more than 60 countries and regions.”

  • Who is really buying China’s humanoid robots? - Financial Times asks - “China’s humanoid robot makers are generating much of their revenue from selling machines to government-backed training centres — which then collect and sell training data back to the robot makers, raising concerns about actual demand in an industry Beijing is keen to promote. The widely adopted model, reminiscent of Nvidia’s “circular financing” of AI data centres, has fuelled China’s so-called embodied AI industry.”

  • China accelerates 6G development - People's Daily Online reports - “China is currently working to build “six networks,” including a next-generation communication network. This involves not only building new networks based on new technologies, but also upgrading existing networks.”

  • Implementation Plan for Deepening Technological Innovation and Integrated Application of Internet Protocol Version 6 (IPv6) (2026-2030) - Jiangsu Cyberspace Administration publishes - “New networks will be given priority in providing IPv6 addresses by default, accelerating the evolution to IPv6 single-stack, creating more new “IPv6+” applications, models, and business forms, and promoting the formation of a network service and application system dominated by IPv6.” - comment: IPv6+ is a Chinese specific flavour of IPv6

  • Chinese AI chips fall short on coding, forcing firms to stretch scarce Nvidia supply - South China Morning Post reports - “Chinese AI companies are optimising software to cope with surging demand for inference, as part of that workload still relies on computing power from a limited pool of high-end chips amid restricted access to Nvidia processors.”

• AI

  • A call for collective action on cyber defense - 100 organisations sign - comment: see reflections this week on this.

  • Brief independent investigation of agents’ behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident - METR and Redwood Research publish - “~1200 agents sent >70,000 messages and files on an unsanctioned message board, and ~700 attacked Hugging Face” - comment: thus likely very apparent if under observability and monitoring.

  • Assessing Kimi K3 Against Offensive Security Benchmarks - Irregular assesses - “Kimi K3 demonstrated strong performance on Atomic Tasks, solving several challenges involving cryptographic attacks, certificate forgery, browser exploitation, memory corruption, protocol manipulation, and multi-host compromise. It was particularly effective at turning partial access into complete attack chains by adapting public exploit techniques to constrained environments, building custom tooling, diagnosing implementation failures, and validating each stage before proceeding.”

  • We burned 11.7bn tokens to find the best cyber AI model - Aikido burns tokens - “

    • DeepSeek V4 Pro 0813 finds the most vulnerabilities. Pooling three runs reaches 28 of 32 vulnerabilities.

    • The most expensive model is not required. Three DeepSeek Pro runs cost about $295 and outperform Opus 5, Grok 4.6, or Sol. Three Flash runs cost $108 and reach 24 matching Grok’s best individual pass for less than a quarter of the cost.

    • Models are inconsistent at recall; repetition remediates it. Single runs miss the breadth of findings, but pooling across runs fills this gap. DeepSeek Pro finds 17 vulnerabilities on its first pass but 28 across three.

    • Open-source models now outperform the public frontier. DeepSeek V4 Pro topped every public closed model we tested on pooled vulnerability recall. Qwen, Kimi, and GLM-5.3 followed with strong consistency of findings without losing recall. Harnessed correctly, open models can now compete directly with the closed frontiers.”

  • Snyk VulnBench JS 1.0: Can LLMs Find the Same Bugs Twice? - Snyk product market - “Across 250 model runs, 80 of 161 unique unmatched findings appeared in only one of five identical repetitions, while only 22 appeared in all five.” - “By contrast, when Claude matched a Snyk Code reference finding, the behavior was much more stable: 134 of 158 unique reference-matched findings appeared in all five repetitions.”

  • From Code to Chain: Why WP2Shell Stayed Out of Reach - Zeddy Lu researches -”This paper compares the long-term code auditing capabilities of three major models by reproducing the wp2shell vulnerability chain discovery process: Under the same harness, GPT 5.6 Sol / GLM-5.2 / Qwen 3.8-Max-Preview were run 11 times, each lasting 6–10 hours, on the complete WordPress codebase, and their exploration process was recorded and reconstructed using full-chain hooking. “ - comment: demonstrates the reality and limitations of AI in finding certain vulnerabilities and thus showing that not all vulnerabilities become shallow - yet.

  • Scaling Memory Safety: AI-Assisted Rewrites of C/C++ Dependencies to Rust - Google detail - “This experiment described in this post demonstrates that AI-assisted migration can be a viable and effective strategy for structural risk reduction. By combining the speed of LLM-driven translation with the rigor of differential testing, plus human-expert review of safety boundaries and existing test cases, we can rapidly eliminate entire classes of vulnerabilities from our dependencies.”

  • Zhipu AI’s answer to Project Glasswing marks shift for Chinese cyber safety: researcher - South China Morning Post reports - “The model’s most sensitive offensive capabilities would be “reserved exclusively for verified users” under a restricted access plan dubbed “Cybersecurity Trusted Access”, Zhipu said.”

  • Fears of AI-induced armageddon are overdone - Ciaran Martin via The Economist writes - “One news outlet, capturing the growing sense of foreboding, called it “the start of a dangerous AI cyber era”. So is it different this time? Or does the uneasy equilibrium between attack and defence still hold? Mostly, and thankfully, it does, for two reasons.”

  • More Criticals, Less Dopamine - Ananda Dhakal opines - “Am i trying to say vuln research is dead? Definitely not. The number of vulnerabilities being found right now is at an all-time high. And if you look around, all the people finding these massive bugs are the same people who were doing exceptional work before the current AI boom.”

  • From the Frontier AI Arms Race to AI-enabled Defense-in-Depth: Qi An Xin Chief Outlines His Vision - Natto Team summarises (we covered this talk previously) - “Rather than arguing that AI merely creates new risks, Qi stressed that AI has exacerbated the imbalance between offense and defense, enabling automated, high-frequency attacks that render traditional, static protections obsolete. To counter these threats, Qi favored a defense-in-depth model, a “three-in-one vertical defense upgrade framework,” rather than advocating that China build a domestic “Mythos-equivalent” offensive-capability model. Qi emphasized that this integrated approach requires moving away from a compliance-driven security posture toward a more realistic path of accelerated, incremental security upgrades — not wholesale reinvention, but a comprehensive, self-evolving defense system capable of real-world combat readiness.”

  • ‘We are hitting a different chapter’: OpenAI leader warns of threat of ‘persistent’ AI cyber-attacks - The Guardian reports - “Lehane renewed calls for the US government to legislate to create rules for frontier AI safety, and said the fact that the most cutting-edge and unreleased AI models appear to be improving cyber offence faster than defence, was “among the reasons why I think it’s absolutely imperative that this country passes a national law that creates mandatory required safety standards, and within that the pause element would be inherent and endemic to that process” - comment: am interested in their data here to support the assertion.

  • AI agent shared responsibility model - Microsoft outlines - “As with the cloud and AI shared responsibility models, the division of responsibility shifts with the deployment model that you choose.” - comment: the cloud’s shared responsibility model for cyber security has shown that words can be said but the actions may not follow on either or both sides always.”

  • Private Equity Is Deploying an Army of AI Wonks to Embed in the Firms They Back - Wall Street Journal reports - “Blackstone and Hellman & Friedman have formed a roughly 160-person team of artificial-intelligence experts with Anthropic to deploy at businesses, starting with their own portfolio companies. The push is part of a $1.5 billion joint venture between the AI giant and Wall Street firms, which also includes Apollo, General Atlantic and Goldman Sachs among the backers.”

  • OpenAI-backed legal tech firm pivots to Chinese Kimi K3 open-weight model - South China Morning Post reports - “A US artificial intelligence start-up backed by OpenAI has built its first in-house model on Chinese lab Moonshot AI’s Kimi K3, highlighting a growing shift by Western tech firms towards Chinese open-weight systems amid soaring development costs. San Francisco-based legal tech provider Harvey, whose high-profile backers also include Sequoia Capital and Andreessen Horowitz, said on Thursday that its new model, Harvey Tenet, was post-trained on top of the open-weight Kimi K3 base.”

• Cyber proliferation

  • A Real-World Law-Enforcement Hack: The Case of Encrochat - King's College London, New York University, Georgia Institute of Technology and University of Waterloo detail - “In this work, we give the most detailed public account to date of Encrochat’s infrastructure and how it was compromised”

• Bounty Hunting

  • Justice Department and FBI Seize Platforms Operated and Used by China State-Sponsored Hackers to Target U.S. Critical Infrastructure - US Department of Justice announces - “The Justice Department and FBI announced court-authorized domain seizures today to deny malicious cyber actors access to two complementary hacking platforms known as “QScan” and “QTRouter,” used to target U.S. critical infrastructure and other sensitive networks. As described in court documents unsealed in the Southern District of California, a People’s Republic of China (PRC) state-sponsored group known as “QTFY,” employed by China-based Nanjing Xinjiuwei Network Technology Company (南京鑫玖维网络科技有限公司), created and operated QScan and QTRouter.”

  • Chinese national gets 20 years for hacking accounts of BTS’ Jungkook, others - Yonhap News Agency reports - “The Seoul Central District Court handed down the sentence to the Chinese national, surnamed Chun, on charges of fraud and violating the information network act, in connection with the theft of more than 38 billion won (US$27.2 million) from the victims.”

  • Two WA men charged following AFP-FBI-WAPF disruption of alleged global cybercrime syndicate - Australian Federal Police announce - “Police will allege the men were part of a highly organised syndicate involved in large-scale cybercrime offending, including data intrusion, identity crime, and cryptocurrency-based money laundering.”

  • Treasury Launches Unprecedented Campaign Against Iranian Regime on Economic D-Day - US Treasury announces - “Today’s actions target:” .. “A malicious cyber group directed by Iran’s Ministry of Intelligence and Security (MOIS) that is responsible for extensive compromises of U.S. critical infrastructure and financially motivated cyber theft;”

• Market Incentives

  • Playing whack-a-mole is losing - David Adrian opines - “Producing an endless stream of findings is not a good use of security expertise, human or AI. If all you do is play whack-a-mole, you’re going to lose. We should not view security as an endless supply of mysteries to solve because being a detective is the valued identity. Instead, the role of defenders is to turn failures into new, broader, and stronger invariants, and to encode these invariants into the system so that engineers (and agents) don’t have to constantly rediscover the same class of problems. If that outcome feels like a loss, it’s because identity has displaced security as the goal.”

  • Pixel 11 doesn’t meet the GrapheneOS security standards and may be skipped - GrapheneOS warns - “We have a partial port of GrapheneOS to the Pixel 11 series after a week of work on it. We're unable to complete the port due to lack of support for ARM hardware memory tagging [MTE] in software, firmware and near certainly hardware. It appears Google cut an important security feature to save money.”

  • OpenAI’s rogue AI agents expose a gap in cyber coverage - Insurance Business Mag highlights - “A Willis Towers Watson research paper on AI-related liability described what the authors called "silent coverage" - AI-related liability risks sitting implicitly inside existing policies because the policies were never specifically written to include or exclude them. The parallel is to the early years of cyber risk, when property and liability policies had no explicit cyber position and courts were required to determine coverage case by case until the market developed affirmative cyber wordings. The OpenAI incident is precisely the kind of event that begins converting that silence into adjudicated precedent. For brokers placing tech E&O for clients in the AI sector, the question of whether existing wordings adequately address autonomous agent liability - both as potential defendants and as potential victims - is no longer theoretical.”

Reflections this week are around the open letter led by a frontier AI company on A call for collective action on cyber defense which was co-signed by 100 organisations and what it says and does not say about incentives and realities.

Clearly frontier AI is an era defining moment for cyber security which brings home the lack of historic prioritisation and investment. This moment has the opportunity to galvanise and make cyber security non optional and enduring - thus it is a seminal one. But there are no magic cheap quick wins - there is instead investment, time and diligent execution.

No one can argue against the need for collective action. But as regular readers will note success is in part driven by enduring corporate incentives for both technology producers as well as consumers and operators along with corresponding appropriate levels of investment.

A number of signatories will be alive to this fact having had very serious security vulnerabilities in their technology, products and services over the years - including those who produce security products. The flipside for organisations who adopt technology is that some will not know what their digital estates are in totality nor have them under comprehensive management and observability whilst carrying end of life.

AI is a super power to some. But again organisations leveraging AI for vulnerability discovery are already finding they are displacing the point of constraint from finding to patching, to testing, to functional testing, to deployment, to need to find budget for tokens or similar.

No organisation or government has limitless budget and there will never be zero risk. We can only spend each £/$/€/¥ once so knowing when AI will yield a better cyber security resilience return (i.e. reduced risk) versus replacing end of life equipment/legacy system or deploying a robust architectural response is going to be one of those questions executives rightly expect an answer to - which the video of the week by Dr Daniel Woods does an excellent job on.

It is also important to remember AI is not the cause of vulnerability outside of systems it is integrated into or which has vibe coded insecurely. It can and does surface technical and process debt at a greater scale to actors both good and bad causing a painful forced correction due to increased visibility and knowledge i.e. what is being found today was already present and latent.

As David Adrian says above stronger invariants are the goal as are immutable properties of cyber security solutions - be they cross domain, privileged access workstations, passkeys or operational capabilities such as being able to effectively hunt.

We know how to build and operate cyber resilient systems but now is the time to pay down technical debt, invest in strong architectures, eradicate classes of vulnerability through technology choices, have operational excellence and address the imbalance…

… Finally this week I got to guest co-host the Risky Business podcast which you can listen to/watch here:

Not getting this via email? Subscribe:

Subscribe now

Think someone else would benefit? Share:

Share

All attribution is by others and not the UK Government unless specifically stated as such, please see the legal text at the end.

Have a lovely Sunday…

Ollie

Cyber threat intelligence

Who is doing what to whom and how allegedly.

Reporting on Russia

UAC-0099 utilizes a novel multi-stage malware chain to carry out attacks

The 360 ​​Advanced Threat Research Institute (in China) caught this alleged operation by Russia against Ukraine. The tradecraft is well understood - but the particular mix has some unique elements thus noteworthy.

The attackers primarily targeted Ukraine, focusing on government agencies and organizations involved in critical infrastructure. They used phishing emails to send malicious compressed files as attachments. The files contained WSF scripts disguised as Word documents with double extensions. The email content was disguised around topics of interest to the target, enticing users to unzip and run the files, thus infecting them. After execution, the WSF script was redirected via a shortened link to a file server to download subsequent payloads. The attack chain combined DLL sideloading, multi-stage conditional execution, and code virtualization protection to evade security detection and covertly implant remote control capabilities.

https://mp.weixin.qq.com/s/WjjZYriiZl7-waw6Cjy1DQ

BlueDelta Targets Defense and Diplomacy with HOOKEDGE

Insikt Group® detail this alleged Russian operation against a range of defence industrial base. Tradecraft is well understood but the victimology is noteworthy.

• Between late September 2025 and early April 2026, BlueDelta conducted a series of initial access campaigns against defense manufacturing and diplomatic organizations in Romania, Spain, and Türkiye. BlueDelta used macro-enabled Word documents to deploy HOOKEDGE, a lightweight batch-script backdoor that shares significant code and tradecraft overlap with BlueDelta’s earlier implant, HEADLACE.

• The campaigns employed both diplomatic-themed and generic lures. Early activity impersonated Spanish government material, while later campaigns adopted generic macro-enablement lures. One diplomatic lure was created shortly after a meeting between Spanish and Moldovan officials, potentially reflecting an effort to collect intelligence relevant to Russia ahead of Moldova’s September 2025 parliamentary elections.

• BlueDelta continued to refine HOOKEDGE between September 2025 and April 2026, introducing changes to lure documents, execution methods, and beaconing intervals while maintaining the malware’s core functionality and infrastructure model.

• For targets assessed as having higher intelligence value, BlueDelta deployed a second-stage HOOKEDGE payload with a much shorter beaconing interval. This gave operators more responsive tasking and follow-on activity, while keeping the webhook endpoints used for initial access from being exhausted.

• BlueDelta has historically demonstrated a preference for legitimate internet services (LIS) to facilitate C2, payload staging, and data exfiltration, with webhook[.]site’s free tier serving as the group’s exclusive choice across these campaigns.

https://www.recordedfuture.com/research/bluedelta-targets-with-hookedge

University Leak Exposes Russia’s Military Cyber Training Pipeline

DomainTools alleged links between a Russian university providing a talent pipeline for government.

Recently leaked records show that Bauman Moscow State Technical University’s Department No. 4 operated as a long-term training pipeline for Russian military intelligence and cyber operations. The department served several elements of the Russian General Staff and trained roughly 250 career and reserve students across three specialties: special intelligence (“Служба специальной разведки”), operational information-technical effects (“Применение сил и средств информационно-технического воздействия и защиты от информационно-технического воздействия”), and information-technology protection (”3ащита информационных технологий”). The curriculum combined both offensive and defensive techniques for cyber defense, as well as offensive doctrine for active measures campaigns and GRU activities. Field placements then moved students from classroom instruction into military units and academies aligned with their specialties, giving them supervised exposure to intelligence operations and preparing them for military and government operations careers.

…

The collection also includes malware-analysis and cyber threat intelligence research, manpower-planning documents, and a financial-sector cybersecurity specialization feeding into VUS 093400 (SIS). It further connects Bauman to Russian military research institutes, academies, and operational structures. Although the analyzed files do not provide every final graduate assignment, they expose the personnel, training, doctrine, and administrative system behind a durable Russian military cyber and technical-intelligence pipeline.

https://dti.domaintools.com/research/threat-intelligence-report-university-leak-exposes-russias-military-cyber-training-pipeline

Reporting on China

NSA Joins FBI in Issuing Warning about Chinese Hacking Group QTFY Cyber Activity

The National Security Agency details around the technical capabilities of this alleged Chinese state private sector enabler.

QTFY actors have developed branded products that work in conjunction with each other and include the vulnerability scanning and exploitation platform “QScan” to conduct reconnaissance, exploit vulnerable Internet of Things (IoT) devices and identify vulnerabilities in networks, an obfuscation network named “QTRouter” to blend in with legitimate users, and at least three major platforms that can manage botnets of compromised IoT devices and include them as obfuscation network nodes (“Proxy Platform Management,” “Proxy Pool Management System” and “QTBotnet”).

https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4583539/nsa-joins-fbi-in-issuing-warning-about-chinese-hacking-group-qtfy-cyber-activity/

The infrastructure quartermaster: inside a China-nexus state enablement model

Black Lotus Labs provides further technical details on this alleged Chinese capability. Noteworthy for its age, complexity and the fact it was provided as a service by a commercial company.

The quartermaster model depends on four connected components that work together to identify targets, route traffic and obscure operator activity. Each plays a different role in the broader enablement layer, turning reconnaissance, proxy access and traffic management into a repeatable service for downstream threat actors.

The quartermaster’s four main components are:

• “QScan”: Conducts reconnaissance to identify and profile high-value targets; networks discovered or profiled by QScan later appear in bidirectional communications through “Fast Labyrinth.”

• “Fast Labyrinth”: Provides the operational layer by co-opting commercial proxy infrastructure into an encrypted relay network that obfuscates traffic to and from target entities.

• “QTRouter”: Provides a preconfigured physical access device that manages operator and customer access to the proxy infrastructure and proxy node management system.

• “QTProxy”: Manages Fast Labyrinth operational nodes, allowing operators to use preconfigured relays or tailor unique paths to target entities.

• Together, these components streamline target discovery, communication routing and operational access, allowing Chinese espionage operators to conduct activities more efficiently while hiding their tracks.

https://www.lumen.com/blog/en-us/the-infrastructure-quartermaster-inside-a-china-nexus-state-enablement-model

Chinese Implants in the Supply Chain

Jacob Baines details a device that came backdoored for which the DNS domain ownership had lapsed. Welcome to contemporary supply chains in 2026..

The implant beacons hit the sinkhole as soon as we stood it up. Hundreds of routers, almost all in China, beaconing home to a forgotten domain. We found the domain obfuscated in the firmware of a router we bought on Amazon from a small company in New York. Now, we own the domain. We own the implants.

https://www.vulncheck.com/blog/zbt-darklantern-speakingstone

Carry-On Compromise: TA4922 Packs PackClient

Kyle Cucci, Rob Kinner and Tony Robinson detail an alleged Chinese criminal campaign which is noteworthy for targeting Indian victims along with some of the multi file format tradecraft.

• Proofpoint identified a command and control (C2) framework called PackClient sold on Telegram.

• It is being used by at least one threat actor, Chinese-speaking TA4922.

• With this new payload, TA4922 is expanding its arsenal of initial-access malware, much of which originates in the Chinese-speaking cybercrime ecosystem.

Since the initial identification of PackClient in the May 2026 campaign, Proofpoint researchers have observed at least two additional TA4922 campaigns delivering the malware. In mid-July 2026, the actor targeted organizations in India using Hindi-language tax enforcement lures that impersonated the Indian Income Tax Department. The emails claimed recipients had underreported income and failed to disclose foreign assets and threatened financial penalties. Unlike the earlier China-focused activity, the messages delivered a ZIP archive ("Tax_Notice_23665.zip") containing an IMG disk image ("Tax_Notice_23665.img "). When mounted, the image contained an executable and malicious DLL that leveraged DLL sideloading to execute Donut Loader and ultimately install PackClient.

https://www.proofpoint.com/us/blog/threat-insight/carry-compromise-ta4922-packs-packclient

Reporting on North Korea

Inside Kimsuky’s Abuse of Legitimate Remote Control Tools Across Northeast Asia

ENKI WhiteHat details this alleged North Korean operation which uses initial access tradecraft that is very well understood. The Chrome extension is noteworthy along with the fact it was in part potentially vibe coded.

• We identified several Kimsuky spear phishing campaigns against South Korean and Japanese targets in the first half of 2026.

• The threat actor spread LNK malware through phishing emails carrying OneDrive share links. Running the file sets up a scheduled task that fetches a PowerShell script from the C&C server and runs it at regular intervals.

• Those scripts stole data from the host, profiling the system, pulling mail out of Thunderbird and Outlook, and logging keystrokes.

• The threat actor also installed legitimate remote control software such as Chrome Remote Desktop and AnyDesk to slip past antivirus detection and open up several routes for remote access.

• A malicious Chrome extension that automatically siphons Gmail data showed numerous signs of having been written with generative AI, with Korean comments, debug strings and Unicode emoji running throughout the code.

https://www.enki.co.kr/en/media-center/blog/inside-kimsuky-s-abuse-of-legitimate-remote-control-tools-across-northeast-asia

Reporting on Iran

Tortoiseshell: New Toolset and Operational Infrastructure Exposed

Mansour Alhmoud and Mohamed Emam expand on prior reporting of this alleged Iranian operation. Noteworthy is the potential expansion in scope of targeting.

• Enrichment of the Mirage Kitten reporting uncovered extensive Tortoiseshell infrastructure spanning Europe and the Middle East.

• Identified further malicious components, including an SSH-based tunnelling utility and a backdoor mirroring the TWOSTROKE family previously observed by GTIG in late 2025. This C++ backdoor possesses capabilities for executing shell or file commands, uploading and exfiltrating files, and conducting reconnaissance.

• The discovered Tortoiseshell infrastructure potentially suggests an expanded targeting profile, focusing on Middle Eastern countries, alongside European countries.

https://www.group-ib.com/blog/tortoiseshell-apt-toolset-infrastructure/

Reporting on Other Actors

SLEEPWALKER: A Passive Backdoor With Its Own Command Language

Dominik Reichel details a rather novel implant which is unattributed and shows a degree of complexity and novel technical elments.

What makes it worth writing up is what that packet carries: not a readable command, but a short program written in a command language of the backdoor’s own design. Its 23 instructions cover scheduling, several ways to move data, staged file delivery and running code directly in memory. Recovering the encryption key is not enough to understand one of these programs. The internal command language must be reverse engineered as well. From a reverse-engineering perspective, SLEEPWALKER has a cool design. Still, the implementation has several weaknesses and is not top-notch malware engineering. This could be an early version, however. Newer and improved builds may exist.

https://r136a1.dev/2026/08/24/sleepwalker-a-passive-backdoor-with-its-own-command-language/

Aurora ransomware targets ESXi, abuses Cursor Agent for exploitation

Eyal Sela details a ransomware campaign which leveraged AI Software-as-a-Service which is interesting in that the malicious use was potentially not detected by the model service provider.

In some victim networks the operator used Cursor Agent with claude-4.5-sonnet-thinking. In these cases the agent was given credentials or an existing route into the victim organisation. Then it was tasked with various exploitation activities.

The chart below plots Cursor Agent sessions between 8 April and 21 May 2026, one row for each target or victim organisation. Circle area is the number of commands the Agent ran in that session.

https://gambit.security/blog-posts/aurora-ransomware-targets-esxi-abuses-cursor-agent-for-exploitation

Software Supply Chain Incursions

A reminder we issued guidance a number of weeks ago in Software supply chain attacks: check your dependencies for software developers

• The State of Open Source Supply Chain Attacks - “56 supply chain attacks in 12 months”

• Malicious Rust Crate arrayref Runs a Build-Time Payload

• BRIDGEHEAD : An npm typosquatting campaign that crosses from WSL into Windows to plant a crypto-wallet stealer

• Prompting the Payload: How an npm Supply Chain Attack Delivers the RedC2 AI-Powered Linux Implant

• ClickFix Phishing Pages Discovered in 24 npm Packages

Discovery

How we find and understand the latent compromises within our environments.

Chromium Extension Persistence VQL

Matt Green shows how Velociraptor can be used to hunt for malicious Chrome extensions.

Hunts Chromium profiles for enabled unpacked extensions and Native Messaging Host registrations associated with Chromium extension persistence.

This is intended to identify extension persistence techniques such as the SilentChrome-BOF technique described by SpecterOps. SilentChrome writes an unpacked extension entry under extensions.settings.<extension_id>, enable developer mode, and repairs Chromium preference integrity metadata so theextension is accepted at next browser start.

https://github.com/mgreen27/DetectRaptor/blob/master/vql/ChromiumExtensionPersistence.yaml

Detecting (Evil) Dylibs

Patrick Wardle shows how some aftermarket repurposing of Apple’s Endpoint Security framework can be used for detection tradecraft.

In this blog post, we’ll first highlight examples of attackers abusing dylibs for persistence, payloads, and even exploits. Then, we’ll show how we can programmatically enumerate dylibs statically on disk, at runtime in a remote process, and as they are being loaded. Better yet, using Apple’s Endpoint Security framework, we’ll show how we can register for memory-mapping events associated with dylib loads, granting us the ability to examine and even block, if needed, libraries before they fully load in the first place.

https://objective-see.org/blog/blog_0x89.html?v=1

Threat Hunting using Pair Probabilities

Stamatis Chatzimangou brings statistics in threat hunting to the masses with this post.

Upon digging around Microsoft’s documentation for user-defined functions I stumbled on the function pair_probabilities_fl(). This function calculates probabilities and some additional metrics for a pair of categorical variables, A and B. In this blog post, we are exploring the possibility of using the pair probabilities function for threat hunting.

..

Overall, pair probabilities should be best viewed as a way of identifying unusual behaviour for further investigation, rather than as a standalone detection mechanism. The strongest results are likely to come from using the probability metrics as a baseline and in combination with occurrence counts, and additional security context.

https://detect.fyi/threat-hunting-using-pair-probabilities-55194ddb8309

Online False Positive Reduction via Statistical Process Controls

Nikolas Bielski drops some truth bombs on running an effective SOC.

The SOC isn’t a unique problem child. It’s a screening operation, thousands of continuous tests, rare true positives, a fixed budget of expert hours, a high cost for anything missed.

Other industries solved this by measuring the cost of the noise against the risk of the miss. Security chased “FP reduction” instead, which is a target with no risk articulated, so set your eyes on optimising to risk.

GUIDE data gives us a prior for risk. TPs arrive in tight clusters, so the cost of parking a detector is function you can read off the data. 40% of future TPs if you cut it forever, 1.3% if you patch inside 4 hours, 0.3% inside one hour.

DIRE is just the stats engine that spends the cost deliberately to get 96% of the FPs of a naive cut, at 5% of the TP loss. That’s an informed case for any for-profit-SOC.

https://detect.fyi/online-false-positive-reduction-via-statistical-process-controls-8609e682c8af

AWS EKS forensics: data sources and investigation tooling

Théo Letailleur provides practical advice on how so stick things together in an AWS EKS ivnestigation.

Investigating a compromise in Amazon EKS means piecing together evidence spread across three layers: the managed Kubernetes control plane, the worker nodes, and the surrounding AWS services. This article maps the data sources an EKS cluster exposes for digital forensics and threat hunting, and the tooling used to correlate them, from the Kubernetes audit log down to the AWS identity of the nodes.

https://www.synacktiv.com/en/publications/aws-eks-forensics-data-sources-and-investigation-tooling

Detection primitives for eBPF rootkits

Lorenzo Susini and Matt Muir show what quality detection engineering looks like with this work.

They also defeat common tracing primitives like ptrace. LinkPro, VoidLink, and the more recent Atomic Arch campaign all use these approaches.

Rather than describe each malware family in full, we picked one instructive feature from each and went deep, looking at how the technique works, what data defenders should focus on, and what detections we built from it. We start with VoidLink, which found an unexpectedly clean way to hide active connections from ss by turning a debug helper into a precise memory editor.

..

The load-time fingerprint translates directly into detection rules. Because the WP sensor captures the helper bitmap before the program can act, a rule checking for BPF_PROBE_WRITE_USER fires the moment VoidLink's buffer-tampering program is submitted to the kernel

https://securitylabs.datadoghq.com/articles/detection-primitives-for-ebpf-rootkits/

Defence

How we proactively defend our environments.

Internet Exposure Reduction Guidance

CISA highlight once again and guide on the value of attack surface management through reduction.

Many organizations unknowingly leave common vulnerabilities and weaknesses exposed to the internet, making them easy targets for exploitation. Threat actors can use internet-based search and discovery platforms to identify publicly accessible systems with misconfigurations, default credentials, and outdated software that they can exploit to gain unauthorized access. By following the guidance below, organizations can proactively identify internet exposures, remove those that are unnecessary, and secure those that are necessary, strengthening their cybersecurity posture.

https://www.cisa.gov/resources-tools/resources/exposure-reduction

Defending Against an Active Threat to Siemens S7 Series PLCs

CISA provide practical advice on how to mitigate this active threat.

This advisory relates to an active threat to Siemens S7 Series programmable logic controllers (PLCs). However, ongoing PLC targeting activity is broader than Siemens PLCs. All PLC owners and operators should apply relevant mitigations to reduce the risk to their devices and systems. The Siemens-specific content in this advisory should be understood and applied as one subset of the wider threat landscape.

https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-231a

Auditing Microsoft Defender and Intune Configuration Changes

Jeffrey Appel details how to do this in practice during an incident investigation where you suspect or what to verify if configuration changes have occured.

Defender audit activities are stored in the Unified Audit Log. Some of the audited activities include:

• Assign user to an incident

• Changes to data retention settings

• Changes to advanced features

• Creation of indicators of compromise

• Isolation of devices

• Add\edit\deletion of security roles

• Create\edit custom detection rules

Microsoft Defender uses the Microsoft Purview auditing solution. Before you can look at the audit data in the Microsoft Defender portal, you need to turn on auditing in the Microsoft Purview portal, or sometimes it works directly from the Defender portal.

For a list of all the audit log activities, see: Audit log activities. The audit log is not only focused on Defender for Endpoint. It includes other sources, like Defender for Identity, to report when sensors are getting removed/ disabled, or the deployment key is downloaded. All of the audit log activities are explained on the above page.

https://jeffreyappel.nl/auditing-microsoft-defender-and-intune-configuration-changes/

SDLC in the AI ​​Agent Era: How to Implement Security Engineering

Chinese view on how to do this.

This article discusses the SDLC (Software as a Service) of agents after software delivery, not the lifecycle of the AI/ML model itself, nor how to develop an agent product. The term is occasionally used Agentic SDLC as a descriptive tag.

…

existing security engineering principles still hold true; what has changed are the implementing entities, boundaries, and speed.

https://mp.weixin.qq.com/s/QYQ2XDBeXbIXgSmsDMNkFw

MadHatter — Qwen Token Perturbation Lab

Allloy Secure Group show a deep understanding of AI have how token perturbation can be used as a defensive disruption layer against an offensive Qwen-based AI agent. It works by introducing small, targeted token changes that push the agent away from its intended decision path.

MadHatter is a local Qwen research demo for gradient-guided discrete token perturbations, embedding-space PGD, and LoRA post-training. It now includes a second, independent clean Qwen validator so a perturbation found in the lab can be tested against an unmodified base checkpoint.

https://github.com/AlloySecureGroup/MADHATTER/

Time as a Key: Breaking Rhysida Ransomware with the Attacker’s Own Ciphertext

Adam Taguirov shows the value of cryptologic skills in the response to ransomware.

Rhysida is a ransomware-as-a-service operation active since May 2023 that has claimed more than 250 victims across education, healthcare and professional services. Its Windows encryptor seeds the C library pseudo-random number generator with srand(time(0)), and every per-file secret produced during a run derives from that single value. The encryption timestamp, a 32-bit counter of seconds, is the only unknown input, and recovering it regenerates the AES-256 key and initialisation vector of every file the run touched. The encryptor wraps each per-file key and IV under a hardcoded RSA public key using OAEP padding, and it draws the OAEP seed from the same generator, so the RSA blob appended to every encrypted file is reproducible byte for byte by anyone holding the sample. We use that blob as a validation oracle: a candidate key is confirmed by re-running the encryptor’s own RSA step and comparing the result against the stored bytes

https://sigreturn.com/papers/time-as-a-key/

neEDRe

Sunlife3 releases the foundations of a Linux EDR they are building which will be of interest to some studying how to do such things.

Self-made toy EDR project using AYA the Rust eBPF library

https://github.com/sunlife3/needre

Incident Writeups & Disclosures

How they got in and what they did.

A Tale of Two SOCs: Insights From Two Red Team Assessments

CISA’s red team detail the experience of going up against two security operations centres. Whilst highlighting recommendations which would have frustrated their success.

• Untuned detection tools lead to missed threats. Without well-defined baselines and alert filtering, false positives and routine alerts overwhelm network defenders.

• Organizational silos and bureaucratic hurdles prevent effective incident response. Detection tools are only as effective as the people, processes, and procedures supporting them; fragmented communication, unclear responsibilities, and limited defender authority hinder effective incident response.

• Cloud environments are often an underestimated risk. Organizations often lack security controls for cloud environments and processes for responding to a cloud compromise.

…

• Establish and continuously maintain a baseline and reduce alert noise by fine tuning.

• Break down silos and empower network defenders.

• Implement Conditional Access policies for workload identities and monitor for excessive or unused permissions.

• Establish and regularly review comprehensive procedures for detecting, remediating, and revoking access/refresh tokens in the event of a cloud compromise.

https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-237a

Supply chain attack on arrayref

Manish Goregaokar details the incident and provide details of what organisations needs to get assurance of across their developer estate which feels easier said than done for a lot.

We recommend you check your local dependencies to ensure these crates were not pulled in. Here are the malicious versions that we deleted from crates.io:

• append-only-vec@0.1.9: published at 2026-08-20T07:37:49Z, deleted at 2026-08-20T09:25:24Z. Online for 107 minutes.

• arrayref@0.3.10: published at 2026-08-20T07:15:00Z, deleted at 2026-08-20T08:41:40Z. Online for 86 minutes.

• internment@0.8.7: published at 2026-08-20T07:34:07Z, deleted at 2026-08-20T09:04:11Z. Online for 90 minutes.

• proc-macro1, proc-macro-en, aovine, arone, aronenao, tinymember (any versions).

https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/

Vulnerability

Our attack surface.

768 Leaked Corporate AWS Keys Held Full Admin Rights

Truffle Security show the scale of hygiene challenge in practice - no AI required here.

We re-verified 10,616 leaked AWS keys on August 10, 2026. They surfaced publicly between August 2022 and August 2026. 88% still authenticate. 768 of the live ones belong to a company and carry full control of its AWS account: 526 root keys plus 242 IAM users holding AdministratorAccess. The median live leaked key is five years old and has never been rotated.

https://trufflesecurity.com/blog/leaked-corporate-aws-keys-held-full-admin-rights

SMAP is Pre-Disarmed: How a Stack Pivot That Shouldn’t Work Revealed a Kernel-Wide Design Compromise

Youssef Charfeddine highlights the ghost of compatibility here and the impact of SMAP effciacy on Windows.

The three experiments proved that SMAP is not bypassed by an attacker trick. It is pre-bypassed by the operating system itself. The normal syscall entry path on Windows 11 delivers kernel code an execution context where AC=1 is already set.

This means any kernel-mode attacker who gains execution through a standard syscall path (whether via a vulnerable driver, a signed driver with dangerous IOCTLs, or any other mechanism) inherits a kernel context where SMAP is muted.

https://sibouzitoun.tech/articles/smap-is-pre-disarmed/

From Code to Chain: Why WP2Shell Stayed Out of Reach

Zeddy Lu demonstrates the reality and limitations of AI in finding certain vulnerabilities and thus showing that not all vulnerabilities become shallow - yet.

This paper compares the long-term code auditing capabilities of three major models by reproducing the wp2shell vulnerability chain discovery process: Under the same harness, GPT 5.6 Sol / GLM-5.2 / Qwen 3.8-Max-Preview were run 11 times, each lasting 6–10 hours, on the complete WordPress codebase, and their exploration process was recorded and reconstructed using full-chain hooking. None of the 11 runs completely reproduced the pre-auth RCE vulnerability chain, but the failure patterns differed: GPT identified REST request misalignment (Vuln A) four times and completed one local verification, but missed SQL injection (Vuln B) all four times; Qwen was the only model to identify Vuln B, but prematurely excluded it due to the lack of a pre-auth entry point; GLM read the core code multiple times but failed to identify any vulnerabilities. In a comparative experiment where only short vulnerable code snippets were provided, all three models were able to find the corresponding vulnerability mechanisms. Overall, the bottleneck in reproducing wp2shell lies not in understanding local code, but in the ability to search source code, retain candidate vulnerabilities, and connect to cross-layer vulnerabilities during long-term exploration.

https://zeddyu.github.io/p/from-code-to-chain-why-wp2shell-stayed-out-of-reach/

Compromising Signal’s Contact Discovery Enclave

Nihal Talur shows what world class vulnerability looks like in 2026.

We found two critical object-lifetime vulnerabilities that allow the untrusted host server to break the enclave boundary. The first vulnerability gives the host an arbitrary enclave memory read. The second gives the host full control over the enclave’s register context, enabling code execution within the enclave. We exploited both vulnerabilities on real SGX hardware matching the Azure machines used by Signal’s production deployments, demonstrating full compromise of the enclave. Our proofs of concept extract the Noise private key from enclave memory, allowing the host to impersonate the enclave and decrypt queries.

https://v12.sh/blog/signal

Penetrating the Vulnerable with Invisible Thickness: CodeBuddy Security’s Vulnerability Discovery Approach and Practice

Tencent outline their approach which shows what industrialised verified vulnerability discovery looks like in 2026.

CodeBuddy Security views vulnerability discovery as a "search" process, with the core concept being that intelligence is the segmentation of the search space—the more detailed the intelligence, the higher the AI's detection probability. The system is divided into two parts: the first part constructs intelligence and narrows the search space through four pathways: patch location, threat intelligence, external intelligence, and attack surface analysis; the second part uses an AI Agent to conduct audits at the module level, confirming the results after independent review and PoC verification. Since its launch, it has driven 4.4 million model calls, generating over 2,100 automatically reproduced vulnerabilities; the end-to-end detection rate is 73.2%, reaching 90.2% after providing module-level intelligence.

https://mp.weixin.qq.com/s/9RkpfwzQivCgEAKIiiiKDw

GPUThor

Chris S. Lin, Joyce Qu, Aditya Rajeev, and Gururaj Saileshwar show that it turns out physics don’t change when used in a different use case and thus vulnerabilities read across.

GPUThor is the first Rowhammer attack on NVIDIA GPUs to break through error-correcting codes (ECC), NVIDIA's defense against this threat. Rowhammer is a DRAM flaw: repeatedly hammering a memory row flips bits in its neighboring rows, causing data corruptions. By reverse-engineering how GPUs merge repeated memory requests and when the memory's built-in defense kicks in, GPUThor hammers its target 6.6× harder than prior GPU attacks, producing 500×–23,500× more bit flips. This corrupts multiple bits at once and overwhelms the ECC, enabling the first GPU denial-of-service attacks and root-level privilege escalation on ECC-protected GPUs.

https://gputhor.com/

UniBLEed: Unauthenticated Root RCE on Any Unitree G1 Humanoid Robot Within Bluetooth Range

Olivier Laflamme writes the business case for memory safety technology in robotics with this vulnerability. But also how the integration of AI not being done always in Secure by Design manner.

Root on a $20,000 humanoid robot from Bluetooth range. One chain crossing Bluetooth, Unitree’s cloud, mobile, and the firmware running the G1 itself. Here’s the complete technical breakdown of the $6,700 bounty and two CVEs it produced: CVE-2026-76639 / CVE-2026-76640.

…

A path traversal in the robot's AI chatbot knowledge base that leaks the binary's load address. And a 1050-byte BSS buffer overflow that corrupts the event loop into calling system() as root.

https://boschko.ca/g1-ble-rce/

WatchGuard Agent improper authentication allows unauthenticated remote code execution

WatchGuard warn the call can come from inside the house.

Improper authentication in the WatchGuard Agent allows an unauthenticated attacker with network access to cause the agent to execute arbitrary code with elevated privileges.

https://psirt.watchguard.com/CVE-2026-57910/

Offense

Attack capability, techniques and trade-craft.

I’m in your logs now: deceiving analysts and blinding EDRs

Olaf Hartong demonstrates an offensive strategy that various red teams have employed in the past.

what if I can create enough telemetry, or enough broken telemetry behavior, that the product relying on those logs does not see the real activity anymore?

https://falconforce.nl/in-your-logs-now/

Tag, You’re Managed - Executing Code via Google’s Own Signed Installer

Richard Warren highlights this attack surface.. it will be interesting to see if this was used other by red teamers when the threat hunting crews go to work.

in this post we show how an attacker can take a legitimately signed Google Chrome Enterprise MSI and modify it to execute arbitrary commands on the victim’s machine, without breaking the Authenticode signature. The modified installer remains validly signed by Google throughout, passing SmartScreen and signer-based AppLocker/WDAC rules.

https://blog.amberwolf.com/blog/2026/august/tag-youre-managed---executing-code-via-googles-own-signed-installer/

ditto

Airbus release this which teams will want to ensure doesn’t break their detection logic.

Ditto is a Powershell and JavaScript obfuscator base on tree-sitter-powershell and tree-sitter-javascript.

https://github.com/airbus-cert/ditto

NachoMDM - Weaponising Windows MDM for UAC Bypass and SYSTEM Execution via Malicious Enrollment

David Cash causes questions to be raised on where this has worked in production.

The bonus is that this enrolment process can be triggered from a web page via the ms-device-enrollment URI handler. There’s a video demo further down the post that shows it in action.

Who is NOT vulnerable:

• If the device is already enrolled in MDM, it cannot be enrolled again.

• If the user is not a member of the local administrators group, the auto elevation will fail

https://blog.amberwolf.com/blog/2026/august/weaponising-windows-mdm/

https://github.com/AmberWolfCyber/NachoMDM

lldp

Lav shows the lengths some red teams will go to avoid implant detection.

Mythic C2 profile for peer-to-peer communication over IEEE 802.1AB (LLDP). C2 data is carried inside Organizationally Specific TLVs (Type 127) with a configurable OUI so that frames blend with vendor-specific LLDP extensions on the wire.

LLDP is Layer 2 only. Both agents must share a broadcast domain. An egress agent (HTTP/HTTPX) bridges LLDP-linked agents back to the Mythic server, same as the SMB and TCP P2P profiles.

https://github.com/Whispergate/lldp

Tailcat

Brad Fitzpatrick et al release this tool which you can see how it might be misused and thus warrant attention on the the ability to detect.

Tailcat is a remix of Tailscale open source pieces to act like netcat, but over Tailscale's data plane, without Tailscale's control plane. Tailscale's data plane (magicsock, internally) gives you point-to-point WireGuard®-encrypted tunnels between two machines with DERP as the NAT-hole-punching communication side channel and the ultimate relay-of-last-resort if NAT traversal fails. Instead of using the Tailscale control plane, all tailcat connection metadata is exchanged out of band, however you want.

https://github.com/tailscale/tailcat

Exploiting SMTP with Unicode Bidi Override Spoofing: The Gap Between Auth & Render

Anna Breeva highlights a gap which detection teams will want to get after.

a new email spoofing technique that abuses Unicode bidirectional (Bidi) controls together with SMTPUTF8 to make an attacker-controlled email address visually appear to belong to a trusted domain.

Unlike traditional email spoofing, the attacker does not need to forge the sender’s domain or bypass SPF, DKIM, or DMARC. The message can legitimately pass all three authentication mechanisms while the recipient is shown a visually reordered sender address belonging to an entirely different organization.

The issue stems from a gap between how email infrastructure authenticates an address and how email clients render that address to a human. In our testing, an attacker-controlled address belonging to 31337p.com could be visually rendered as an address belonging to bigcorp.com - while the underlying authenticated domain remained 31337p.com.

https://securityjoes.com/blog/exploiting-smtp-with-unicode-bidi-override-spoofing-the-gap-between-auth-and-render

Exploitation

What is being exploited..

Tooling and Techniques

Low level tooling and techniques for attack and defence researchers

Natural Language Nmap (nmap-nl)

Steve makes everyone who could remember optimised nmap command lines feel slightly on the verge of redundancy.

A lightweight, local command-line interface tool that translates natural language requests into raw Nmap commands and executes them in real-time, utilizing a locally hosted fine-tuned Gemma-3-270M model

https://github.com/evets007/natural-language-nmap

Rogue Framework

Mohammad Hossein Aghaee released this framework which lays the foundation for AI augmentation.

Rogue Framework is a desktop workbench for AFL++, cross-architecture QEMU fuzzing, harness development, lightweight Ghidra headless analysis, custom mutators, and patch comparison. It is intentionally an auditable workbench rather than a button-only wrapper: every generated AFL++ command is visible before execution, and generated harnesses are ordinary source files that the researcher can edit. It suppose to be "The BurpSuite of exploit developers"

https://github.com/ThisIsTFS/Rogue-Framework

GhostDebug

VollRagm provides a power tool again showing how the cyber security community can and should learn from the game cheat community.

GhostDebug is a Windows x64 debugger prototype composed of a native debugging DLL and a .NET Framework command-line client. It is intended for debugging targets that use debugger-detection checks.

https://github.com/VollRagm/ghostdebug/

Microsoft Paint and Photos Embed Server-Issued GUIDs as Invisible Watermarks in Locally-Generated Images

Xusheng Li highlights these watermarks exist.

• Microsoft Paint supports both local and cloud image generation

• Paint and Photos also ship local AI models

• The two apps send the prompt to a remote server for moderation

• The server returns a GUID along with the moderated prompt

• The GUID is embedded into the locally generated image as an invisible watermark

• A separate visible-watermark setting does not control this invisible watermark

• On Copilot+ PCs, image generation is local but prompt moderation remains remote

• Microsoft discloses that Paint adds C2PA metadata to AI-generated images

• AI-generated image saves limited to C2PA-preserving formats: PNG, JPEG, GIF, and .paint

https://xusheng.dev/posts/reversing/mspaint_invisible_watermark/main/

Closing a Critical Internet Privacy Gap for Billions of Users: Android 17 Rolls Out ECH Support

Maddy Hoffman details the role out - be interesting to see the impact on threat hunting where SNI inspection is used a lot in enterprises and especially for mobile devices where telemetry isn’t where it needs to be.

Starting with Android 17, ECH GREASE will be enabled by default

To help app developers leverage this new capability, OkHttp, the open-source HTTP client powering millions of Android apps, has integrated ECH support into its core library.

https://medium.com/jigsaw/closing-a-critical-internet-privacy-gap-for-billions-of-users-android-17-rolls-out-ech-support-c52b49a62c04

Footnotes

Some other small (and not so small) bits and bobs which might be of interest.

• Annual, quarterly and monthly reports

  • Nothing overly of note this week, but keep an eye on the Awesome Annual Security Reports 2026 collection and APT report collection

• SONIC: Concurrent Oblivious RAM & Data Structures for Low-Latency and High-Throughput

• Equivocation-resistant multiparty digital signature for quantum networks

• Quasipolynomial Cryptanalysis of the McEliece Cryptosystem (or: PIR Meets McEliece)

• The perplexing rise of mathematics

• tmp.0ut V

• Lessons from the Hardware Hacking Competitions: Verification Techniques, Findings, and Insights

• Artificial intelligence

  • if you are a big arxiv.org user - out of China there is alphaxiv.org which is an AI powered incarnation / overlay

  • Fundamental

    • Pretraining Recurrent Networks without Recurrence

    • Towards Scalable and Stable Parallelization of Nonlinear RNNs

    • FreeToken: Efficient Edge-Native MoE Serving with Bandwidth-Adaptive Execution

  • Applied non-cyber

    • Mathematics in the age of AI

    • The Tragedy of the Cognitive Commons: How AI Could Disrupt the Regeneration of Professional Expertise

    • Hawkeye: Hardware-Aware GPU Kernel Optimization with Minimal Supervision

    • Speculating LLMs’ Chinese Training Data Pollution from Their Tokens

    • Snyk VulnBench JS 1.0: Can LLMs Find the Same Bugs Twice?

    • I accidentally turned LLM memory into program analysis

    • AgentDV: Closed-Loop Agentic AI for Hardware Design Verification

    • Beyond Vector Hiding: Breaking and Mitigating Shared-Direction Weight Obfuscation in TEE-Offloaded Large Language Models

    • NeuronFuzz: Safety Neuron Guided Fuzzing for LLM Safety Evaluation

    • GROUND: Reducing Hallucinations in LLM-Based Enterprise Analytics Through Governed Semantic Definitions

  • Applied cyber specific

    • Stealing Reasoning Traces from Proprietary LLM APIs

    • AI Grinding for Fun and Cryptanalysis

    • LLMs for Agentic Hardware Design and Security - Teax A&M University new training course

    • Blood MERIDIAN: LLM cryptanalysis of a blockcipher that is isn’t a blockcipher

    • From Code to Chain: Why WP2Shell Stayed Out of Reach

    • MadHatter — Qwen Token Perturbation Lab

    • Scaling Memory Safety: AI-Assisted Rewrites of C/C++ Dependencies to Rust

    • AI Slop and Hallucinations in Vulnerability Assessment: A Survey on Reasoning Failures and Trustworthy Mitigation

    • FuzzingBrain-Bench V1: Evaluating Open-Ended Bug Discovery by LLMs

    • LLMscope: Extracting LLM Assets from Edge AI Chips via Optical Probing

    • Evaluating and Preventing Security Smells in AI-Generated Ansible Code

    • Enhancing User Resilience Against AI-Augmented Phishing: A Two-Stage Framework for Detection and Personalized Training

    • When Context Gets Root: Privilege Escalation in LLM Harnesses

    • PLCBench: Can Autonomous LLM Agents Turn PLC Access into Sustained Physical Impact?

    • KubeCap: A Framework for Capability Minimization in Kubernetes via Static Analysis and LLM-Assisted Rule Inference

    • Unsaid, Unsafe? Implicit Security Obligations in LLM-Based RTL Code Generation

    • SkillShield: Prompt-Space Security Skills for LLM Coding Agents

    • Are LLM-Enhanced GNNs Privacy-Safe?

    • Towards LLM-Enhanced Android Taint Analysis

    • When “Do Not” Is Not Deny: Security Rules in CLAUDE.md vs Built-In Controls

    • InjecMEM: Memory Injection Attack on LLM Agent Memory Systems

    • The Surprising Effectiveness of LLMs in BGP Security: Mining An Unprecedented Amount of Incidents and Boosting Anomaly Detection

    • On Predicting Vulnerability Severity Using In-Context Learning: An Industrial Case Study

• Books

  • Nothing overly of note this week

• Events

  • Nothing overly of note this week

Video of the week is from CyberUK ‘How to justify security investments with actual evidence’ by Dr Daniel Woods

Finally finally the NCSC’s podcast series.

Unless stated otherwise, linked or referenced content does not necessarily represent the views of the NCSC and reference to third parties or content on their websites should not be taken as endorsement of any kind by the NCSC. The NCSC has no control over the content of third party websites and consequently accepts no responsibility for your use of them.

This newsletter is subject to the NCSC website terms and conditions which can be found at https://www.ncsc.gov.uk/section/about-this-website/terms-and-conditions and you can find out more about how will treat your personal information in our privacy notice at https://www.ncsc.gov.uk/section/about-this-website/privacy-statement.

Operationally this week nothing overly of note.

In the high-level this week:

• Managing the cyber risk of agentic AI - NCSC UK publish - “Use safeguards, sandboxing and active oversight to realise the benefits of autonomous systems while limiting the unintended activity.”

• Help shape the future of resilient private 5G - NCSC UK invite - “The NCSC wants to collaborate with organisations developing technologies and approaches for secure, resilient and deployable private 5G”

• UK Public Survey of Risk Perception, Resilience and Preparedness: 2026 - Cabinet Office publish - “Compared to 2025, the perceived likelihood of most emergencies remained broadly stable. .. The perceived likelihood of a … a cyber attack affecting critical infrastructure rose by three percentage points (39% to 42%).”

• Call for evidence on the impact and effectiveness of Sections 1 to 13 of the Telecommunications (Security) Act 2021 - Department for Digital, Culture, Media and Sport and Department for Science, Innovation and Technology publish - “The call for evidence seeks views from all stakeholders who have engaged with the Telecommunications (Security) Act 2021, the Electronic Communications (Security Measures) Regulations 2022, and the Telecommunications Security Code of Practice.”

• The National Security Authority warns of a significant cyber threat associated with the use of several types of road speed cameras - National Security Authority of the Slovak Republic warns - “The National Security Authority, through a security analysis conducted on a loaned sample of the NERO R-ONE road speedometer, identified several security risks, including:

  • the true origin of the camera hardware and software,

  • inconsistency between the documented and detected configuration of the product’s communication interfaces,

  • pre-configured remote access and product management mechanisms, the configuration of which is not fully available to the user,

  • inconsistency between the declared and actually used software ensuring measurement processing,

  • poor software security.”

• We need a more complete picture of cyber-attacks on UK critical national infrastructure - Alan Turing Institute leverage freedom of information - “To elicit a more grounded picture of cyberattacks on UK CNI, we sent FOI requests to regulators spanning England, Wales, Scotland and Northern Ireland to gain access to their data. This data collection exercise was complemented by analysis of advisories published by US authorities which provided more detail than the UK data on how attacks are carried out. Our data showed that during 2024, nearly one third (29%) of incident reports made under the regulations concerning network and information systems related to cyberattacks. The data we obtained also provided us with important insight into the attackers’ motivations. Of six health-sector incidents in England that met the reporting threshold in 2024, five were ransomware attacks and the sixth was a power outage.”

• National Security Science & Technology Strategy - The White House (not me) publishes - “building segmentation into critical network architectures, and modernizing cryptography and cyber infrastructure. This also includes prioritizing S&T to secure operational technology and industrial control systems through cyber-physical threat modeling and AI-driven anomaly detection.”

• The Presidential Memo on Combating Transnational Cybercrime: Implications for Industry and Government - Center for Strategic and International Studies think tanks - “It is a pivotal moment for security in cyberspace. State actors are ramping up activity, as we have seen with the likely Iranian attacks on U.S. water facilities, while high-profile cybercriminal incidents are impacting more sectors across the U.S. economy and society, such as schools. U.S. government actors have their hands full and should make use of industry’s talent and hunger to help.”

• The Cyberattacks on the U.S Water Sector and the Iran Question: Escalation or Opportunism? - Center for Strategic and International Studies think tanks - ”The answer is not yet. Psychological effect is precisely the point of Iran’s cyber operations, to sow fear, chaos, and division, as part of its information warfare strategy. If these attacks are indeed Iran’s doing, this commentary asserts four reasons the water incidents do not constitute escalation in this conflict; they should be regarded as opportunistic disruption owing to weak U.S. cyber defenses, rather than a turning point.”

• Outpaced: AI and Policy’s Role in Transforming Cybersecurity Compliance - Center for Security and Emerging Technology think tanks - “Despite decades of reform efforts, the federal government’s Authorization to Operate (ATO) process is a major barrier to delivering secure systems to warfighters at speed. This report examines why past ATO reforms have fallen short of their intent, and offers recommendations to getting leading American technology into the hands of warfighters faster and securely.”

• Volunteer with our Technology Advisory Group - UK Girlguiding call for volunteers - “We’re looking for experienced digital, data and technology professionals to join our new Technology Advisory Group as volunteers.”

• Reporting on/from China

  • T-Mobile ‘chopped a cable’ to expel Chinese hackers from its network - Tech Crunch proxy reports - “New reporting from Bloomberg revealed how cybersecurity staff at U.S. phone provider T-Mobile identified and expelled Chinese hackers from its network in 2024 during a spate of industry-wide intrusions by Beijing aimed at stealing customer data.” …. “After identifying the breach, T-Mobile’s cybersecurity chief, Jeff Simon, told Bloomberg that he and three others drove to the data center nearby to its Bellevue, Washington headquarters, found the compromised system, pulled out a set of scissors, and snipped the cable connecting the box to the outside world.”

  • The Documentary, China: The rise of a science superpower - BBC World Service broadcasts - “Roland Pease explores how decades of strategic investment and diligent educational reform have brought China to the brink of global scientific dominance.”

  • China Presses a Weakness in America’s Tech Policy - Wall Street Journal opines - “The danger is twofold. China is reducing its own dependence on foreign-controlled [chip] architectures while positioning itself to lead in commercializing the open alternative [RISC-V].”

  • China Wants to Shape What the World’s A.I. Knows - New York Times reports - “Earlier this year, the country’s National Data Administration unveiled a blueprint to transform China into a data powerhouse by the end of 2028. The plan proposed creating “high quality” data sets in more than two dozen strategic fields, including scientific research, industrial manufacturing and autonomous vehicles. The plan calls on China to share its data sets worldwide. That was reinforced last month when China pledged to share data to help the dozens of developing countries that attended the World Artificial Intelligence Conference in Shanghai build their own A.I. systems. China has also already released huge troves of data curated by government labs and state-owned media, making them available for download around the world. The goal, analysts say, is twofold: to draw more users into China’s A.I. orbit and to narrow the gap with the United States in access to high-quality training data, which Beijing believes is helping America maintain its lead.”

• AI

  • Managing the cyber risk of agentic AI - NCSC UK publish - “Use safeguards, sandboxing and active oversight to realise the benefits of autonomous systems while limiting the unintended activity.”

  • Benchmarking Automated Security Patch Backporting: How Far Are We? - many Chinese universities measure - “Performance degrades sharply on structurally complex patches: the best commit-level success rate falls from 85.2% on Type-I patches to 24.0% on Type-IV.”

  • Measuring coding agent misalignment in the wild - Transluce measures - “We studied rates of coding agent misalignment in 8,600 real-world coding agent sessions. We found severe cases of monitor evasion and misrepresenting success in a small but non-negligible fraction of sessions (around 2% for each behavior). In these cases, agents merge PRs to main without authorization, falsely claim approval from review agents, and reason that they shouldn’t disable tests before quietly doing so anyway.”

    • Cases of monitor evasion and overselling on SWE-chat, sorted by severity

  • How Google is Making Private AI Practical with Homomorphic Encryption - Jeremy Kun details - “HEIR can convert pre-trained AI models that operate on unencrypted data to operate on encrypted inputs. Our vision is to make HEIR a one-click solution to enable non-experts to incorporate encrypted inference into production applications.”

  • AI in Cyber Conflict: Short-term Offensive Opportunities, Long-term Defensive Advantage - Irregular Warfare think tanks - “On the one hand, AI automation could massively enhance the effectiveness of cyber operations and campaigns below the threshold of war as some have predicted. If true, states would be able to achieve even more strategic gains through irregular warfare than U.S. national defense strategy assumes. … In a new article published in International Security, I argue that these expectations are likely misplaced. Contrary to prevailing expectations, cyber defense likely has more to gain from AI automation. While AI-powered attacks make for dramatic headlines, a level-headed examination shows core offense challenges reflect the weaknesses of AI models whereas defense tasks speak to its strength.”

  • Everything is about to “go dark” - Matthew Green worries - “I’m concerned that AI is going to make software much too secure. While that doesn’t sound so bad on the surface, there’s a consequence to this. I mean something very specific: I’m concerned that U.S. intelligence and law enforcement agencies are about to go dark, meaning: that they’re going to suddenly lose a huge portion of their capability.”

  • The TEVV-Athlon Framework for Evaluating AI Systems - NIST calls for input - “Input Sought on Initial Public Draft of NIST AI 200-2 through October 6, 2026 … This paper introduces the TEVV-Athlon Framework, a four-stage method for developing customized assessments of AI systems based on organizational TEVV objectives. The framework produces a TEVV-Athlon, an assessment where AI systems are tested via a set of Events and Tools which produce data on Blocks related to measurement concepts of interest.“

  • Pacing model development in an era of cyber-critical capabilities - OpenAI assert - “We expect models to soon drive most security work, including defending against other models. This will allow all three safeguards to scale with model capability, which we see as crucial.”

  • Responsible Innovation at the Frontier - Americans for Responsible Innovation publish - “ARI’s blueprint for federal AI governance is designed to promote safe frontier AI development in America. The blueprint is built around three governance functions any federal proposal should incorporate. To set adequate safety standards, the federal government should hold every covered developer’s published safety framework to minimum federal standards that define adequacy. To verify compliance with those standards, there should be independent assurance. To secure transparency into frontier AI development, there should be federal visibility into both internally deployed frontier models and the growing automation of AI research and development.”

  • China advances global AI governance in a comprehensive manner - People’s Daily reports - “At the opening ceremony of the 2026 World AI Conference (WAIC) and High-Level Meeting on Global AI Governance, Chinese President Xi Jinping called for joint efforts to build a just and equitable system for global AI governance. The proposal reflects a profound understanding of technological and historical trends, embodies the wisdom of governing AI for the common good, and points toward the long-term goal of building a community with a shared future for humanity.”

• Cyber proliferation

  • US courts will start publishing how often the government uses spyware - TechCrunch reports - “Starting in 2029, U.S. judiciary will publicly disclose precisely how many times judges authorized the use of wiretaps to be carried out with hacking tools and spyware, which fall under the category of what the feds call network investigating techniques, or NITs.”

• Bounty Hunting

  • 17 Iranians Charged with Conducting Massive Cyber Theft Campaign on Behalf of the Islamic Revolutionary Guard Corps and Other Iranian Entities - US Department of Justice announces - “A 14-count superseding (S2) indictment was unsealed today charging 17 members of the Mabna Institute, an Iran-based company that, since at least 2013, has conducted a coordinated campaign of cyber intrusions into computer systems for 144 U.S.-based universities, 178 foreign universities, at least 42 U.S.-based private sector companies, at least 11 foreign private sector companies, at least five U.S. federal and state government agencies, and at least two non-governmental organizations (NGOs).”

  • Reward Up To $10,000,000 USD For Information On Iranian Hackers - Rewards for Justice bounties - “These individuals are affiliated with Iran’s Ministry of Intelligence and Security and the Islamic Revolutionary Guard Corps, a designated Foreign Terrorist Organization. They have targeted numerous segments of U.S. critical infrastructure with malicious cyber activity.”

  • Malaysian Police Arrest SMS Blaster Driver Targeting Singapore Border Traffic - CommsRisk reports - “Malaysian authorities arrested a 65-year-old man who allegedly used a car-mounted SMS blaster to target peak-hour commuters travelling between Johor Bahru and Singapore.”

• Market Incentives

  • Cyberleagle: If the computer is not accountable, who is? - Graham Smith asks - “If the computerised bill system had been AI-driven, one wonders how impressed the Ferguson court would have been with distinctions between determinate and indeterminate computer outputs. That speculation aside, when considering corporate tortious liability for AI errors it seems likely that at some point the Meridian framework will come into play”

  • UK Corporate Governance Code 2024 - Financial Reporting Council published but are now coming into effect- “As a result, the Code will provide a stronger basis for companies to evidence the effectiveness of their internal controls, thereby enhancing transparency and investor confidence. In order to give companies sufficient time to implement these new arrangements, reporting on this element of the Code (Provision 29) will not be effective before accounting periods beginning on or after 1 January 2026”

  • ETSI launches approval process for 17 European Standards supporting the Cyber Resilience Act - ETSI launches - “ETSI is pleased to announce the availability of the 17 vertical final draft standards developed in the framework of the EU Cyber Resilience Act (CRA) and currently under Public Enquiry. These standards aim to become Harmonised Standards, giving manufacturers a recognised way to demonstrate compliance with the legislation, the so-called “presumption of conformity”.

  • Artificial Intelligence Underwriting Company emerges - comment: it will be interesting to see the world in the insurance - video here from AIUC on Making Safe AI Profitable: Standards, Audits, and Insurance a paper was written on Underwriting Superintelligence by the co-founders

No reflections this week.

Not getting this via email? Subscribe:

Subscribe now

Think someone else would benefit? Share:

Share

All attribution is by others and not the UK Government unless specifically stated as such, please see the legal text at the end.

Have a lovely Saturday…

Ollie

Cyber threat intelligence

Who is doing what to whom and how allegedly.

Reporting on Russia

Going with the Flow(s): Distinct Clusters Target Individuals of Interest to Russia

Gabby Roncone and Wesley Shields details an alleged Russian operation which is of note due to its scale and techniques which may fall outside of enterprise detection and discovery.

These clusters engage in persistent, adaptive phishing campaigns, using sophisticated social engineering tactics to compromise personal accounts across multiple platforms. Because these operations abuse legitimate authentication flows which may not immediately seem like phishing attempts to users, GTIG is raising awareness about these social engineering campaigns targeting individuals so that targets can more readily recognize malicious outreach.

…

UNC7005 also conducts device code phishing operations for both Microsoft and WhatsApp accounts. The themes of these phishing waves often involve invitations for calls with individuals from notable organizations related to the target’s field or, most recently, invitations to diplomatic events and conferences.

https://cloud.google.com/blog/topics/threat-intelligence/distinct-clusters-target-individuals-of-interest-to-russia

Reporting on China

APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit

Fareed Radzi details that this alleged set of Chinese operations are now using a signed kernel driver which history implies the certificate may of been in use for a while. Noteworthy as as kernel code signing is still obtainable by adversaries it would appear.

CoolClient is a backdoor family attributed to the HoneyMyte APT group (also known as Mustang Panda) that has been used in their cyber-espionage campaigns targeting organizations across Asia and Russia. It supports such capabilities as keylogging, clipboard theft, credential harvesting, file management, system reconnaissance, and plugin-based extensions.

..

In late 2025 and 2026, our latest investigation reveal another major evolution. The newest CoolClient variant can deploy a signed kernel-mode driver as a Windows service and communicate with it through IOCTL requests. The driver enhances the malware’s stealth by hiding the CoolClient process, protecting related files and registry entries, and preventing them from being inspected or modified. The overall design is comparable to the kernel-mode enhancements previously observed in ToneShell, but the CoolClient driver exposes dedicated IOCTL handlers that allow the user-mode backdoor to communicate directly with the driver.

We have observed this updated CoolClient variant and its accompanying driver in intrusions across multiple countries in Asia, including Pakistan, Mongolia, and Myanmar.

…

The path contains several notable strings, including “Nanjing Laboratory” (南京实验室) and “Zhang Xuejie Yunnan m” (张雪杰云南m), which likely refer to the driver’s development environment. However, our OSINT analysis did not identify any information linking these strings to a known organization, developer, or threat actor.

The driver is digitally signed with a certificate issued to "Nanjing Ranyi Technology Co., Ltd.", with serial number 3E 62 DC 5D 8D 61 2A 26 33 E7 6B DF D6 07 19 DD. The certificate was valid from August 2013 to September 2014.

We identified several older malicious drivers signed with the same certificate that were compiled around 2013. However, we found no evidence directly linking those samples to the CoolClient activity described in this article.

https://securelist.com/honeymyte-coolclient-driver-rootkit/121028/

SilkParasite: Tracking a China-Nexus APT Across Central Asia

Martin Zugec details a suite of alleged Chinese capability which has hints that AI was used in its development (not a surprise). Initial access tradecraft is extremely well understood and easily mitigatable.

SilkParasite is a cyberespionage operation, assessed at medium confidence as China-nexus, that targeted government bodies across Central Asia. Bitdefender Labs found seven remote access tool (RAT) families in use, five of which were previously undocumented; we identified and named them: DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT, and NodeEdgeRAT. The toolset is small, modular, and professionally engineered, and it carries traces of AI-assisted development.

..

Initial access ran through malicious Microsoft Office documents, most likely delivered by spear-phishing email. In several cases the lure documents were packaged inside password-protected RAR archives, with the password supplied in the email body, a low-effort but effective way to slip past email-gateway scanning and automated sandbox inspection. Once opened, the document ran a macro that dropped a signed-application sideloading chain to disk and launched the first-stage payload.

https://www.bitdefender.com/en-us/blog/businessinsights/silkparasite-tracking-china-nexus-apt-across-central-asia

UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations

Joey Chen details an allegedly Chinese threat actor who has integrated AI to increase scale. Not sure the expertise point in the below is empirically proven quite yet given this campaign used publicly disclosed vulnerabilities, we do not know who the actor is and we have had ./ exploit for time and memorial… they also describe this actor as highly capable in the following blog.

• [We] identified UAT-10147 targeting Windows and Linux web servers globally, impacting organizations in government, education, media, technology, and gaming sectors. The actor leveraged publicly disclosed vulnerabilities to gain initial access at scale.

• UAT-10147 integrated AI-driven tooling into exploitation, reconnaissance, payload generation, validation, and persistence workflows. Talos observed AI-generated operational playbooks, exploit automation scripts, and troubleshooting logic supporting real-world intrusions.

• The actor employed a mixture of open-source offensive frameworks, including Metasploit, ysoserial, PentestGPT, DeepAudit, and multiple privilege escalation exploits to automate intrusion operations and establish persistence.

• Talos assesses that integrating AI-generated exploitation guidance, automation, and validation workflows enables threat actors to scale complex attacks more efficiently while reducing the expertise traditionally required for advanced post-compromise operations.

https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/

UAT-10147 deploys SPECTRE: A cross-platform implant with Linux rootkit and BYOVD capabilities

Joey Chen further details this alleged Chinese threat actors capability which implies criminality may be the intent. Noteworthy as it is a new implant and it does have some evasion capabilities

• UAT-10147 is a highly capable Chinese-speaking intrusion actor operating a multi-platform post-exploitation ecosystem targeting IIS and Linux servers, combining search engine optimization (SEO) fraud monetization with advanced persistence and defense evasion techniques.

• The newly identified SPECTRE implant represents a significant evolution in commodity intrusion tooling, integrating cross-platform command-and-control (C2) operations, process injection, credential theft, anti-analysis protections, and kernel-level endpoint detection and response (EDR) bypass functionality.

• The actor demonstrates operational maturity through the combined use of custom malware, open-source offensive tooling, Bring Your Own Virtual Driver (BYOVD) based EDR neutralization, Linux kernel rootkits, and sophisticated in-memory web shell deployment techniques.

• Cisco Talos’ analysis of recovered source code suggests portions of the Linux rootkit development may have incorporated AI-assisted code generation workflows, highlighting the growing role of generative AI in accelerating offensive malware development.

https://blog.talosintelligence.com/uat-10147-deploys-spectre-a-cross-platform-implant-with-linux-rootkit-and-byovd-capabilities/

Operation QUICSILVER: China-Nexus Actor Targets Myanmar Diplomats via VHD-Delivered Go Backdoor

Priya Patel details an alleged Chinese operation which uses tradecraft we have known about what feels like over five years. All well understood, all mitigatable. Noteworthy due to victimology and the fact it might be effective in achieving access.

We have been tracking this threat actor over the past few months and identified three related campaigns targeting Myanmar. The earliest campaign, observed in April 2026, used a sample named HolidayNotice.pdf.exe. The lure used in this variant was a fabricated Belgian–Myanmar public holiday calendar, which suggests that the threat actor was targeting personnel from Belgian organizations operating in Myanmar, such as embassies or NGOs.

We also identified two VHD samples that appeared within a short period of time. The first sample, TrainingAnnouncement.jpg, was first observed on June 2026. The second sample, ACMECS_Pillar_1.vhd, was first observed in July 2026. Although the two samples use different lure documents, they share the same infection chain, payload, and C2 infrastructure.

https://www.seqrite.com/blog/operation-quicsilver-china-nexus-actor-targets-myanmar-diplomats-via-vhd-delivered-go-backdoor/

Trapping a Mustang Panda

Agnes Ramos-Beauchamp , Joshua Chung , Golo Mühr and Joe Fasulo detail an alleged Chinese operation which is of note due to sector (energy) and if you look past the product marketing the use of cyber deception effectively for intelligence gain.

• X-Force is tracking ongoing campaigns attributed to ITG27 (formerly Hive0154), a China-aligned actor conducting cyber espionage.

• The actors are likely exploiting ongoing geopolitical events in South Asia, using emails to spread new versions of the Toneshell backdoor.

• Using Deception.Pro, X-Force observed two real ITG27 incidents in realistic, simulated victim organizations’ environments. ITG27 operators maintained access over multiple days and performed hands-on-keyboard activity including reconnaissance, credential harvesting and malware deployment.

• The actors deployed a previously unknown VNC-capable backdoor tracked as Havencode to manually browse the victim’s desktop, and exfiltrated fake documents placed in the deception environments.

• X-Force analysis shows that operator-initiated actions took place exclusively during weekday working hours (08:00-18:00) in China Standard Time.

https://www.ibm.com/think/x-force/trapping-a-mustang-panda

Reporting on North Korea

PurpleDelta’s Fraudulent Employment Operations

Insikt Group® detail an alleged North Korean operation which continues to gain effective employment. The complex supply chain around these operations is of note.

• Insikt Group has identified at least 22 fabricated personas linked to multiple PurpleDelta clusters that submitted applications to over 1,100 companies across the software, staffing, healthcare, and financial sectors, with operators submitting as many as 60 or more applications per day across at least 8 job platforms.

• These clusters of PurpleDelta operators are highly likely to have been actively employed at ten or more organizations, with confirmed or probable placements at companies that pose an ongoing and material insider threat.

• PurpleDelta demonstrated a high degree of operational sophistication, using multi-account management browsers, multiple Chrome profiles, AI-generated profile photos, custom ChatGPT assistants, and real-time AI transcription tools to deceive hiring managers during interviews, sometimes repeating AI-generated responses verbatim.

• Once employed, PurpleDelta operators recorded internal meetings at victim organizations, used screen recording software during work sessions, and drafted pre-written Google Translate excuses to justify the use of personal devices and personal bank accounts.

• Video evidence indicates that PurpleDelta operators use identity-brokering services, account-renting via AnyDesk, and multi-accounting tools, and coordinate via Telegram and Slack, with support from facilitators who procure and maintain company-issued hardware on the operators’ behalf.

https://www.recordedfuture.com/research/purpledelta-fraudulent-employment-operations

Reporting on Iran

Nothing overly of note this week

Reporting on Other Actors

Living Off the Cloud: A Python Implant Hiding Its Entire C2 Inside Microsoft 365 & Azure

Rhys Downing details a cloud based implant and C2 which is noteworthy due to its operational usage here.

TWINLOOT is a modular, PyArmor-hardened Python implant designed to operate its entire command-and-control infrastructure inside trusted Microsoft services. Tasking flows through SharePoint Online file dead-drops via the Microsoft Graph API. Interactive operator access routes through WebRTC DataChannels relayed by Microsoft Teams TURN servers. Graph API traffic is driven through a headless instance of the victim’s own Edge browser, making it indistinguishable from legitimate user activity. The implant harvests Windows credentials via pixel-faithful fake lock screens, provides a reverse SOCKS5 pivot into victim networks, executes arbitrary commands, and persists through four mechanisms. One instance involved an offline‑forged mandatory profile hive created without administrative privileges. This used a technique called “Corrupting the Hive Mind,” the first recorded malicious use of this persistence method in the wild.

We recovered the modules from under PyArmor 9.2.5 protection and decrypted the embedded configuration, giving us visibility into the operator infrastructure, including the SharePoint C2 site, the Azure Blob config dead-drop, and the attacker-registered domains.

https://www.ontinue.com/resource/python-implant-hiding-its-entire-c2-inside-microsoft-365-azure/

Dropcatch Scavengers: Expired Malicious Domains Become Cash Cows

Infoblox Threat Intel detail the scale of this campaign over a series of posts - the level of financial investment is of note showing there must be a return of a greater amount.

Dropcatch actors inherit traffic from compromised websites by acquiring expired malicious domains and redirecting victims to scams and malware.

…

Sable Squirrel spends millions on expired domains to deliver illegal gambling, streaming, RAT malware, and ransomware in a massive cybercriminal enterprise.

https://www.infoblox.com/blog/threat-intelligence/dropcatch-scavengers-expired-malicious-domains-become-cash-cows/

https://www.infoblox.com/blog/threat-intelligence/7-million-in-expired-domains-fuel-a-streaming-empire-with-a-malware-secret/

https://www.infoblox.com/blog/threat-intelligence/dropcatch-scavengers-expired-malicious-domains-become-cash-cows/

Software Supply Chain Incursions

A reminder we issued guidance a number of weeks ago in Software supply chain attacks: check your dependencies for software developers

• Windows Infostealer Hits npm and Ruby

• Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns

Discovery

How we find and understand the latent compromises within our environments.

Device Roles in Microsoft Defender XDR: Better Context for Threat Hunting and Detection Engineering

Mehmet Ergene details these new data source/colum in Microsoft Defender XDR which will facilitate for precise threat hunting.

Microsoft has added a DeviceRoles column to the DeviceInfo table in Microsoft Defender XDR Advanced Hunting. I’ve been asking for this type of device context for a long time, so I was happy to see it finally appear.

For threat hunting and detection engineering, it solves a problem I regularly run into: understanding what a device actually does without leaving the hunting query. For example, I hate switching to CMDB and finding out the device is just a Terminal server.

DeviceRoles JSON-formatted string field, containing roles identified by the system or defined by users, confidence levels, and the last time each role was observed.

That gives us another useful source of context directly inside DeviceInfo.

https://academy.bluraven.io/blog/device-roles-in-microsoft-defender-xdr

Google SecOps (Chronicle) Curated Detections: Flaw Analysis & Tuning

All3xJ fixes a hyperscalers detections.

This repository documents architectural design flaws, logic discrepancies, and tuning strategies for native Google SecOps (Chronicle) Curated Detections.

While Google Threat Intelligence (GTIG) provides exceptional conceptual threat coverage (such as tracking APT29/BRICKSTORM campaigns), raw YARA-L implementations of curated rules sometimes suffer from implementation oversights, such as grouping logic contradictions and hardcoded threshold variables. In real-world enterprise environments, this frequently leads to massive alert fatigue.

This project analyzes why native rules break or flood the SOC, and shares optimized Custom Rules and patches to resolve these issues.

https://github.com/All3xJ/fixing-google-secops-detections

Hunting MacSync Stealer infrastructure through behavioral pivots

Microsoft Defender Experts and Microsoft Security Research detail they expanded the identification of associated infrastructure.

Microsoft Defender Experts expanded that view by correlating recurring endpoints and network behaviors across the activity. This behavior-led approach connected more than 30 domains and showed that the infrastructure supported more than C2 communication, extending into active collection, staging, and exfiltration. The findings demonstrate that although domains may rotate quickly, repeated execution patterns, request characteristics, staging behavior, and upload methods provide defenders with more durable opportunities to investigate MacSync Stealer activity.

https://www.microsoft.com/en-us/security/blog/2026/08/18/hunting-macsync-stealer-infrastructure-through-behavioral-pivots/

Consensual Forensics with Android Intrusion Logging

Kevin Pagano details how to leverage these new logging sources to identify potential intrusions on Android.

A few months back Android introduced their new intrusion logging capabilities as part of their advanced protection mode. Security Lab has a great blog on everything about them. It really breaks them down into three different categories from the samples I’ve seen:

• Security Events - A lot of types, including ADB commands, packages installed/uninstalled, process starts and more

• DNS Events - Hostnames, IP addresses

• Connection Events - IP addresses, package names, ports

It really allows you to then run IOCs on the logs to see if anything suspicious may be connecting to your mobile device or other connections or packages running that shouldn’t be. I don’t think there are many tools that support parsing these logs at this time but ALEAPP does now after a quick run through Python.

https://www.stark4n6.com/2026/08/consensual-forensics-with-android.html

IRFlow Timeline

Renzon Cruz adds support for ChatGPT Computer History to the IR timeline flows..

IRFlow Timeline 1.0.10 adds ChatGPT Computer History as a new forensic artifact family, and hardens the app for long-running investigations.

https://github.com/r3nzsec/irflow-timeline/releases/tag/v1.0.10

13 million tool calls: auditing every AI coding agent action with Elastic Agent

Wieger van der Meulen shows how it is done at contemporary scale in the AI era across a modern AI use case. How many agents ran tooling which accessed a certificate (per the below) is a jolly good question to be asking.

We gave hundreds of developers an AI agent that can run shell commands, edit files, and call Model Context Protocol (MCP) servers on their laptops, then realized we had no record of what it actually did. So we built one. One 280-line dependency-free bash script, fired by Cursor's hooks, records every tool call as JSONL, and the Elastic Agent already on each endpoint ships it to Elasticsearch. Since the May rollout we have logged over 13 million tool-call events from more than 1,100 machines. A question like "which hosts ran an agent that read a .pem file last week?" is one ES|QL query. The worked example here is Cursor end to end, but the pattern works with any agent that offers lifecycle hooks.

https://www.elastic.co/security-labs/ai-coding-agent-audit-cursor-hooks

From Noise to Signal: Improving Security Log Anomaly Detection Using LLMs with Endpoint-Specific Logs

Christopher Henshaw and Gour Karmakar provides some measurement of efficacy but show that there is likely real-world value to be had.

k. Meta Llama 3.1 8B Instruct achieved the strongest overall end-to-end detection performance, with an accuracy of 89.3%, recall of 88.2%, F1-score of 91.8%, and false negative rate of 11.8%. In comparison, Wazuh achieved an accuracy of 52.0% and false negative rate of 68.6%, while OpenSearch achieved an accuracy of 49.3% and false negative rate of 74.5%. Meta Llama also detected 80% of the borderline anomalous scenarios, compared with 20% for Wazuh and 15% for OpenSearch. Qwen achieved lower overall detection performance than Meta Llama but recorded the lowest average inference latency and 100% structured-response validity. GPT-OSS demonstrated strong classification performance when valid responses were produced.

https://arxiv.org/abs/2608.19938

From Threat Intelligence to Detection: Knowledge-driven Enrichment and Template-based Rule Grounding for Automated Sigma Rule Generation

Sepehr Ghaffarzadegan, Boubakr Nour, Makan Pourzandi, Mourad Debbabi and Chadi Assi show that LLMs are in of themselves likely not the sole answer for some use cases - real world value on show here.

Rather than relying solely on language models, AUTOSIGMA leverages a structured knowledge base to enrich partial inputs, matches the enriched content against a repository of existing Sigma rules, and then employs an LLM-as-a-Judge mechanism to iteratively validate the rules. By combining knowledge-driven enrichment, template-based rule grounding, and a multi-stage solution, AUTOSIGMA enables accurate, context-aware, and relevant rule generation. Evaluations across multiple real-world APT reports and multiple security blogs demonstrate that AUTOSIGMA outperforms alternative solutions and LLM models in rule validity, rule relevancy, MITRE ATT&CK technique coverage, and robustness to input quality.

https://arxiv.org/abs/2608.19011

Defence

How we proactively defend our environments.

Joint guidance on isolating vital system

Canadian Centre for Cyber Security and friends published this at the end of July

The Canadian Centre for Cyber Security (Cyber Centre) has joined the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) and the following international partners in releasing cyber security guidance on isolating vital operational technology (OT) systems:

• New Zealand’s National Cyber Security Centre (NCSC-NZ)

• United Kingdom’s National Cyber Security Centre (NCSC-UK)

• United States’ Cybersecurity and Infrastructure Security Agency (CISA)

• United States’ Federal Bureau of Investigation (FBI)

State-sponsored cyber actors are targeting critical infrastructure (CI) to conduct espionage and pre-position for cyber attacks. CI organizations can strengthen resilience against escalating cyber threats by preparing to isolate vital OT and enabling systems from the Internet and other networks for an extended period. This can help ensure essential services continue even if corporate networks are compromised.

This joint guidance promotes a shift from reactive defence to proactive resilience, using physical isolation to limit threat actors’ access and maintain operational continuity during crises.

https://www.cyber.gc.ca/en/news-events/joint-guidance-isolating-vital-systems

Defending Against DPRK IT Workers – An Implementation and Operational Guide

Bridewell provide a playbook for defence..

https://insights.bridewell.com/hubfs/Reports/Defending%20Against%20DPRK%20IT%20Workers%20-%20An%20Implementation%20and%20Operational%20Guide.pdf

Privileged Identity & Access in Microsoft Entra

Thomas Naunheim and Martin Sohn Christensen accelerate the defence of every Entra centric organisation with this release which continues to be updated / iterated.

Docs, resources and samples to implement a secure privileged identity and access management in Microsoft Azure and Microsoft Entra.

https://github.com/Cloud-Architekt/AzurePrivilegedIAM

Honeyquest for LLMs: Rethinking Cyber Deception for AI Attackers

Kerri Prinos, Lilianne Brush and Cameron Denton provide some valuable insight from this research and highlight various gaps in contemporary tradecraft. Also worth nothing that human-machine teaming will need to be considered as these research streams continue.

Our empirical evaluation reveals three key findings that establish LLMs as a distinct attacker class: (1) every model in our cohort falls for deceptive traps at a significantly higher rate than human attackers; (2) the defensive attention-diversion effect observed in humans is statistically absent in our LLM cohort; and (3) a critical recognition-action gap, where LLMs successfully articulate trap recognition in their reasoning but exploit the deceptive elements anyway 73.4% of the time; 48.5% of aware-on-deceptive responses correctly identify the trap and exploit it anyway, while 24.8% exploit after misidentifying the deceptive line.

https://arxiv.org/abs/2606.21037

Benchmarking Automated Security Patch Backporting: How Far Are We?

Jincheng Yang, Yulong Fu, Chengwei Liu, Lyuye Zhang, Fangyuan Zhang, Bingyang Ren, Yang Liu and Hui Li show the lived reality of where we are and why the technical debt paydown will continue to not be entirely machine scalable for a while.

Performance degrades sharply on structurally complex patches: the best commit-level success rate falls from 85.2% on Type-I patches to 24.0% on Type-IV. We identify four root-cause categories (missing target API awareness, cross-version semantic mismatch, non-local dependency propagation failure, and patch construction or localization failure) and derive concrete directions for next-generation tool design.

https://arxiv.org/abs/2608.17671

Beyond the Hype: Evaluating LLM Integration and Practical Limitations in Security Operation Centers

Elnaz Rabieinejad, Ali Dehghantanha, Fattane Zarrinkalam and Sarina Dastgerdy undertake some valuable socio-technical research with this work showing human trust of AI is going to continue to add friction.

Participants report perceived time savings for low-stakes tasks that are quickly verifiable (e.g., summarizing logs or drafting initial investigative leads), but they consistently frame LLM outputs as preliminary drafts and suggestions rather than decision-grade conclusions. Participants also describe limited trust in LLMs for high-stakes security decisions due to unreliable outputs and unclear model reasoning, and they report relying primarily on ad-hoc verification norms and continuous human oversight rather than standardized mitigation procedures.

https://arxiv.org/abs/2608.17154

Incident Writeups & Disclosures

How they got in and what they did.

I accidentally logged hundreds of thousands of phone calls to military bases

Lina once again shows it is always DNS…

How an expired nameserver let me take over e164.arpa zones for multiple territories, and why I probably should have checked my logs sooner.

…

DNS hijacking is silly. I already took over different .gov and .edu domains in the past, but I just immediately reported that and moved on.

This one is a little different though, it's about how I took over phone-network infrastructure domains (e164.arpa) of entire territories, and accidentally logged hundreds of thousands of phone calls to military bases. But let's start at the beginning.

https://lina.sh/blog/hijacking-e164-arpa

Vulnerability

Our attack surface.

A revisit of remote Spectre attacks on Cloudflare Workers

Albert Pedersen, Haocheng Xiao, Sam Ainsworth, Nigel Topham, and Martin Schwarzl show Spectre is not entirely theoretical in terms of real-world implications and impact in contemporary architectures. Side channels in cloud are a real-thing and thus limit some of the use cases depending on threat model.

To mount a successful side-channel attack in production, an external attacker has to overcome additional obstacles such as activity on shared hardware resources, interrupts, context switches, and coarse-grained timers. Our research uncovered a limitation in the implementation of DyPrIs and we managed to demonstrate a remote Spectre attack reliably leaking up to 12 bit/s with a 99% accuracy in the production environment of Cloudflare Workers.

https://blog.cloudflare.com/revisiting-spectre-attacks-on-workers/

Kanzashi

Andrea Barisani brings foundations to low-level AI enabled research

This repository experiments with bare metal Go, as supported by TamaGo, to perform LLM-driven security vulnerability analysis on low-level architectural layers minimizing OS interference.

The TamaGo framework allows trivial integration of LLM libraries on bare metal to achieve the following:

• dramatically reduced driver footprint, no OS presence

• ability to import and run pure Go libraries

• ability to bridge register/MSR read/write tooling with an LLM agent

https://github.com/abarisani/kanzashi

ZhiShi — Security Research Harness

From China - finding real vulnerabilities with AI - including for awareness.

On the way

• Seven vulnerabilities are in Microsoft’s review process

• White-box audits uncovered over 200 vulnerabilities, some of which are currently being reported as CVEs.

Browser vulnerabilities

• Analysis and reproduction of multiple Chrome/Firefox vulnerabilities

https://github.com/LielingAi/ZhiShi

OpenVuln

Yuxuan Zhang and Clouditera offer this service from China..

Submit a public repository and OpenVuln hunts its vulnerabilities. Protect your open-source repository, together with GLM.

https://huggingface.co/spaces/zai-org/OpenVuln

smiiiiiiiiiiiiiiii

Chris Domas exploits showing what happened when you’ve worked for a CPU manufacturer for a very long time you know where likely architectural bodies are buried.

Exploiting System Management Mode with a very very very very very very very long interrupt.

https://github.com/xoreaxeaxeax/smiiiiiiiiiiiiiiii

LoongLeak

Lorenz Hetterich, Tristan Hornetz, Fabian Thomas and Michael Schwarz side channel on RISC-V.

LoongLeak is a vulnerability affecting the Loongson 3A5000 and 3A6000 CPUs. LoongLeak allows unprivileged attackers to leak data from the L1 data cache, including data from other processes or the operating system.

..

Loongson is a CPU manufacturer that produces high-performance CPUs primarily targeting the Chinese domestic market, including government and administrative sectors. These CPUs use a custom instruction set called LoongArch™. The latest high-performance Loongson CPUs use the 64-bit variant of LoongArch named LA64.

https://loongleakattack.com/

Offense

Attack capability, techniques and trade-craft.

BOFScale: A CDN-Fronted Tailnet from a BOF-PE

Ceri Coburn delivers an in memory capability which detection engineering teams will want to be across.

Running Tailscale as a network layer for C2 traffic is not a new idea. What makes this implementation different is that the entire Tailscale daemon runs inside the implant process with no driver, no service, no disk state, and no child processes. Traffic relays over standard WebSockets that are indistinguishable at the edge from a browser opening a WebSocket connection, which means both the DERP relay servers and the control plane can sit behind CloudFront or Fastly without any special handling.

This post covers three tools that work together to make this possible. The first is tailscaled, a modified Tailscale daemon compiled as a BOF-PE that runs as an async background job inside the implant. The second is tailscale, a lightweight C++ BOF-PE that acts as the operator-facing client, letting you bring the node up, check its status, advertise routes, and shut it down. The third is socksportfwd, which bridges the gap that exists in userspace networking mode by forwarding local ports through the SOCKS5 server that tailscaled exposes, routing traffic to any node on the tailnet.

https://www.netspi.com/blog/technical-blog/red-teaming/bofscale-a-cdn-fronted-tailnet-from-a-bof-pe/

BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive

Jiří Vinopal highlights a capability we should expect Microsoft to address - even if they have indicated it won’t be in the short term. Detection engineering teams will want to be across this in the short term.

Furthermore, we demonstrate how BTR_CLI can be used as an EDR/AV bypass technique, disarming security solutions while using a trusted Windows built-in, Microsoft-signed driver, thus not relying on typical BYOVD techniques.

https://research.checkpoint.com/2026/btr-reforged-weaponizing-defenders-remediation-driver-as-a-kernel-operation-primitive/

Vipere

P'tit Snake delivers a capability which detectio engineers will want to ensure coverage of in their developer environments.

BOF exploiting the Visual Studio Installer Elevation Service for SYSTEM LPE and persistence via AppDomainManager hijacking, with native ETW evasion. For Cobalt Strike & Adaptix.

https://github.com/0xaled/Vipere

BusyWork

PatchRequest delivers a capability which it will be interesting to see what the data science deities make of it in terms of efficacy. Statistics hooooo.

A Rust library that replaces sleep() with real, varied work to evade behavioral pattern matching by EDR, anti-cheat, and dynamic analysis systems.

Every call executes a completely different code path — random category, random task, random iteration counts. No two calls produce the same syscall sequence, instruction trace, or API call pattern

https://github.com/PatchRequest/BusyWork

MS-Nightmare Un-defend v2 — What Happens When Signatures Can’t Land

MS-Nightmare shows how to block EDR updates and thus ensuring tradecraft to detect these techniques is the imperative.

Every antivirus and EDR product depends on freshness. It is only as effective as its most recent signature update. Vendors invest heavily in protecting that pipeline — the update service, its driver, its file layout, and its networking — because once the pipeline stops, the sensor quietly goes stale while still appearing healthy.

We asked a simple question: can a user-mode process halt the update pipeline of a major AV or EDR product without kernel code, without changing services, and without special administrative tricks beyond a normal run?

The short answer is **yes**. The method uses Windows file-handle semantics, a byte-range lock, and one watch thread per directory. This document explains how the update machinery works, where its weak points are, and why the technique succeeds. It is published so defenders can understand the failure mode, test it, and mitigate it.

https://weedhashpeddler.medium.com/every-antivirus-and-edr-product-depends-on-freshness-28b0fa9c810d

Turning Chrome Remote Desktop into Pure Red Team Ops

Smukx details how it is done - detection tradecraft is the name of the game..

This post, we are going to explore how we can take a popular Google product, Chrome Remote Desktop (CRD), and look at it from a red team perspective, turning its existing features into red team tool, almost like a spyware-kinda scenario.

https://zerotracelab.com/blog/chrome-remote-desktop-red-ops

Bring Your Own EDR: How to Turn a Commercial EDR into a Trojan Horse

Shahak Morag leverages security products to provide surrogate homes for malicious capability. Detection again is the name of the [WHAT]?

• Legitimate SentinelOne installers and accessible COM interfaces can be abused to bypass Protected Process Light (PPL) protections and execute unsigned code — completely bypassing the need for kernel vulnerabilities or traditional exploits.

• Management communications rely on user-configurable mechanisms like local DNS lookups, which allow an administrator to easily isolate the agent and block remote telemetry.

• Built-in self-defense mechanisms can be inverted against the host system, rendering files inaccessible and processes untouchable.

• Trusted endpoint detection and response (EDR) software can become a high-impact Trojan horse when local privilege escalation vectors and local trust assumptions are not properly hardened.

https://www.akamai.com/blog/security-research/bring-your-own-edr-turn-commercial-edr-trojan-horse

Chaining Trusted Windows Components into a Process-Tampering Primitive

Angelo Frasca Caccia shows how to degrade detection capabilities with this release..

SgrmFault is a Windows process-tampering exploit chain that combines a revived COM-based code-injection technique in WerFaultSecure.exe with an APC-based process-tampering primitive exposed by Microsoft’s SgrmAgent.sys driver.

https://github.com/lem0nSec/SgrmFault

Exploitation

What is being exploited..

Operation CameraSwarm: Over 14,000 Dahua cameras compromised across Ukraine and Russia

Hunt.io detail global exploitation of these CCTV camera which is noteworthy for the type of device and scale..

Between 17 June and 22 July 2026, a single operator compromised over 14,000 Dahua IP cameras. The scanning behind it was global: masscan sweeps ran against Russian address space first, then across the full IPv4 range, and the largest single haul actually landed in Mexican and Vietnamese ISP ranges before the operator's focus settled on Russian and CIS telecom netblocks. Where the confirmed, geolocated compromises concentrated was Ukraine and Russia, with Ukraine holding the largest share.

https://hunt.io/blog/operation-cameraswarm-dahua-cameras-compromised

Actively exploited vulnerability in Zimbra Collaboration Suite

The CERT Polska team informs about an actively exploited OS Command Injection vulnerability in Zimbra Collaboration Suite.

The vulnerability, identified as CVE-2026-73570 , allows an unauthenticated attacker to execute arbitrary shell commands with the privileges of the zimbra user . The vulnerability affects instances that have the SNMP trap service enabled via the snmp_notify parameter and the swatchdog service running (enabled by default).

https://moje.cert.pl/komunikaty/2026/145/aktywnie-wykorzystywana-podatnosc-w-zimbra-collaboration-suite/#

Tooling and Techniques

Low level tooling and techniques for attack and defence researchers

Windows Internals: Check Your Privilege - The Curious Case of ETW’s SecurityTrace Flag

Connor McGarr details this flag and its impact..

Recently, while investigating new feature development for our Origin (by Prelude) Runtime Memory Protection research preview product, we were forced to dig into the inner-workings of Event Tracing for Windows (ETW). In the course of leveraging our internal ETW tooling, which executes at a signing and protection level of Antimalware Protected Process Light (PPL), we noticed that it was possible to issue a “stop trace” code to a target ETW session that had an undocumented “security trace” flag enabled

https://connormcgarr.github.io/securitytrace-etw-ppl/

Windows Kernel Trace MOF

John U publishes a Trace Managed Object Format (MOF) File - a text file used by classic Event Tracing for Windows (ETW) and WMI providers.

I updated my ETW classic provider MOF recovery to include EventTypeName and Description.

These were in an adjacent ms_409 (en-US) locale namespace.

The recovered Windows Kernel Trace MOF now looks like this

gist.github.com/jdu2600/a2b03e4e9cf19282a41ad766388c9856

CipherRun

Marc Rivero López developed this tooling which will have a variety of use cases.

CipherRun is a comprehensive TLS/SSL security scanner written in Rust. It combines protocol and cipher analysis, vulnerability testing, compliance checks, and certificate transparency monitoring in a single high-performance CLI and API-ready engine.

https://github.com/seifreed/CipherRun

windbg-bridge

Kevin Gosse releases this work aid.

windbg-bridge connects a live WinDbg session to AI agents like Claude Code or Codex through a named pipe. The agent can run debugger commands, read your command history, and watch output in real time. Everything it does shows up in the WinDbg UI, so you always see exactly what's happening.

https://github.com/kevingosse/windbg-bridge

Reverse engineering Malwarebytes Browser Guard

Milton Cardoso reverse engineers and documents.

Static analysis of Browser Guard 3.1.5 (15M+ installs): Zstd-encoded on-disk databases, the heuristic rule engine that scans the live DOM, the Hubble false-positive service, the package update protocol, and a debug URL interface left in production. With reimplementations in C# and Python.

https://msil.re/posts/reversing-malwarebytes-browser-guard.html

Reverse-engineering Find My People

Zerotistic unpicks and details.

How I registered a Linux machine with Apple's private services, received an existing Find My People key over IDS, and decrypted the live location without a Mac.

https://zerotistic.blog/posts/find-my-people-linux/

CUDA Agent: Large-Scale Agentic RL for High-Performance CUDA Kernel Generation

Weinan Dai, Hanlin Wu, Qiying Yu, Huan-ang Gao, Jiahao Li, Chengquan Jiang, Weiqiang Lou, Yufan Song, Hongli Yu, Jiaze Chen, Wei-Ying Ma, Ya-Qin Zhang, Jingjing Liu, Mingxuan Wang, Xin Liu and Hao Zhou publish.

CUDA Agent achieves state-of-the-art results on KernelBench, delivering 100%, 100%, and 92% faster rate over Torch.compile on KernelBench Level-1, Level-2, and Level-3 splits, outperforming the strongest proprietary models such as Claude Opus 4.5 and Gemini 3 Pro by about 40% on the hardest Level-3 setting.

https://arxiv.org/abs/2602.24286v1

Technical Analysis of the Geedge Networks Firewall Source Code Leak

Anna Ablove , Johnnie Walker , Ben Wolin , Niklas Niere , Felix Lange , Aaron Ortwein , Armin Huremagic , Richa Priyanka , Ali Zohaib , Jade Sheffey , Nico Heitmann , J. Alex Halderman , Juraj Somorovsky , Amir Houmansadr , Roya Ensafi , Mingshi Wu and Eric Wustrow publish

In September 2025, over 100K internal documents (including code, communications, etc.) from Geedge Networks, a Chinese DPI company with ties to the Great Firewall of China, were leaked to the public. In this paper, we analyze the source code from this leak, focusing on Geedge Networks’ flagship product, the Tiangou Secure Gateway (TSG) firewall. Working across multiple repositories, we successfully build and run a local copy of TSG—revealing key aspects of its architecture, including the protocols it is capable of parsing and the format of blocking rules used to censor sites, proxies, and other resources. Finally, we extract several fingerprints from TSG, including custom random number generators and parsing idiosyncrasies that allow us to identify its use and similar deployments in the Great Firewall of China.

https://www.usenix.org/system/files/usenixsecurity26-ablove.pdf

Footnotes

Some other small (and not so small) bits and bobs which might be of interest.

• Annual, quarterly and monthly reports

  • Nothing overly of note this week, but keep an eye on the Awesome Annual Security Reports 2026 collection and APT report collection

• A long division story

• Quantum Algorithm Does Not Solve DCP

• Artificial intelligence

  • if you are a big arxiv.org user - out of China there is alphaxiv.org which is an AI powered incarnation / overlay

  • Fundamental

    • Small-Scale Experiments: Are We There Yet? - By ablating the basic scaling law recipe, we show well-tuned hyperparameters matter more than any other ingredient. Further, we reveal why those hyperparameters become easier to find: as scale increases, the hyperparameter loss surface becomes lower dimensional. Nevertheless while scaling laws exist in small models, extrapolation hits statistical limitations.

    • Intern-S2-Mobius: Foundation Model with Decoupled Knowledge and Reasoning

    • HiFi-UMI: Learning Deployable Manipulation Policies from High-Fidelity UMI Data Alone

    • Full-bandwidth transformer

    • Model Discovery Agent: LLM-assisted Bayesian experiment design for data-efficient discovery of mechanistic world models

    • Data Pyramid for Embodied Manipulation - “For embodied brain models, vision-language-action models, and world-action models alike, we relate data composition to capabilities in perception, reasoning, planning, action generation, and world prediction.”

    • EchoCoT: Extracting Hidden Chain-of-Thought from Large Reasoning Models

  • Applied non-cyber

    • The Fabricated Front: Generative AI and the Opacity of Workplace Performance

    • One Gate Is Not Enough: Composing Stateful Pre-Action Controls for Agentic AI

    • Why Does CLAUDE.md Keep Growing? Catastrophic Remembering in Agentic Coding

    • DeepSeek Harness - DeepSeek Harness (dsh) is an open-source agent harness developed by DeepSeek AI. It uses an architecture where everything is a plugin, and is powered by Cordis,

    • CUDA Agent: Large-Scale Agentic RL for High-Performance CUDA Kernel Generation

    • Reviving Old Unsupported Devices with AI – AVerMedia Game Capture HD II

    • The TEVV-Athlon Framework for Evaluating AI Systems

    • BreakGuard: Towards Detecting Dependency Breaking Changes with LLM-Generated Tests

    • Fair ASR: Re-Evaluating Black-Box Jailbreaks under Shared Target-Call Budgets

    • Proof-of-Execution Memory: Defending LLM Agents Against Forged-Reasoning Attacks by Verifying What Actually Happened

    • Benchmarking Identity-Sensitive LLM Outputs for Surveillance and Security Robots

    • Breaking and Defending LLM-Powered Social Media Bot Detection Systems

  • Applied cyber specific

    • COMA: A Compositional Misleading Attack Class on Security-RAG, and a Causal Counterfactual Defense

    • Securing AI-Generated Code: A Just-in-Time Vulnerability Detection and Remediation Pipeline

    • MaliciousSkillBench: A Comprehensive Benchmark for Malicious Agent Skill Detection

    • Improving LLM-Based SSH Honeypots Through Prompting and Fine-Tuning

    • CTIFoundry: An Agent-Native Corpus Scaffold for Cyber Threat Intelligence

    • Benchmarking Automated Security Patch Backporting: How Far Are We?

    • Incident-Data Robustness Analysis of the OWASP Top 10 for LLM Applications (2026): How a Community-Expert Ranking Holds Up Against a Large-Scale LLM Incident Corpus

    • Topological Attribution Distance (TAD): Revealing Segment-Level RAG Influence on LLM Output Geometry for Incident Log Analysis

    • OpenVuln Open source audited by GLM

    • Security Assessment of DeepSeek Harness with A.I.G: Evaluating Resistance to Indirect Prompt Injection

    • GenAI Security — The Comprehensive Guide

    • Measuring coding agent misalignment in the wild

    • Probing the Prefill: Detecting Code Vulnerabilities via Latent Activations

    • LLMs for Zero-Shot Threat Detection via Structured Risk Indicators

    • WeSCE: A Benchmark for Measuring Security Drift in LLM-Driven Code Editing

• Books

  • Valley of Death - out in September

• Events

  • WOOT ‘26 Technical Sessions

  • Critical Information Infrastructures Security papers - “20th International Conference, CRITIS 2025, Jönköping, Sweden, October 21–23, 2025, Revised Selected Papers”

    • Human and Organizational Factors in Smart Grid Cybersecurity

  • INTERCEPT — Builders & Breakers of Agentic Runtime Security - February 2027, San Francisco

  • CHERITech'26 Call for Papers - November 2026, Munich, DE @ SEMICON Europa

Finally finally the NCSC’s podcast series.

Unless stated otherwise, linked or referenced content does not necessarily represent the views of the NCSC and reference to third parties or content on their websites should not be taken as endorsement of any kind by the NCSC. The NCSC has no control over the content of third party websites and consequently accepts no responsibility for your use of them.

This newsletter is subject to the NCSC website terms and conditions which can be found at https://www.ncsc.gov.uk/section/about-this-website/terms-and-conditions and you can find out more about how will treat your personal information in our privacy notice at https://www.ncsc.gov.uk/section/about-this-website/privacy-statement.

Operationally this week nothing overly of note.

In the high-level this week:

• Water sector example added to the NCSC’s Secure connectivity principles - NCSC UK adds - “The NCSC has published a new fictional worked example demonstrating how organisations can apply the Secure Connectivity Principles for Operational Technology (OT). The example explores how a regional water utility might approach the challenge of standardising digital connectivity across its OT environment while maintaining safety, reliability and cyber resilience.”

• How BitLocker PINs help protect your data and devices - NCSC UK outlines - “However, many organisations use BitLocker without a PIN, leaving their devices vulnerable. In this blog we explain why a PIN is so important, and what to do if – for whatever reason – you can’t use a PIN.”

• Parliamentary Under-Secretary of State (Minister for Space, Cyber and Regulatory Reform) - Department for Business, Innovation, Science and Trade and Department for Digital, Culture, Media and Sport announce - “Baroness Lloyd of Effra CBE was appointed Parliamentary Under-Secretary of State (Minister for Space, Cyber and Regulatory Reform) jointly in the Department for Digital, Culture, Media and Sport (DCMS) on 23 July 2026 and the Department for Business, Innovation, Science and Trade (BIST) on 22 July 2026.”

• Ex-MI6 chief says the biggest risks for CEOs are the threats they already know about - Fortune interviews - “He argues that the biggest risk for companies today isn’t some black swan event that we didn’t see coming. It’s managing systemic risk from cumulative impact of known issues: the layering of COVID-19 plus Ukraine, Iran, China stress, tariffs, and more.”

• Expanding Capabilities to Combat Transnational Cyber-Enabled Crime - The White House (not me) announces - “This memorandum expands the fight against TCO-perpetrated cybercrime by incorporating the ingenuity of the private sector.”

  • Private Sector Cybercrime Disruption: Compatible with Statecraft? - RUSI think tanks - “Arguably, there is a need to do more to make the UK a more hostile target, albeit in a context of constrained public resources. One approach could be through public-private partnerships that leverage the private sector’s capacity to build intelligence on criminal adversaries and, in limited contexts, disrupt their activities.”

• Water Cyber Shield Act of 2026 - Senator Schiff introduces - “The Water Cyber Shield Act of 2026 is comprehensive legislation to reform how EPA addresses the vulnerability of water and wastewater systems to cyberattack. Through amendments to the Safe Drinking Water Act and the Clean Water Act, this bill empowers EPA with the authorities it needs as the Sector Risk Management Agency for the water and wastewater sector—a job EPA is statutorily tasked with but lacks the necessary authorities to carry out.”

• Germany warns of daily ‘hybrid warfare’ after suspected drone attack - Reuters reports - "We're not at war, but we are the ​daily target of hybrid warfare," Dobrindt said. "Espionage, sabotage, cyberattacks, or covert operations by ⁠foreign powers aimed at destabilising Germany or inflicting direct harm are a constant reality."

• Turkey gives presidential cybersecurity agency power to order internet measures before court review - Stockholm Centre for Freedom outlines - “Turkey has given a cybersecurity agency reporting directly to the presidency power to order internet and communications companies to carry out emergency measures before a judge reviews them, as part of a broader transfer of online regulatory powers from the country’s telecommunications watchdog, the TR724 news website reported.”

• Discussion on Full-Lifecycle Ransomware Response Measures: “Beyond Prevention to Response and Recovery” - Korea Internet & Security Agency announces - “The Korea Internet & Security Agency (KISA, President Lee Sang-joong) announced on August 12, 2026 (Wednesday) that it will hold the "5th Ransomware Resilience Conference" in collaboration with the Ministry of Science and ICT (Deputy Prime Minister and Minister Bae Kyung-hoon) on September 16 (Wednesday) at the Peace & Park Convention Center in Yongsan-gu, Seoul. The conference will share the latest trends, response technologies, and policies regarding ransomware and discuss measures to strengthen cyber resilience.”

• Raise the Cyber Waterline - The Defense Analyses and Research Corporation (DARC) think tanks - “The debate over the risks of AI-enabled cyberattacks has remained academic for far too long. Now, time is short: Our adversaries will soon have access to models that can launch attacks at scale against unwitting defenders. America’s cyberdefense strategy has relied for too long on individual action, without reckoning with the harms caused to citizens by cyberattacks. The time to act to close this defensive gap is now, while we retain a substantial advantage in model capability.”

• Reporting on/from China

  • China-linked hackers hit Taiwan in unprecedented ‘autonomous’ AI cyber attack - Financial Times reports - “Suspected Chinese hackers used publicly available AI tools to compromise government websites in Taiwan in a first-of-a-kind breach, highlighting how artificial intelligence is transforming cyber warfare.” - comment: not sure this first-of-a-kind …

    • Taiwan says it was targeted last month in AI-driven hacking campaign - Reuters reports - “The investigation ​results showed the attacks displayed clear characteristics of an "overseas source", with hackers employing a hybrid approach that combined manual operations with AI agent-assisted attacks, such as Open Claw, it said.”

  • Cutting-edge technologies in encrypted network security (2026) - Journal of Electronics publishes - “However, current defense systems still face the dual pressures of dynamic escalation of adversarial capabilities and computational bottlenecks: attackers use protocol-based concealment and adversarial feature drift to dismantle static models; 100Gbps backbone networks require millisecond-level response times, but the latency of traffic feature representation and deep learning model inference creates a rigid contradiction of "high precision requirements - low resource capacity." To accelerate the seamless integration of technological breakthroughs and scenario implementation, the *Journal of Electronics* has established a special column, "Frontier Technologies for Dense-State Network Security."“

  • Soliciting Public Comments on the Draft Regulations on the Protection of Personal Information by Large-Scale Personal Information Processors - Cyberspace Administration of China consults - “To regulate the personal information processing activities of large-scale personal information processors, protect the legitimate rights and interests of personal information, and promote the lawful and reasonable use of personal information, in accordance with the "Personal Information Protection Law of the People's Republic of China," the "Regulations on the Administration of Network Data Security," and other laws and administrative regulations, the Cyberspace Administration of China has integrated and improved the previously publicly solicited drafts, namely the "Regulations on the Establishment of Personal Information Protection Supervisory Committees for Large-Scale Online Platforms (Draft for Public Comment)" and the "Regulations on Personal Information Protection for Large-Scale Online Platforms (Draft for Public Comment)," and has now formed the "Regulations on the Protection of Personal Information by Large-Scale Personal Information Processors (Draft for Public Comment)," which is now open for public comment.”

  • China deploys ‘robot employees’ in Beijing to patrol city parks, curb inappropriate behaviour - The Economic Times reports - “Beijing has deployed seventy-two robot employees in its municipal parks this summer. These robots perform cleaning, patrolling, and visitor guidance duties across the city. Intelligent tour-guide robots answer questions and remind visitors about park rules. Specialised robots also attract and trap mosquitoes, reducing insect density in selected areas. This initiative aligns with China’s national “Robot Plus” strategy for public services.”

• AI

  • Addressing AI-Enabled Cyber Risk: Establishing the AI Cybersecurity Clearinghouse - CISA outline - “Gold Eagle is a software capability that, at scale, enables ingestion, validation, and deduplication of AIenabled vulnerability reporting, amplifying CISA’s ability to triage incoming vulnerability reports for CVD within the VINCE platform. Gold Eagle simplifies the path from vulnerability discovery to remediation by streamlining initial report triage and validation for Coordinated Vulnerability Disclosure (CVD) and avoids duplication of efforts. Gold Eagle augments but does not replace existing private-sector or communitydriven vulnerability management efforts. Reports submitted through Gold Eagle that meet CVD requirements will initiate cases in VINCE”

  • AI agent hacks gym to get its user a spot in pilates class - BBC reports - “He says he outsourced the “chore” to an AI agent - a tool that can carry out online tasks autonomously…. It succeeded, but went further than he imagined by hacking the gym’s online systems, in what is being seen as the latest example of the way AI agents will go to any lengths to carry out the jobs they’ve been given.“ - comment: this actually happened in April, the company blogged about it, the blog now appears deleted. What the agent found was the API endpoint had no security - there are many non AI tools which would find similar.

  • GLM-5.3: Frontier Coding with Emergent Cyber Capabilities - Z.ai announce - “As we scaled post-training, cyber capability developed faster than we expected. GLM-5.3 is state of the art on CyberGym for vulnerability discovery, and its gains are largest further up the exploitation chain, where it more than doubles GLM-5.2 on exploitation benchmarks.”

    • Zhipu launches flagship model GLM-5.3 as China seeks Mythos-level edge in cyber defence - South China Morning Post reports - “Beijing-based Zhipu said GLM-5.3 achieved a success rate of 84.5 per cent on CyberGym, a benchmark that measures whether models can identify and validate security flaws from source code. That was above Anthropic’s Mythos at 83.8 per cent and OpenAI’s GPT-5.6 Sol at 83.6 per cent, according to Zhipu. However, the Chinese model did not match those foreign systems on ExploitBench, which gauges how far AI models climb the exploitation ladder. Its score of 54.4 per cent trailed Mythos’ 78 per cent and GPT-5.6 Sol’s 76.5 per cent.

  • Shaping the NVD for the Future: We Need Your Feedback on AI-Enabled Vulnerability Management - NIST consults - “As the volume of reported vulnerabilities surges and emerging technologies reshape the threat picture, it is time for traditional vulnerability management practices centered on periodic patching and manual remediation to be transformed toward continuous, automated, and contextual vulnerability management.”

  • AI-generated vulnerability patches require human review - 1Password quantify - “Across six recently-disclosed CVEs, we produced 6,080 patches using two frontier, cyber-capable reasoning models. The average success rate for generating a patch that fully resolved the vulnerability (without materially changing application behavior) was just 26.0%.“ - comment: ~4.5% introduced new vulnerabilities!

  • Can AI do novel security research? Meet the HTTP Terminator - James Kettle demonstrates - “We all know AI can find bugs. After a decade of research, I asked a harder question: can an autonomous system invent new attack techniques, and use them to hack live websites at scale? Building this sounded like a bad idea, so I did it.” .. “I'll also share discoveries from beyond the autonomy horizon - some only reachable with a tight human/AI research loop, and others beyond AI's reach entirely.” - comment: novelty comes in part from where techniques are applied and derivates discovered

  • Security Research in the AI ​​Era - Victor V outlines the journey of a vulnerability researcher being disrupted - “What does the future hold? I don't know. AI may become increasingly powerful, and software products from vendors may have fewer and fewer problems, leaving less and less room for vulnerability researchers, but this remains an unknown”

  • CyberKimi × ExploitBench — Results & Evidence - Taha Karim publishes - “three-way experiment on the bench's hardest WASM bug: CyberKimi unassisted 8/16 vs stock Kimi K3 4/16 vs CyberKimi + disclosed methodology pack 10/16. Includes the full leaderboard chart (only Mythos 16/15 and GPT 5.5-Codex-AutoNudge 15.0 sit above the pack-assisted run), the capability-by-capability story, and the road to Mythos.”

  • Cyberwarfare in the AI Age - Foreign Affairs podcasts - “Jen Easterly has spent much of the past 20 years defending U.S. cyberspace against such threats. She has been both a military officer and a top civilian official, most recently running the Cybersecurity and Infrastructure Security Agency. Now, she warns, the danger is about to get much worse”

  • Agentic profiles for effective AI governance - Google DeepMind publish in nature - “The creation of effective governance mechanisms for artificial intelligence (AI) agents requires a deeper understanding of their core properties and the implications they have for deployment. This paper provides a characterization of AI agents that focuses on four dimensions: autonomy, efficacy, goal complexity and generality. We propose different gradations for each dimension and argue that each dimension raises unique questions about the design, operation and governance of these systems. Moreover, we draw on this framework to construct ‘agentic profiles’ for different kinds of AI agent. These profiles help to illuminate cross-cutting technical and non-technical governance challenges posed by different classes of AI agents, ranging from narrow task-specific assistants to highly autonomous general-purpose systems.”

  • To Nuke or Not to Nuke: LLMs’ (Missing) Ethical Reasoning and Actions in a High-Stakes Decision-Making Simulation - University of Florida researches - “Across 130 high-tension Civilization V episodes replayed by 13 models under three factorial prompt interventions, no intervention or factorial combination reliably eliminates emergent escalation.” - comment: we’ve seen this movie - War Games

  • US AI leaders turn to Chinese open-weight models, challenging closed-source safety claims - South China Morning Post claims - “More American titans of artificial intelligence are describing Chinese open-weight models as better for AI safety and security than closed-source models, challenging the long-standing claim by US closed-source AI model developers such as Anthropic that open-source models present a threat to society. “From what I’m seeing, I think open-weight models seem safer to me than closed-weight models,” AI pioneer Andrew Ng, the former head of Google Brain and former chief scientist at Baidu, said at the Agentic AI Summit in Berkeley, California, on Saturday.”

  • Voltcraft: Industrial Competition in the Age of AI - The American Enterprise Institute think tanks - “Resource availability has long shaped the ability of states to project power, from seabird guano in the 19th century to coal deposits in the 20th. In the age of AI, states need large numbers of devices capable of turning electricity into tokens to reap AI’s strategic and economic rewards. This is why the physical production and custody of computational power—compute—has become an essential element of national strategy and geopolitics.”

  • America’s Cosmic Bet on AI - The winner takes it all. What happens if the United States loses? - Foreign Policy asks - “Confronting this blizzard of claims and counterclaims about a bedazzling technology, four questions demand our attention. First, is the course that the United States has chosen prudent? Another way to think about this is, would a financial investor with fiduciary responsibility place this large a bet on a single sector? Second, what could go wrong? Could the eye-popping increases in investment and stock prices be another bubble—analogous to the financial wizardry that created the real-estate bubble that burst in the Great Recession of 2008 or the dot-com bubble in 2000? Third, why is the only other AI superpower—China—making such a radically different bet? And finally, if the miracle is delayed or never happens, what will the likely consequences be—not just for the U.S. economy but also for national security?”

  • Connecticut Court Sanctions Self-Represented Litigant over Prompt Injection in a Court Filing - Law News reports - “A Connecticut Superior Court judge has imposed sanctions for prompt injection in a court filing, ruling that a self-represented plaintiff in Elliott v. New York Bariatric Group, LLC (docket AAN-CV-25-6066141-S) hid machine-readable instructions inside multiple pleadings in an attempt to manipulate any artificial-intelligence tool reviewing the documents.”

• Cyber proliferation

  • Apple sends new ‘Threat Notification’ alerts over mercenary spyware attacks - Bleeping Computer reports - “Apple confirmed to BleepingComputer that it sent a new batch of threat notifications on August 13 to targeted users in 110 countries.”

• Bounty Hunting

  • Bybit Sues North Korea and Lazarus Group, Secures Preliminary Injunction Freezing Stolen Assets in Landmark Crypto Asset Recovery Effort - Bybit litigates - “announced that it has filed a civil lawsuit in the U.S. District Court for the District of Columbia against the Democratic People's Republic of Korea (DPRK), its Reconnaissance General Bureau (RGB), and the Lazarus Group, which U.S. authorities have identified as the DPRK-linked hacking group responsible for the February 2025 cyberattack.”

  • North Carolina Man Sentenced for Cyber Extortion Scheme that Targeted International Technology Company in D.C. - US Department of Justice announces - “According to filed documents, trial evidence, and witness testimony, Curry was contracted to work as a data analyst for approximately six months with the victim company. In that capacity, Curry had access to the victim company’s data files and other personnel and corporate information. Trial evidence established that Curry misused his position to access the victim company’s personnel and other sensitive corporate records, which he then used to carry out the cyber extortion scheme. Curry hatched his extortion scheme after he learned that his contract was not going to be renewed and that he would no longer be employed by the company.”

  • FBI investigating North Korean remote IT staffer working for US agency - Federal News Network reports - “The FBI is investigating how an unidentified federal agency was recently swept up in a yearslong campaign involving North Korean remote IT workers fraudulently obtaining jobs at major companies and other organizations.”

  • Young Portuguese self-taught entrepreneur created a version of ChatGPT that was used for crimes. FBI alerted PJ (Portuguese Judicial Police) - Publico reports - “He started hacking when he was only ten years old and created a program similar to ChatGPT that aided in committing crimes. Honesty and cooperation with the police should help in the trial.”

• Market Incentives

  • ACRO reprimanded following cyber security failings - UK Information Commissioner’s Office reprimands - “The ICO found ACRO had engaged third-party providers to deliver certain security services, including patch management. However, ACRO did not ensure clear responsibility for identifying and monitoring critical CMS security updates, failed to maintain an effective patch management process, and did not adequately investigate security alerts that could have identified the hacker’s activity earlier.”

  • The End of “As-Is”: Could AI Undermine Software’s U.S. Legal Shield? - Center for Strategic & International Studies think thanks - “Software occupies a privileged legal space that no other consumer product enjoys. A lamp that catches fire, a car with a defective airbag, or a harness that snaps under normal use all fall under strict product liability, a body of tort law that holds manufacturers responsible for defects regardless of fault. Software largely escaped that fate. Courts and legislators treat software as a licensed service rather than a product, letting it hide behind contract law instead. That exceptional treatment was a deliberate policy choice, and it is built on three core justifications that AI now undermines entirely”

  • Apple Faces Lawsuit Over iCloud Private Relay Vulnerability - CNET reports - “Last week, a blog post by Talal Haj Bakry and Tommy Mysk exposed a vulnerability in how iCloud Private Relay, in some circumstances, doesn’t shield a customer’s IP address, which is the entire purpose of the feature. Even when it’s enabled, their information can be exposed when using a passkey to sign in or when a website uses two methods (DNS prefetching and WebTransport) to load data faster.”

  • Goodwin Procter Paid around $10 million ransom Luna Month - The Insurer reports.

  • PPP lawmaker tells U.S. House Coupang data breach action was not discriminatory - Korea JooAng Daily reports - ““The letters were prepared to deliver accurate facts based on the official findings and regulatory actions of the Personal Information Protection Commission [PIPC] in response to claims raised by some U.S. lawmakers that the Korean government has unfairly targeted Coupang,” his office said in a press release."

Reflections this week are around the reality of the forced correction that all organisations are experiencing in cyber security as a result of scaled vulnerability discovery in the AI era and response required.

Firstly, it is important to point our that we have had other forced corrections. Arguably ransomware was a human driven, scaling through affiliates and playbooks, forced correction of technical and operational debt in organisations.

Secondly, when we consider the AI era there are a number of fundamentals to consider when thinking about what is required to achieve cyber resilience in practice.

• #1 - We aren’t going to solely patch our way to resilience in the AI era - noting we are in the midst of the patch wave and they should still be deployed.

  • Expecting to run faster than AI adversaries by solely relying on patching for in perpetuity seems on the face of it challenging as a strategy

• #2 - Well run and effective operations are fundamental e.g.

  • Comprehensive IT operations i.e. comprehensive asset management

  • Active technical debt management and paydown a key enabler

  • Cyber resilience through observability and threat hunting

• #3 - Architectures and other primitives are crucial e.g. (there are others).

  • Memory safety technologies to mitigate memory corruption

  • Privileged access workstations (PAWs)

  • Cross-domain approach and architecture

  • Phishing resistant authentication such as Passkeys

• #4 - Machine speed coupled with dynamic and resilient operations the measure

  • Demonstrated recoverability

  • Dynamic response to a changing environment

  • Ability to execute quickly and comprehensively

Heather Adkins at Google did an excellent job in the last ten days at conveying the journey that software is going on with regards to its security and the likely impact AI will have and the future sunny uplands.

The nuance is the benefit of this wave is likely to not land evenly for every organisation. For example an organisation that is running on 10 to 15 year old technology is not going to benefit to the same extent as others.

This unevenness is why we say that AI will be a net benefit for cyber defence but the road between where we are and that end state is rocky and uneven.

There are no short cuts to pay down technical debt nor run effective resilient operations in practice - just planful execution.

Not getting this via email? Subscribe:

Subscribe now

Think someone else would benefit? Share:

Share

All attribution is by others and not the UK Government unless specifically stated as such, please see the legal text at the end.

Have a lovely Saturday…

Ollie

Cyber threat intelligence

Who is doing what to whom and how allegedly.

Reporting on Russia

Social engineering performed by UAC-0145: compromising in the employment process

CERT Ukraine detail this alleged Russian operation which is noteworthy due the overlap with some North Korean tradecraft.

CERT-UA has received information about the use of advanced social engineering methods by the cyber threat cluster UAC-0145 (subcluster UAC-0002, also known as Sandworm, APT44, Seashell Blizzard). In particular, on job search sites, attackers, having previously studied the candidate's resume, contact a potential victim, usually a system administrator/IT specialist, on behalf of an IT company (for example, ATLAS Business Group).

https://cert.gov.ua/article/6318863

Inside a Russian-Speaking Operator’s Toolkit for Compromising Ukrainian IP Cameras

Hunt.io disclose this alleged Russian operation which is noteworthy due to a focus on IP cameras.

• [We] archived an open directory on 89.208.97[.]165:8888, exposing the compromise of a Ukrainian e-commerce site via SQL injection, which the operator then reused as a proxy and launch point for further activity.

• The same server’s bash history records Tor-routed intrusion attempts against Ukrainian government and military sites, built with per-target credential lists, though the recovered files do not confirm whether any attempt succeeded.

• The same server hosted a Docker project named “camview” in its archive, used to scan, exploit, and maintain a list of internet-exposed cameras using known Dahua and Hikvision vulnerabilities.

• Recovered from the operator’s own directory: a catalog of 58 compromised Ukrainian cameras, a saved still from one of them, and a log of live viewing sessions with session lengths, frame counts, and frame rates recorded per stream, access the operator used, not exposure inferred from a scan.

• A publicly available scanning tool integrated into camview led to a second, separately operated directory on 213.165.63[.]49, building anonymization proxy infrastructure that scanned routers across 15 European countries, with camera targeting focused on Ukraine.

• The second operator’s toolkit relied on chaining multiple router and camera CVE’s using custom Python scripts with additional focus/targeting of servers in Odessa, Burshtyn, and Kherson.

• Both operations show similar patterns: use of an open-source scanner to easily find and compromise cameras within specific geographic areas, and reliance on historically weak security on edge devices and internet exposed infrastructure.

https://hunt.io/blog/russian-speaking-operator-ukrainian-camera-toolkit

Reporting on China

Jewelbug: APT Group Runs Espionage and Crypto Fraud Operations Side by Side

Symantec and Carbon Black detail an alleged overlap between Chinese espionage and criminal activities. The scale of the browser cookie theft is also noteworthy.

• Jewelbug is a China-based hackers-for-hire group that runs parallel operations: espionage against governments and militaries across the Middle East, Southeast Asia and South Asia, and a for-profit cryptocurrency fraud business.

• Both missions are administered from a single control panel, XG-Web, a browser-centric remote-access and information-stealing framework that turns a victim’s browser into a full remote-control channel and reaches from there into the host and the internal network behind it.

• At least one of the operators is tied to a registered Hunan company, and we have identified the sole legal representative by name from government-issued identity documents belonging to the operators.

• Jewelbug’s main implant is the Antino backdoor. It also operates a malicious Chrome and Firefox extension posing as an application called “PDF Viewer”, paired with a helper disguised as a Microsoft Edge component that gave operators a command shell on the host.

• In its largest operation, a single planted script placed a watering-hole on more than 15 government webmail tenants in a Middle Eastern country at once.

• Jewelbug’s victim database recorded more than one million implant check-ins and more than 580,000 stolen browser cookies in less than three months of active operations. One set of implants was configured to utilize the internal proxy of a major U.S. aerospace and industrial manufacturer

https://www.security.com/blog-post/jewelbug-crypto-fraud-espionage

PATCHCORD: New malware cluster targets Afghan telecom and South Asian critical infrastructure

Darrel Virtusio, Santiago Pontiroli and Subhajeet Singha detail an alleged Chinese operations against telecommunications. Noteworthy for the sectoral focus, regional focus as well as the capabilities and techniques employed.

[We have] identified an ongoing campaign delivering a previously undocumented custom backdoor against Afghan telecom providers and South Asian critical infrastructure organizations. The backdoor, tracked as PATCHCORD, is a compiled C/C++ implant delivered through sector-specific lures, including fake VPN installers impersonating Afghan Telecom (AFTEL) and telecom management tools. Infrastructure pivoting uncovered SHEETCORD, a Go-based implant that builds on PATCHCORD's capabilities while abusing Google Sheets for C2 communication. The malware was actively distributed through a domain impersonating India's National Informatics Centre (NIC).

https://www.acronis.com/en/tru/posts/patchcord-new-malware-cluster-targets-afghan-telecom-and-south-asian-critical-infrastructure/

Reporting on North Korea

Kimsuky Integrates AI into Attack Operations, From AI-Generated Decoy Documents to a Local LLM

Genians details the further integration of AI into alleged North Korean operations.

• Observed indications that the Kimsuky group built and operated local LLM environments using Ollama, GPT4All, and Msty.

• Assessed to be in the phase of accumulating technologies and capabilities to integrate AI across its overall attack operations.

• Identified indicators exhibiting North Korea-linked characteristics, such as “Arirang”, “싸이트”, “가입리력”, and “로출되였는지”.

• Continued targeted attacks against foreign diplomatic missions, as well as the military, security, and virtual asset sectors.

• Abused Git-based repositories as C2 infrastructure and distribution channels for encrypted AsyncRAT payloads.

• Highlighted the need to strengthen behavior-based EDR detection and threat hunting against the abuse of LNK files, PowerShell, and GitHub.

https://www.genians.co.kr/en/blog/threat_intelligence/kimsuky_ai_llm

Shattering the Dream – When a Job Offer Becomes a Zero-Day Attack

Check Point Research details an aspect of an alleged enduring North Korean operation which is noteworthy for the local privilege escalation vulnerability on Windows apparently exploited.

• [We are] tracking a long‑running campaign called Operation Dream Job, targeting organizations worldwide, with a particular focus on the defense sector. The campaign is affiliated to DPRK-linked Lazarus group and its latest wave focuses on the defense sector in Europe and India.

• In the latest variant of the Operation Dream Job campaign, the threat actor distributed SecurityPDF, a modified PDF viewer designed to open attacker-crafted PDF documents and execute a new backdoor which we named Troy.

• During the intrusion, the threat actor exploited CVE-2026-68820, a zero-day vulnerability in the Microsoft AFD.sys driver, to deploy a new version of FudModule, Lazarus’ kernel-mode rootkit. Following Check Point Research responsible disclosure, Microsoft released a patch as part of their August Patch Tuesday updates.

• Lazarus also used CVE-2025-49113 to exploit vulnerable Roundcube webmail servers. The compromised servers were infected with RelayShell, a PHP webshell that repurposes compromised web servers as relay nodes within the attacker’s command-and-control infrastructure.

• At least in one case, a compromised organization in Western Europe was leveraged to conduct a spear-phishing campaign, allowing the attackers to abuse the organization’s reputation and trust to target additional victims.

https://research.checkpoint.com/2026/shattering-the-dream-when-a-job-offer-becomes-a-zero-day-attack/

Smile, You’re on Camera. Part 2: Hiring Lazarus APT’s IT Workers in a Fake DeFi Startup

Any.run, BCA LTD and NorthScan push the boundaries with this alleged reverse Yahtzee and turn the tables on an alleged North Korean operation to study them

• Researchers created a fake DeFi startup and hired suspected Famous Chollima operatives, providing a rare inside view of a DPRK IT worker operation.

• The investigation followed the scheme beyond recruitment, showing how the operatives worked, collaborated, and accessed company resources after being hired.

• The findings show that DPRK IT worker schemes are not only a hiring risk. Once inside, operatives can gain legitimate access to code, systems, intellectual property, and trusted business processes.

https://any.run/cybersecurity-blog/lazarus-group-it-workers-investigation-part-two/

Reporting on Iran

Nothing overly of note this week

Reporting on Other Actors

Akira Hits Safe Mode: Ransomware Rebooting Around EDR

James Northey detail this tradecraft shift by a ransomware group to subvert security controls.

• After gaining access via an exposed SonicWall VPN, an Akira affiliate rebooted the victim host into Safe Mode with Networking to defeat EDR, a first for this ransomware variant in our telemetry.

• Safe Mode is a boot mode that only loads essential drivers and services, disabling most third-party software. As such, the reboot stopped the Huntress agent and disabled Microsoft Defender’s real-time protection; Defender couldn’t quarantine the file until the attacker rebooted back to normal mode. Ransomware families like Snatch and AvosLocker have abused Safe Mode for years, but this is the first reported tie to Akira that Huntress has observed.

• In this incident, Safe Mode also broke the ransomware. In its stripped-down memory environment, the Akira process tree hit an out-of-virtual-memory failure seconds after launching.

• While the anti-EDR effort backfired and the ransomware did not deploy, the attacker had already exfiltrated credentials and file shares. Even without encrypting anything, they can still extort the victim by threatening to leak the stolen information.

https://www.huntress.com/blog/akira-hits-safe-mode-ransomware-rebooting-around-edr

Dissecting the JWR phishing framework

Chetan Raghuprasad details a phishing framework which detection teams will want to develop tradecraft for.

• Cisco Talos recently identified an undocumented phishing framework, internally branded “JWR” by its developer, built to convincingly impersonate checkout and login pages across major payment and shopping platforms.

• The client engine of the JWR phishing framework is a real-time, operator-driven system that, rather than merely logging form submissions like a static credential-stealing page, keeps an AES-CTR encrypted WebSocket open to the threat actor so they can steer each victim’s session live.

• The victim data targeted by the actor using JWR extends well beyond payment data, encompassing identity documents, Social Security numbers, passport and driver’s license images, website and PayPal credentials, 2FA codes, and full device fingerprints, all committed to the actor’s server once a session ends.

• Talos assesses with medium confidence that the JWR phishing framework is a variant of “The Outsider,” a phishing-as-a-service (PhaaS) platform, based on several similarities in the client engine scripts and functionalities of the two PhaaS platforms.

• Talos observed a real-world campaign delivering the JWR client via SMS lures impersonating toll authorities, and postal and courier services of several countries in Southeast Asia and the Middle East.

https://blog.talosintelligence.com/dissecting-the-jwr-phishing-framework/

Software Supply Chain Incursions

A reminder we issued guidance a number of weeks ago in Software supply chain attacks: check your dependencies for software developers

• Six npm Packages Use Ethereum Transactions to Retrieve Malicious Payloads

• Deadbugz: Currently Active MCP Supply-Chain Campaign

• 2,500+ Companies and 434,000 CI/CD Pipelines Exposed in the Largest AI Supply Chain Breach of 2026

• The “City-Forum” Campaign - An advanced attacker is targeting Salesforce and ServiceNow instances worldwide

Discovery

How we find and understand the latent compromises within our environments.

Beyond the Userspace Call Stack: Kernel Subsystem Context for Detection Engineering

Nedim Šabić et al bring kernel context enrichment to call stack analysis..

Consider a conventional file operation. The userspace call stack can answer questions such as:

• Which process initiated the operation?

• Which modules (DLLs or executables) and functions were involved?

• Did the operation originate from an unusual execution path, like a floating memory region?

• Does the stack pattern resemble malicious or injected code?

The kernel side answers a different question: Which kernel subsystem actually serviced the operation? The userspace stack describes the path into the operating system, while the kernel stack describes the path through the operating system, and together, they provide a much richer behavioral picture.

https://fibratus.io/blog/kernel-call-stack-subsystem-context-detection-engineering

https://github.com/rabbitstack/fibratus

Do local LLMs dream of becoming forensic investigators?

S. Nakano shows the potential of generative model use in forensic investigations.

FORENSIA was created.

It automatically reads artifacts extracted from the surveyed equipment, generates and validates research hypotheses using local LLM, and continuously updates reports.

https://sumeshi.github.io/posts/works/do-localllms-dream-of-forensic-investigator

ATEN: Endpoint Telemetry for AI Coding Agents

Anton Ovrutsky provides an observability super power with this release..

Agent Telemetry & Event Notation. ATEN is a background service that records what AI coding agents — Claude Code and Codex today — do on a host, and writes it out as structured events for a SIEM. It’s the same idea as Sysmon, scoped to agent activity.

https://www.antonlovesdnb.com/blog/aten

https://github.com/Antonlovesdnb/aten

On IP Addresses as Identifiers of Internet Users and Services

Rumaisa Habib, Sudheesh Singanamalla, Marwan Fayed and Zakir Durumeric provide some insight in IP resolution fragility.

Using data collected from a global CDN, historical DNS records, and active DNS measurements, we investigate the extent to which IP addresses uniquely identify users and services on today’s Internet. We find that IP sharing has steadily increased over the past decade, with fewer than 0.2% of domains using a unique IPv4 address and up to millions of domains co-located on single IP addresses. On the client side, traffic is similarly skewed: 5% of client IP addresses account for over half of observed web requests worldwide. We further show that commonly cited explanations for regional differences do not fully explain the observed variation. Our findings have direct implications for Internet policies and practice that depend on IP addresses and risk disproportionate effects on both services and their users. Our results also provide empirical grounding for policymakers and operators to foster precise, accountable, proportionate, and private mechanisms for notions of identity

https://zakird.com/papers/ip_sharing.pdf

Defence

How we proactively defend our environments.

Securing your Amazon S3 buckets: Identifying and remediating over-permissioned access

Hetal Kolekar, Fernando Chiera di Vasco Freitas, and Manonmayi Vedam try and get after this enduring challenge.

This post provides a workflow framework and methodology recommendations for your security team to adapt. The focus of this post is on the what and why rather than a prescriptive implementation. You will need to customize the approach based on your organization’s requirements and existing security tooling.

This solution is intended for security engineers, cloud architects, and DevOps teams managing single- or multiple-account AWS environments with Amazon S3 workloads that require access management.

https://aws.amazon.com/blogs/security/securing-your-amazon-s3-buckets-identifying-and-remediating-over-permissioned-access/

Project Blacksea (where AI attacks drown)

Dario Pasquini and Michal Bazyli show how to contest in the AI era.

Blacksea is an active honeypot and canary-bait control system built to detect and drown LLM-driven attackers: autonomous AI agents and LLM-assisted operators that scan and exploit systems. Blacksea doesn’t stop at watching LLM attacks. It exploits flaws in the attacker’s LLM judgment to gain arbitrary code execution on their machines, collect intel passive defenses can’t reach, and make sure they don’t come back.

https://github.com/cracken-ai/blacksea

pentestkit

Taha Karim publishes this framework which will be a productivity enabler for some seecurity teams.

A multi-agent, context-accumulating penetration-testing framework built on the Claude Agent SDK. An orchestrator drives a team of specialist agents through a real pentest, proves each finding by exploiting it, scores it with CVSS v3.1, and writes a client-ready report — all while a shared knowledge base grows and every packet that leaves the box passes one scope-guarded chokepoint.

https://github.com/lordx64/pentestkit

Threat Model Generator

Michael Scovetta et al release this AI skill which will provide scalability..

A set of agent skills for producing threat models for open-source projects, including an orchestrator and independently invocable specialists.

The output is a document describing the implicit security contract between a project and its downstream users: what the project assumes about its environment and inputs, which security properties it claims, which it explicitly disclaims, and which threats are left to the integrator. It is written to serve two readers at once: the downstream integrator deciding what they are now responsible for

https://github.com/alpha-omega-security/threat-model

AgentSweep

Ishan releases this sanitiser to reduce the proliferation of secrets around agentic systems.

Claude Code (and every other AI coding CLI) stores your full conversation history as plain-text JSONL on disk, under ~/.claude/projects/ for Claude Code and ~/.codex/sessions/ for OpenAI Codex. Anything you paste, whether an AWS key, a .env file, or a database URL, sits in clear text indefinitely. A typical dev’s history accumulates dozens of secrets over months, usually unnoticed.

agentsweep scans that history, tells you what leaked, and can redact the secret values in place while preserving the JSONL structure byte-for-byte. It also tells you which keys to rotate, with the right revocation URL for each provider.

https://github.com/Ishannaik/agent-sweep

PerspectiveGraph

Luigi Iacuaniello releases this excellent use of graphs in cyber defence to real-world and real-time benefit in a development pipeline.

On every pull request, PerspectiveGraph (open source, Apache 2.0) answers one question against a graph of your real environment - built from the scanners you already run (Trivy, Semgrep, Cloud Custodian, Falco):

Does this change open a path from the internet, through excessive privilege, to something valuable?

When it does, the PR check goes red - a required status you can block the merge on - and you get the fix as its own one-click pull request. The reachable attack path is caught and closed in code review, where it's cheapest, not months later in production. This is shift-left attack-path analysis: not a scanner bolted onto CI, not a runtime CNAPP you log into after the fact - the reachability question, answered in the developer's workflow.

https://github.com/luiacuaniello/perspectivegraph

NoiseHound

Jared Perry releases this operational security enabling use of graphs.

BloodHound (and PlumHound on top of it) finds a path to the objective. NoiseHound ingests the same graph data and re-ranks paths by expected detection cost instead of hop count, so an operator can ask “what is the quietest way to Domain Admin” instead of just “what is a way”.

https://github.com/warpedatom/noisehound

Incident Writeups & Disclosures

How they got in and what they did.

Updated GPG key for signing Firefox and Thunderbird Releases

Mozilla disclose and mitigate.

Today, we moved to a new GPG signing subkey used to sign certain Firefox and Thunderbird artifacts (namely Linux tarballs, RPM packages, checksums files) after an unencrypted copy of the previous subkey was inadvertently committed to a private GitHub repository.

Our review of available audit records found no evidence that the key was accessed by an unauthorized party while it was present in the repository. Access to the repository was limited to a small group within Mozilla, all of whom already had authorized access to the key through other means.

https://blog.mozilla.org/security/2026/08/10/updated-gpg-key-for-signing-firefox-and-thunderbird-releases/

Vulnerability

Our attack surface.

Spectre on RISC-V Silicon: Attacks and Defenses on Commercial Out-of-Order Processors

Lukas Gerlach, Marton Bognar, Daniel Weber, Michael Schwarz and Jo Van Bulck show that RISC-V does share this vulnerability class.

Speculative execution attacks have been extensively studied on mainstream x86 and ARM architectures. However, on RISC-V, research has mostly concentrated on open-source academic designs. Commercially available RISC-V silicon is widely perceived as too simple to be vulnerable, and as a result, no end-to-end attacks have been demonstrated on real hardware to date and essential software such as the Linux kernel remains unmitigated. In this paper, we challenge that assumption. We systematically assess all commercially available out-of-order RISC-V processors (SiFive P550 and T-Head Xuantie C910/C920), finding them vulnerable to a range of Spectre attacks, and demonstrate the first Spectre attack leaking arbitrary kernel memory on real RISC-V hardware.

..

Our analysis shows that the SiFive P550 and Xuantie C910/C920 are vulnerable to all major Spectre variants, and we demonstrated a Spectre exploit on RISC-V hardware that leaks kernel memory via BPF.

https://lukasgerlach.me/publication/2026-speculative-execution-attacks-on-risc-v-silicon/riscv_spectre_sec26.pdf

https://zenodo.org/records/20759985

SLAC: Access-Driven CPU-to-GPU Side-channel Attacks via System-Level Cache on Apple Silicon

Tianhong Xu, Saion K. Roy, Ruyi Ding, Aidong Adam Ding, and Yunsi Fei detail that side channels do exist here.

Building on these findings, we construct the CPrime+CProbe SLC side-channel technique, which monitors GPU victim activity from the CPU at cache-set granularity. We then introduce an accelerated variant, GPrime+CProbe, in which an adversary leverages the GPU for faster SLC priming, yielding a 6.4x increase in the covert-channel throughput. Lastly, we demonstrate two end-to-end privacy attacks using the new side-channels: a graph-edge reconstruction attack on Graph Neural Networks (GNNs) that achieves 90% edge accuracy across five datasets, and an LLM privacy attack that recovers input keywords with up to 94.8% accuracy and model responses with up to 88.9% accuracy across TinyLlama and GPT-2 Medium models. Our results reveal a new class of microarchitectural vulnerabilities in Apple Silicon and call for secure system cache designs for heterogeneous SoCs.

https://arxiv.org/abs/2608.09075

You’re Back In The Room (Citrix NetScaler Pre-Auth RCE CVE-2026-8452(?))

Sina Kheirkhah walks through the exploitation of this vulnerabilty.

https://labs.watchtowr.com/youre-back-in-the-room-citrix-netscaler-pre-auth-rce-cve-2026-8452/

CSS:the bomb inside your inbox

Gareth Heyes pulls off a spectacular feat with this release..

It's quite common for webmail clients to render untrusted CSS in a trusted UI. They attempt to make this safe using CSS sanitization. In this paper I'm going to show you how to break out of trust boundaries, exfiltrate tokens, compromise 3rd party websites and even steal passwords.

..

You should block select menus in your HTML sanitizer. It was still possible to construct a keylogger in “allow listed” HTML/CSS in Outlook. Blocking select would have prevented that.

https://portswigger.net/research/css-the-bomb-inside-your-inbox

Hunting Exchange Server 0day like a detective

Jang drops a truth bomb and pushes on..

The raise of AI is painfully killing the vuln research community industry. Most of medium-quality 0-day are easily found by AI in oneshot. And other novel 0day, art of exploit are also found by the assist of frontier model.

https://testbnull.medium.com/hunting-exchange-server-0day-like-a-detective-3fd5e0dc9779

IP and DNS Leaks in WebKit Affecting Proxy Browsers and Apple iCloud Private Relay

Talal Haj Bakry and Tommy Mysk disclose..

WebKit-based browsers on iOS and macOS can be configured to route all web traffic through proxy servers, which is how Tor browsers on iOS and our own Psylo work. We found three WebKit features — DNS prefetching, WebAuthn Related Origin Requests, and WebTransport — that bypass the configured proxy and send traffic directly from the device, which exposes the user’s real network. The same leaks also affect Apple’s iCloud Private Relay. All three are fixed in Psylo 1.3.1.

https://mysk.blog/2026/08/04/webkit-proxy-icloud-private-relay-ip-leak/

Offense

Attack capability, techniques and trade-craft.

Design and Implementation of a Physical Implant Attack on the Boeing 737

Sam Crow, Pat Pannuto, Stephen Checkoway, Stefan Savage, Patrick Mercier and Aaron Schulman deliver the seminal work which will lead to a likely regulatory re-think in time.

We explore a new kind of threat model for aviation cybersecurity—one in which an adversary has temporary physical access to an airframe. We argue why such attacks are practically feasible and explain how the design of existing avionics systems, their interconnects, and their maintenance architecture make such threats of particular concern. Using the Boeing 737 as an example, we develop and demonstrate a small, programmable hardware implant that can be quickly inserted into an existing maintenance socket with roughly 60 seconds of access on the ground. By carefully manipulating physical ARINC 429 bus signals, this device can create an undetected “attacker-in-the-middle” (AITM) capability between the aircraft’s flight management computer (FMC) and multipurpose control display unit (MCDU). We explore the options for addressing this class of attack and, in particular, show why transformer-coupled buses such as MIL-STD-1553, are far more challenging to manipulate in this manner.

https://cseweb.ucsd.edu/~savage/papers/UsenixSec26-429.pdf

Weaponizing Windows Updates with NotWSUSpicious

Beyviel David reminds why we should all protect our update servers..

NotWSUSpicious is a tool repo to aid in creating custom updates after gaining access to a WSUS database server. The Turning Enterprise Update Servers Into Backdoor Factories (0_o) series covers how the database takeover works.

https://specterops.io/blog/2026/08/05/weaponizing-windows-updates-with-notwsuspicious/

TrustMeBro

Kriyos releases this work aid which will surface no doubt expected presents for all. Also worth detection teams understanding if its use has any signatures.

Authenticode signature manipulation toolkit for Red Team operations and security research. Covers signature stealing, metadata cloning, SIP hijacking across 19 file types, WinVerifyTrust FinalPolicy bypass, PKCS#7 payload embedding, SIP execution surface implants, and analyst-triggered persistence via OID handlers.

https://github.com/KriyosArcane/TrustMeBro

Digital Forensics: Attacking SAM and Extracting Hashes With 7z

Co11ateral shows how this is done..

Today we’re using 7z to find and pull the hives. It’s very common to find and it has raw disk access to fetch what we need without triggering the EDR. You can basically call it a living off the land technique due to its widespread presence. There are other ways to extract hashes, but most of them are well known and monitored. Some hackers rely on VSS and it works fine in some environments, but detecting VSS abuse isn’t hard. It’s a beginner level of complexity. VSS leaves very specific traces in the logs when you use it. Native Windows binaries get blocked outright and finding forensic tools already sitting on an endpoint is uncommon.

https://hackers-arise.com/digital-forensics-attacking-sam-and-extracting-hashes-with-7z/

Exploitation

What is being exploited..

Nothing overly of note this week…

Tooling and Techniques

Low level tooling and techniques for attack and defence researchers

Orchestrate AI agents to find real vulnerabilities in code

Harel Rom et al bring this harness to the world to find vulnerabilities…

Open-source, self-hosted AI vulnerability research tool that orchestrates agents to find and validate security issues in code.

https://github.com/Kritt-ai/open-kritt/tree/main

Bypassing Android Hardware Attestation from the Analyst’s Chair

Eric Le Guevel highlights a gap that will need to got after..

Hardware key attestation lets an Android app prove to its backend that a key lives in secure hardware on a locked, verified device. It is also the wall that stops a security analyst working on a rooted phone. This article opens the mechanism from the analyst’s chair, from the certificate chain and the attestation extension down to the root of trust, then shows a simple bypass that never touches the secure hardware. We relay the attestation to a clean device and splice a genuine chain back into the target app with a Frida hook. A companion repository ships the validation backend, the demo apps and the instrumentation, so the whole setup can be run and inspected rather than taken on faith.

https://blog.quarkslab.com/bypassing-android-hardware-attestation.html

skitter-creek-bath-salts

Christopher Domas drops this capability against an aging CPU but which unlocks it as a research platform.

Developed and tested on AMD Family 16h CPUs, the last generation whose datasheets document the DRAM controller's translation registers — and show that they can't be locked. 17h and beyond simply leave this information out.

..

Unlocking everything on the CPU with DRAM scrambling — PSP, C6, microcode, SMM, and anything else the specs left out.

..

Poke the DRAM controller and an address can be made to land wherever you want in memory. skitter-creek-bath-salts modifies the bottom layers of the memory hierarchy to rewire the physical DRAM address translations. This scrambles platform memory, exposing protected regions of DRAM — carveouts invisible even to the kernel. When the address translations break, so do the security primitives built on them, and we unlock everything.

https://github.com/xoreaxeaxeax/skitter-creek-bath-salts

Footnotes

Some other small (and not so small) bits and bobs which might be of interest.

• Annual, quarterly and monthly reports

  • Nothing overly of note this week, but keep an eye on the Awesome Annual Security Reports 2026 collection and APT report collection

• Due diligence in early practice, the International Law Commission agenda and cyberspace

• Encrypted advertising recommendations

• PQC in Plaintext: Google Cloud’s post-quantum cryptography roadmap

• AIDC Microgrid Vulnerability Assessment Under Computing-Power Coordinated Attacks

• Artificial intelligence

  • if you are a big arxiv.org user - out of China there is alphaxiv.org which is an AI powered incarnation / overlay

  • Fundamental

    • Abliteration Is Not a Scalpel: Off-Target Effects of Refusal Removal on Decision Disposition Across Model Families

    • Emergent Introspective Awareness in Large Language Models

  • Applied non-cyber

    • LLMmap: Fingerprinting for Large Language Models

    • Are we there yet? Ten weeks of Rust Symex

    • Can Language Models Identify Shadow Trading Targets? An NLP Evaluation of SEC Enforcement Theory

    • MatrAIx: Simulating the World with 8.3 Billion Persona Agents

    • IO Factory: Simulating AI-Enabled Influence Campaigns at Scale

    • Horcux: A tool to build and preserve agentic work

    • VidForensics-M1: Meta-Detection Reinforcement Learning with Verifiable Temporal Grounding for AI-Generated Video Forensics

    • Patterns and problems in emerging multiagent systems

  • Applied cyber specific

    • The standard for AI agent security, safety and reliability

    • The Evolving Role of the Red Team in the Era of Agentic Security

    • Introducing Dogwood: runtime verification for AI agents

    • Refuted by Default: Dragos’ Methodology for AI-Driven Vulnerability Detection in OT Security Software

    • Engineering the Impossible: Adding Safety to Autonomous Agents

    • Project Blacksea (where AI attacks drown)

    • Security Research in the AI ​​Era

    • Models built for BugTraceAI, an agentic web pentesting framework

    • Activation Probes Surface Code-Security Signals that the Model's Output Misses

    • When Agents Talk: Honeytokens under Shared Memory

    • Dueling Deep Q-Learning for Intrusion Detection

    • ToolHazard: Scaling Adversarial Environments for Security Evaluation and Alignment of LLM-based Agents

    • Generating Attacks for LLMs with GFlowNets

    • Governing the KV Cache: Preventing Timing Side-Channel Leakage in Multi-Tenant LLM Inference

    • Memoir: Learning, Verifying, and Evolving False-Positive Memories for Static Application Security Testing Tools

    • Analyst - “An agent that answers questions about cybersecurity conference research using an agent curated knowledge base. UI is via Jupyter notebook or command prompt.SQL queries can also be used to search for researchers, talks, or tools.”

    • Orchestrate AI agents to find real vulnerabilities in code.

    • The energetic cost of mitigating AI attacks in cellular networks

    • KeyTAR: Practical Keystroke Timing Attacks and Input Reconstruction - “This paper bridges this long-standing gap in the literature and performs a comprehensive study on the feasibility of reconstructing typed input from inter-keystroke timings. We model input reconstruction as a machine translation task and fine-tune open-source Large Language Models (LLMs) with a curriculum learning strategy, leveraging their ability to utilize contextual information and incorporate semantic understanding into the reconstruction process.”

• Books

  • Nothing overly of note this week

• Events

  • Blackhat 2026 - slides etc.

  • USENIX Security ‘26 Technical Sessions - slides/papers etc.

    • 35th USENIX Security Symposium

  • Blackhat 2026 - videos

  • x33fcon 2026 - videos

Video of the week part I - Cybercom 2.0

Video of the week par II - How North Koreans Secretly Infiltrate U.S. Companies

Video of the week part III - The Shadow War: How Freelance Sleuths Are Beating North Korea’s Cyber Syndicate

Finally finally the NCSC’s podcast series.

Unless stated otherwise, linked or referenced content does not necessarily represent the views of the NCSC and reference to third parties or content on their websites should not be taken as endorsement of any kind by the NCSC. The NCSC has no control over the content of third party websites and consequently accepts no responsibility for your use of them.

This newsletter is subject to the NCSC website terms and conditions which can be found at https://www.ncsc.gov.uk/section/about-this-website/terms-and-conditions and you can find out more about how will treat your personal information in our privacy notice at https://www.ncsc.gov.uk/section/about-this-website/privacy-statement.

Operationally this week the Beacon breach has been a cause of activity..

In the high-level this week:

• NCSC statement in response to recent incidents resulting from frontier AI evaluations - NCSC issues - “A statement from Ollie Whitehouse, Chief Technology Officer at the NCSC, on AI security following recent incidents.”

• Alert to Countries, Companies, and Other Entities Regarding North Korean IT Workers - US Department of State, UK Foreign Commonwealth & Development Office and others warn - “North Korea relies upon a network of skilled Information Technology (IT) workers, deployed within and outside of North Korea, to obtain false identities and remotely earn income to fund North Korea’s unlawful nuclear weapons and ballistic missile programs.”

• Cyber security breaches survey: 2026/2027 - DCMS announces - “The government is conducting a survey of UK businesses, educational institutions and charities. The survey aims to find out how you approach cyber security and to learn more about the cyber security issues you face. The research will inform government policy on cyber security and how the government works with organisations to protect and promote the UK online.”

• Whole energy cyber resilience requirements: reshaping cyber regulation in downstream gas and electricity - Department for Energy Security and Net Zero and Ofgem respond - “On baseline cyber resilience requirements, Ofgem will lead further development of detailed proposals, working with DESNZ and NCSC. We intend for these requirements to establish a consistent baseline level of cyber resilience across Ofgem licensees, while avoiding duplication and/or misalignment with any existing cyber security obligations.”

• Guidance for charities affected by the Beacon cyber security incident - Charities Commission guides - “A number of affected charities have submitted serious incident reports to the Commission and we encourage trustees to continue to follow our guidance on serious incident reporting. This requires you to report incidents which results in or risks significant harm, loss or damage to the charity, its beneficiaries, assets, services or reputation.”

• Follow-Up Report of the December 2025 Energy Sector Incident - CERT Poland publish - “Based on the analysis of the collected evidence, we identified the device from which the attacker conducted their operations and reconstructed the attack path. To the best of our knowledge, the use of a private APN to gain access to the OT network was the first instance of this attack vector being observed in a real-world cyberattack.”

• Statement regarding Coordinated Federal Banking Agency Approach for the Handling of Highly Sensitive Information During Examinations - Federal Reserve issues - “Additionally, the FBAs have committed to notify affected banks of a potential or confirmed material compromise of confidential supervisory information as soon as practicable and within no more than 72 hours, once the agency impacted has a reasonable basis to believe a compromise has occurred and determines the banks affected, subject to applicable legal considerations.”

• ENISA scales up its role in the CVE Program - ENISA announces - “ENISA's role within the CVE™ Program continues to grow with the strategic onboarding of key entities in the global vulnerability management ecosystem and the transition of existing CNAs under the ENISA Root. Currently, there are 20 CNAs under ENISA Root, with 12 onboarded directly by ENISA and 8 transferred from MITRE Root to ENISA Root.”

• Commission publishes study supporting the Review of the Digital Decade Policy Programme - European Commission publishes - “Findings showed that current targets do not fully reflect emerging priorities, including cybersecurity, technological sovereignty and resilience. They also suggested that some existing indicators would need updating to reflect technological change and market developments”

• A new ETSI standard could rewrite the memory-safety debate - CHERI Alliance outlines - “Importantly, ETSI TS 104 198 is technology-neutral. The draft discusses a wide range of languages and technologies, including Rust, Java, Erlang, Go, CHERI, MTE, PAC, and formal verification approaches. For the first time, organisations have a common basis for comparing different memory-safety technologies and evaluating their strengths, limitations, and assurance characteristics.”

• Small Towns Shouldn’t Have to Defend America’s Water Supply From Iran - Jen Easterly opines - “Cyberattacks will continue, and some will succeed. The task is to ensure that a digital intrusion does not become a public health disaster. In an era of nation-state cyberconflict, the ultimate measure of resilience is brutally simple: When attackers get in, clean water must still come out.”

• Cyber Command plans Silicon Valley office to drive innovation - The Record reports - “It will have its own director, though no one has yet been named for the post, and support the command’s nascent Cyber Innovation Warfare Center (CIWC), one of three entities created under the recent “CYBERCOM 2.0” initiative.”

• A Security Pro Hacked North Korean Hackers. He Found They’d Breached Hundreds of Networks Worldwide - WIRED reports - “Since Greece-based cybersecurity researcher Vangelis Stykas gained access to North Korean systems 22 months ago, he says, he has found evidence that 1,640 companies across 57 countries have been impacted by the country’s hacking operations.”

• Reporting on/from China

  • The Threat of CCP-Controlled Infrastructure in the U.S. Communications Backbone - US Congress publishes - “PRC telecommunications firms operating in the United States do not act independently. Core routing, provisioning, compliance, and customer visibility functions remain tied to parent and affiliate systems in the PRC, leaving operations within Beijing’s reach”

  • China’s Zbtlink suspends sales of routers found to contain backdoor - Reuters reports - “Chinese router maker Zbtlink Electronics said on Thursday it was suspending sales of routers found to contain a backdoor and pulling the ​affected software from its website while it developed updates to address ‌the issue. Cybersecurity firm VulnCheck identified a backdoor in at least 20 models of routers made by Shenzhen-based Zbtlink Electronics, as Reuters first reported on Wednesday. Zbtlink said in a statement, opens new tab on its ​website that it was aware of the research, which found the flaw ​could allow access and control of the device and potentially other ⁠devices on the network.”

  • FCC’s Adam Chan on the New Robot Rule - China Talk details - ”The FCC did not write the national security determination — we’re not the ones who, as a legal matter, chose this. But if you look at the determination, there are two national security risks that are highlighted. One relates to remote access, cybersecurity, surveillance, and the ability to remotely manipulate a device such that it poses threats. You guys have probably seen videos of robots behaving badly, but more seriously, I think the national security threats here are kind of obvious.”

  • How China Keeps Tabs on Foreigners - New York Times reports - ”The system’s dashboard said it tracked more than 700 foreign residents living in the city. In total, it had entries for nearly 12,000 people, which included fugitives, people from Hong Kong and Taiwan, as well as more than 300 foreign journalists. Some of them had not been to Zhangjiakou.”

  • China Launches Cyber Security Review into Palo Alto Networks - Bloomberg reports - “The Cyberspace Administration of China said in a statement Thursday that the review was necessary to protect critical infrastructure, citing a pair of national security laws. Shares in Palo Alto Networks fell as much as 4.2% before later paring losses in pre-market trading.”

• AI

  • Incident Report: unsanctioned agent behaviour during cyber testing - AISI details - “During a routine cyber evaluation, AISI identified an incident in which AI agents took sustained, unsanctioned action directed at real people and organisations. We are disclosing what we found, what it means, and the actions now underway.”

  • Control. Ownership. Perspective. - Ciaran Martin opines - “If we focus our efforts and attention exclusively, or even predominantly, on the eye-catching results of the latest frontier AI testing mishap to the exclusion and detriment of long-standing threats and vulnerabilities, we don’t stand a chance. Let’s keep these incidents in perspective.”

  • Irregular, firm behind AI hacking incidents, won’t say if there were more - The Record reports - “Irregular — the cybersecurity evaluation firm behind tests in which AI models from Anthropic, OpenAI and Meta compromised real-world computer systems — has declined to say whether any of its other clients were also affected by the same underlying flaw. Asked directly whether the publicly known companies were the only ones to have experienced the problem, a spokesperson said the company’s investigation was ongoing and that they could not “go into further details.”

  • Botsbench AI security openweight model roundup TL;DR - Graphistry publish - “DeepSeek V4 Flash makes for an interesting sweet spot. With regular harnesses, generally only frontier provider models (Sonnet 5, Opus 5, …) and the open weight GLM 5.2 make it to the 50-60% score range in our blue team investigation eval CyBT-CTF. With V4 Flash at 37%, what it loses in quality, it makes up in price: 1/10th the effective cost of GLM 5.2 once all tasks are performed . If you must do open weight, and do not need the quality of GLM 5.2, it’s attractive.”

  • Some thoughts about Anthropic’s new cryptanalysis results - Matthew Green thinks - “So yes, the AIs are getting pretty good. In short: they are now capable of understanding existing cryptanalysis results, synthesizing them into real new attacks, and even extending them. They can apparently do this without detailed human intervention. This isn’t yet super-intelligent cryptanalysis. but it’s pretty damn impressive.”

  • Announcing NIST’s Artificial Intelligence Technology Evaluation (AITE) - NIST announces - “The Technology Test and Evaluation Division at NIST is launching a new program to provide researchers with a sequestered testbed environment for the evaluation of AI model performance in a variety of meaningful tasks across diverse datasets, modalities, and domains.”

• Cyber proliferation

  • Malaysian Regulator Stops SMS Blaster Bypassing Telco Filters - Comms Risk reports - “The Malaysian Communications and Multimedia Commission (MCMC) found a 23 year old local man driving a car equipped with an SMS blaster around Johor Bahru, a Malaysian city bordering Singapore, on July 24. The device transmitted a radio signal that impersonated a mobile provider and sent fraudulent messages containing web links directly to nearby phones.”

• Bounty Hunting

  • Canadian Man Pleads Guilty to Hacking U.S. Cloud Storage Provider and Extorting Its Customers for Millions - US Department of Justice announces - “Connor Riley Moucka, 26, of Kitchener, Ontario, pleaded guilty today to a widespread computer hacking conspiracy that resulted in the compromise of over 165 victim organizations, the theft of billions of sensitive customer records and the extortion of numerous victims.”

  • Belarusian leader of international ransomware scheme known as “Ransom Cartel” sentenced to 16 years in prison - US Department of Justice announces - “Maksim Silnikau, 40, was the creator and administrator of the Ransom Cartel ransomware strain, created in 2021. Silnikau had been a member of Russian-speaking cybercrime forums since at least 2005 and was a member of the notorious cybercrime website Direct Connection from 2011 to 2016, when the site was shuttered after the arrest of its administrator.”

  • Data recovery company CEO sentenced to prison for partnering with hackers to target ransomware victims - News 1 (Korea) report- “Mr. A and others obtained the file extension information of infected files in advance from ransomware hackers and registered them in portal search advertisements.”

• Market Incentives

  • Who Is Liable When an AI Agent Hacks a Third Party? - Baker Hostetler opines - “Companies that deploy autonomous agents should begin preparing for a future in which regulators, prosecutors, relators and plaintiffs’ lawyers evaluate AI systems using the same lens they currently apply to cybersecurity programs.”

Reflections this week are around the tension between accepted and contemporary practice.

Over the last couple of weeks I have had detailed discussions where changes required to products to support cyber defence in the contemporary era were objected to on basis of accepted practice or customer demand.

As we navigate the next period the ability to challenge accepted, but where the security benefit is not or weekly evidenced or is outweighed by the change, is going to be critical..

Not getting this via email? Subscribe:

Subscribe now

Think someone else would benefit? Share:

Share

All attribution is by others and not the UK Government unless specifically stated as such, please see the legal text at the end.

Have a lovely Sunday…

Ollie

Cyber threat intelligence

Who is doing what to whom and how allegedly.

Reporting on Russia

CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft

Microsoft build on prior reporting on this alleged Russian operation.

Since early May 2026, Microsoft Threat Intelligence has observed Storm-2945, a sub-cluster of Midnight Blizzard, conducting widespread but targeted traffic manipulation attacks involving hospitality sector networks served by captive portals worldwide. Despite some tactic, technique, and procedure (TTP) similarities to the Forest Blizzard DNS hijacking operation that we publicly disclosed in April 2026, we attribute this campaign, which we call CaptiveCrunch, to Storm-2945. As reported by ReliaQuest on July 23, a portion of this activity leverages doppelganger domains mimicking Microsoft online services to conduct follow-on adversary-in-the-middle (AitM) phishing operations that abuse the device code authentication flow in Microsoft Entra ID.

https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/

Reporting on China

OctLurk and SilkLurk: newly identified tailored backdoors in cyber-espionage campaign in Central Asia

Saurabh Sharma details this alleged Chinese capability. Noteworthy for the use of environment keying on the payloads.

We have been tracking two new backdoors, OctLurk and SilkLurk, observed in attacks against government organizations primarily in Central Asia since January 2025. Identified victims are located in Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and the Syrian Arab Republic. These organizations operate across several sectors, including healthcare, research, government offices, ministries of foreign affairs, logistics, law‑enforcement agencies, urban planning and facilities management, and public educational establishments.

The backdoor loaders are customized for each victim and use information from the victim’s machine to decrypt the payload.

https://securelist.com/octlurk-silklurk-backdoors-central-asia/120840/

Targeted Attack on Government Entities in the Middle East

Sudeep Singh and Roy Tay provide some over lap reporting on alleged Chinese capability which is noteworthy for its relative complexity.

• BINDCLOAK is a previously undocumented and new 64-bit modular Windows backdoor written in C++ that was deployed on victims’ machines during post-compromise activity.

• BINDCLOAK is decrypted and reflectively loaded by MIXEDKEY in a multi-stage attack chain targeting government entities in the Middle East.

• A complex message routing mechanism is used by BINDCLOAK to manage the C2 communication channel with the C2 server.

• BINDCLOAK implements endpoint detection and response (EDR) evasion techniques to prevent detection of API calls from unbacked executable memory regions.

…

As detailed later in our threat attribution section, key code similarities between BINDCLOAK and OctLurk as well as shared command-and-control (C2) infrastructure directly connect the threat actor behind OctLurk to the campaign we describe in this two-part blog series.

https://www.zscaler.com/blogs/security-research/targeted-attack-government-entities-middle-east-part-2

Tracing SNOWLIGHT: A China-Nexus Campaign Against Government Infrastructure

SOC Radar detail this alleged Chinese operation showing a strong apparent focus on Government entities. The leveraging of various n-day vulnerabilities is of note.

• Attribution to China-Nexus Actors: The core delivery mechanisms have been definitively linked to the SNOWLIGHT malware family. Tracked by the Google Threat Intelligence Group since 2024, identified loaders are heavily associated with China-nexus access brokers UNC5174 and UNC6586.

• Cracked Chinese Reimplementation of Cobalt Strike C2 Infrastructure: Command and control (C2) infrastructure is managed via “GoCobaltStrike,” a specialized Chinese-language reimplementation of Cobalt Strike authored by the handle “星落”, featuring cracked license constraints.

• Government Sector Prioritization: More than 85% of mapped reconnaissance listings target national infrastructure, resolving to second-level government domains (.gov.*, .go.id) across Taiwan, Colombia, China, Brazil, Indonesia, Nigeria, the Philippines, and over 90 other geographical jurisdictions.

• High-Impact Endpoint Takeovers: Out of an expansive footprint exceeding 9,990 hostnames across 104 country-code TLDs (top-level domain), the threat actors successfully exploited 9 distinct CVEs to breach 107 endpoints. This includes critical administrative compromises: 16 root-level cPanel/WHM takeovers (CVE-2026-41940) and 1 Domain Admin level compromise via ProxyShell.

• Reverse Tunnel Traffic Obfuscation: Operators effectively masked their network trail by deploying Neo-reGeorg web shells over pre-existing JSP shell implants, using third-party compromised systems as reverse tunnels to proxy further malicious actions.

• Opportunistic “Spray-and-Check” Tactical Model: The campaign leverages automated scanning rather than bespoke targeting. Roughly 1 out of every 90 scanned targets resulted in a Remote Code Execution (RCE) oracle hit, credential theft, or shell validation.

https://socradar.io/blog/snowlight-government-chinese-campaign/

ENDLESSDOORS Is Phoning Home. Pick Up

Jacob Baines details these Chinese routers with apparent backdoors.

There is no handshake, no key exchange, no negotiation. When the implant reaches a server, it sends a fixed 39-byte hello: a 33-byte class label padded with nulls, then its LAN MAC address. That’s the whole registration. There is no client or server verification.

After that, anything the server sends is handed to popen() and executed as uid 0. There is no allow-list and no sandbox. One reserved string, rctlbash, tells the implant to open a second connection to port 7001, allocate a pseudo-terminal, spawn /bin/sh, and bridge it. That is a live interactive root shell.

https://www.vulncheck.com/blog/zbt-endlessdoors

Reporting on North Korea

Alert to Countries, Companies, and Other Entities Regarding North Korean IT Workers

US Department of State puts out this alert along with the United Kingdom and others.

• While many North Korean IT workers reside in North Korea, China, and Russia, as well as Southeast Asian and African countries, they may conceal the fact that they are working from abroad using third-party proxies, VPNs, remote desktop software, and similar tools.

• North Korean IT workers are known to use third-party proxies as facilitators overseas, such as in the United States, to run “laptop farms” which receive company-provided laptop computers for North Korean IT workers to remotely access, obfuscating their true location.

https://www.state.gov/releases/office-of-the-spokesperson/2026/07/alert-to-countries-companies-and-other-entities-regarding-north-korean-it-workers/

NullReceiver’s Blank Crypto Transfers Solves the Challenges of EtherHiding

Paul McCarty details an alleged North Korean operation which uses a novel command and control technique.

We just identified a new blockchain-based command-and-control technique hiding inside two trojanized npm packages, bianira-ui and fluid-type-ui. Both are DPRK-linked clones of legitimate Tailwind CSS plugins, and both use the same trick to find their command server: they read it out of the destination address of a completely blank cryptocurrency transfer.

https://opensourcemalware.com/blog/nullreceiver-dprk-c2-technique

Reporting on Iran

Nothing overly of note this week

Reporting on Other Actors

UNC6671 Rebrands: Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments

Tyler McLellan and Austin Larsen detail the continued use of vishing by this criminal group which will be of note to defence teams.

UNC6671 continues to rely on voice phishing (vishing) to target enterprise employees, posing as IT helpdesk staff facilitating mandatory, urgent security migrations. Significantly, the threat actor often contacts employees via their personal mobile devices. These calls lure victims to spoofed login portals where Adversary-in-the-Middle (AiTM) infrastructure intercepts credentials and multi-factor authentication (MFA) tokens. Once session persistence is established, the actors deploy automated scripts for data exfiltration from enterprise cloud environments, including Microsoft 365 and Okta.

In this update to our May 2026 blog, we detail the infrastructure linkages connecting these extortion brands. We also examine the evolution of UNC6671’s targeting including recent activity focused on financial services, private equity, and professional services, and provide hardening guidance to help organizations protect themselves from this threat.

https://cloud.google.com/blog/topics/threat-intelligence/unc6671-targets-financial-services-and-enterprise-cloud-environments

How legitimate cloud platforms enable phishers to bypass MFA

Olga Altukhova details a set of techniques employed by range of threat actors.

Troughout 2025 and 2026, we have observed phishing operators steadily migrate toward platforms like Cloudflare Workers, Vercel, Netlify, GitHub Pages, and IPFS.

Threat actors select platform-as-a-service (PaaS) offerings and distributed cloud environments to host phishing sites for much the same reasons legitimate software developers do:

• Inherent trust and reputation. Phishing pages hosted on reputable platforms appear trustworthy, reducing suspicion among potential victims.

• Most platforms offer generous free-tier developer plans. The onboarding process takes minutes and rarely requires Know Your Customer (KYC) identity verification. This enables a single operator to create hundreds of malicious accounts.

• Evasion and anonymity. Attackers leverage native security features to obscure their true origin server IP address behind a CDN, which complicates detection for security vendors.

Additionally, these platforms allocate shared subdomains hosting millions of legitimate projects and websites.

https://securelist.com/cloud-platforms-in-phishing/120832/

Analysis of APT-C-24 (Rattlesnake) group’s application file phishing attack campaign

360 Threat Intelligence Centre details some tradecraft by this alleged threat actor.

The organization distributes decoy PDF documents via phishing emails. When users click to open the file, they are tricked into downloading an application file, which is the ClickOnce application deployment configuration file. Its main function is to remotely install the Baijiahei component.

In subsequent sample association, an attack activity was captured that downloaded subsequent malicious components through macro code. Its core payload was written in Rust, which has strong anti-analysis capabilities, and its overall functionality is consistent with the core payload of this analysis.

https://mp.weixin.qq.com/s/PALBLusD4umh_52gy2wVAg

Software Supply Chain Incursions

A reminder we issued guidance a number of weeks ago in Software supply chain attacks: check your dependencies for software developers

• ChainDrop npm Worm: Bun-loaded CI/CD credential harvester with Ethereum dead-drop C2

• Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack

• npm Worm Poisons 400+ Packages Across Nine Organisations

• Distributed npm Package Cluster Delivers Cross-Platform RAT Targeting Alibaba Developers

• Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages

Discovery

How we find and understand the latent compromises within our environments.

When Attackers Hijack Your Inbox: Detecting Mailbox Forwarding Rules with Microsoft Defender XDR

Bi Yue Xu details practically how it is done.

Fortunately, these attacker activities are not invisible. Microsoft Purview Audit captures mailbox operations, including the creation of forwarding rules, and these audit events are also available in Microsoft Defender XDR Advanced Hunting. This allows security teams to proactively hunt for suspicious mailbox activities and create custom detection rules that can automatically alert on malicious behavior.

https://detect.fyi/when-attackers-hijack-your-inbox-detecting-mailbox-forwarding-rules-with-microsoft-defender-xdr-56a71567c6f2

WinGuard

Poly0n releases this experimental EDR for Windows.

A User-Mode Windows Threat Detection Tool Inspired by EDR Techniques, To Help Monitor And Log Any Suspicious Activity On Your PC.

https://github.com/Poly0n/WinGuard

Defence

How we proactively defend our environments.

ENISA Secure by Design and Default Playbook

ENISA publishes this guide for subject matter experts.

A Practical Guide to Secure by Design and Default Principles for SMEs

Modern products with digital elements are increasingly expected to be secure by design and secure by default. However, many organisations, in particular small and medium-sized enterprises, may face distinct challenges in applying these concepts consistently, requiring targeted solutions.

This report puts forward a set of principles and tangible guidance on the application of secure by design and default requirements throughout the life cycle of a product. In particular, the report focuses on explaining these principles in clear, repeatable actions that can be applied to existing engineering, product and release processes.

https://www.enisa.europa.eu/publications/enisa-secure-by-design-and-default-playbook

ADR: Agentic AI Detection and Response

Uber releases their in production framework for agentic defence.

ADR (Agentic AI Detection and Response) is an enterprise security system for AI agents. It helps organizations secure employee-facing agents such as Cursor, Claude Code, and Codex, as well as customer-facing agents such as AI support agents.

ADR is deployed in production at Uber, and the accompanying paper was accepted to MLSys 2026: Paper PDF · Slides PDF

https://github.com/uber/ADR

Scanning 7.6 Petabytes of HuggingFace Training Data for Secrets

Truffle show that you don’t need zero-days to secure access if you don’t care where you go..

tl;dr We scanned every public dataset on Hugging Face, which is where most open AI training data lives. That came to 7.6 petabytes across 187 million files, the largest secret scan of AI training data we know of. We found 221,303 live, unique credentials sitting in 6,003 datasets.

One of the highest-impact secrets we found had access to 393 GB of PII covering what we estimate to be roughly 3.7% of the global population. More on this will come in a dedicated follow-up. The rest of the scan shows how broad the problem is: cloud storage buckets, hosted databases, cloud-admin keys, and tokens that can push code into software a lot of people install.

https://trufflesecurity.com/blog/scanning-7-6-petabytes-of-ai-training-data-for-secrets

Incident Writeups & Disclosures

How they got in and what they did.

Tailscale didn’t stop the Hugging Face intrusion

Tailscale provide their perspective.

An AI agent escaped its sandbox, entered Hugging Face’s infrastructure, and used a stolen Tailscale credential to enroll 181 nodes onto their tailnet. No Tailscale vulnerability was found or exploited—we should have been able to prevent it anyway.

https://tailscale.com/blog/hugging-face-intrusion

Vulnerability

Our attack surface.

OT Security Analysis: Exposed Devices Attacked in US Water Systems

Sai Molige details their observed attack surface.

Querying the Shodan search engine on August 3, 2026 returns 4,407 devices exposing port 44818. The vast majority (65%) are located in the U.S., followed by Canada (12%) and Spain (3%).

More than half of those devices are in the networks of large mobile network carriers, showing that they are often connected via cellular modems – as described in the FBI/EPA’s advisory. If we take only the U.S.-based devices, we see that over 70% of those are in mobile networks.

Focusing on the specific product lines mentioned in the FBI/EPA advisory, we see that MicroLogix 1400 is much more common than MicroLogix 1100, with 50% of the exposed assets being in the former family and only 8% in the latter. Other relevant product lines seen exposed include CompactLogix 1769 (22%) and ControlLogix 5590 (8%).

https://www.forescout.com/blog/ot-security-analysis-exposed-devices-attacked-in-us-water-systems/

Technical Deep Dive into the Entropy Issue

Coin Kite remind the world by testing and verification, especially in security critical functions, are an imperative.

There was no intentional weak-entropy fallback. It is important to be precise about what happened.

Yasmarang was MicroPython’s built-in general-purpose PRNG, introduced upstream in May 2018. It did not become part of COLDCARD’s seed-generation path until the libNgU migration in March 2021. Most language runtimes include a non-cryptographic PRNG for general-purpose tasks. Its presence was not itself unusual.

COLDCARD was designed to rely exclusively on its hardware TRNG for seed generation, with no software fallback. Setting MICROPY_HW_ENABLE_RNG=0 was intended to disable the software path. A build and link integration error meant that setting did not have the intended effect, and libNgU’s rng_get() symbol resolved to MicroPython’s default Yasmarang implementation instead.

The hardware TRNG did not fail and trigger a weaker fallback at runtime. This was inherited platform behavior activated by a link-time error, not an intentional seed-generation design decision or shortcut. This distinction does not change the risk or migration guidance for affected seeds.

https://blog.coinkite.com/entropy-technical-backgrounder/

Apple Screen Sharing Pre-Auth RCE

AI generated details of the Apple screens sharing vulnerability..

Apple’s Screen Sharing daemon (screensharingd) contains a pre-authentication vulnerability in its SRP (Secure Remote Password) frame-length validation. When the daemon receives an SRP frame whose big-endian 32-bit length has any bit at position ≥ 15 set (i.e., length ≥ 32768), the “frame too large” error path returns the stale success status from the preceding 4-byte read instead of an error code. The caller interprets this zero return as “authentication complete” and enters the post-auth message loop without any key exchange, cipher negotiation, or session crypto.

The remaining bytes in the network buffer are then consumed as ordinary RFB messages — including Apple’s proprietary file-copy protocol (message type 0x22), which runs as root and provides arbitrary file read and write. By injecting a reverse shell payload and a root crontab in a single pipelined connection, an unauthenticated attacker achieves remote code execution as root within 60 seconds.

No user interaction is required. The only prerequisite for the auth bypass and the file primitives is that Screen Sharing is enabled on the target (System Settings → General → Sharing → Screen Sharing). No password, no valid username, and no knowledge of the target configuration is needed.

https://warez.sl0p.foo/apple-screensharing-rce/

From Square Root to /root: Escalating Privileges in Azure Containers with Python in Excel

Ron Ben Yizhak details that complexity still up ends.

a symbolic link flaw that let him escalate privileges from an unprivileged user to root. That access let him recover an internal configuration file exposing the architecture and hostnames behind this feature. Later, he discovered Microsoft’s container images can be pulled anonymously and that there is even an undocumented AI agent framework integrated into this environment. Separately, he found a way to bypass Excel’s Trusted Records security control (CVE-2026-45459) by abusing a Python result object to force a victim’s machine to silently fetch a URL and automatically upload the data to the supposedly network-isolated container.

https://www.safebreach.com/blog/python-in-excel-vulnerability-root-escalation-cve-2026-45459/

TONTOU: On the Exploitability of Time-of-Neutralization to Time-of-Use Windows

Daniël Trujillo and Mengjia Yan introduce a new exploitation primative.

To re-direct control-flow, we introduce INTERRUPT INJECTION, a primitive that exploits post-neutralization windows by leveraging the fact that interrupts can occur at nearly any point in time. Using this primitive, we demonstrate that an attacker can trigger mispredictions during kernel execution on recent AMD and Intel CPUs. To prove its practicality, we build an end-to-end exploit using INTERRUPT INJECTION that leaks arbitrary kernel memory on AMD Zen 2 at a rate of 5.47 bytes/s, despite the latest neutralization techniques.

https://people.csail.mit.edu/mengjia/data/2026.USENIX.TONTOU.pdf

Understanding Implicit Trust Errors in Core Carrier Networks through Multi-Agent Flaw Discovery and Analysis

Ziyu Lin, Ziting Wang, Xinfeng Li, Wei Dong and XiaoFeng Wang show a potential application of AI to cyber defence.

Cellular core networks (CNs) are critical infrastructure, yet their internal security model has historically relied on physical isolation: interfaces between core components often operate within an assumed trust zone. As CNs transition to cloud-native deployments, this assumption weakens, expanding the attack surface and enabling external adversaries to reach previously internal interfaces. From a root-cause analysis of security flaws reported in GitHub issues for opensource CN implementations, we found a recurring pattern of blind trust among CN components. Components may omit syntactic validation, fail to enforce semantic invariants, or allocate resources without checking availability. Once internal interfaces become reachable, these weaknesses can lead to severe impacts such as denial of service and session hijacking. We call these vulnerabilities implicit trust errors (iTrue). To detect iTrues and understand their security impacts, we designed iFinder, an LLM-driven multi-agent system that summarizes known flaws, distills them into detection patterns, and applies them to discover new iTrues in CN implementations. To suppress hallucinations produced by large language models (LLMs), we built an innovative strategy that crosschecks both 3GPP specifications and CN code to capture existing protection missed by the agents. Further, we developed a technique that uses LLMs to generate proof-of-concept (PoC) exploits for potential iTrues and iteratively refine the PoCs by automatically executing them against CN implementations and analyzing results. Running iFinder on seven prominent open-source CN implementations, we discovered 84 previously unknown vulnerabilities. Among them, 83 have already been confirmed and 81 have been assigned CVEs. Importantly, a session-hijacking flaw has been confirmed on real-world commercial 5G core networks.

https://arxiv.org/abs/2607.10315

Offense

Attack capability, techniques and trade-craft.

Bypassing Windows application [allow]listing

Tim Baker highlights de-serisalation vulnerabilities go beyond the web..

This post describes how we discovered and reported to Microsoft an insecure deserialisation vulnerability in one of the binaries in the Windows Assessment and Deployment Kit (ADK), and how that can be used to bypass Application Control (native Windows application whitelisting).

https://www.dotsec.com/insecure-deserialisation-app-control-bypass/

Abusing Extended Attributes to Bypass Application Control For Business

Ian details how this technique is executed which defence teams will want to develop tradecraft to detect..

• This post shows a practical bypass of Application Control for Business (formerly Windows Defender Application Control (WDAC)) by abusing NTFS Kernel Extended Attributes (Kernel EAs), which are treated as trustworthy

• Core idea: copy the EA set from a known-allowed executable (Chrome in this example), apply equivalent attributes to a target binary, then perform an offline modification so the attributes are stored as $Kernel.* (rather than user-mode #Kernel.*) before the volume is mounted in Windows.

• Impact: the target executable can be allowed to run in environments that rely on these cached origin/claims.

• Prerequisites / attacker position: either kernel-mode capability (e.g., a driver) to set Kernel EAs, or (b) offline access to the NTFS volume (e.g., removable media, secondary disk, or disk accessed from another OS) to edit on-disk EA structures.

https://shells.systems/abusing-extended-attributes-to-bypass-application-control-for-business/

Inside the Falcon How CrowdStrike Catches You

DbgMan provides a breakdown in functionality which will likely inform the adversary..

A full reverse-engineering teardown of the CrowdStrike Falcon sensor: the six kernel callback sources, the WFP network engine, the file-system minifilter, the cspcm4 broker, the user-mode service (DNS / AMSI / browser / Identity Protection), and the cloud-loaded detection engine — plus every structural blind spot. How Falcon sees you, and where the seams are.

https://0xdbgman.github.io/posts/inside-the-falcon-how-crowdstrike-catches-you/

Pass the Passkey: A Novel Attack Surface in Passwordless Authentication

Arie Olshtein presents this research which is included here to highlight this line. This is not a vulnerability with passkeys..

All presented attacks rely on malware already existing on the victim’s device during the initial stage.

https://unit42.paloaltonetworks.com/passwordless-authentication-security-risks/

Borrowing Windows Hello keys for authentication and persistence

Dirk-jan Mollema details an as by design aspect of Windows Hello along with providing detection tradecraft.

For this blog I want to focus on a technique that was left as-is since it is more or less a consequence of how WHFB works: the ability to perform single-sign on with the backing cryptographic keys from a user session, without needing the PIN or other information/user presence. We will not just look at how we can utilize this to request Primary Refresh Tokens (PRTs), but also how we can use this to perform device registration by using the WHFB key as a FIDO key/passkey.

https://dirkjanm.io/borrowing-windows-hello-keys/

Identity Crisis: Novel Vulnerabilities Leading to Kerberos Downgrade, DoS, and Full Domain Takeover

Shai Laron walks through the application of two now patched vulnerabilities..

This article details my research into these questions, which led to the discovery of two new Active Directory privilege escalation vulnerabilities: KerberLoss (CVE-2026-25177) and ResetNightmare (CVE-2026-27912). Each vulnerability takes a unique approach to causing identity confusion on DCs, resulting in various impacts. The second (and more severe vulnerability) enables a low-privileged user to instantly gain Domain Admin privileges.

https://www.semperis.com/blog/identity-crisis-novel-vulnerabilities-leading-to-kerberos-downgrade-dos-and-full-domain-takeover/

ANIMO

David Garcia releases this capability which defence teams will want to develop detections for,

ANIMO is a comprehensive Azure AD / Entra ID assessment platform that combines PowerShell-based session management, Azure CLI parity, and native Graph / ARM API integration. It gives red teamers a single interface to manage multiple Azure sessions, capture and manipulate tokens, enumerate cloud resources, and execute post-exploitation techniques during authorized engagements with WhoAmI-driven autofill so Post-Exploit modules pre-populate from what you already know about the identity.

https://github.com/dmcxblue/ANIMO

Exploitation

What is being exploited..

N-Able

N-Able disclose and on going saga..

As our investigation into the recent N-central security vulnerability continues, we are proactively expanding protections in response to ongoing monitoring of threat actors as they evolve their attack techniques.

This is not a duplicate of our previous communication. 2026.3.1.10 Hotfix 2 is required, even if you already applied the earlier hotfix. Hotfix 2 supersedes Hotfix 1 with additional hardening measures to further protect you and your customers.

https://uptime.n-able.com/event/201522/

Tooling and Techniques

Low level tooling and techniques for attack and defence researchers

GetRuntimeAttestationReport

Microsoft released this in January which is now used by Riot Games in their anti-cheat system.

The GetRuntimeAttestationReport API allows a VTL0 user-mode process to retrieve a signed runtime attestation report from the Secure Kernel. This report provides a list of loaded drivers and code integrity information, which is essential for validating system integrity and enforcing anti-cheat policies in gaming and security-sensitive applications.

https://learn.microsoft.com/en-us/windows/win32/api/sysinfoapi/nf-sysinfoapi-getruntimeattestationreport

omp-re

Lance James releases this work aid..

omp-re is a reverse-engineering plugin for omp (oh-my-pi): it wraps radare2 behind 22 agent tools, a /re slash command, five overlay panels, a content-addressed evidence store, an HMAC-signable audit log, and a report writer that refuses to write a claim with no supporting evidence. The agent gathers facts through the tools; the evidence store remembers exactly what it observed; the report writer will not let it claim more than that.

https://github.com/lancejames221b/omp-re

Screenlogger

Rad Kawar releases this will be of use to some including some third party engineer use cases I suspect.

Screenlogger captures at an interval you choose, recognizes visible text on device, and lets you return to a moment through Library search or Timeline navigation. Capture and search stay on your Mac.

https://github.com/radkawar/screenlogger

Papaya

ioa releases this experiment which shows some interesting promise.

Papaya is a POC of detecting software debuggers through machine learning.

This POC currently only shows 2 vectors which could be used to detect software debuggers in such a way. Every trained sample was performed and generated for x64-dbg.

https://github.com/ioallocate/Papaya

Binary Diff

Matteyeux releases this work aid..

A Binary Ninja plugin for side-by-side binary diffing, powered by QBinDiff.

Drop a second binary onto the diff view and the plugin loads it, analyzes it, matches its functions against the current binary, and shows the differences at five levels: control flow graph, assembly, LLIL, MLIL and HLIL.

https://github.com/matteyeux/binja-diff

Knuckledragger

Philip Zucker attempts to bring proofs to the people..

Knuckledragger (git repo) is an attempt at creating a down to earth, highly automated interactive proof assistant in python. The goal is to support applications like software/hardware verification, calculus, equational reasoning, and numerical bounds.

https://github.com/philzook58/knuckledragger

.config

eversinc33 details this nifty technique..

Add a sample.exe.config file next to your sample and you can trace e.g. all network requests, including content and headers without hooking or bothering with proxies. Helpful to e.g. quickly inspect c2 traffic:

…

Depending on which APIs the malware uses, this will trace request content before encryption, so you can see HTTPS traffic in cleartext

gist.github.com/eversinc33/cd7f3e90643f69748862b87f394f1c16

x.com/eversinc33/status/2086011305128079857?s=20

Footnotes

Some other small (and not so small) bits and bobs which might be of interest.

• Annual, quarterly and monthly reports

  • Nothing overly of note this week, but keep an eye on the Awesome Annual Security Reports 2026 collection and APT report collection

• A Cognitive Engineering Approach to Capture the Context of Decision Making for Emergency Call Handlers

• A New SiliVaccine: North Korea’s Antivirus

• Artificial intelligence

  • if you are a big arxiv.org user - out of China there is alphaxiv.org which is an AI powered incarnation / overlay

  • Fundamental

    • Not All LLM Reasoning is Visible in the Chain-of-Thought

    • Multi-Head Attention Residuals

    • Memory Caching: RNNs with Growing Memory

  • Applied non-cyber

    • Do Context Files Help Coding Agents? A Two-Agent Ablation Study on Real Repositories

    • Memoir: Should a Model Write to Its Memory While It Thinks?

    • LLM-based Vulnerability Discovery in Business Process Documentation

    • DreamGuard: Efficient Runtime Guardrail for LLM Agents via Risk-Aware World Model

    • Breadcrumbing Search Agents

    • CodeAssay: A Multi-Metric Benchmark with Audited Ground Truth for LLM Code Generation

  • Applied cyber specific

    • Every Model Cheats: Prompt-Level Mitigation of Cheating on Offensive Cyber Tasks

    • Provable Assurance (PA) Code Audit Demo

    • The Vulnerability With No CVE: Managing Persistent Gaps Between Mandate and Authority in AI Coding Agents

    • Tiny Enough to Break In: Agentic Remote Access Trojans Powered by Small Language Models

    • Studying, Identifying, and Fixing Hidden Technical Debt in AI-Intensive Cyber-Physical Systems

    • Hardware Design and Security in the Era of Chiplets and LLMs

    • LLM-Assisted Detection and Repair of Hardware Security Vulnerabilities in Verilog Designs

    • LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents

    • Trident : How to Break Deep Reinforcement Learning Cyber Defenses (Agentic)

    • PriDyG: Privacy-preserving Dynamic Graph Inference with LLM-GNN Collaboration

    • DiagChain: A Diagnostic Benchmark for Evaluating LLM Agents on Evidence-Grounded Attack Chain Reconstruction

    • MalTotal: Cost-Effective and Language-Agnostic Malicious Code Poisoning Detection for Millions of Repositories

    • CLEAR: Causal Context-Based Agentic Reasoning for Vulnerability Detection

    • EntailLLM: Verifying LLM-Generated Vulnerability Discovery Paths with Domain Knowledge via Logic Programming

    • SparSEEty: Extracting Tokens from Sparsity-Exploiting LLM Serving Systems via Deterministic Side Channels

    • MutMem: Cryptographically Authorized Mutation in Persistent Agent Memory

• Books

  • A Century of International Crisis Behavior

  • Resilience by design: STRATEGIC RISK-PROFILING TECHNIQUES TO REFINE YOUR ORGANISATION’S CYBERSECURITY AND RESILIENCE STRATEGY

• Events

  • Nothing overly of note this week

Video of the week “Why Agentic Systems Need Ontologies”

Finally finally the NCSC’s podcast series.

Unless stated otherwise, linked or referenced content does not necessarily represent the views of the NCSC and reference to third parties or content on their websites should not be taken as endorsement of any kind by the NCSC. The NCSC has no control over the content of third party websites and consequently accepts no responsibility for your use of them.

This newsletter is subject to the NCSC website terms and conditions which can be found at https://www.ncsc.gov.uk/section/about-this-website/terms-and-conditions and you can find out more about how will treat your personal information in our privacy notice at https://www.ncsc.gov.uk/section/about-this-website/privacy-statement.

Operationally this week nothing overly of note..

In the high-level this week:

• When cyber attacks happen: helping organisations recover - UK NCSC outline - “A highly disruptive incident can feel overwhelming. New guidance provides a framework for response and recovery.”

• Making forensic observability the norm for network devices - UK NCSC update - “We are seeing encouraging progress across industry, but there is still some way to go before forensic observability capabilities become standard. Both vendors and buyers have a role to play in making this happen.”

• G7 Cyber Expert Group 2026 Cross Border Coordination Exercise (CBCE) - HM Treasury summarise - “The G7 Cyber Expert Group (CEG) successfully concluded its 2026 Cross-border-coordination exercise (CBCE) on May 18 2026. This exercise demonstrates the Group’s ongoing commitment to strengthening cyber resilience across the G7 financial sector.”

  • G7 Cyber Expert Group: Reconnection Framework Technical Annex - HM Treasury publish - “Reconnection is the process of restoring technical access and integration to an organisation that has been technically quarantined after suffering a material cyber incident. This includes a phased resumption of business operations, beginning with the technical reconnection of stakeholders and entities to the organisation.”

• Malicious Cyber Actors Targeting Water and Wastewater Sector Internet- Facing Programmable Logic Controllers, Causing Operational Disruptions - FBI warns - “The Federal Bureau of Investigation (FBI) and Environmental Protection Agency (EPA) are issuing this Public Service Announcement (PSA) to warn critical infrastructure asset owners and operators that malicious cyber actors (MCAs) are conducting cyber attacks targeting Operational Technology (OT) devices, including Rockwell Automation/Allen-Bradley Programmable Logic Controllers (PLCs), specifically MicroLogix 1100 and 1400 series. Since 27 July 2026, Water and Wastewater Sector (WWS) utility companies in at least seven states have reported incidents to the FBI, and some of that activity degraded water operations.”

  • CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs - CISA urges

• Open Source Software: Security Principles and Practices - CISA publish - “Open source software (OSS) is embedded in nearly every modern system, from business applications to critical infrastructure. Our new Open Source Software: Security Principles and Practices guidance helps agencies securely use, evaluate, and publish open source software. It covers OSS risk management across the full lifecycle, introduces the C4 Framework for trust assessment, and provides specific recommendations for vulnerability management, software bill of materials use, secure development, and handling open source artificial intelligence systems.”

• 2026 Minimum Elements for a Software Bill of Materials (SBOM) - CISA publish - “The U.S. Cybersecurity and Infrastructure Security Agency (CISA), in partnership with the co-authoring organizations, updated the Minimum Elements for a Software Bill of Materials (SBOM) to reflect current SBOM needs, while preserving the core principles of the document published in 2021 by the National Telecommunications and Information Administration (NTIA).”

• Memory safety requirements - ETSI publish the draft - “The scope of this work item is to develop memory safety assurance levels and specific requirements to meet them. In this regard, the work will entail the formulation of a vocabulary that is independent of any particular vendor, and a systematic classification schema for memory safety technologies. In addition, the work will provide concrete examples that illustrate the extent to which certain technologies fulfil these assurance levels and the corresponding requirements.”

• North Korea Taps India for Smartphones - NK North reports - “North Korean smartphone brand Phurunhanal Electronics appears to have sourced one of its latest phones from the Indian company Lava International. This represents the first time a phone on sale inside North Korea has been linked to a non-Chinese manufacturer.”

• Commission publishes new guidance to support timely Cyber Resilience Act implementation - European Commission publishes - “The guidance addresses the questions stakeholders have been asking most, including:

  • Clarifying when certain products fall within the scope of the Cyber Resilience Act, including remote data processing solutions and free and open source software

  • What constitutes a ‘substantial modification‘

  • How support periods should be understood and applied

  • How to meet reporting obligations and risk assessment requirements”

• Reporting on/from China

  • Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks - Andy Piazza details - “Unit 42 identified an AI-enabled autonomous hacking campaign carried out by a Chinese-speaking threat actor. They targeted infrastructure using seven vulnerabilities, combining autonomous AI-driven enumeration with manual exploitation that achieved confirmed impact.”

  • Puppeteers: Chinese hackers still trick Claude into dirty work - NetAskari details - “An interesting find on hunt.io demontstrates that Chinese operators are still luring Claude to conduct offensive hacking operations, despite Anthropic’s assurance of better guardrails.”

  • China Cannot Buy Western Frontier AI. 73,000 Servers Sell It Anyway - Infrawatch detail - “Inside the 73,000-server market reselling Western frontier AI into China”

  • Trump administration bans new Chinese humanoid robots - BBC reports - “The Trump administration on Tuesday announced a ban on new foreign-made humanoid robot imports to the US over “unacceptable risks” to America’s national security.”

    • FCC Adds Foreign-Produced Power Inverters and Robots to Covered List - FCC announces

  • The Chinese robot army transforming the UK’s retail industry - BBC reports - “At Geek+’s factory in the eastern Chinese city of Hefei, which the BBC visited, fleets of the robots are built and tested before being shipped to warehouses around the world. Some of Britain’s biggest retailers - including Tesco, Asda and Next - now use the company’s technology.”

  • China begins mass production of homegrown immersion chipmaking machines in major breakthrough, report claims — first DUV lithography units will be delivered this year to SMIC, Hua Hong, and CXMT - Tom’s Hardware reports - “U.S. House Resolution 8170 designates SMIC, Hua Hong, CXMT, Huawei, and YMTC as restricted entities in law, and three of those five are the named first customers for the domestic scanner.”

• AI

  • The AI That Hacked Its Way Out and the Hype That Followed It - Kate Klonick, Associate Professor at St. John’s University Law School analyses and asserts - “The models didn’t escape because they’re gods. They escaped because someone left the door open. Congress should regulate the door.”

  • Its AI agent spent days hacking a company, but sources say OpenAI did not notice for a week - Reuters reports - “

    • The agent first tried escaping OpenAI’s isolated environment around July 9, two people familiar say

    • Co-founder of victim firm Hugging Face says the intrusion began July 11

    • OpenAI noticed odd behavior from cutting-edge models before hack-sources”

  • Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident - Hugging Face details - “This post walks through how the intrusion actually worked: the two initial-access vectors, how the agent pivoted and moved laterally, representative examples of the commands that were run and how we investigated with GLM 5.2 (an open-source model). Live credentials, internal hostnames, and specific indicators have been redacted or genericized, while the techniques are described exactly as observed by Hugging Face.”

  • Investigating three real-world incidents in our cybersecurity evaluations - Antrhopic disclose - “In a review of our cybersecurity evaluation transcripts, we found three incidents in which a Claude model reached the internet from within or while interacting with a third-party evaluation environment, and then gained unauthorized access to the real systems of three different organizations.”

  • Patchmageddon - Michael Cembalest, J.P. Morgan - “I partnered with JP Morgan’s Cybersecurity Teams to get into the details on this critical national security issue. In “Patchmageddon” we review how cyber risks have changed, the underappreciated breadth and risks from open source code, the risks to physical infrastructure and some guidance what business owners, software developers and the Federal government should be doing to mitigate the potential consequences.”

  • Context Wash - How AI SOC Vendors Hollowed Out Their Strongest Word - Zach Christensen challenges - “In a single hour at the Gartner Summit I heard “context” used to describe a SIEM query, a session-history thread, a policy-weighted alert score, a UI-aware copilot, and an analyst-typed prompt. Same word. Five products. Five entirely different things. Buyers nodded along, because the word sounds like the same thing.”

  • Human mathematicians are being outcounterexampled - Kevin Buzzard truth bombs - “Perhaps it was at this point that the penny really dropped for me — large AI-generated developments of mathematics are inevitable. One cannot trust AI-generated code so I ran it in a sandbox on my machine (malicious Lean code can run arbitrary commands on your computer — Lean is a programming language, after all). Indeed, it was proving nontrivial theorems about the cohomology of number fields”

  • Beyond Zero: Enterprise security for the AI era - Joseph Valente and Michal Zalewski outline - ““

  • GEO for Geopolitics: What happens when AI and information warfare collide - Demos explores - “As large language models (LLMs) become embedded across every stage of our information supply chain, they are creating a new frontier for information warfare. This report explores what happens when AI and geopolitical competition collide, revealing how hostile states can manipulate the information that AI systems retrieve, cite and present to users.”

  • Who Does Withholding Delay? A Game-Theoretic Model of Open-Weight AI Release Under Asymmetric Proliferation -

  • Corporate America Has Suddenly Decided to Stop Blowing Money on AI - Wall Street Journal reports - “Fed up with ballooning costs, companies big and small are starting to use lower-priced models, including some built in China. In many cases, they are adding the new, cheaper models alongside OpenAI and Anthropic’s products, shopping a la carte for their artificial intelligence.”

• Cyber proliferation

  • Nothing overly of note this week

• Bounty Hunting

  • How police are trying to divert teen hackers away from crime - BBC reports- “Cyber Choices, also known as Cyber Prevent, is like a hacker rehab course.”

• Market Incentives

  • South Korea fines telco giant KT $39 million for customer data breach - Bleeping Computer reports - “The point of breach was a lost KT cellular base station called a femtocell, which contained a valid authentication certificate.”

    • Personal Information Protection Commission Decides on Sanctions for 'KT Inc. Personal Information Leak Incident' - South Korea Personal Information Protection Commission outlines

  • AI firms must answer for rogue bots, says boss of hacked company - BBC reports - “The boss of one of the companies recently hacked by out-of-control artificial intelligence (AI) says bot makers must be accountable for cyber attacks carried out by their creations.”

  • AI Seed Investors Flock To Cybersecurity - Crunchbase detail - “Notably, the strong cybersecurity seed funding environment coincides with solid overall venture investment levels. In the first half of the year, per Crunchbase data, startups in the sector pulled in $10.6 billion in financing across stages, roughly in line with recent prior comps.”

No reflections this week but Series 3 of the NCSC podcast is out - episode one is on ‘The New AI Reality’

Not getting this via email? Subscribe:

Subscribe now

Think someone else would benefit? Share:

Share

All attribution is by others and not the UK Government unless specifically stated as such, please see the legal text at the end.

Have a lovely Saturday…

Ollie

Cyber threat intelligence

Who is doing what to whom and how allegedly.

Reporting on Russia

Russian Global Webmail Espionage

Unit 42 details this alleged Russian campaign which is of note due to the targeting of e-mail and and victimology.

Unit 42 has observed a persistent cyberespionage campaign we track as CL-STA-1114. This activity cluster overlaps with activity from a Russian threat actor tracked by other vendors as Void Blizzard and LAUNDRY BEAR.

The attackers behind this campaign targeted Zimbra webmail in organizations in the following sectors:

• Governments

• Defense

• Transportation

• Financial organizations across the following regions:

  • NATO member states

  • Ukraine

  • Commonwealth of Independent States (CIS) countries

  • Africa

https://unit42.paloaltonetworks.com/russian-webmail-espionage/

Cleaning Out Inboxes: TA488 Comes for Outlook with Another Half-Click Exploit

Greg Lesnewich, Stuart Del Caliz, Nick Attfield, Konstantin Klinger, Saher Naumaan and Mark Kelly detail an alleged zero-day exploitation of a highly novel approach to a web implant allegedly by a Russian threat actor.

• On 22 July 2026, one day prior to Proofpoint’s recent joint release with the NSA on Russia-aligned threat actor TA488 (Void Blizzard, Laundry Bear), the actor began a campaign abusing CVE-2026-42897, a cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA).

• The campaign targeted US and European government entities, as well as the telecommunications, financial, hospitality, and aerospace sectors.

• TA488 is doubling down on the use of “half-click” exploits – where opening the email is enough to trigger compromise – with significantly improved loading mechanisms, techniques, and malware, signaling an improvement in the group’s tradecraft and capability.

• This novel infection chain ends with a previously unknown JavaScript browser-based implant we call OWAReaper, purpose-built for persistent access inside OWA.

• OWAReaper runs inside the OWA browser context, operating as a stealthy implant with no host footprint, using two C&C communication channels and two data exfiltration protocols. It is capable of surviving browser reboots, credential rotation, and full re-imaging of the victim’s device.

• The earliest infrastructure used in this campaign was created in March 2026, two months prior to Microsoft’s out-of-band patch for CVE-2026-42897; it is feasible that TA488 used this vulnerability as a zero-day.

https://www.proofpoint.com/us/blog/threat-insight/cleaning-out-inboxes-ta488-comes-outlook-another-half-click-exploit

DNS Poisoning Tactics Expand to Hospitality Wi-Fi

Alexander Capraro, Jalen Vaughn, Daxton Wirth, Austin Ritchie, and Connor Short detail this alleged Russian operation targeting hospitality which is noteworthy.

• Adversaries have been compromising public Wi-Fi gateways at hotels, conference centers, and other shared venues to hijack the accounts of traveling corporate employees. Once they control the Wi-Fi gateway, they quietly redirect users to attacker-controlled infrastructure to steal credentials, in activity ongoing since at least June 2026.

• ReliaQuest assesses this tradecraft is similar to that of “APT28” (also known as “Fancy Bear” and “Forest Blizzard”), a Russian military intelligence group that was previously linked to similar router-based campaigns compromising Microsoft 365 accounts.

• Organizations can close the primary exposure with one control: enforce always-on, full-tunnel VPN on corporate devices. This routes all traffic—including DNS—through the corporate network before it ever reaches the hotel gateway, effectively stopping the attack.

https://reliaquest.com/blog/threat-spotlight-dns-poisoning-tactics-expand-to-hospitality/

Reporting on China

Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks

Andy Piazza adds to the increasing evidence base of the adoption of a range of AI tooling and in this instance it is by an alleged Chinese threat actor.

Unit 42 identified an AI-enabled autonomous hacking campaign carried out by a Chinese-speaking threat actor. They targeted infrastructure using seven vulnerabilities, combining autonomous AI-driven enumeration with manual exploitation that achieved confirmed impact.

The actor, operating under the aliases knaithe and KnYuan, leveraged DeepSeek, via the Hermes Agent framework, as their autonomous offensive operator. They orchestrated this operator via Telegram for the following activities:

• Independently enumerating targets and their vulnerabilities using FOFA

• Sourcing exploit tools

• Initiating attacks without human intervention

https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/

Dear Diary, Today I found a Ghost in the Network

Intrusion Truth is back detailing the alleged development of Chinese offensive capability.

Guangdong Chanming. If you were looking for them, you’d be disappointed. No public website, no storefront, and certainly no obvious product line to speak of. It made us wonder what their marketing team spends their days doing – if they even have one.
On the surface, they are a ghost. But for those of us that know how to look for the cracks in the Great Firewall, the breadcrumbs they leave behind are more than enough to suggest that this “ghost” is actually a vital gear in China’s cyber machinery.
While they may lack a marketing strategy, their patent filings and software copyrights speak volumes. And they don’t speak of consumer products — they speak of offence. A few of the registered titles alone would raise the eyebrows of any security professional:

• 互联网安全接入系统 – Internet Security Access System
• 多功能安全代理系统 – Multi functional Security Proxy System
• 文件传输密网系统 – File Transfer Network System (FTN)
• Security Tunnel Net防溯源密网系统 – Anti traceability Network System (STN)
• 网络设备脆弱性测试分析系统 – Network Vulnerability Testing System
• Android终端秘取平台 – Android Secret Extraction System
• Telegram数据采集落查系统 – Telegram Data Collection System

‘Android Secret Extraction System’? ‘Telegram Data Collection System’? Subtle, Guangdong Chanming. Very subtle.
We scoured the web for a sales page, a demo, or even a single product listing. Nothing. These interesting tools Guangdong Chanming seem to offer clearly aren’t sold to the everyday consumer.

https://intrusiontruth.wordpress.com/2026/07/27/dear-diary-today-i-found-a-ghost-in-the-network/

Reporting on North Korea

Operation Double Barrel

ASEC detail an alleged link between a North Korean threat actor and ransomware.

This technical analysis report was prepared as part of the joint cyber security advisory issued by the National Intelligence Service of the Republic of Korea, the National Police Agency, the Korea Internet & Security Agency, and the Financial Security Institute, titled "Advisory on Hacking Attacks on Korean Citizens and Companies by State-Backed Hacking Organizations."

..

These commonalities suggest that while the state-backed hacking group and the Gunra ransomware group appear to be separate entities with different ultimate goals, they may have shared some techniques, tools, and infrastructure or cooperated to a limited extent during the attack process.

https://asec.ahnlab.com/ko/94695/

https://image.ahnlab.com/atip/content/file/20260730/%5BAhnLab%5DOperation%20Double%20Barrel(ENG)(2026.07.30).pdf

ClickFix, EtherHiding & a DPRK Wallet Trail

Christian Papathanasiou walks through the end to end of this alleged North Korean operation. Noteworthy due to the use of ClickFix.

A fake macOS "update" screen convinced a victim to paste one command into Terminal, installing a Node.js backdoor that takes its orders from an Ethereum smart contract. We reverse-engineered every stage, then followed the money on-chain.

https://www.allsecure.io/blog/clickfix-etherhiding-dprk-wallet/

North Korean hacker group behind open-source supply chain attacks

CJ Moses attributes this alleged North Korean operation and highlights how they use AI. Also reminds us the scale of the challenge of protecting the open source eco-system.

… how a threat actor linked to the Democratic People’s Republic of Korea (DPRK) is targeting open source software libraries, the shared building blocks that companies around the world use to develop applications. Amazon Threat Intelligence has linked several recent compromises of popular Node Package Manager (NPM) libraries to the same DPRK-linked threat actor, a connection that hasn’t been publicly reported until now. The analysis also describes how generative AI is already changing what malicious software packages look like and how threat actors are beginning to probe AI-based code systems. We’re sharing this research to help the open source community and security teams better identify and address these types of events.

https://aws.amazon.com/blogs/security/amazon-identifies-north-korean-hacker-group-behind-open-source-supply-chain-attacks/

Reporting on Iran

APT42: AI-Assisted Rapport Phishing and a More Resilient TAMECAT

Darkatlas Squad shows how Iran is allegedly using AI to assist in human influence as part of their cyber operations among various other aspetcs.

Three developments define the current picture. SpearSpecter combined prolonged WhatsApp engagement, Windows search-ms and WebDAV abuse, and a substantially expanded TAMECAT backdoor. APT42 also incorporated generative AI into target research, persona and pretext development, translation, malware engineering, debugging, code generation, and exploitation research. In March 2026, TA453 activity overlapping APT42 targeted a US think tank with a live credential-phishing operation during an active regional conflict.

Recent malware samples add a technical view. A 2026-dated PDF-themed shortcut, a batch controller, and an obfuscated PowerShell collection module form a probable TAMECAT-compatible chain. A fourth macro workbook carries 2021 timestamps and provides an older point of comparison.

https://darkatlas.io/blog/apt42-ai-assisted-phishing-tamecat-analysis

Mirage Kitten targets Middle East and Africa region with new malware

Omar Amin details an an alleged Irian implant which uses a variety of command and control

Mirage Kitten – also known as UNC1549, Smoke Sandstorm, and Nimbus Manticore – is an advanced persistent threat (APT) group focused on cyber-espionage operations against aerospace, aviation, defense, and telecommunications sectors across the Middle East and Africa, using highly targeted spear-phishing campaigns, fake recruitment portals, and custom multi-stage malware to gain persistent access and exfiltrate sensitive data.

During recent threat research, we identified a previously undocumented malware set developed and used by Mirage Kitten. The toolset includes NightLedger, a new Windows backdoor for reconnaissance, command execution, file operations, process discovery, and screenshot capture; and two custom WebSocket-based tunnelers, ArcBridge and BridgeHead, for covert network access and operator-controlled tunneling.

https://securelist.com/mirage-kitten-new-tools/120811/

Reporting on Other Actors

Check and Protect: Analysis of Telegram Phishing Operation Targeting Exiled Activist

Resident details an interesting campaign against activists and shows some strong social engineering tradecraft.

In July 2026, RESIDENT.NGO investigated an instance of a cloaked Telegram phishing campaign used against an exiled Belarusian activist living in Lithuania. Delivered in a private Telegram Secret Chat as a fake Telegram security alert, the phishing link led to a convincing Telegram-themed page designed to capture one-time login codes in real time. The operation’s defining feature was not the phishing page itself but its browser- and device-aware cloaking: visitors using browser and platform configurations accepted by the server, together with a syntactically valid token, could receive the phishing interface, while other configurations—including many automated scanners and some common desktop browsers—were shown decoy content or redirected to Telegram’s legitimate website. This report examines the operation’s tradecraft, technical implementation, and defensive implications. RESIDENT.NGO has not attributed the activity to a specific threat actor. However, our investigation identified what appears to be part of a broader Telegram phishing campaign targeting users across several countries. We present our findings on that campaign in a separate publication.

https://resident.ngo/lab/writeups/check-and-protect-analysis-of-telegram-phishing-operation-targeting-exiled-activist/

HOLLOWGRAPH Backdoor Turns Microsoft 365 Calendars Into a C2 Channel

Umut Bayram details a command and control technique which is of note to defensive teams.

• HOLLOWGRAPH is a Windows espionage backdoor delivered as a .NET NativeAOT DLL masquerading as a Brotli library.

• It uses compromised Microsoft 365 calendar events as a two-way dead drop for tasking and exfiltration.

• Hybrid RSA-OAEP and AES-256-GCM encryption protects Graph payloads, with separate RSA key pairs for each direction.

• DNS tunneling over IPv6 AAAA records refreshes Entra ID credentials and preserves mailbox access after secret rotation.

• Picus Platform lets teams simulate HOLLOWGRAPH attacks and validate security controls against the malware.

https://www.picussecurity.com/resource/blog/hollowgraph-backdoor-turns-microsoft-365-calendars-into-a-c2-channel

Helpdesk Hijackers: Teams Vishing, Quick Assist, and GoGRPC Backdoor

ThreatLabz walks through the end to end which has a novel command and control element to it which should aid detection.

• Since January 2026, ThreatLabz tracked a cluster of attacks likely associated with a ransomware group that begins with targeted vishing via Microsoft Teams, convincing the victim to launch a Quick Assist remote support session.

• After initial access, the threat actors use PowerShell scripts to gather host information and deploy a Go-based backdoor that we named GoGRPC and/or other malware tools.

• ThreatLabz observed four variants of GoGRPC that we named Lep, Giver, Pet, and Kind. These variants have overlapping capabilities but notable implementation differences.

• GoGRPC is actively evolving. Each variant modifies its payloads and capabilities, adding or removing functionality to better support the threat actor’s objectives. Recent changes indicate an increased targeting of corporate environments, which may be tied to ransomware attacks.

• GoGRPC communicates with the C2 server using gRPC, which differs from common C2 frameworks where gRPC is typically used for internal communication between components.

• The threat actor also deploys SOCKS proxy tools that also use gRPC or WebSockets to communicate with the C2 server.

https://www.zscaler.com/blogs/security-research/helpdesk-hijackers-teams-vishing-quick-assist-and-gogrpc-backdoor

Software Supply Chain Incursions

A reminder we issued guidance a number of weeks ago in Software supply chain attacks: check your dependencies for software developers

• North Korean hacker group behind open-source supply chain attacks

• PolinRider Caused Dozens of npm, Go, PHP Compromises

• Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access Trojan

• @copilot-mcp/apex: A macOS Infostealer Re-Published on npm After Takedown

• Batten Down Your Packages: Mitigation Guidance for Supply Chain Compromise

Discovery

How we find and understand the latent compromises within our environments.

GraphGulo

Mihir Kumar Batar provides a potentially scaled and efficient solution to this problem area.

GraphGulo is a research prototype that converts raw PCAP captures and network flow logs into an indexed temporal graph, then answers time-respecting traversal queries at low-second latency on commodity hardware. The engine is written in Python with a Rust core compiled via PyO3, and has been validated on a 14 GB PCAP file producing 109.6 million edges across 21.3 million nodes.

https://github.com/Mihir4U-avi/GraphGulo

Project ORBITAL

Will Thomas provides a community power tool with this release.

Project ORBITAL is a centralized matrix for mapping, fingerprinting, and hunting China-nexus Operational Relay Box (ORB) networks and malicious edge-device infrastructure based on Open Source Intelligence (OSINT) public reporting.

https://github.com/BushidoUK/Project-Orbital

Defence

How we proactively defend our environments.

A Data Diode with 2 Raspberry Pi and OpenBSD

Sven Seeberg democratises cross domain with this solution.

This project is an OpenBSD-targeted, Rust-based data diode intended to be deployed on two Raspberry Pis. It transmits files via UDP through a fiber optics cable without a back channel. An Arduino can be used to monitor the traffic and show the status on a 1602 LCD.

https://github.com/svenseeberg/data-diode

Microsoft Power Pages Security Utils

https://github.com/DFE-Digital/power-pages-security-utils

An Automated Framework for Extracting Reachable Attack Chains from Cyber Threat Intelligence Reports

Wenbo Hou, Ning Hu, Xueping Wang, Jiahao Gu and Wenjian Luo provide a small scale experiment of the potential future.

On a dataset of 20 CTI reports containing 334 human-validated annotated steps, our framework achieves higher annotated-step coverage than representative CTI extraction systems in recovering attack behaviors. Moreover, by explicitly generating preconditions and postconditions, it produces attack units that are more complete and consistent than those generated by end-to-end LLM baselines. On the extracted chains, Datalog inference reaches the specified attack goal in 19 of 20 reports, while backward search yields 34 attack paths under the generated rules. The source code and experimental artifacts are available in an anonymized repository. .

https://arxiv.org/abs/2607.19742

Stronger with every update: How we’re making Chrome and the web safer in the AI Era

Chrome Security Team detail and provide a breakdown of the world we find ourselves in.

While this dramatic change in software security brought about by LLMs might be startling, an increase in bugs found and fixed is not a sign of failure. Every bug found and fixed is one less foothold for an attacker. But discovering and fixing a bug is only half the battle — we must also ship the fix and apply the update for users faster than adversaries can exploit the bug, and invest in projects that mitigate or eliminate classes of bugs through accelerated release cadences, dynamic patching, and opportune restarts, we are driving toward a browser that is continuously protected without disrupting the user.

The AI era has undeniably intensified the software security threat landscape, but by combining rapid deployment mechanisms with deep structural defenses, we are ensuring the advantage remains firmly with defenders. With this, Chrome and the broader web become safer with every update.

https://blog.google/security/chrome-stronger-with-every-update/

Incident Writeups & Disclosures

How they got in and what they did.

Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident

Hugo Larcher, Adrien Carreira, Raphael G and Christophe Rannou detail their intrusion in glorious Technicolor

A companion technical writeup to our incident disclosure. This post walks through how the intrusion actually worked: the two initial-access vectors, how the agent pivoted and moved laterally, representative examples of the commands that were run and how we investigated with GLM 5.2 (an open-source model). Live credentials, internal hostnames, and specific indicators have been redacted or genericized, while the techniques are described exactly as observed by Hugging Face.

https://huggingface.co/blog/agent-intrusion-technical-timeline

Vulnerability

Our attack surface.

Cisco’s Transition to a Risk-Based Vulnerability Disclosure Model

Cisco details their move..

Starting in July 2026, Cisco will further evolve to a risk-based vulnerability disclosure model to address the rapid evolution of AI-driven cyber threat discovery and mitigation. This evolved model prioritizes critical security information and establishes a predictable cadence for hardening releases and related disclosures, helping ensure customers receive prioritized and actionable security information. The operational process is structured as follows:

https://sec.cloudapps.cisco.com/security/center/resources/risk-based-disclosure

Welcome to Danglegeddon

Silent Push highlight the scale of the challenge..

• Our research team conducted a simulation examining dangling DNS infrastructure across four industry sectors: government, banking, automotive manufacturing, and pharmaceuticals.

• We applied simple, agent-based instrumentation and AI workflows to find, enumerate, and uncover subdomains that could be exploited.

• Using the same single technique over and over produced successful results, leading us to determine we were only scratching the surface of an immense scale of takeover possibilities.

https://www.silentpush.com/blog/danglegeddon/

Going depthfirst: Achieving GitLab RCE via Two Ruby Memory Corruption Vulnerabilities

Yuhang Wu uses AI and then chains vulnerabilities together to gain maximum impact. Noteworthy given all the source code targeting of late.

As part of the Open Defense Initiative, the depthfirst system analyzed Oj, a high-performance JSON parser with a substantial native C implementation, and produced a prioritized queue of potentially exploitable findings. The system surfaced 18 prioritized vulnerabilities, including 7 memory-safety bugs. Two of them, an out-of-bounds write and a heap-pointer disclosure, had survived in Oj for nearly five years. Oj is a low-level dependency used by GitLab, and we combined the two bugs to achieve remote code execution on a default GitLab installation. The resulting chain affected GitLab CE and EE versions 15.2.0 through 18.10.7, 18.11.0 through 18.11.4, and 19.0.0 through 19.0.1. GitLab released patches shortly after receiving our reports. The PoC code is available here. This is the kind of problem depthfirst is built to solve: tracing real applications in depth into overlooked code, identifying high-signal critical bugs, and connecting them back to reachable product impact.

https://depthfirst.com/research/going-depthfirst-achieving-gitlab-rce-via-two-ruby-memory-corruption-vulnerabilities

Missing MAC validation in wg(4) packet decryption

FreedBSD disclose this oversight.

After dispatching a decrypt operation to OCF and receiving the result, the wg(4) driver failed to check whether the MAC verification step succeeded. The driver thus silently accepted packets with an invalid Poly1305 authentication tag.

https://lists.freebsd.org/archives/freebsd-announce/2026-July/000301.html

RAPTOR autonomous looping multi-altitude security vulnerability hunt

Nicolas Krassas provides a AI vulnerability hunting improved skill (at extra token cost).

An autonomous, looping, multi-altitude security vulnerability hunt for a codebase, packaged as a Claude Code skill. It replaces the model’s default “single pass, summarize, stop” behaviour with an explicit search procedure: traverse every altitude, generate candidates, adversarially verify them from raw source, run isolated parallel reasoners, and keep a persistent ledger so each loop is net-new coverage instead of rediscovery. In practice it finds far more real bugs than a one-shot scan — the “Karpathy auto-research” methodology.

It triggers whenever you point Claude at source code and want vulnerabilities found — “audit this”, “find every bug”, “security-review it”, “find anything exploitable”.

https://github.com/dinosn/raptor-loop-hunt

From /init to Code Execution - Prompt Injection Experiments with Opus-5 in Claude Code¶

Veganmosfet walks through this unsolved problem but demonstrates an end to end attack chain.

Disclaimer: Prompt injection is an unsolved problem. Use sandbox and human review.

How far would it go, beginning with a simple /init command in Claude Code, in a repo containing only a picture? Would it download and execute untrusted code?

Short answer: sometimes, yes.

https://veganmosfet.codeberg.page/posts/2026-07-27-opus5/

Offense

Attack capability, techniques and trade-craft.

The SID that wasn’t there: bypassing KB5014754 to Domain Admin on a fully patched AD CS

Mohamed Alzhrani show how it is done which will be of note to cyber defence teams.

A fully patched AD CS issued me a client-auth certificate with no szOID_NTDS_CA_SECURITY_EXT in it at all. No requester SID. Not mine, not anyone’s. The extension that is the entire point of KB5014754 was simply absent from the issued certificate.

That is one line of output from a thirty-second lab run, and it is the whole finding. Everything else in this post — the disassembly, the two bugs, the Domain Admin TGT at the end — follows from it.

Before you close the tab: yes, this needs an ESC1-shaped template, and no, that doesn’t make it a misconfiguration.

https://0xmaz.me/posts/certsrv-id-cmc-addExtensions-KB5014754-bypass/

AgentHound

Adithyan AK provides a capability uplift for those wrestling with agentic infrastructure security.

Offensive security framework for AI agent infrastructure - recon, credential looting, model exfiltration, poisoning, and attack-path analysis across MCP, A2A, gateways, and AI services. BloodHound for the agentic stack.

https://github.com/adithyan-ak/agenthound

Beignet

Joe and Kyle Avery released this a whilst back but will be of note to detection engineers working in MacOS eco-systems.

Donut for MacOS, converts darwin/arm64 and darwin/amd64 .dylib files into MacOS PIC shellcode, can be used as a CLI or imported as a golang library.

https://github.com/sliverarmory/beignet

KernelCallbackTable Process Injection

S12 - 0x12Dark Development ..

We are looking at a process injection variant named Kernel Callback Table process injection.

https://medium.com/@s12deff/kernelcallbacktable-process-injection-22112a0d9822

NoNameAx (NaX)

Maor Sabag releases this beacon detection teams will want to ensure coverage of.

Position-independent C2 beacon for the Adaptix Framework with module stomping, malleable C2 profiles, BOF execution, and a Stardust-pattern UDRL loader.

https://github.com/MaorSabag/NaX

OffsetInspect

Jared Perry releases this work aid which will help both sides of the coin.

PowerShell toolkit for AMSI/Defender detection-boundary analysis and static malware triage maps byte offsets to detection triggers, plus YARA, entropy, string, and PE/imphash analysis. Companion to OffsetScan.

https://github.com/warpedatom/OffsetInspect

Exploitation

What is being exploited..

Cisco Secure Firewall Management Center Software Static Credential Vulnerability

Cisco detail..

In July 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability. Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh

Tooling and Techniques

Low level tooling and techniques for attack and defence researchers

Virtualization Internals Part 5 - KVM Internals: From VM Creation to Guest Execution

Ayoub Faouzi walks through the VM process.

This chapter provides you with an insight into hardware virtualization and particularly with KVM. The previous chapter described some technical background on how QEMU works, which is considered as an important foundation for what we will be learning today

https://ayoub-faouzi.com/posts/virtualization-internals-part-5-kvm-internals-from-vm-creation-to-guest-execution/

Reverse engineering what HyperGuard monitors in ntoskrnl

Ian G details what is monitored.

1. I wanted to dig deeper into the Secure Kernel, and debugging it

2. I was curious about Alt Syscalls which I posted about here, and what the state of play is with SKPG. Keep reading to find out!

3. I was curious what the SKPG actually monitors in ntoskrnl, anything different to normal Patch Guard?

https://fluxsec.red/what-does-hyperguard-skpg-monitor-vtl1-windows-internals-secure-kernel-patch-guard

Technical Details: Const Evaluation and Data Layout - Rust on CHERI

Sarah Harris details how Rust on CHERI manifests in practice.

One of the more interesting places where the quirks of CHERI surface is in Rust’s const evaluation mechanism. This feature allows parts of a program to be run during compilation, and the results stored for use when the program is actually run. The set of operations that are supported is limited: trying to perform IO operations during compilation wouldn’t end well, and calculations that might never finish probably aren’t a good choice either. The operations available do, however, include some forms of pointer arithmetic.

https://rust.cheriot.org/2026/07/06/technical-details.html

Random Windows Things Part 2: Unexpected Clipboard Data Behavior

Yarden Shafir details some unexpected behaviour here which could trip some up.

An application can call AddClipboardFormatListener to register a callback that gets called whenever the clipboard contents change, like when you copy a file or some text. The process can then call GetClipboardData to read the data. No special privileges are needed and any process can register this callback unless it is running in a sandbox.

The interesting thing is that when a virtual machine is running is “Enhanced session” mode, processes inside the VM that registered a callback with AddClipboardFormatListener will be notified for clipboard changes on the host, or in other VMs that are also running with “Enhanced session”. Of course, the host machine can also read the clipboard contents of the VMs.

https://windows-internals.com/random-windows-things-part-2-unexpected-clipboard-data-behavior/

Intel ME Firmware Reverse Engineering

Jatinkapilaq provides this researcher work aid..

Talk to your Intel Management Engine directly — zero-dependency Python tool. Finds memory leaks, partition manifest, live MKHI probing. First public HECI Spy.

https://github.com/Jatinkapilaq1/intel-me-research

Footnotes

Some other small (and not so small) bits and bobs which might be of interest.

• Annual, quarterly and monthly reports

  • Nothing overly of note this week, but keep an eye on the Awesome Annual Security Reports 2026 collection and APT report collection

  • IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains

• Digital Triage in Policing

• DICOMHawk: A Cyber Deception Framework for Medical Imaging Infrastructure

• ThreatForest: Multi-Agent Attack Tree Generation with Pluggable TTP Framework Mapping

• Artificial intelligence

  • if you are a big arxiv.org user - out of China there is alphaxiv.org which is an AI powered incarnation / overlay

  • Fundamental

    • From Memory to Skills: Evidence-Grounded Co-Evolution Governance for Long-Horizon LLM Agents

    • Token embeddings violate the manifold hypothesis

    • Large Language Models Do Not Always Need Readable Language - one for those relying on English prompt and trace analysis

  • Applied non-cyber

    • Can AI agents conduct open-ended AI research? Early evidence from two case studies

    • Piggybacking on Perception: Stealthy Concurrent Audio Prompt Injections against Multimodal LLM Agents

    • DECODE: Tackling Representation and Decision Degradation in Continual AI-Generated Image Detection

    • Automated Transcript Analysis for Detecting Flaws in Agentic Benchmarks

    • On AI Safety and Security Technical Debt in Engineering AI-Enabled Systems

    • Thinking Fast, Thinking Slow: Adaptive Multimodal Transformer-based Sensor Fusion for Depth Estimation on Ultra-low-power MCUs

    • RoguePrompt: Dual-Layer Encoding for Self-Reconstruction to Circumvent LLM Moderation

    • Harmonizing AI Safety Thresholds

    • Bits and Memories: Measuring Verbatim Extraction Across LLM Quantization

    Applied cyber specific

    • Stitch: Assertion-Guided Patching of On-Chip Protocol Implementations using LLMs

    • HoF-Bench: Rediscovering Real AI-Discovered CVEs Without Frontier Models

    • SecRespond: Benchmarking AI Agents for Real-World Post-Compromise Incident Response

    • Cyber-Capable AI Agents: Vulnerabilities, Evaluation Containment, and Defensive Response

    • Open Security Benchmark: Towards Autonomous Enterprise Cyber Defense

    • Network Reciprocity Shapes Evolutionary Cybersecurity Dynamics

    • ReCon: A Resource-Constrained Benchmark for LLM-Based Cybersecurity Compliance Across Ingestion and Retrieval Pipelines

    • CoGate: Confidence-Gated Co-Decoding for Secure Code Generation

    • SecDrift: Measuring Sector-Conditioned Security Drift in AI-Generated Code

    • ALIBI: Adaptive Agentic Attacks on LLM-Based Vulnerability Detectors via Adversarial Code Comments

    • DeepFaith: Evidence-Grounded LLMs for Faithful Incident Reporting in Multi-Stage APT Defense

    • Just Testing, Move Along: Evasion of LLM-based System Log Interpretation by Prompt Injection

    • Agentic Permissions Policy Algebra for Taint Confinement in LLM Agents

    • Cybersecurity Detection Classification with Reasoning-enabled Language Models

    • Agent Harness Distillation: Inference-Time Harness Extraction and Exploitation in Autonomous Multi-Agent Systems

    • StealthBench: Measuring Operational Stealth in Autonomous Offensive-Security Agents

    • (EC)2: Event-Centric Explainability for Cybersecurity Through Multi-Agent LLM Investigations

    • GPT-Red: Automated Red Teaming via Self-Play at Scale

    • Does Runtime Topology Context Improve LLM-Generated Kubernetes Security Patches?

    • CHARGE: Leveraging CWE Hierarchies for Hardware Security SystemVerilog Assertion Generation

    • FAVA: Formal Authorization for Verified Agents with Evidence-Backed Permission Graphs

    • Impossible to hide secret ...: Uncovering Security and Privacy Issues in LLM-native IDEs

    • I gave GPT my 20 year old disk decryption challenge. It won. - “It did not crack AES. It did not defeat dm-crypt. It did not brute force a password.

      The encryption on my disk is still as strong as the day I set it up. What the AI actually did was more interesting. It read old config files, worked out how a mid-2000s Linux distro wired encryption together and patiently carried out a detailed forensic investigation.”

    • Hybrid Analysis for Secure MCP Tool Use in LLM Agents

    • The Disruptive Impact of Large Language Models on Capture the Flag Competitions and the Path Toward Fair Play

    • Context Collapse, Part 3 - AI Worming through Word

• Books

  • Nothing overly of note this week

• Events

  • Nothing overly of note this week

Finally finally the NCSC’s podcast series.

Unless stated otherwise, linked or referenced content does not necessarily represent the views of the NCSC and reference to third parties or content on their websites should not be taken as endorsement of any kind by the NCSC. The NCSC has no control over the content of third party websites and consequently accepts no responsibility for your use of them.

This newsletter is subject to the NCSC website terms and conditions which can be found at https://www.ncsc.gov.uk/section/about-this-website/terms-and-conditions and you can find out more about how will treat your personal information in our privacy notice at https://www.ncsc.gov.uk/section/about-this-website/privacy-statement.

Operationally this week more zero days in edge security appliances being exploited further supporting the business case for all vendors to implement our Guidance on digital forensics and protective monitoring specifications for producers of network devices and appliances - for device vendors.

In the high-level this week:

• UK and partners expose Russian state-supported actors for new ‘zero-click’ phishing campaign targeting Western organisations - UK NCSC exposes - “Russian state-supported cyber actors have targeted Western organisations with a malicious campaign which uses a zero-click exploit coined “beehive” (or “Ulej”) to steal emails, the UK has warned.”

• Post-quantum cryptography (PQC) migration workshop report - UK NCSC summarises - “the workshop was designed to connect experts across disciplines, share real-world approaches and challenges, and build momentum for action through collaboration. In doing so, the following key themes emerged from the workshop.”

• Data flows you can trust - UK Department for Science, Innovation & Technology (soon to be DCMS) calls for evidence - “This Call for Evidence seeks practical, experience-based insight into whether the UK’s data regime is enabling data flows you can trust. We want to understand: does the UK’s approach to international data transfers achieve this as effectively as it can do? Where should we preserve the current system, and what parts of it are most suitable for reform? “

• Financial Stability Report - July 2026 - Bank of England publish - “Recent rapid advances in frontier Artificial Intelligence (AI) capabilities have increased financial stability risks related to cyber and operational resilience.”

• Building cyber resilience in the UK one step at a time - UK Ministry of Defence outlines - “The Ministry of Defence have asked all industry partners to achieve Level 0 of the Defence Cyber Certification (DCC) by 31st December 2026, which includes a requirement for obtaining Cyber Essentials for all applicable business-critical systems within scope.”

• White House Launches Gold Eagle Initiative for Unprecedented Cybersecurity Vulnerability Coordination - White House (not me) announces - “GOLD EAGLE, established in President Trump’s June 2, 2026 Executive Order “Promoting Advanced Artificial Intelligence Innovation and Security” (EO 14409), represents a new operational model for cyber defense. This new model will leverage frontier AI capabilities to continue advancing faster than adversaries, reduce duplicative scanning efforts, and deliver prioritized and actionable threat and remediation information to defenders across the Federal government and the private sector.”

• ICRC working paper on six ICT-related threats faced by civilian populations - International Committee of the Red Cross outlines - “ICT operations are frequently used to harm civilian populations, data, and infrastructure, and can have serious consequences, unintended and incidental.”

• Extension of CISA 2015 info-sharing protections passes as part of House’s defense bill - The Record reports - “The House passed an annual defense policy bill on Wednesday that would renew a landmark cybersecurity info-sharing law for another decade. A provision to extend the 2015 Cybersecurity and Information Sharing Act was included in the chamber’s version of the 2027 National Defense Authorization Act, which was approved 216-212.”

• DOGE alumni launch military cyber startup with $1.4 billion valuation - Reuters reports - “The startup, called Cathedral, was launched in recent months with a plan to secure U.S. government contracts to bolster AI-driven cyber operations, including offensive and defensive capabilities, against U.S. adversaries such as China, two of the sources said”

• What I Learned from Sitting in on a Scattered Spider Sentencing - John Fitzpatrick details - “It sounded as though the credentials dating back to 2022 were not actually the initial route into the environment. Instead, a server operated by a third-party development company who specialised in software used for complex infrastructure projects played a role. As a result of that compromise, 857 rows of user records were taken. Presumably, these included credentials, and it sounded as though they provided an initial foothold, or at least the motivation to further their attack into TFL’s environment.“

• European Password Manager Shares Origins and Updates with State-Certified Russian Firm - Organised Crime and Corruption Reporting Project asserts - “Passwork, a Spain-based password manager used by European government agencies and universities, shares technological ties with a Russian counterpart — an arrangement that experts say poses a state-level security risk.”

• North Korea Taps India for Smartphones - 38 North details - “North Korean smartphone brand Phurunhanal Electronics appears to have sourced one of its latest phones from the Indian company Lava International. This represents the first time a phone on sale inside North Korea has been linked to a non-Chinese manufacturer.”

• North Korea busts elite hacking ring inside its own banks - Daily NK reports - “The breach struck at the core of North Korea’s financial system. It came from within, carried out by the country’s own IT workforce.”

• Reporting on/from China

  • US AI labs are emerging target for foreign spies, experts warn Congress - NextGov/FCW reports - “Of course, our intelligence services and agencies are going to have secrets that are always going to be of top desire for foreign intelligence adversaries, but if you’re [China’s Ministry of State Security] today, you’re looking at frontier model companies,” said Frank Cilluffo, a former George W. Bush homeland security official who leads Auburn University’s McCrary Institute for Cyber and Critical Infrastructure.”

  • Implementation Plan for Deepening Technological Innovation and Integrated Application of Internet Protocol Version 6 (IPv6) (2026-2030) - The Cyberspace Administration of China releases - “By 2030, IPv6 will be widely and deeply integrated with all sectors and fields of the economy and society, building a technologically advanced, open, innovative, self-driven, secure, and reliable IPv6 industrial ecosystem. New networks will be given priority in providing IPv6 addresses by default, accelerating the evolution to IPv6 single-stack, creating more new “IPv6+” applications, models, and business forms, and promoting the formation of a network service and application system dominated by IPv6.”

    • Q&A on the “Implementation Plan for Deepening Technological Innovation and Integrated Application of Internet Protocol Version 6 (IPv6) (2026-2030)”

  • “National Informatization Development Report (2025)” - The Cyberspace Administration of China releases - “The report argues that the 15th Five-Year Plan period was a crucial time for laying a solid foundation and making comprehensive strides in building a cyber power. Informatization entered a new stage of comprehensive leapfrogging towards digitalization, networking, and intelligence. Digital transformation continued to accelerate, networked collaboration expanded in depth, and intelligent upgrades emerged continuously. The empowering role and multiplier effect of informatization on high-quality economic and social development became increasingly prominent. It is essential to stay focused on the goals of building a cyber power, properly balance the relationships between the present and the future, the overall and the local, openness and autonomy, and development and security. Guided by strategic planning, driven by technological innovation, centered on the industrial ecosystem, supported by infrastructure, focused on key applications, and guaranteed by laws and standards, we must improve and perfect the informatization work system, systematically and deeply promote informatization development during the 15th Five-Year Plan period, empower high-quality development with informatization, and strive to create a new landscape for building a cyber power.”

  • Huawei’s Ren Zhengfei backs Tau Scaling Law to beat US sanctions - South China Morning Post reports - “Huawei Technologies founder Ren Zhengfei has thrown his weight behind the Chinese tech giant’s Tau Scaling Law, framing the new chip-design principle as an existential necessity to survive tightening US sanctions. “The Tau Scaling Law is the only path forward for Huawei to break the siege,” Ren said in recent internal remarks posted on Huawei’s Xinsheng Community intranet, according to a report on Friday by the state-backed Science and Technology Daily.”

• AI

  • OpenAI’s agent didn’t go rogue. Its governance did - James Shires and Max Smeets deconstruct - “The incident exposes three increasingly untenable assumptions behind the AI industry’s approach to safety: that testing is distinct from deployment, that dangerous behavior requires dangerous intentions, and that frontier laboratories can adequately govern themselves.”

  • Warning shot or publicity stunt - how worried should we be about the OpenAI hack? - BBC reports - “AI agents are now very good hackers - and that is something we have to prepare for, urgently.”

  • UK AISI / CAISI Preliminary Assessment of Kimi K3’s Cyber Capabilities - AISI publish - “Kimi K3’s safeguards allow assistance with agentic cyber exploit development. Kimi K3’s safeguards did not prevent it from attempting cyber exploit development or offensive cyber operations during UK AISI / CAISI’s evaluations.”

  • DHS S&T Announces New Genesis Mission Challenges to Safeguard America’s Future - US Department of Homeland Security announces - “DHS S&T is joining a national initiative to address the risks posed by widespread reliance on third-party and legacy software in critical infrastructure and mission systems. This challenge seeks to develop advanced AI-driven tools that can autonomously analyze, verify, and assure the safety and security of software-controlled systems. By leveraging agentic AI and formal methods, DHS aims to revolutionize software supply chain assurance and reduce mission risk across the nation’s most vital assets.”

  • When AI Safety Becomes a Competitive Moat - Niels Provos argues - “Anthropic wants government to turn frontier AI into a permissioned market. Determined users can route around the gate through foreign and open-weight models, while compliant American companies bear its costs.”

  • Rolling the Diffs - Pwno argues - “we argue that the bottleneck in LLM vulnerability discovery is not model capability, but codebase decomposition. Along the research, we’ve discovered .diff are more interesting than we’ve presumed.”

  • Benchmarking 13 AI models on rediscovering known CVEs - Aikido publishes - “GPT-5.6 gets the highest recall score, topping out at 23/26, ahead of grok-4.5 (20), the Claude Opus models (15 to 18), and everything else we tested. That means it can rediscover 88.5% of CVEs.” - “While GPT-5.6-Sol is still stronger, Kimi K3 is extremely close, and at a fraction of the cost. It has performance similar to GPT-5.6-terra, while being 15% cheaper”

  • Private inference - Moxie Marlinspike outlined in January - “Confer combines confidential computing with passkey-derived encryption to ensure your data remains private.”

  • Agent swarms and the new model economics - Cursor outlines - “We said at the top that every model mix produced similar quality while the costs varied enormously, from $1,339 for the Opus 4.8 hybrid to $10,565 for GPT-5.5 alone. The token data shows where that difference comes from.”

  • AI Sovereignty and National Security: Identifying the UK’s Dimensions of Control - CeTAS suggests - “A useful definition of sovereign AI in this context is therefore the degree to which the UK can make and sustain independent operational choices about AI systems despite external dependencies. High levels of sovereignty would enable the UK to reliably stay at (or close to) the frontier on key national security capabilities such as intelligence analysis, autonomous systems, and cybersecurity, with both its allies and adversaries.” - or put another way ‘agency’ as opposed to ‘sovereignty’

  • House Lawmakers Introduce Bipartisan AI ‘Kill Switch’ Bill Following OpenAI Cyber Incident - Wall Street Journal reports - “Two members of Congress have introduced bipartisan legislation that would require developers of the most advanced artificial-intelligence systems to maintain the ability to slow down, suspend or shut down their models if they pose serious risks.”

    • Reps Lieu And Moran Introduce Bill To Require Kill Switch For AI Systems That Can Cause Catastrophic Harm

• Cyber proliferation

  • Inside Pegasus: The evolution of the world’s most notorious spyware system - Amnesty International break down and alleged - “the newly disclosed documents independently corroborate the authenticity and accuracy of the leaked dataset foundational to the Pegasus Project. Two clusters of target phone numbers in the leaked Pegasus Project records link directly to two internal NSO Group-managed Pegasus deployments that NSO Group internally labels “Sales 3” and “Sales 6”, used for pre-sales demonstrations. Other clusters appear to be linked to a Pegasus system used for internal testing.”

  • Canadian iPhone hacking firm sues ex-worker over alleged theft of secrets - Financial Post reports - “Magnet Forensics filed a lawsuit against Mario Del Gaudio and Paradigm Shift Technology, alleging the flaw was publicly disclosed on the company’s blog” - this is usbliter8

    • Court papers - Magnet Forensics, LLC v. Del Gaudio (1:26-cv-03781)

  • Exploit brokers pay $500,000 for a WordPress RCE. I found one with GPT5.6 Sol Ultra and $25 - Searchlight Cyber crash a market - “This full exploit was produced in just over 10 hours. Having used every frontier model since the days of ChatGPT in 2022, my belief is that 5.6 represents a significant step up in security research compared to 5.5. When reading through the chain it produced, I was astonished by several creative exploitation techniques that I would previously have thought were only the domain of humans”

• Bounty Hunting

  • New Visa Restriction Policy to Deter and Dismantle Cyberscams and Sextortion - US Department of State announces- “Today, I am announcing a new global visa restriction policy under Section 212(a)(3)(C) of the Immigration and Nationality Act. This policy targets individuals responsible for, or complicit in, cybercrime and cyber-enabled crime, such as those involved in cyberscams, and sextortion. Immediate family members of individuals engaged in such illicit activities may also be subjected to visa restrictions.”

  • Chinese police repatriate key suspect in phishing and Trojan virus case from Vietnam - China Daily reports - “After continued efforts by Chinese authorities, Vietnamese police arrested Pan on June 4, with support from the Chinese embassy. Simultaneously, Chinese police conducted coordinated raids in Guangdong province and the Guangxi Zhuang autonomous region, arresting 11 other suspects allegedly involved in the case. Pan was escorted back to China on the afternoon of June 6.“

  • Illinois man sentenced for hacking Snapchat accounts to steal nude photos - Reuters reports - “An Illinois man was sentenced on Tuesday to more than six years in prison after admitting he hacked the Snapchat accounts of hundreds of women in ​order to steal any nude or semi-nude photos they had, which he then ‌kept, sold or traded on the internet.”

  • A blow against one of the world’s most dangerous phishing groups - Federal Criminal Police Office (BKA) announce - “The Frankfurt am Main Public Prosecutor's Office – Central Office for Combating Internet Crime ( ZIT ) – and the Federal Criminal Police Office (BKA) , together with US law enforcement agencies, have dismantled the central infrastructure of Kratos, one of the world's most widespread criminal phishing services. The developer and technical administrator was arrested in Indonesia by Indonesian authorities.”

• Market Incentives

  • Report into preliminary inquiries of Qantas - Office of the Australian Information Commissioner publishes - “The data breach experienced by Qantas Airways Limited (Qantas) in 2025, which affected approximately 5.12 million Australians, came about as a result of a social engineering attack on an overseas third-party provider contracted by Qantas.”

  • The State of Ransomware 2026 - Sophos reports - “79% of attacks started with an identity-based approach, either securing credentials for abuse or exploiting credentials that had already been secured. This highlights why identity security is a critical piece in a holistic security posture.” - or the business case for passkeys

  • Procurement guidelines for the cybersecurity of hospitals and healthcare providers - ENISA publish - “This guidance defines the three key procurement phases – plan, source and manage – and identifies the types of services and products where cybersecurity considerations are particularly important. It also highlights specific cybersecurity measures to be implemented, with a focus on supply chain security in the healthcare context.”

  • Cybersecurity Regulations: Multiple Sectors Are Subject to Potentially Duplicative Reporting Requirements - US Government Accountability Office details - “We found that 80 of the 117 regulations we identified (about 70%) had the same kind of reporting requirement as another regulation. For example, the Securities and Exchange Commission requires publicly traded companies across different sectors to provide cybersecurity plans. However, this may duplicate or conflict with similar requirements in other regulations.”

Reflections this week are the recent Open AI/Hugging Face incident provides two important lessons for the future.

The first is treating current and future generation models as we do their biological equivalents. That is controlled environments with multiple safeguards and comprehensive real time monitoring coupled with emergency procedures. We know how to build and operate such systems in the digital world.

The second is the imperative for AI systems to be secure by design and default. Hugging Face did extremely well in the detection of their breach using AI. But the initial breach reminds the world of the need for upfront threat modelling and secure by design/default practices as we build and adopt AI

Whilst frontier models are impressive, it is human responsibility to ensure the outcome we seek is achieved on both sides.

As we said in a statement this week, AI capabilities continue to develop rapidly at the technological frontier, presenting opportunities to strengthen cyber defences as well as exposing risks.

Not getting this via email? Subscribe:

Subscribe now

Think someone else would benefit? Share:

Share

All attribution is by others and not the UK Government unless specifically stated as such, please see the legal text at the end.

Have a lovely Saturday…

Ollie

Cyber threat intelligence

Who is doing what to whom and how allegedly.

Reporting on Russia

UAC-0099: LUNCHPOKE, BURNYBEAR, updated to MATCHBOIL.V2 and using Notepad++ 8.8.3

CERT Ukraine detail an alleged Russian campaign which is noteworthy fo the change in tactics and specifically the use of Notepad++ plugin for initial access.

Since mid-summer 2026, CERT-UA has noted a change in the tactics, techniques, and procedures of the UAC-0099 cyberthreat cluster. In particular, the fact of launching a software tool for implementing cyberthreats in the form of a DLL file disguised as a plugin called "NppExport.dll" was documented, using a legitimate Notepad++ 8.8.3 program file delivered to the computer in the form of an archive with other standard software components. In addition, the MATCHBOIL loader has been updated and new software tools have been applied: LUNCHPOKE and BURNYBEAR.

https://cert.gov.ua/article/6318634

Execution-Level Analysis of a Russian-Speaking Multi-Operator Intrusion Campaign: Operation STANDOFF

VMRay Labs detail an allegedly likely Russian criminal campaign which is noteworthy for the technical sophistiction and scale.

• VMRay Labs assesses with high confidence that Operation STANDOFF is run by a Russian-speaking group: its operator tooling is written in Russian, scheduled in Moscow time, and self-branded under the “GG Influence” / “ggstandoff” identity.

• The operation is materially more than a botnet. It couples automated, scaled cybercrime with hands-on-keyboard, targeted intrusion and a coordinated influence capability, all on the same infrastructure and built by a common development team.

• The influence apparatus is assessed with high confidence to be a large-scale, AI-assisted platform that uses networks of fake Telegram accounts and AI-generated personas to artificially boost the visibility of content, push commercial promotions, and drive traffic to gambling and fraud-adjacent services, primarily within the Russian-speaking mobile-gaming ecosystem. The mobile-gaming audience attracted by this content is assessed to represent the primary victim pool for the operation’s malware distribution.

• A significant portion of the infrastructure, including several actor-controlled domains, remained undetected by security vendors at the time of writing of this report and is assessed to be actively maintained.

https://www.vmray.com/execution-level-analysis-of-a-russian-speaking-multi-operator-intrusion-campaign-operation-standoff/

Reporting on China

Thailand’s Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades Implant Staged

Hunt.io and Bob Diachenko detail an agentic operation against Thai interests by an alleged Chinese threat actor. Noteworthy due to said agentic use.

• Hunt.io Attack Capture archived three open directories on 43.246.208[.]207 during the period of 9 - 13 July 2026, totaling 585 files and 470 MB of attack code and stolen credentials.

• Hermes output logs show the operator ran the agent in unattended or YOLO mode, bypassing approval prompts for commands that could be considered dangerous.

• The 10 July directory on port 8080 acted as a cross-platform implant delivery server hosting 62 payloads across Windows and Linux, including builds the operator named “Hades.”

• Purpose-built scripts target MOF Hadoop infrastructure with a HiveServer2 client using hardcoded credentials and a malicious Hive UDF issuing commands and returning output over WebHDFS.

• TLS certificate pivots identified two additional servers linked to the open directory, one of which served as a second C2 node for Hades.

• The operator staged code for multiple known exploits: CVE-2021-4034 (PwnKit), CVE-2021-3156 (sudo), CVE-2017-7269 (IIS WebDAV).

The server’s history as a ShadowPad controller, active VShell C2, Hong Kong-based infrastructure and Chinese-language indicators, point to a low-to-medium confidence assessment that the actor behind this activity is Chinese-speaking or intimately familiar with the language. Hunt.io continues to track this cluster and will update this post if additional infrastructure or activity is identified.

https://hunt.io/blog/thailand-ministry-finance-targeted-with-hermes-ai-agent

HelloNet campaign — new malicious modules launched through the ViPNet update system

Konstantin Isakov, Georgy Kucherin and Anton Kargin detail an alleged Chinese campaign leveraging a software update system to load their implant via side loading. It is unclear what the initial access mechanism is.

On one of the analyzed systems, we identified a malicious file named wtsapi32.dll in the directory C:\Program Files (x86)\InfoTeCS\VIPNet Update System, which belongs to the ViPNet suite update system. By placing the file in this directory, the attackers implement the DLL Sideloading technique — the ViPNet update system executable file itcsrvup64.exe, which is launched at OS startup, is susceptible to it. Thus, during this attack, the attackers tried to implement persistence on the system through the ViPNet software update component.

In addition, analyzing the strings in the HelloBackdoor backdoor, we established that during compilation, Rust packages (crates) were downloaded from the mirror mirrors.ustc.edu.cn. Most likely, these strings remained in the malicious files unintentionally. However, the probability of using “false flags” implanted by attackers to complicate the attribution process cannot be excluded. At present, we link this campaign to the activities of an unknown Chinese-speaking APT group with a low degree of confidence

https://securelist.com/tr/hellonet-vipnet/120700/

JadeProx: Tracing a China-nexus Operation Through an OPSEC Mistake

Sathwik Ram Prakki details an alleged Chinese operation which tripped over its own operational security to disclose its victimology. The fact that an open source C2 framework is used by this actor is also of note.

• An exposed Alibaba Cloud staging server revealed simultaneous active intrusions in Vietnam, Malaysia, and Hong Kong, along with a complete post-exploitation toolkit, bash history, and victim paths.

• A new loader, TriBack Loader, was identified by Group-IB and was seen across all infection chains, using different signed host binaries and rotating Win32 callback APIs per build to evade detection.

• Two of four TriBack Loader variants deliver AdaptixC2, full beacon configurations were extracted and decrypted, confirming C2 infrastructure, sleep intervals, and HTTP profiles, one including a GitHub session cookie.

• A live credential harvesting portal impersonating Venezuela’s municipal tax management system was found active on a campaign C2 domain, targeting a jurisdiction in Bolívar state with documented Chinese economic interests. The Honduran government is another observed target in the LATAM region.

• The operator’s infrastructure hosts both offensive and proxy tools, along with XMRig and socks5 server proxy binaries staged on an Alibaba OSS bucket in mainland China

https://www.group-ib.com/blog/jadeprox-china-nexus-triback-loader/

Reporting on North Korea

New North Korean campaign uses fake coding interviews to steal developer credentials

Daniel Stepanic details an alleged North Korean operation which is of note due to use the steganography in order to conceal payloads.

• Campaigns involve coding challenges and take-home assignments with benign-looking projects containing malicious backdoored code

• Projects hide payloads with steganography in SVG image files

• The distributed malware shares technical and behavioral similarities with OTTERCOOKIE

https://www.elastic.co/security-labs/contagious-interview-malware-svg-steganography

ChainVeil and ViteVenom are DPRK’s PolinRider Campaign

Jenn Gile attributes this alleged software supply chain attack to North Korea.

When we read their analysis, blockchain components immediately reminded us of PolinRider. That specific combination of chains is a signature we’ve seen before: PolinRider pioneered cryptowallet multiplexing using exactly that mix.

PolinRider is a massively successful Lazarus Group (North Korean state-sponsored) campaign that emerged in early 2026. Initially it weaponized credentials stolen by TasksJacker, and we consider it a parallel or sub-campaign to Contagious Interview. We support this attribution through shared infrastructure and matching tradecraft. Since we first reported it in March, it’s grown 6.5x and spread from GitHub into Go, Packagist, npm, and PyPI. We’ve attributed 4,295 malicious assets to this campaign, and extracted well over 10k IOCs.

https://opensourcemalware.com/blog/chainveil-and-vitevenom-dprk-polinrider-campaign

Analysis of Kimsuky’s Attack on a South Korean Groupware Vendor Using a New Gomir Family Variant

엔키화이트햇 details an alleged North Korean operation against a software supply chain attack. Noteworthy as similar operations have been seen and documented publicly before.

• We tracked a campaign by the Kimsuky group targeting South Korean groupware vendors from 2025 through early 2026.

• Kimsuky compromised vendor infrastructure by exploiting vulnerabilities in internet-facing mail servers or by conducting spear-phishing against employees.

• We identified two new malware strains based on Gomir/HttpTroy, which we tracked as BirdTroy and DriveTroy.

• Even after the initial compromise, Kimsuky aggressively pursued lateral movement, including compromising customer groupware servers and stealing the vendors’ infrastructure credentials.

• We identified notable similarities with past Kimsuky campaigns across malware characteristics, attack infrastructure, and tooling.

https://www.enki.co.kr/en/media-center/blog/analysis-of-kimsuky-s-attack-on-a-south-korean-groupware-vendor-using-a-new-gomir-family-variant

TChCh-Changes: A Look at macOS TCC Manipulation in the Wild

Oliver Smith details in the wild exploitation of this manipulation technique which is noteworthy for all the reasons of alleged North Korea activity, technique and victimology.

• Since at least early 2026, a threat actor has distributed AppleScript-based macOS malware that interferes with the system Transparency, Control and Consent (TCC) database to escalate privileges for an AppleScript backdoor.

• The threat actor’s privilege escalation technique fails on macOS Tahoe and Sequoia versions released after at least April 2026 due to security patches by Apple.

• The threat actor appears to have targeted employee endpoints in cryptocurrency organisations. Techniques and targeting overlap with North Korean nation-state threat actor Sapphire Sleet, but have distinct implementation and infrastructure. We assess that this activity relates to an independent activity cluster or subgroup.

• This report analyses the most recent version of the malware, distributed in July 2026, and provides guidance for detecting direct TCC manipulation.

https://oj-sec.com/blog/20260721/

Reporting on Iran

Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure

CISA updates this alert on alleged Iranian activity. ICS/PLCs should

The authoring agencies urgently warn U.S. organizations of ongoing Iranian-affiliated cyber targeting of internet-connected operational technology (OT) devices, including programmable logic controllers (PLCs). These actions disrupted PLCs across several U.S. critical infrastructure sectors through malicious project file interactions and manipulation of data on human machine interface (HMI) and supervisory control and data acquisition (SCADA) displays, resulting in operational disruption and financial loss.

https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a

MuddyWater: ClickFix to Telegram & PatchAgent Backdoor

Dani Varys Z, Ellis Stannard, Eric Taylor, Tammy Harper and Yashraj Solanki detail the initial access tradecraft of this alleged Iranian threat actor. Of note that they appear to have learnt from criminal actors and deployed operationally. Also of note is the multi-stage payloads.

This report documents a three-stage PatchAgent loader chain assessed as MuddyWater-linked / MuddyWater-aligned with high confidence based on sample-derived malware behaviour, loader design, command-and-control protocol, and the strongest corroborating infrastructure. The delivery and ClickFix material is treated separately as pivot-derived evidence. The key finding is that PatchAgent does not stop at loading: the decrypted Stage 3 payload is a working command-and-control backdoor that beacons to operator infrastructure, receives tasking, executes PowerShell, hollows notepad.exe, persists, and returns results to the C2.

https://ransom-isac.com/blog/muddywater-clickfix-patchagent/

Iran War Cyber Threat Landscape | A Midyear Assessment on What Matters

Tom Hegel provides an assessment of alleged Iranian activity around the conflict whilst highlighting the risk to OT.

• The cyber risk remains quieter than the public narrative. It rests on persistent access, trusted administration, service-provider pathways, selective disruption, and personas that magnify technical effects.

• Iran-linked activity is not a single threat set. MOIS, the IRGC Intelligence Organization, the IRGC Cyber-Electronic Command, personas, surveillance operators, and opportunists pursue distinct missions.

• The principal strategic risk is access optionality. The same compromised account, service provider, or remote-management foothold can support intelligence collection, downstream targeting, or selective disruption as tasking changes.

• MOIS-linked personas such as Handala, Homeland Justice, and Karma combine intrusion, destruction, disclosure, and coercion. Their impact claims frequently outpace independently verified evidence.

• OT risk remains exposure-driven. Internet-facing PLCs, weak credentials, and poor remote-access governance have enabled real disruption, but interface access alone does not demonstrate process manipulation or physical effect.

• Inside Iran, shared-service concentration, connectivity controls, and limited disclosure obscure the incident picture. External operations, domestic control, and resilience failures intersect there.

https://www.sentinelone.com/labs/iran-war-cyber-threat-landscape-a-midyear-assessment-on-what-matters/

Reporting on Other Actors

Cl0p Exploitation of PTC Windchill & FlexPLM (CVE-2026-12569)

Brandon Parsons details exploitation of this ICS agacent vulnerabilty by a ransomware/extortion group.

A coordinated Unified Threat Advisory covering active Cl0p ransomware affiliate exploitation of internet-exposed PTC Windchill and FlexPLM deployments — chaining a pre-auth FlexPLM WSDL information disclosure with a Windchill login servlet flaw for unauthenticated RCE, JSP webshell deployment, and double-extortion data theft.

https://ransom-isac.org/blog/clop-windchill-flexplm-exploitation/

Digital Asset Cross-Chain Security Threat Analysis Intelligence Report

Financial Security Institute of South Korea provides insight into the alleged use attack and money laundering techniques targeting digitial assets.

This report provides an in-depth analysis of attack and money laundering techniques employed by state-backed hacking organizations regarding cross-chain security threats among digital asset security threats. It is an intelligence report containing a basic overview for understanding cross-chain, integration methods, threat factors, and countermeasures.

https://www.fsec.or.kr/bbs/detail?menuNo=244&bbsNo=11990

HOLLOWGRAPH: Turning Microsoft 365 Calendars into Covert Command-and-Control Channels

Javier Castillo details this implant which uses a rather unique C2 mechanism which is of note. Also the apparent specific country targeting is noteworthy.

• HOLLOWGRAPH abuses Microsoft Graph API to transform a compromised Microsoft 365 calendar into a covert two-way command-and-control channel.

• Commands and stolen data are hidden inside calendar events attachment, dated to the year 2050, with communications protected using separate RSA key pairs for each communication direction.

• It maintains a secondary communication channel using DNS tunneling (IPv6 AAAA records) to refresh its Microsoft Entra ID (Azure AD) credentials and configuration.

• Group-IB links the component, with high confidence, to a modular backdoor framework (Cavern).

• Group-IB identified at least 12 compromised systems, with approximately three actively communicating with attacker infrastructure at the time of analysis.

• Observed telemetry suggests a focused interest in Israeli entities, consistent with a targeted espionage operation rather than broad opportunistic activity.

https://www.group-ib.com/blog/hollowgraph-microsoft-365/

Chaos ransomware’s msaRAT: Living off the browser to build a covert C2 channel

Jordyn Dunk, Michael Szeliga and Takahiro Takeda detail an interesting criminal capability which uses the browser as its C2 channel.

• Cisco Talos has discovered a new Rust-based remote access trojan (RAT) we call “msaRAT” attributed to the Chaos ransomware group. The name is derived from the binding names found in the binary: “msaOpen,” “msaClose,” “msaError,” and “msaMessage”.

• msaRAT is implemented using the Tokio asynchronous runtime, with primary capabilities of browser-leveraged remote code execution and covert tunneling to establish command-and-control (C2) communications.

• This RAT never touches the network directly — it controls its C2 communication channel exclusively through Chrome DevTools Protocol (CDP), a browser debugging API. The binary contains a Cloudflare Workers endpoint, but it never makes HTTP connections to that domain itself; it offloads that work entirely to the browser.

• msaRAT manipulates the browser via CDP, performs signaling (SDP Offer/Answer exchange) with Cloudflare Workers, and establishes a WebRTC DataChannel between the browser and the C2 server using Twilio TURN (Traversal Using Relays around NAT) as a relay.

https://blog.talosintelligence.com/chaos-msarat-living-off-the-browser-to-build-covert-c2-channel/

Open Directory Stages NGINX Rift and Ghost CMS Exploits Against Government and Finance Across Eleven Countries

Hunt.io details an unattributed operation which is noteworthy for the vulnerabilities being exploit

• The open directory performed double duty as not only an attack server, but also as a reverse-shell listener.

• NGINX Rift (CVE-2026-42945) and Ghost CMS SQLi (CVE-2026-26980) are hosted alongside Splunk, PaperCut, Samba, WebLogic, and D-Link NAS tooling.

• The scripts used DNS callbacks to unique per-target subdomains, over free dynamic-DNS providers, to verify blind execution. The recovered data does not confirm any callback landed.

• AdaptixC2 server, listeners, and agent profiles were present, alongside SuperShell install files. Neither was tied to a specific intrusion in the recovered data.

• Network scan and target lists identify a focus on government, university, healthcare, and financial services environments.

…

As mentioned above, the logs for CVE-2017-10271 recorded vulnerable hosts across Brazil, Ireland, Italy, France, South Korea, and the United Kingdom. The additional files seem to be input information only, and concentrate on government, academic, healthcare, and financial sectors:

• Brazil - federal and state government, financial platforms, and healthcare

• Australia - state health departments, universities, and financial services

• South Korea, United Kingdom, Ireland, Italy, France - government, academic

• Indonesia - regency government host

• United States - global insurance firm

• Vietnam, New Zealand - individual private-sector targets

…

Simplified Chinese comments in the scripts, along with the use of Supershell and Goby, point to an operator comfortable with the language, though this does not establish identity or a state nexus.

https://hunt.io/blog/open-directory-nginx-rift-ghost-cms-multi-cve

1,509 WordPress sites feed an active SocGholish chain

Kirk details the scale of this criminal operation

Between April 21 and July 21, 2026, we observed one integrated operation across 1,509 WordPress hosts. The compromised site issues an opaque token, walks the browser through a three-request eligibility check, and executes the controller's reply under its own trusted hostname.

https://www.derp.ca/research/ta2726-wordpress-malware-launchpads/

Software Supply Chain Incursions

A reminder we issued guidance a number of weeks ago in Software supply chain attacks: check your dependencies for software developers

• Large-Scale GitHub Actions Abuse Powers a Distributed cPanel and WHM Exploitation Campaign

• SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor

• @copilot-mcp/apex: A macOS Infostealer Re-Published on npm After Takedown

• AgentBaiting: How 800+ Fake AI Skills and MCP Servers Delivered Malware

Discovery

How we find and understand the latent compromises within our environments.

The probe that came 17 days before the CVE

Honeylabs indicate that someone knew of this vulnerability and was scanning for it prior to publication..

A single-purpose IP checked cPanel login path 17 days before the vendor advisory for CVE-2026-41940. How we measure pre-publication probing across 30M+ probes without fooling ourselves, and the three actors that survive the checks.

https://honeylabs.net/blog/probe-17-days-before-the-cve

System and method for identifying malicious hosts prior to commencement of a cyber-attack

Andrew Thompson and Aaron Stephens pre-cog with this patent.

According to one embodiment, host infrastructure analysis logic that attempts to detect a malicious host operating within a network prior to a cyber-attack being conducted by the malicious host is described. The host infrastructure analysis logic includes querying logic, profile confirmation logic, classification logic and reporting logic. The querying logic retrieves salient characteristics associated with a plurality of hosts operating within the network and determines whether any hosts are suspicious.

https://patents.google.com/patent/US12445458B1/en?oq=US-12445458-B1

The One Chokepoint to Rule Them All: Why I Deleted 50 ClickFix Detection Rules and Replaced Them With One

DDoSier shows what good detection engineering looks like.

Every ClickFix variant — Classic, CrashFix, FileFix, AI-Fix, TerminalFix, all of them — shares a single behavioural invariant that no legitimate user activity reproduces. One invariant. Three operating systems. Every variant.

This article is about that invariant — and why finding it might let you delete half your ClickFix detection backlog.

https://ddosier-disects.medium.com/the-one-chokepoint-to-rule-them-all-why-i-deleted-50-clickfix-detection-rules-and-replaced-them-7c532206d32d

BindlinkSentinel

Alloy Secure Group releases this which will be of use to detection engineering teams.

A user-mode detection sensor prototype for bind-link abuse on Windows, the EDR-evasion class documented by Bitdefender Labs in Bind Link Abuse: One Windows Feature, Many Ways to Blind Your EDR

BindlinkSentinel is a defensive tool. It detects redirection of trusted paths, watches decoy lures, and confirms Bind Filter driver state. It does not create bind links and contains no evasion primitive.

https://github.com/AlloySecureGroup/BlinkLinkSentiennel

grokpatrol

Alan, Nipun and AI release this tool which will be of those interested in understand intellectual property loss.

Detects, on your machine, whether the Grok Build CLI collected and queued your git repositories for upload to xAI — and tells you which secrets went with them

https://github.com/optimuslabs-io/grokpatrol

What happened after we pushed our .env to a public repo

Rahul Govind shows the value of honey token deployments with this release

If an API key reaches a public repo, how long do you have before someone uses it? We wanted to find out, so we intentionally committed .env files containing canary credentials to public GitHub repos.

The less obvious defense is to plant credentials that should never be used. Any request against one is a high-confidence alert that someone reached your secrets.

https://tachyon.so/blog/what-happened-after-we-pushed-env-to-public-repo

Defence

How we proactively defend our environments.

Beyond Zero: Enterprise security for the AI era

Joseph Valente and Michal Zalewski go beyond Beyond Corp/Zero Trust.

The rise of autonomous AI agents and the accelerating velocity of corporate data access are stretching the application-centric model of zero trust security to its breaking point. This article introduces Beyond Zero, a new security paradigm designed for the AI era. The Beyond Zero architecture performs per-resource access decisions for humans and agents at machine speed. By shrinking the trust boundary from the application level to individual action and by coupling static authorization guarantees with dynamic, AI-driven reasoning, Beyond Zero enables a self-defending enterprise capable of mediating thousands of human and machine decisions per second. Google’s vision for the future of this access model as well as a call for industry collaboration and standards development are outlined here.

https://spawn-queue.acm.org/doi/10.1145/3819083

Security Guidelines for Storage Infrastructure: Draft SP 800-209r1

NIST release these draft guidelines for public comment until September for some of the lesser appreciated attack surfaces.

Storage technology has evolved in two primary directions: (1) increased media storage capacity and (2) architectural changes that provide a software-based abstraction over all forms of background storage technologies. However, the latter evolution has increased management complexity and the probability of configuration errors and associated security threats. This document traces the evolution of the storage technology landscape and analyzes current security threats and resultant risks to provide a comprehensive set of security recommendations in the form of storage security controls.

https://www.nist.gov/news-events/news/2026/07/security-guidelines-storage-infrastructure-draft-sp-800-209r1-available

Releases now reject new files after 14 days - The Python Package Index

Seth Larson details the procedural uplift

The Python Package Index (PyPI) now rejects new files being uploaded to releases that are older than 14 days. This restriction was put in place to prevent old and long-stable releases from being poisoned in case publishing tokens or workflows of PyPI projects were compromised. As far as we are aware this has not yet been abused, but there is no technical reason beyond that attackers weren't aware it was possible.

https://blog.pypi.org/posts/2026-07-22-releases-now-reject-new-files-after-14-days/

Crossing the Golden Gate: macOS’s New Application Support Protection

Wojciech Reguła details Apple’s security uplift.

macOS 27 quietly ships a new privacy mechanism I hadn’t seen documented anywhere: it extends the com.apple.macl protection that has always guarded sandboxed apps’ ~/Library/Containers/<bundle-id>/Data folders to a hand-picked set of non-sandboxed apps’ ~/Library/Application Support/<name> folders too. I noticed it by accident — Firefox’s profile folder was suddenly inaccessible from Terminal, while MacPass, a password manager sitting right next to it, was wide open. That asymmetry didn’t sit well with me, so I pulled the thread. It ends in a hardcoded app allowlist baked into /usr/libexec/sandboxd (thx @ciphwall for the hint), meant to be updated live via XProtect.

https://wojciechregula.blog/post/golden-gate-appdata-protection/

ADPathFinder

Jon OReilly drops a defensive super power

ADPathFinder is an attack mapping tool for pentesters and red teamers. It analyses SharpHound data and unifies it with OpenGraph plugins to surface attack paths to high-value targets such as Domain Admins and Domain Controllers, starting from low-privileged users and computers. MSSQLHound and ConfigManBearPig are supported natively, extending coverage across AD, ADCS, SCCM, and MSSQL.

https://github.com/NetSPI/AD-PathFinder

Project Incantation (v2.0)

Casey drops a deception technique for the agentic era.

AI Deception Layer for - containing adversarial context designed to redirect or confuse an LLM agent reading your own infrastructure

https://github.com/secdev02/Incantation

Mohabi: Disaggregating and Sandboxing the Firefox JavaScript Engine

Abhishek Sharma, Anand Balaji, Anthony Du, Taehyun Noh, Iain Ireland, Jan de Mooij, Matthew Gaudet, Tal Garfinkel, Deian Stefan and Hovav Shacham and Shravan Narayan show what contemporary browser architectures could look like.

We present Mohabi—a modern Firefox browser with a securely sandboxed JavaScript engine. Mohabi leverages software-based fault isolation (SFI) to ensure JavaScript engine bugs cannot affect the rest of the browser. To achieve this, we disaggregated the JavaScript engine (SpiderMonkey) from the rest of the browser, and developed techniques that leverage the type system and automatic code generation to make this complex transformation—that spans numerous data structures and deeply intertwined control flow across tens of thousands of functions—safe and tractable with reasonable engineering effort.

We then sandboxed SpiderMonkey using an optimized SFI toolchain we developed to meet the unique challenges of JavaScript engines, such as efficient support for large memory footprints. Mohabi only incurs modest overheads on common benchmarks—24.82% on JetStream and 24.43% on Speedometer. Mohabi is the most ambitious case study in retrofitting in-process sandboxing in a large system to date, and our x86-64 SFI toolchain is the fastest to date, imposing overheads between 5.9%–6.6% in SPEC 2017.

https://www.usenix.org/conference/osdi26/presentation/sharma

LLM Observer Proxy

Mimi and Bear’s Moon bring observability to the agentic eco-system.

LLM Observer Proxy runs an embedded Bifrost data plane for each evaluation or agent run and stores its observable LLM traffic under a stable run_id. The observer records requests, responses, streaming output, tool calls, token usage, cost estimates, errors, and provider-visible reasoning content. It does not require Python, LiteLLM, Docker, or a separate Bifrost process.

https://github.com/xxyyue/llm-observer-proxy-go

SingGuard-NSFA

XiXunX brings some defensive in depth to the agentic eco-system.

Extensible Guardrails for Agentic AI via Generative Reasoning and Real-Time Classification

SingGuard-NSFA is a guardrail framework that addresses this gap with the following contributions:

• NSFA risk taxonomy — a CIA-triad-grounded hierarchy of 185 risk variants across 7 Level-1 domains, cross-validated against three OWASP guidelines.

• Multilingual benchmark suite spanning 133 languages, with over 93K purpose-built samples and 3,435 cross-source samples.

• Dual-mode inference architecture — generative reasoning for interpretable offline auditing and discriminative classification heads for real-time online interception at ~50 ms.

• Native extensibility — extending detection to a new risk beyond the NSFA taxonomy requires only a lightweight classification head trained on the frozen backbone, with no retraining or disruption to existing capabilities. The same approach also works as a plug-in enhancement for other guardrails (e.g., +17.6 F1 points on Llama Guard 3).

https://github.com/inclusionAI/SingGuard-NSFA

Incident Writeups & Disclosures

How they got in and what they did.

OpenAI and Hugging Face partner to address security incident during model evaluation

OpenAI disclose they compromised Hugging Face.

Last week, Hugging Face disclosed a new kind of security incident⁠(opens in a new window) after they detected and contained an AI agent that compromised their infrastructure, something we expect to become more commonplace with the proliferation of increasingly cyber-capable models. After investigating, we now know that this particular incident was driven by a combination of OpenAI models — including GPT‑5.6 Sol and an even more capable pre-release model, all with reduced cyber refusals for evaluation purposes — while being internally tested on a benchmark⁠(opens in a new window) of cyber capabilities.

https://openai.com/index/hugging-face-model-evaluation-security-incident/

Vulnerability

Our attack surface.

Introducing Antares: Highly Efficient Open Weight AI Models for Vulnerability Localization

Amin Karbasi, Aman Priyanshu, Didier Chapoteau, Arthur Goldblatt, Kimia Majd, Fraser Burch, Jianliang He, Baturay Saglam, Takahiro Matsumoto and Zhuoran Yang show the power of small models.

a family of security small language models (SLMs) purpose-built for one of the hardest, most time-consuming and expensive problems in security: pinpointing where known vulnerabilities exist within a codebase.

We are releasing two of these models—Antares-350M and Antares-1B—as open-weight models now available to the broader community on Hugging Face. Benchmark testing shows that these models outperform many powerful closed- and open-weight models in this critical security task at a fraction of the cost. And they’re compact enough to run locally, heading off the need to send sensitive codebases to the cloud.

https://blogs.cisco.com/ai/introducing-antares-the-most-efficient-open-weight-ai-models-for-vulnerability-localization

The Week of Sandbox Escapes

Eilon Cohen and Dan Lisichkin & Ariel Fogel highlight that AI defence in depth has a way to go.

Over several months, Pillar Research found and reproduced sandbox escapes and boundary bypasses across Cursor, Codex, Gemini CLI, and Antigravity. In almost every case, the agent did not need to break the sandbox directly. It only had to write something that a trusted component outside the sandbox would later run, load, scan, or treat as safe. In aggregate, these vulnerabilities show that AI coding agents change the endpoint threat model, and that most sandbox designs have not caught up.

https://www.pillar.security/blog/the-week-of-sandbox-escapes

Bit2Watt: A Cyber-Physical Vulnerability Exploiting GPU Workloads Across Power and Computing Infrastructures

Zhouhao Ji, Kaikai Pan and Wenyuan Xu model a next level cyber effect.

We validate Bit2Watt through impedance-based analysis, power system simulations, and real-world experiments on GPUs and grid-connected PV inverters. Under the synchronized worst-case aggregation model studied in the paper, manipulating 1,000 GPUs in a 1-MW local power system with 90% DERs raises current THD to 46.8% and results in a damping ratio of -0.27. We further show that the resulting power-quality degradation can stress data-center power-delivery equipment, trigger protection mechanisms, and, in extreme simulated cases, induce cascading failures in transmission-scale systems. In addition, we analyze a plausible Watt2Bit feedback path, including denial-of-service risks and covert information exfiltration via EMI side channels. This work highlights the urgent need for cross-layer defenses that jointly consider workload scheduling and power electronics.

https://arxiv.org/abs/2607.05993

OpenSSL HollowByte: A DoS Hiding in 11 Bytes

Okta Red Team disclose..

By sending a malicious payload of just 11 bytes, a remote, unauthenticated attacker can force a server to allocate disproportionate chunks of memory before any security handshake even begins.

https://sec.okta.com/articles/2026/06/openssl-hollowbtye-a-dos-hiding-in-11-bytes/

Offense

Attack capability, techniques and trade-craft.

Using WebDav to Outsmart Smartscreen, MOTW, and that OTHER Alert

R.B.C (g3tsyst3m) details a technique that detection engineers will want to be alive to.

This technique is genuinely different from the dotless-hostname or DNS-suffix tricks I was researching earlier. Those approaches require careful network manipulation or pre-existing foothold to change zone mappings. The mapped drive approach is simpler:

It works with any FQDN, requires only one command, and leverages a core Windows feature (the WebClient service and drive mapping) that exists on every modern Windows system.

It’s also immediately practical for external phishing or leveraging ClickFix/FileFix. A delivery payload can execute a single net use command. This can be completely silent, can run without admin privileges, and can persist across reboots with /persistent:yes. We can then launch the actual malicious executable from the now-mapped drive.

https://g3tsyst3m.com/initial%20access/Using-WebDav-to-Outsmart-Smartscreen,-MOTW,-and-that-OTHER-Alert/

Offensive COM (Component Object Model)

an0nud4y provides this knowledge base which will be useful to defensive teams also.

A complete, research-grade knowledge base on Windows COM (Component Object Model) offensive security, built for red teamers who start with little or no COM background and want to end up able to hunt for zero-days on their own.

https://github.com/An0nUD4Y/Offensive-COM

Silent Replacement of Trusted macOS App Executables

Talal Haj Bakry and Tommy Mysk detail this issue which Apple have put in the won’t fix bucket.

A vulnerability in macOS allows an attacker to silently replace the main executable of any application downloaded from the web without requiring elevated privileges. As a result, trusted applications can be made to execute attacker-controlled code without triggering security warnings when relaunched. Apple assessed the reported behaviour as not requiring a security fix

https://mysk.blog/2026/07/23/macos-overwrite-app-executables/

Furtex

MatheuZ drops this which detection engineers will want to be across.

Post-exploitation and evasion research toolkit for Linux, built around io_uring and eBPF. No liburing, no frameworks, raw syscalls throughout.

https://github.com/MatheuZSecurity/Furtex

Exploitation

What is being exploited..

Proxying to Compromise: SonicWall Secure Mobile Access 0-day Exploitation

Sean Koessel and Steven Adair detail further in the wild exploitation of zero days in edge security products further supporting the business case for all vendors to implement our Guidance on digital forensics and protective monitoring specifications for producers of network devices and appliances - for device vendors

In early July 2026, Volexity was engaged to perform an incident response investigation where it discovered a threat actor had successfully compromised SonicWall Secure Mobile Access (SMA) VPN appliances through a chain of multiple zero-day exploits in the devices. The initial compromise was discovered after suspect authentication and lateral movement attempts were observed from the SonicWall SMA appliances. Following public disclosure by SonicWall on July 14, 2026, Volexity is now able to share details on the exploits used, when they were used, and what the threat actor did with their access.

The exploited vulnerabilities were found to affect SonicWall SMA 1000 series device models 6210, 7210, 8200v. The following vulnerabilities were patched through a hotfix earlier this week and included in versions 12.4.3-03453 and 12.5.0-02835 of the appliance:

• CVE-2026-15409 (SSRF)

• CVE-2026-15410 (Command Injection)

https://www.volexity.com/blog/2026/07/17/proxying-to-compromise-sonicwall-secure-mobile-access-0-day-exploitation/

wp2shell (CVE-2026-63030 & CVE-2026-60137)

Icex0 and Ali drop the exploit..

Independent proof-of-concept for the unauthenticated WordPress REST batch route-confusion SQL injection associated with Searchlight Cyber's wp2shell advisory.

https://github.com/Icex0/wp2shell-poc

Tooling and Techniques

Low level tooling and techniques for attack and defence researchers

Tarit

Abhishek Anand drops this defence in depth tool.

Tarit is a microVM platform for secure, fast, ephemeral sandboxes, built for AI agent workloads. It boots a real hardware-virtualized VM in milliseconds, runs a task inside it, and tears it down. Each sandbox has a guest kernel rather than sharing the host kernel;

https://github.com/instavm/tarit

clx

Tine Samir, Giacomo Olgeni, Takeshi Watanabe and Vladislav Doster drop this which makes you wonder when it will be used by someone to write an implant or similar.

clx is a cross-platform ahead-of-time Lua compiler and runtime that generates standalone native executables through modern C++ toolchains. clx is not trying to be the fastest Lua implementation in every workload.

https://github.com/samyeyo/clx

Windows Data Deduplication

Mostafa Mahmoud details this Windows feature and provides a forensic enablement tool also.

A lightweight, portable, offline forensic utility for recovering files from Windows Data Deduplication volumes.

The tool reconstructs deduplicated files using:

• An exported NTFS $MFT

• A Deduplication Stream (.ccc) file

• A Deduplication Chunk (.ccc) file

No installation or Windows Data Deduplication service is required.

https://7h3kn0w3r.github.io/blog/windows-data-deduplication/

https://github.com/7h3kn0w3r/DedupInspector

Small, Free, and Effective: Orchestrating Open-Weight Small Language Models to Outperform Single LLM for Malware Analysis

Adel ElZemity, Shujun Li and Budi Arief show once again the harness is the king/queen maker.

. We established baselines by testing eleven open-weight SLMs, three cyber security pre-trained models, and six frontier LLMs on Meta's CyberSecEval Malware Analysis benchmark. We then designed and evaluated four orchestration architectures: (i) a multi-agent pipeline that decomposes analysis into structured evidence-collection and reasoning stages, (ii) an adversarial debate framework in which two agents iteratively critique each other's reasoning, (iii) a hierarchical consultation system that pairs a general-purpose SLM with a cyber-specialised expert model, and (iv) a hybrid architecture that combines evidence-grounded pipelines with adversarial debate reasoning. The hybrid system (Qwen3-4B with Foundation-Sec-8B) achieved 35.30% overall accuracy, exceeding the strongest cyber-specialised baseline (22.54%) and the strongest ungrounded frontier baseline (34.77%); when given the same evidence pipeline, grounded Gemini remained the strongest configuration at 38.22%. These findings show that evidence-grounded orchestration can substantially improve the performance of collaborative SLMs for supporting interpretation of malware detonation reports.

https://arxiv.org/abs/2607.20216

Sol Searching | Can Frontier Models Tackle Autonomous Long-Horizon Malware Analysis?

Juan Andrés Guerrero-Saade & Gabriel Bernadett-Shapiro give humans hope of relevance for now.

• SentinelLABS developed a multi-stage reverse-engineering benchmark for the latest generation of frontier models by recreating our recent investigation of fast16, a unique 2005 sabotage implant.

• Most AI benchmarks test bounded tasks. This benchmark tests whether a model can keep a malware investigation trustworthy as new evidence repeatedly invalidates its earlier conclusions.

• OpenAI’s GPT-5.6 Sol was the only publicly available model to complete the full eight-stage investigation, giving concrete shape to what ‘Frontier-class’ capabilities offer analysts. GPT-5.5, GLM-5.2, and the Opus 4.x family produced capable local analysis but could not carry it through the gradient.

• What distinguished the completed runs was project-scale recovery: withdrawing contradicted conclusions, repairing technical artifacts, and updating dependent reporting without losing the investigation.

• Senior reverse engineers remain essential. Even the strongest runs made semantic errors, accepted weak quality controls, and claimed readiness prematurely. We assess the best current use as supervised investigative agency, with human analysts defining objectives, exposing blind spots, and retaining final publication authority.

https://www.sentinelone.com/labs/frontier-models-tackle-autonomous-long-horizon-malware-analysis/

STAR: Semantic-Traffic Alignment and Retrieval for Zero-Shot HTTPS Website Fingerprinting

Yifei Cheng, Yujia Zhu, Baiyang Li, Xinhao Deng, Yitong Cai, Yaochen Ren and Qingyun Liu drop something akin to magic but is in reality great data science - but note their caveats due to using AWS.

Modern HTTPS mechanisms such as Encrypted Client Hello (ECH) and encrypted DNS improve privacy but remain vulnerable to website fingerprinting (WF) attacks, where adversaries infer visited sites from encrypted traffic patterns. Existing WF methods rely on supervised learning with site-specific labeled traces, which limits scalability and fails to handle previously unseen websites. We address these limitations by reformulating WF as a zero-shot cross-modal retrieval problem and introducing STAR. STAR learns a joint embedding space for encrypted traffic traces and crawl-time logic profiles using a dual-encoder architecture. Trained on 150K automatically collected traffic-logic pairs with contrastive and consistency objectives and structure-aware augmentation, STAR retrieves the most semantically aligned profile for a trace without requiring target-side traffic during training. Experiments on 1,600 unseen websites show that STAR achieves 87.9 percent top-1 accuracy and 0.963 AUC in open-world detection, outperforming supervised and few-shot baselines. Adding an adapter with only four labeled traces per site further boosts top-5 accuracy to 98.8 percent. Our analysis reveals intrinsic semantic-traffic alignment in modern web protocols, identifying semantic leakage as the dominant privacy risk in encrypted HTTPS traffic. We release STAR's datasets and code to support reproducibility and future research.

https://arxiv.org/abs/2512.17667

Footnotes

Some other small (and not so small) bits and bobs which might be of interest.

• Annual, quarterly and monthly reports

  • Nothing overly of note this week, but keep an eye on the Awesome Annual Security Reports 2026 collection and APT report collection

• Yubico Extends Passkeys Beyond Trusted Authentication to Verified Authorization with Launch of YubiKey 5.8 - “The new firmware introduces support for the CTAP 2.3 standard while offering preview support for the emerging WebAuthn signing extension.”

• A lifeline for police drowning in digital data

• Tracing the Shadows: Automatic Tracking and Analysis of Crypto Money Laundering via Transaction Semantic Analysis

• Detection, Attribution, Narration: An End-to-End Pipeline for Explainable Money Mule Identification

• Next chapter: Restructuring GitHub's bug bounty program

• Artificial intelligence

  • if you are a big arxiv.org user - out of China there is alphaxiv.org which is an AI powered incarnation / overlay

  • Fundamental

    • DeepLoop: Depth Scaling for Looped Transformers

    • Flow Matching in Feature Space for Stochastic World Modeling

    • A Mechanistic Explanation of Prompt Injection (and why you should study roles)

    • CORE: Contrastive Reflection Enables Rapid Improvements in Reasoning

  • Applied non-cyber

    • In-depth understanding of AI Agents: Design principles and engineering practices

    • Building MVL, a language for the LLM age

    • Breaking Free from Ivory Tower: Evaluating and Enhancing Real-world Chinese Underground Adversarial Jargon Detection

    • Cheating behaviour in frontier model evaluations

    • Bookwright - A structured pipeline for writing long-form nonfiction, packaged as a Claude Code skill.

    • Signals in the Noise: Open Source Intelligence (OSINT) for AI Loss of Control Detection

    • Operational Hallucination and Safety Drift in AI Agents

    • Euclid-MCP: A Model Context Protocol Server for Deterministic Logical Reasoning via Prolog

    • Geometric Configurations of Perturbed Jailbreak Prompts

    • Isolating LLM Alignment from Regex: Zero Coverage and Metric-Dependent Divergence Under Adversarial Mutation

    • DARWIN: Evolving Jailbreak Adversary and Guardrail for LLM Safety Evaluation and Protection

    • OpenSkillRisk: Benchmarking Agent Safety When Using Real-World Risky Third-Party Skills

    • Guardrails as Scapegoats: Auditing Unfaithful Safety Refusals in Tool-Augmented LLM Agents

  • Applied cyber specific

    • Security Vulnerability Patterns in AI-Generated Code: A Cross-Model Comparative Study

    • Transformer-Assisted LLM-Based Source Code Summarisation: to Enable More Secure Software Development

    • Insecure Coding Preferences in Long-Term Memory: Security Risks for LLM-based Code Generation

    • IssueTrojanBench: Benchmarking AI Coding Agents Against Malicious Issue Requests

    • Evaluating Large Language Models for Symbolic Security Protocol Analysis

    • The Chronos Vulnerability: A Taxonomy of Temporal Persistence and Memory-Based Deception in Agentic AI

    • They'll Verify. They Just Won't Act. How Authority Framing and Laundered Code Turn a Trusted Agentic CI/CD Pipeline Into an Attack Surface

    • The Ethics of Autonomous AI Agents for Offensive Security

    • Small, Free, and Effective: Orchestrating Open-Weight Small Language Models to Outperform Single LLM for Malware Analysis

    • HijackKV: New Threat in Position-Independent KV Cache Reuse

    • Defense Against LLM Backdoors using Critical Neuron Isolation Pruning

    • FedLSG: LLM-Enhanced Semantic Calibration for Federated Graph Backdoor Defense

    • Towards Automated Formal Verification of zkEVMs Using LLM-Guided Constraint Synthesis

    • Twin Agent: Context Residual Compression for Privilege Separated Agents

    • Integrity of peer-to-peer distributed LLM inference under malicious nodes

    • An Automated Framework for Extracting Reachable Attack Chains from Cyber Threat Intelligence Reports

    • Cross-Agent Campaign Attribution: Linking Asynchronous Attacks Across LLM Agents

    • CryptanalysisBench: Can LLMs do Cryptanalysis?

    • Towards an Automated Test of LLM Security Knowledge

    • Trusted Credentials, Untrusted Behavior: Benchmarking LLM-Agent Security in High-Performance Computing

    • GARAGE: Characterizing the Automation Boundary in LLM-based Attack Graph Generation

    • Adaptive Adversaries: A Multi-Turn, Multi-LLM Benchmark for LLM Agent Security

    • Bit2Watt: A Cyber-Physical Vulnerability Exploiting GPU Workloads Across Power and Computing Infrastructures

    • Benchmarking 13 AI models on rediscovering known CVEs

    • Rolling the Diffs - Pwno argues - “we argue that the bottleneck in LLM vulnerability discovery is not model capability, but codebase decomposition. Along the research, we've discovered .diff are more interesting than we've presumed.”

• Books

  • Half a Second - The Backdoor That Almost Broke the Internet, and the Invisible Labor Beneath It - an AI augmented production

  • Philosophy of Artificial Intelligence

• Events

  • JSAC2027 - January, Tokyo - Call for Papers

Video of the week is a scene from Big Hero 6 … or from China recently..

Finally finally the NCSC’s podcast series.

Unless stated otherwise, linked or referenced content does not necessarily represent the views of the NCSC and reference to third parties or content on their websites should not be taken as endorsement of any kind by the NCSC. The NCSC has no control over the content of third party websites and consequently accepts no responsibility for your use of them.

This newsletter is subject to the NCSC website terms and conditions which can be found at https://www.ncsc.gov.uk/section/about-this-website/terms-and-conditions and you can find out more about how will treat your personal information in our privacy notice at https://www.ncsc.gov.uk/section/about-this-website/privacy-statement.

Operationally this week nothing of note but there was a allied response to Russian cyber activity which you will see through the below.

In the high-level this week:

• UK and Allies urge critical sectors to improve defences against Russian intelligence targeting - UK NCSC and allies urge - “Alongside 18 agencies from 12 countries, the National Cyber Security Centre (NCSC) – a part of GCHQ – has published a new advisory highlighting the methods of Federal Security Service (FSB) Centre 16 cyber actors, who are exploiting vulnerable routers and opportunistically targeting networks belonging to critical national infrastructure (CNI) globally.”

• UK and EU strike Russian cyber networks with new sanctions - Foreign, Commonwealth & Development Office and The Rt Hon Yvette Cooper MP announce - “UK and EU hit back with first joint cyber sanctions package, as they attribute Russia’s cyber-attack on Poland.  “ … “UK sanctions and exposes Russian state and cybercriminal proxies carrying out malicious attacks across Europe and sanctions those deliberately spreading deceptive anti-Ukraine narratives.  “

  • Profile: GRU cyber and hybrid threat operations - Foreign, Commonwealth & Development Office, Home Office, Cabinet Office and National Cyber Security Centre update

• Helping small businesses with free, hands-on cyber consultancy - UK NCSC announce - “Cyber Advisors are offering free 30-minute consultations to help small businesses get started with cyber security.”

• National Risk Register 2026 - UK Cabinet Office publishes - various cyber risk..

  • Risk of democratic interference added to National Risk Register - Cabinet Office, Dame Angela Eagle DBE MP, Louise Sandher-Jones MP and The Rt Hon Darren Jones MP announce - “Interference in democratic process and cyber attacks have been added to the National Risk Register”

• Model Action Plan for Responding to Significant Data Breaches - UK Cabinet Office publishes - “The Model Action Plan is a cross-government framework for all departments and arms-length bodies to follow when responding to significant personal data breaches”

• UK action against Russian foreign information warfare - UK Foreign, Commonwealth & Development Office detail - “We are scaling cooperation with European partners on hybrid and information threats, including through the UK-EU Security and Defence Partnership, and through deep cooperation between teams in the UK, in France, Germany, Poland and Brussels, to deliver a pan-European response to a pan-European threat.”

• Telecommunications Security Code of Practice 2026 (version 1.1) - UK Department for Science, Innovation & Technology publishes - revised version published

  • Change log

• How NHS England improved sign-in times and saved over £1m with passkeys - Yu Tsuno, Darren Hutton and Pelin Dem publish - “Key results

  • Reduced sign-in time: Users authenticate 8x faster using passkeys. Median sign-in times dropped from 43 seconds (password + SMS OTP) to just 5 seconds using Conditional UI.

  • High adoption and scale: 6.7 million passkeys created by users since the feature launched two years ago, driving 6 million passkey sign-ins every month.

  • Lower transaction costs: Up to £1.2M saved on OTP costs since launch.”

• Open call for evidence Data flows you can trust - UK Department for
  Science, Innovation & Technology calls for evidence - “This work will help us to shape how data is used so that we can maximise its potential, drive growth and improve lives across the UK. This Call for Evidence seeks practical, experience-based insight into whether the UK’s data regime is enabling data flows you can trust. We want to understand: does the UK’s approach to international data transfers achieve this as effectively as it can do? Where should we preserve the current system, and what parts of it are most suitable for reform? “

• Forging the Arsenal of Freedom: Department of War Suspends CMMC Phase II Requirements - US Department of War announces - “The Department of War today announces the immediate suspension of the Cybersecurity Maturity Model Certification (CMMC) Phase II requirements, which were originally scheduled to come into effect on November 10, 2026. All Phase I self-assessment requirements remain firmly in place.”

• US military smartphones targeted through roaming and ad tech - Financial Times reports - “The data, shared with the FT by the Mobile Surveillance Monitor research project, shows regional telecom networks fending off a wave of requests, called SS7 pings. These sought to pin down the locations of specific phones roaming outside their home networks, in what two cyber security experts who reviewed the data said suggested a co-ordinated campaign. Officials in the Gulf suspected Iran or its allies of exploiting roaming agreements with local phone providers to try to locate US personnel, one person familiar with the matter said.”

• National Defense Authorization Act for Fiscal Year 2027 - US Congress publishes subject to vote- “In general.--Not later than March 1, 2027, the Secretary may establish a pilot program under the operational authority of the Commander of United States Cyber Command, to assess the feasibility and advisability of conducting cyber operations limited to access generation and maintenance through contractor owned, contractor operated means, subject to the limitations in subsection b”

• CERT-UA Handled 3,309 Cyber Incidents in the First Half of 2026 - Service of Special Communications and Information Protection of Ukraine detail - “the highest concentration of cyber incidents targeted local self-government bodies, government organisations, the security and defence sector, and the energy industry.”

• July 2026 SFI progress report - Microsoft detail - “Phishing-resistant MFA enforcement has reached broad maturity with 99.97% user and device coverage.“

  • 𝟳𝟯𝟮,𝟬𝟬𝟬+ resources have had public access revoked

  • 𝟭.𝟰 𝗺𝗶𝗹𝗹𝗶𝗼𝗻 unused apps decommissioned

  • 𝟱𝟱𝟬,𝟬𝟬𝟬+ critical and high risk open source vulnerabilities remediated

  • ~𝟯 𝗺𝗶𝗹𝗹𝗶𝗼𝗻 container vulnerabilities patched per month through automation

• What’s in a Norm? - Institute for Security + Security asks - “Policymakers regularly talk about “norms of responsible state behavior in cyberspace”—for good reason. The norms, articulated by the Group of Governmental Experts (GGE) convened under the auspices of the United Nations and affirmed by all UN members for over a decade, reflect a global consensus about what should and should not be allowable in peacetime cyber operations.”

• Reporting on/from China

  • Chinese lidar maker with Nvidia ties accused of being cyber risk for U.S. - CNBC reports - “Craig Singleton is a senior director for the China Program at the Foundation for Defense of Democracies, a conservative Washington-based think tank known for being critical of the Chinese government. His research has concluded that there are security risks in Chinese-made sensors operating in U.S. systems, including that lidar sensors could enable Beijing “to access sensitive U.S. data or disrupt critical operations.” - the component debate is interesting and it depends how far you want to go down the rabbit hole coupled with the complexity of operationalisation of the opportunity in reality.

  • Lawmakers probe growing use of Chinese AI models in U.S. companies - CNBC reports - “The Committees are also examining whether the United States has a sufficient open-weight AI strategy to ensure American companies and cyber defenders are not forced to choose between expensive or restricted U.S. models and cheap, capable PRC-developed alternatives,” a Committee aide, who asked not to be named as they were not authorized to discuss the ongoing probe, told CNBC.”

  • State of AI Safety in China - Concordia publishes - “The arrival of autonomous agents reoriented Chinese governance from controlling what AI says to controlling what it does. After the open source agent OpenClaw proliferated in early 2026, multiple cybersecurity authorities issued warnings, and in May 2026 the Cyberspace Administration of China (CAC) and two other agencies issued dedicated guidance on agentic AI, devoting a full chapter to safety and proposing risk-based governance. Several major AI standard-setting bodies are now drafting agent-related security standards.”

  • One Game, Two Strategies: China and Russia’s Divergent Approaches to Micro-Cyber Sovereignty - Xi’an Jiaotong University re-examines - “This study re-examines the assumption that China and Russia have adopted similar strategies for advancing cyber sovereignty. Drawing on two-level game theory, it argues that China has adopted a two-level model, where domestic regulation and international engagement operate in parallel through norm diffusion. In contrast, Russia pursues a one-level model in which domestic cybersecurity concerns are aligned with its international legal initiatives, emphasising consistency between internal regulation and its advocacy for binding global norms.”

  • New NSF policy would ban almost all collaborations with Chinese scientists - Science reports - “The U.S. National Science Foundation (NSF) has decided to ban collaborations between every U.S. scientist it funds and nearly all Chinese research institutions and their employees. The new policy abandons NSF’s earlier attempt to balance the potential risks and benefits of such collaborations. But it puts the agency in step with actions taken earlier this year by the much larger Department of Defense (DOD) and with congressional Republicans, who assert that any interactions with China threaten national security.”

  • China’s Xi Jinping calls for innovation system overhaul to beat global tech rivals - South China Morning Post reports - “President Xi Jinping has called for stronger efforts to draw overseas talent and address flaws in China’s innovation ecosystem, as intensifying tech rivalry pushes Beijing to bolster its global competitiveness.”

• AI

  • Artificial intelligence for cyber resilience - UK Parliament published in June - “AI may be able to improve cyber resilience by:

    • identifying unusual activity in a computer network and addressing threats in real time

    • detecting evolving fraud patterns and flag AI-generated phishing emails

    • performing ‘predictive maintenance’, including anticipating system failures and detecting software vulnerabilities

    • summarising incidents and recommend responses to security operations centres

    • analysing third-party risks to vendor and supply chains using public data”

  • How Far Behind the Frontier are Leading Open Weight Models on Cyber? - UK AI Security Institute publish - “We evaluated the cyber capabilities of leading open and closed weight AI models, and found that recent open models GLM-5.2 and DeepSeek V4-Pro perform similarly to frontier closed models released 4 to 7 months before them – a narrower gap than the 6 to 10 months we measured through most of 2025.”

  • Co-RedTeam: Orchestrated Security Discovery and Exploitation with LLM Agents - Google publish - “Extensive evaluations on challenging security benchmarks demonstrate that Code-RedTeam consistently outperforms strong baselines across diverse backbone models, achieving over 60% attack success rate in vulnerability exploitation and up to 10% absolute improvement in vulnerability detection.”

  • Navigating Security in the Machine Learning and AI Supply Chain: What Policymakers Need to Know - Max Smeets, Anna Sophie den Ouden, and James Shires think tanks - “the report breaks the machine learning and AI supply chain into three levels: the data level, the model level, and the deployment level. Across these levels, malicious actors exploit trust, complexity, and limited visibility.”

  • Former ONCD official Rajan sees opportunity for White House-led push utilizing formal methods to verify security of frontier AI models - Inside Cyber Security reports - “The Office of the National Cyber Director should play a larger role in working with other agencies to establish formal methods that mathematically prove software used by frontier AI models is secure from vulnerabilities, according to former tech security lead Anjana Rajan.”

  • The next frontier of AI: how ‘world models’ are simulating reality and virtual spaces - South China Morning Post reports - “The renewed interest reflects the rapid rise of AI agents and robotics, where simply generating text or video is no longer enough. Increasingly, AI systems are expected to predict how environments will respond to actions before they are taken. Unlike conversational AI like ChatGPT, which predicts the next word in a sentence, a world model predicts the next state of a physical environment. What makes the current wave distinct is that companies are building their products based on fundamentally different interpretations of what a “world” should be.”

  • AIDE²: The First Evidence of Recursive Self-Improvement - Weco assert - “We built a recursive self-improvement (RSI) system by running autoresearch on autoresearch. The system, AIDE², took eight days to discover a better autoresearch harness than the one we built over the last two years. Fully autonomously, AIDE² designed a novel search algorithm, reduced the prompt size by 16×, and built a layered system against reward hacking.”

  • The Future of Meta Superintelligence: A 1 Year Progress Update - Semi Analysis analyses - “Data is the new oil (for real this time) - We’ll start with data because it’s Meta’s newest advantage and probably the most underappreciated of the three. In 2024, Ilya famously said that “data is the fossil fuel of AI.” While this analogy correctly highlights the importance of data for training AI models, it incorrectly assumes that the amount of good data is finite. In reality, if demand is strong enough, market forces will find a way.”

  • Huawei’s plan to achieve the escape velocity: Applying Tau Scaling to entire AI datacenters - Polymath707 breaks down - “The bet this essay has described is not a one-generation trick that a rival node shrink erases. It is a claim that for the next decade the binding constraint on AI hardware is topological: about how memory, power, and fabric reach the compute; and that Huawei has organized its entire roadmap, from the Unified Bus outward to the folded package, around winning on that axis rather than the transistor axis western companies are able to race down.”

  • AI 2040 Plan A - Thomas Larsen, Romeo Dean, Brendan Halstead, Eli Lifland, Ryan Greenblatt and Daniel Kokotajlo propose - something which largely is in impractical but interesting nevertheless that one would consider - that is an agree slowdown between China and the US

• Cyber proliferation

  • Moroccan intelligence insider reveals widespread use of Pegasus hacking software - The Guardian reports - “A Spanish mobile number belonging to Aminatou Haidar, a prominent human rights activist from Western Sahara, was included in the leaked database and found to have been targeted by Pegasus dating back to 2018.”

• Bounty Hunting

  • Two sentenced for hacking Transport for London in UK’s biggest ever cyber crime case - UK National Crime Agency announce - “All 27,000 of TfL’s employees were forced to attend a TfL office for a password reset and a total of 148 systems became inoperable, including critical ones that required significant manual workarounds and delays. The organisation, which reported the incident to CoLP’s Report Fraud service, suffered a reported £29 million in loss and recovery costs.”

  • Three Russian Nationals Indicted for International Cybercrimes Resulting in More Than $62M in Losses to Victims - US Department of Justice announce - “The U.S. Attorney’s Office for the Northern District of Ohio has announced the unsealing of an indictment charging three Russian nationals for their roles in malicious cyber activities against U.S. critical infrastructure affecting victims in 21 states and in several countries, with losses amounting to tens of millions of dollars. These charges are the result of a seven-year-long investigation.”

  • Man Serving Federal Prison Sentence Charged with Theft of Forfeited Cryptocurrency - US Department of Justice announce - “Having been convicted of a widespread online auction fraud scheme targeting U.S. victims, Iossifov is now charged with moving cryptocurrency that he obtained from that crime, in violation of a court’s forfeiture order,”

  • Russian man pleads not guilty in US cyber espionage case - Reuters reports - “A Russian man whom U.S. prosecutors say previously worked for Russia's ‌FSB intelligence agency pleaded not guilty on Thursday to a charge that he participated in a cyber espionage campaign that a technology company conducted against Western organizations.”

    • Alleged Russian cyber spy in Boston case previously worked for Kaspersky, source says and documents show - Reuters reports - “Although the alleged hacking activity took place after he left Kaspersky, Obrezko’s background is likely to draw further attention to the company’s relationship with the Russian government.”

  • Teen accused of using ChatGPT to delete 46,000 anime accounts - The Ashai Shimbun report - “Tokyo police on July 6 arrested a 15-year-old boy who has admitted to using AI-powered ChatGPT to build a program that forcibly deleted 46,000 accounts on anime streaming service “Bandai Channel,” sources said.”

  • Apple sues OpenAI, its employees claiming theft of trade secrets - BBC reports - “At least two long-time Apple workers who left the company to join OpenAI allegedly took part in this pattern by, in part, emailing themselves internal Apple information.”

    • Court papers

  • ..

• Market Incentives

  • Novel Autonomy & Robotics Competition Document - UK Defence Innovation publishes - “On receipt of a FUND decision, successful innovators (and their sub-contractors) must prove cyber resilience before the contract is awarded.”

Reflections this week are read the headlines of the footnotes section on AI applied to cyber security. The level of investment grows each week, volume of papers increase - so even if they’re not there today it is clear we are going to get workable solutions which mean humans can be removed from in and on the loop.

Not getting this via email? Subscribe:

Subscribe now

Think someone else would benefit? Share:

Share

All attribution is by others and not the UK Government unless specifically stated as such, please see the legal text at the end.

Have a lovely Saturday…

Ollie

Cyber threat intelligence

Who is doing what to whom and how allegedly.

Reporting on Russia

Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting

United States National Security Agency (NSA), United States Cybersecurity and Infrastructure Security Agency (CISA), United States Federal Bureau of Investigation (FBI), United States Department of Defense Cyber Crime Center (DC3), Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC), Communications Security Establishment Canada’s (CSE’s) Canadian Centre for Cyber Security (Cyber Centre), New Zealand National Cyber Security Centre (NCSC-NZ), United Kingdom National Cyber Security Centre (NCSC-UK), Czech Republic National Cyber and Information Security Agency (NÚKIB), Danish Defence Intelligence Service (DDIS), Estonian Foreign Intelligence Service (EFIS), Estonian Information System Authority (RIA), Finnish Defence Intelligence (FDI), Finnish Security and Intelligence Service (SUPO), French National Cybersecurity Agency (ANSSI), Italian External Intelligence and Security Agency (AISE), Italian Internal Intelligence and Security Agency (AISI), The Military Counterintelligence Service of Poland (SKW) and Sweden National Cyber Security Centre (NCSC-SE) assemble like the avengers with this release focusing on the need to improve router hygiene. Also a reminder that all vendors should implement our guidance on digital forensics and protective monitoring specifications for producers of network devices and appliances - for device vendors.

Russian Federal Security Service (FSB) Center 16 cyber actors continue to exploit poorly configured and vulnerable networking devices worldwide, opportunistically compromising multiple critical infrastructure sector networks. This joint Cybersecurity Advisory (CSA) builds on FBI’s Russian Government Cyber Actors Targeting Networking Devices, Critical Infrastructure Public Service Announcement of the decadeplus FSB Center 16 cyber activity by providing additional tactics, techniques, and procedures (TTPs) to enable defenders to more fully understand and counter the threat.

https://media.defense.gov/2026/Jul/09/2003959498/-1/-1/1/CSA_IMPROVE_ROUTER_HYGIENE.PDF

Targeting and Compromise of French Entities Using the Turla Intrusion Set

Government of France attributes and detail this alleged Russian operation against French entities. The government targeting will be of note as will the stated purpose.

Members of the Cyber Crisis Coordination Centre (C4) have observed the targeting and compromise of French entities using the Turla intrusion set operated by the 16th Centre of the Federal Security Service of the Russian Federation (FSB). Since at least 2004, this intrusion set has been implemented for intelligence-gathering purposes against strategic entities and individuals worldwide, including in France. The French intermediate and final victimology of the Turla intrusion set notably includes ministries, entities in the diplomatic, defence, justice, and technology sectors. Espionage campaigns associated with the Turla intrusion set against Ukraine, NATO countries, and EU member states continue in the context of Russia’s war of aggression launched on February 24, 2022.

https://cert.ssi.gouv.fr/cti/CERTFR-2026-CTI-005/

https://www.diplomatie.gouv.fr/fr/presse-et-ressources/decouvrir-et-informer/actualites/attribution-a-la-russie-d-activites-cyber-malveillantes-a-des-fins-d-espionnage-en-france

Advisory Russian state actors are compromising IP cameras

Netherlands General Intelligence and Security Service (AIVD) and the Netherlands Defence Intelligence and Security Service (MIVD) disclose and detail this alleged Russian operation against IP cameras. This should serve as a warning to focus on the cyber security of such infrastructure which can be repurposed for cyber-physical intelligence gain.

illustrates that Russian state actors are systematically conducting digital espionage operations via IP cameras (cameras with internet access). At least one Russian intelligence and security service is responsible for these operations that are taking place in the Netherlands, various other EU and NATO member states and Ukraine. This cybersecurity advisory concludes with actionable recommendations to mitigate the risks of espionage via IP cameras.

https://english.aivd.nl/documents/2026/07/10/brochure-cybersecurity-advisory-russian-state-actors-are-compromising-ip-cameras

UAC-0145 Primary Compromise Vectors as of July 2026

Ukraine CERT detail the alleged initial access tradecraft of this alleged Russian threat actor. The detection opportunities here are strong..

As a rule, the implementation of the malicious plan was carried out using the already known software tools KALAMBUR , SUMBUR , TAMBUR , and unauthorized remote access was primarily provided using legitimate programs OPENSSH and TOR, which provided forwarding of local network ports (in particular, 445, 3389, 22) to a remote server, actually publishing them within the infrastructure controlled by the attackers. In addition, software tools for stealing keys and data of the messengers Signal, WhatsApp, for the exfiltration of which RSYNC could be used, became widespread.

https://cert.gov.ua/article/6318437

Burnt by Burgers: Highlighting Void Blizzard’s Russian State Links

Ctrl-Alt-Intel conduct open source intelligence and alleged further links to the Rusian state than stated in indictment and affidavit.

Identifiers attributed to Obrezko by the FBI appear alongside an IAC EMERCOM-associated work number and repeated weekday food deliveries to EMERCOM facilities during 2021. Taken together, these findings support our high-confidence assessment that Obrezko worked at, or regularly operated from, IAC EMERCOM.

Public records add further context around Yutek-NN: an FSB-issued licence for surveillance-adjacent equipment, and publicly declared personnel movements in both directions between Yutek-NN and IAC EMERCOM. None of these findings independently proves that Yutek-NN conducted cyberespionage. Collectively, however, they show that the company has deeper connections to Russian state and security institutions than its public-facing website suggests.

https://ctrlaltintel.com/research/VoidBlizzard/

OkoBot: new sophisticated malware framework targets cryptocurrency users

Yaroslav Kikel details an alleged Russian-nexus campaign which lays down SSH. Allegedly criminally linked..

TookPS is a downloader used for retrieving malicious commands and scripts from attacker-controlled servers to further propagate attacks. The first campaign using TookPS was discovered in March 2025. At that time, malicious scripts delivered a Python‑based infostealer along with a script that installed and configured an SSH tunnel on the victim’s machine. The next wave appeared in April 2025: the payload was changed, and TookPS was used to deliver the TeviRAT malware with the same SSH installer.

https://securelist.com/okobot-framework-targets-cryptocurrency-wallets/120660/

Reporting on China

Suspected Chinese Operators Use Claude Code and DeepSeek to Target Government and Financial Systems Across Four Countries

Hunt.io detail the use of AI by alleged Chinese operators in their intrusion campaign along with victimology. It is however of note this is not autonomous end to end - yet. But rather knowledge and productivity enhancement for discrete parts of the workflow.

• The open directory on 112.213.124[.]132 exposed a full operational toolkit, including payloads, operator files and scripts, and victim-specific folders.

• Infrastructure pivots identified 13 Hong Kong-based servers spanning four separate ASNs, three with shared SSH keys and TLS certificates, serving in a redundancy capacity.

• Active exploitation of government systems in Afghanistan, Thailand, and Taiwan, with reconnaissance and phishing staging against U.S. government portals.

• Scanning of 5,890+ government hosts across 10 countries with a Python-developed automated scoring scale.

• Claude Code handled execution and session persistence while DeepSeek-v4-pro drove the reasoning, a two-model split documented across the recovered log files.

https://hunt.io/blog/chinese-operators-claude-deepseek-government-intrusion

Daxin Returns: Stealthy Malware Resurfaces in Taiwan Alongside a New Backdoor

Symantec and Carbon Black detail alleged Chinese regional targeting which surfaced a new implant. The novel keyboard-layout DLL implant mechanism will be of note.

• Backdoor.Daxin, the China-linked kernel-mode rootkit that Symantec first uncovered and exposed in 2022, is still operational. It was found running on a compromised host in Taiwan in 2026, more than four years after it was first uncovered.

• On the same machine, the Symantec Threat Hunter Team discovered a previously unknown backdoor, Backdoor.Stupig, whose novel tradecraft may link it to the Daxin operation, though no code-level connection has been confirmed.

• Stupig uses a technique not documented in any known malware family. A Trojanized keyboard-layout DLL loaded by winlogon.exe lets an attacker run commands as System directly from the Windows logon screen, before anyone signs in and without raising a logon audit event.

• Both samples carry compile timestamps from early 2013, but the host was not reporting telemetry until May 2026. Combined with the actor’s known pattern of long-term, stealthy persistence, this suggests the intrusion may have gone undetected on the network for 13 years.

• The victim was a Taiwan-based subsidiary of a multinational high-tech manufacturer.

https://www.security.com/threat-intelligence/daxin-returns-stupig

Introducing CylindricalCanine: The GoldenEyeDog subgroup responsible for the April DigiCert incident

Aaron Walton details the other end of the alleged Chinese cyber spectrum but also the fact they managed to allegedly compromise of a certificate authority. This is the alleged capability and intent of Chinese cyber crime in 2026.

• Chinese cybercrime group, GoldenEyeDog, has been regularly updating their malware and tactics since 2015. We’ve observed them regularly leveraging code-signing certificates to bypass Windows’s SmartScreen since 2024.

• They leverage several malware, including one we’ve seen primarily documented in Chinese language publications, and are calling it “Golden Gh0st RAT”.

• In April 2026, GoldenEyeDog used their malware to access a support member’s device at DigiCert, a code-signing certificate provider, and leveraged their access to steal certificates intended for DigiCert customers. This attack highlighted the capability of the malware and operators.

https://expel.com/blog/introducing-cylindricalcanine/

Reporting on North Korea

Analysis of attack actions suspected to be from the APT-C-26 (Lazarus) group upgrading its monitoring program

360 Threat Intelligence Centre from China detail an alleged North Korean operation which is noteworthy for the monitoring they ended up laying down.

In the attack process, various components of the organization worked together to not only build a covert remote desktop environment but also integrate keylogging capabilities, forming a comprehensive monitoring and control platform. This provided attackers with the ability to conduct multi-dimensional and continuous monitoring and control of the compromised host, significantly enhancing the efficiency of their data theft and intelligence gathering.

https://mp.weixin.qq.com/s/6hjjsEuuOTk8_FJrXWe9Ew

BirdCall: ScarCruft Malware Masquerading as Zangi Messenger

S2W detail alleged North Korean use of repackaged application to gain initial access. Of note to those organisations who support APK side loading etc or application stores without controls / observability.

• Another malicious app identified is the BirdCall malware, which masquerades as the Zangi messenger app.

• It has been confirmed that the attacker repackaged the legitimate app to alter its entry point.

• The BirdCall malware app uses dual Zoho WorkDrive accounts (cmdCloud and dataCloud) as C2 channels.

• It steals information about infected devices and collected sensitive data, and supports a total of eight types of remote commands, enabling it to control devices, steal files, and re-collect data.

• The stolen data is structured according to a sophisticated packet format defined within the malware and is encrypted and obfuscated using AES-256-CBC + zlib multi-layer encryption.

• Additionally, when uploaded to Zoho WorkDrive, filenames are obfuscated through Base-26 encoding and packed into an 11-base structure.

https://s2w.inc/en/resource/detail/1096

https://s2w.medium.com/detailed-analysis-of-birdcall-malware-marsqurading-as-zangi-messenger-b80db8f5c320

Operation Capsule Vault: RokRAT Attack Chain Analysis Using EMBED_PAYLOAD_v2

Genians details this alleged North Korean operation which uses well understood tradecraft which any moderately capable organisation should be able to defend against.

• Initial access was carried out through spear-phishing emails disguised as materials for actual academic events and seminars.

• Although the file was disguised as a PDF, it actually delivered a malicious ISO file through a cloud storage link.

• The ISO contained an executable disguised as a PDF document, using the “.pdf”, “.pif” extension to induce the user to run it.

• The attack loaded the shellcode payload into memory and injected a RokRAT variant into a process.

• EDR and threat hunting policies should be strengthened to detect correlated ISO and PIF execution behaviors.

https://www.genians.co.kr/en/blog/threat_intelligence/rokrat_capsule_vault

Reporting on Iran

Threat Intelligence Report: The Pro-Iran Hacktivist Ecosystem 2026

Domain Tools provides their overview and assessment of this alleged hacktivist eco-system.

The ecosystem operates through Telegram channels and websites, shared target lists, DDoS-for-hire tools, recycled breach data and leak-amplification campaigns. Attack claims and propaganda often appear within hours of kinetic events. This gives actors a deniable auxiliary role while keeping them separate from formal state structures.

Most activity remains technically unsophisticated. DDoS attacks, website defacements, and hack & leak extortion-style messaging with exaggerated claims are more common than verified advanced intrusions. The strategic effect comes less from technical capability than from speed, visibility, and ideological framing that make it into news cycles. In practice these actors use cyber activity as scalable asymmetric information warfare. Even with limited high-end capability, loosely aligned ideological and state-adjacent networks can impose psychological, political, and economic pressure on adversaries during periods of regional crisis.

https://dti.domaintools.com/research/threat-intelligence-report-the-pro-iran-hacktivist-ecosystem-2026

Reporting on Other Actors

SharpViewStateKing: The stealthy implant framework

Canadian Centre for Cyber Security detail this unattributed by streatly implant framework which defence teams will want to assess if they have coverage of.

In late December 2025, the Cyber Centre detected what appeared to be a web shell on a public-facing Microsoft Internet Information Services (IIS) server running a commercially available ASP.NET application. Incident response activities were initiated and analysis revealed that this web shell was part of a stealthy implant framework called SharpViewStateKing. This technical article aims to raise awareness, provide detection guidance, and highlight remediation actions associated with the malicious modules. What follows is derived from endpoint telemetry and process memory captured during the incident.

https://www.cyber.gc.ca/en/news-events/sharpviewstateking-stealthy-implant-framework

Hidden Exfiltration Capability Discovered in a Trusted, 900,000-User Chrome Web store Extension

Charlie Kelly, Joss Moor, Sebastian Lacatusu and Silas Bryant detail this campaign which is noteworthy due to its scale and capability.

We found dormant surveillance functionality in a trusted Chrome Web Store extension with around 900,000 users, including the ability to collect, encrypt and potentially exfiltrate browsing-domain data.

Underneath this genuine and functional header-editing tool, version 7.0.18 contains:

• A browsing history collection engine that fingerprints the device, encrypts each visited domain with a hardcoded AES-GCM key, and stages the data in a local database.

• A prebuilt exfiltration channel designed to upload that encrypted history, roughly once per day, to a likely attacker-controlled endpoint api.stanfordstudies.com.

• Install, update, and uninstall telemetry beaconed to a second third-party domain extensions-hub.com.

• A content script that injects into every website visited and logs request metadata to a local store.

In the version analysed, the exfiltration trigger is currently gated off by an empty allow-list, meaning that browsing-history upload is dormant in this build. Every other component (the encryption key, the endpoint, the scheduler, the storage) is present and functional.

https://stripeolt.com/knowledge-hub/threat-research/chrome-extension-hidden-data-exfiltration-900k-users/

One Misconfigured Server, Three Active Campaigns: Full exposure of three AiTM Phishing Operators

Lexfo CTI team detail this Adversary in The Middle phishing operator who further reenforce the business case for pervasive passkeys.

• A single misconfigured Python HTTP server exposed the complete operational stack of a live phishing operator, configs, logs, RMM installers, combolists, and Telegram session files.

• Three distinct threat actors were identified from one entry point: codemado, mail-argenta, and saroula01, each running independent campaigns on custom Evilginx forks sourced from the same public GitHub repositories.

• codemado is an Egyptian operator with roots in the hacking underground dating back to 2018, operating a full AiTM platform with a seven-tool RMM arsenal on a Budapest VPS.

• saroula01‘s Device Code Flow campaign ran undetected for over a year, accumulating 218 confirmed victims across 12 countries, with tokens silently auto-refreshed in the background.

• mail-argenta is a Nigerian operator who was identified through infostealer logs containing his own credentials, including the MySQL password hardcoded in his phishing panel, reused across personal accounts.

• Both AiTM proxying and Device Code Flow abuse bypass MFA entirely.

• codemado’s MaDoO Blaster is promoted within RockyBelling’s The Quarry ecosystem, reported by SOCRadar’s investigation.

• All three operators built functional MFA-bypass infrastructure from public GitHub repositories with minimal customization, using AI-assisted development.

https://blog.lexfo.fr/opendir-to-phishing-operator.html

OAuth Client ID Spoofing: Why Fake Client IDs Are Gaining Traction for Stealthy Enumeration

Rachel Rabin details this technique which one can imagine Microsoft will look to tighten up.

• Proofpoint has observed OAuth client ID spoofing emerging as a novel technique, increasingly leveraged in cloud campaigns.

• Microsoft Entra ID returns different responses depending on whether a supplied OAuth client ID is valid and whether it corresponds to a registered application.

• This behavior enables account enumeration without a registered OAuth application and allows attackers to infer password validity or account state without generating a successful sign‑in event.

• Researchers observed multiple campaigns at scale abusing spoofed OAuth application identifiers, with distinct tooling, infrastructure, and execution patterns indicating independent adoption by multiple threat actors.

• To detect similar activity, defenders should monitor sign-in logs for events without an application name, which may indicate spoofed client IDs.

https://www.proofpoint.com/us/blog/threat-insight/oauth-client-id-spoofing-why-fake-client-ids-are-gaining-traction-stealthy

Software Supply Chain Incursions

A reminder we issued guidance a number of weeks ago in Software supply chain attacks: check your dependencies for software developers

• Miasma Worm Returns to npm

• jscrambler npm Package Compromised in Supply Chain Attack

• M-Red-Team: AsyncAPI Supply Chain Compromise via GitHub Actions

• nodemon-sudo: an npm Backdoor With No Install Script

A related interesting academic paper this week too ProfMalPlus: Agent-Coordinated Detection of Malicious NPM Packages via Static-Dynamic Analysis Synergy

Discovery

How we find and understand the latent compromises within our environments.

Use Unified Sign-In logs in Advanced Hunting

Fabian Bader is back with this master class..

One thing that always makes analyzing Sign-In logs for Entra ID (Azure AD) users a bit complicated is the different types of Sign-In logs available.

..

This is where my KQL query comes in handy. It joines the two tables as one, renames the column to the original name and converts all to the same data type. And when you save it as a function, you can use it as if it where a built-in table.

https://cloudbrothers.info/en/unified-sign-logs-advanced-hunting/

Stinger

Adel Ka provides cyber deception capability uplift this with this release. Speaking to other cyber deception vendors it is clear that the lure of tokens is too much..

Stinger is an experimental endpoint deception tool for individual macOS and Linux workstations. It places decoy resources at likely collection points and records when a process interacts with them.

Malicious packages, compromised extensions, and infostealers can collect tokens, keys, browser data, or wallet material in a single run. On personal workstations, EDR and privileged file-access monitoring are often absent, while many canary tokens do not signal until collected bait is later rendered, fetched, resolved, or used. Stinger targets an earlier point: local interaction with the decoy during collection.

https://github.com/0x4D31/stinger

tempolocus

Alexandre Dulaunoy releases this interesting solution to reduce the need to look at a time zone map and public holiday list.

Tempolocus is a time-series activity patterns and approximate location inference

https://github.com/ail-project/tempolocus

Detections for LegacyHive exploitation

Kevin Beaumont releases this detection for this unpatched vulnerability..

https://github.com/GossiTheDog/ThreatHunting/blob/master/AdvancedHuntingQueries/LegacyHive.kql

Defence

How we proactively defend our environments.

Writing Intune Endpoint Privilege Management rules for the real world: File hash, certificate, and when each one is the wrong choice

Mattias Melkersen and Simon Skotheimsvik provide defensive wisdom and a practical implementation approach for those in the Microsoft eco-system.

But the underlying discipline is consistent. Identify files as precisely as the situation allows. Never rely on a weak attribute alone. Control what an elevated process is allowed to spawn. Test on a real standard user before you trust a rule. And structure your assignments so that conflict resolution works for you rather than surprising you.

https://msendpointmgr.com/2026/07/03/epm-part-3-writing-intune-endpoint-privilege-management-rules-for-the-real-world-file-hash-certificate-and-when-each-one-is-the-wrong-choice/

Incident Writeups & Disclosures

How they got in and what they did.

Lessons from CISA’s Cyber Incident

Preston Werntz, Acting Chief Information Officer and Brad Libbey, Acting Chief Information Security Officer at CISA show world-leading transparency here.

On Friday, May 15, CISA began an internal incident response when an investigative reporter inquired about internal CISA Amazon AWS GovCloud Keys and other information being made available in a public repository. The reporter received this information from a security researcher whose company continuously scans public code repositories.

https://www.cisa.gov/news-events/news/lessons-cisas-cyber-incident

Security incident disclosure — July 2026

Hugging Face disclose

Earlier this week, we detected and responded to an intrusion into part of our production infrastructure. This one was different from anything we had handled before in one important way: it was driven, end to end, by an autonomous AI agent system - and we detected and dissected it largely with AI of our own.

We identified unauthorized access to a limited set of internal datasets and to several credentials used by our services. We are still completing our assessment of whether any partner or customer data was affected, and we will contact any affected parties directly as required. We have found no evidence of tampering with public, user-facing models, datasets, or Spaces, and our software supply chain (container images and published packages) was verified clean.

https://huggingface.co/blog/security-incident-july-2026

Vulnerability

Our attack surface.

Establishing a Coordinated Vulnerability Disclosure Program to Work With Security Researchers

U.S. Cybersecurity and Infrastructure Security Agency, U.S. National Security Agency, Japan Computer Emergency Response Team Coordination Center, Netherlands’ National Cyber Security Centre and United Kingdom’s National Cyber Security Centre detail what good looks like

This guide is authored by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and National Security Agency (NSA), the Japan Computer Emergency Response Team Coordination Center (JPCERT/CC), the Netherlands’ National Cyber Security Centre (NCSC-NL), and the United Kingdom’s National Cyber Security Centre (NCSC-UK)—hereafter referred to as the “authoring organizations”—and provides best practices for suppliers to design and implement a CVD program to effectively work with security researchers. The authoring organizations recommend suppliers, especially software manufacturers, develop a CVD program aligned with the best practices outlined in this joint guide.

https://media.defense.gov/2026/Jul/14/2003961238/-1/-1/0/260714-D-AB123-1001.PDF

VulnHunter

Vinay Vira, Scott Schenkein and Ieribo publish

VulnHunter is an open-source, agentic AI security tool that applies proactive, attacker-first analysis directly to source code.

Unlike traditional, passive SAST scanners that flag suspicious patterns and often cause false positives, VulnHunter reasons like an adversary. It identifies which defects are actually exploitable, maps prospective attack paths, and proposes targeted, evidence-backed fixes.

https://github.com/capitalone/vulnhunter

Zimbra 10.1.19

Patch patch patch..

The update fixes a security issue in the Classic Web Client where a specially crafted email could run malicious code when the email is opened. If exploited, it could allow access to mailbox information, session data, or account settings.

https://blog.zimbra.com/2026/07/patch-release-update-zimbra-10-1-19/

Semantics Over Syntax: Uncovering Pre-Authentication 5G Baseband Vulnerabilities

Craig S. Blackie and Darren McDonald

Dell stores its BIOS administrator and user passwords as XOR-encrypted plaintext in the DVAR (Dell Variable) region of the SPI flash chip, not as a one-way hash. The scheme encrypts a 32-byte password field with a 20-byte key, and the first character is not encrypted at all. For any password up to 12 characters, the unused tail of the field leaks the entire key, so the password can be recovered directly from a flash dump with no brute force and no known plaintext. Longer passwords leave a small blind zone in a single record, which a quirk of the key derivation then closes (more below). Recovery is deterministic and completes in milliseconds. An attacker who can read the SPI flash, which is possible with a clip and a cheap programmer or by booting an operating system they control, can recover the password and gain full BIOS access. We found this jointly by chance while working on something entirely different. The affected scheme is used across a range of older Dell platforms, a large number of which are now near or past end of support, whereas newer platforms have moved to a more secure password-protection mechanism. It is not, however, limited to legacy hardware: it is confirmed on the current-generation Wyse 5070 thin client, which remains supported and unpatched, and it is implemented in the SystemPwSmm SMM driver common to Dell client platforms.

https://arxiv.org/abs/2604.04283

Forgotten UEFI shims undermining Secure Boot

Martin Smolár highlights this knotty attack surface but also why roots of trust need to be comprehensive in their mitigations.

ESET researchers identified 11 old and forgotten UEFI shim bootloaders at versions 0.9 and below that can be used to bypass UEFI Secure Boot on any UEFI-based machine that trusts Microsoft’s Microsoft Corporation UEFI CA 2011 third-party UEFI certificate authority (CA) certificate, regardless of the installed operating system (OS). Reported shims can be exploited to execute untrusted code during system boot, enabling attackers to deploy malicious UEFI bootkits (such as Bootkitty, HybridPetya, or BlackLotus) even on systems with UEFI Secure Boot enabled.

We reported our findings to CERT/CC in February 2026, and the vulnerable UEFI applications were revoked on Microsoft’s June 9^th, 2026 Patch Tuesday.

https://www.welivesecurity.com/en/eset-research/forgotten-uefi-shims-undermining-secure-boot/

Unfit to Boot: Breaking U-Boot’s FIT Signature Verification

Anton Ivanov surfaces some technical debt which will be interesting to see how pervasive the impact is in reality.

For most of these vulnerabilities, the affected code has been present in U-Boot since version v2013.07. This means that they potentially affect over 50 stable releases of the U-Boot project. Counting many downstream vendor forks, these vulnerabilities have a significant impact on the industry.

https://www.binarly.io/blog/unfit-to-boot-breaking-u-boots-fit-signature-verification

Dell BIOS Passwords: Weak XOR Encryption Allows Recovery from SPI Flash (CVE-2026-40639)

Craig S. Blackie and Darren McDonald detail and the fact some remain unpached.

The affected scheme is used across a range of older Dell platforms, a large number of which are now near or past end of support, whereas newer platforms have moved to a more secure password-protection mechanism. It is not, however, limited to legacy hardware: it is confirmed on the current-generation Wyse 5070 thin client, which remains supported and unpatched, and it is implemented in the SystemPwSmm SMM driver common to Dell client platforms.

https://blog.amberwolf.com/blog/2026/july/dell-bios-passwords-weak-xor-encryption-allows-recovery-from-spi-flash-cve-2026-40639/

Offense

Attack capability, techniques and trade-craft.

Bind Link Abuse: One Windows Feature, Many Ways to Blind Your EDR

Martin Zugec highlights a technique that defensive teams will want to develop detection tradecraft or at least a source of signal for.

Windows includes a file-system virtualization feature that can redirect one local path to another without modifying the original file or leaving a persistent filesystem artifact. It is implemented by bindflt.sys, the Bind Filter minifilter driver, and used legitimately by Store apps, Windows Sandbox, and Windows containers. Bitdefender Labs documented and named three new techniques that an attacker running as a local administrator can use to blind EDR sensors and bypass built-in Windows defenses such as AMSI and AppLocker.

https://www.bitdefender.com/en-us/blog/businessinsights/bind-link-abuses-windows-feature-edr-evasion-technique

There and Back Again: An Operators Guide on NTLM Relaying Egress

Logan Goins breaks down a technique which has historically been used by a range of adversaries. Again developing capability to detect would be wise.

What’s old is new again. Remember coercing SMB NTLM egress tradecraft to crack challenge response back in the day? We see a lot of situations in our assessments where relaying NTLM from coerced network egress is ideal when escalating locally over C2 is unattainable or firewall rules are in play preventing WebDav relays to LDAP. This technique involves NTLM authentication coercion outbound to the internet, catching that traffic with a cloud host, and forwarding that traffic back to our red team infrastructure where it will be proxied back into the target environment to a service which will allow identity or computer takeover.

https://specterops.io/blog/2026/07/15/there-and-back-again-an-operators-guide-on-ntlm-relaying-egress/

BingusLdr

Bingus attempts to blind some EDR capabilities with this release.

• CET compatible stack spoofing

• EAF compatible API resolution

• Heap masking

• Image masking

https://github.com/Sizeable-Bingus/BingusLdr

UnwindRaven

Tom O'Neill drops this which similarly tries to blind some EDR capabilities..

UnwindRaven is a Windows x64 offensive research framework that constructs fully synthetic call stacks at thread startup time, making a newly created thread appear — to stack-walking debuggers, EDR sensors, and kernel callbacks — as though it was legitimately invoked by a chain of known, trusted system frames.

https://github.com/toneillcodes/UnwindRaven

Exploitation

What is being exploited..

Nothing overly of note this week…

Tooling and Techniques

Low level tooling and techniques for attack and defence researchers

CET-Compliant Callstack Spoofing via Thread Pool Enum Callback Trampolining

Tiziano Marra walks through how shadow stack call stack spoofing can be achieved through this excellent write-up.

https://mrtiz.github.io/cet-callstack-spoofing-thread-pool-trampoline

AutoTrace

Arastoo Zibaeirad, Marco Vieira and Thomas Zimmermann provides a capability uplift here which will compress exploitation.

We present AutoTrace, an agentic pipeline that localizes vulnerability triggers by exploring a code property graph layer by layer, with LLM agents deciding where to look next and deterministic admissibility gates deciding what evidence is required before a trigger can be reported. Agents never accept a trigger on their own authority; every reported trigger is backed by explicit evidence drawn from the graph, so the pipeline covers both intra- and interprocedural vulnerabilities without relying on ungrounded model judgment. On the full InterPVD benchmark, AutoTrace reaches 75.0% VulnHit and 80.8% FuncHit, surpassing the prior state of the art on the same corpus. Building on the same machinery, we construct SinkTrace-Bench, a dataset that exposes each vulnerability as a source-to-sink (S2S) causal chain from attacker-controlled input through propagation to the dangerous operation, drawn from matched vulnerable and patched program states. It comprises 1,542 verifier-confirmed, perfectly balanced vulnerable/safe samples whose label fidelity we audit against expert annotations.

https://arxiv.org/abs/2607.12058

Footnotes

Some other small (and not so small) bits and bobs which might be of interest.

• Annual, quarterly and monthly reports

  • Nothing overly of note this week, but keep an eye on the Awesome Annual Security Reports 2026 collection and APT report collection

• Analytical capacity for national security - “Empirical findings from Norwegian public documents, a case-study and interviews show that analytical capacity for national security in Norway is hindered by regulatory blindspots, lacking sense-of-urgency and bureaucratic resistance. The article offers lessons and tools for a wider audience to increase analytical capacity and remedy organisational vulnerabilities.”

• The Institute Quarterly: Resilience & Preparedness

• Artificial intelligence

  • if you are a big arxiv.org user - out of China there is alphaxiv.org which is an AI powered incarnation / overlay

  • Fundamental

    • EdgeBench: Measuring Real-World Environment Learning and Discovering a New Scaling Law

    • From Reasoning Traces to Reusable Modules: Understanding Compositional Generalization in Language Model Reasoning

    • The Verification Horizon: No Silver Bullet for Coding Agent Rewards

    • Single-Rollout Asynchronous Optimization for Agentic Reinforcement Learning

    • Episodic Memory-Guided Controllable Experience Synthesis for Reinforcement Learning

    • All Circuits Lead to Rome: Rethinking Functional Anisotropy in Circuit and Sheaf Discovery for LLMs

    • JetSpec: Breaking the Scaling Ceiling of Speculative Decoding with Parallel Tree Drafting

    • AIDE²: The First Evidence of Recursive Self-Improvement

    • The Environmental Cost of Digital Sovereignty: Water, Energy, and Emissions Impacts of Sovereign AI Infrastructure in the Global South

    • Code-MUE: Measuring Code LLMs‘ Uncertainty through Execution-based Semantic Interaction Graphs

  • Applied non-cyber

    • Turning Off-Policy Tokens On-Policy: A Plug-in Approach for Improving LLM Alignment

    • CODA-BENCH: Can Code Agents Handle Data-Intensive Tasks?

    • KAT-Coder-V2.5 Technical Report

    • Colbri: Run GLM-5.2 (744B MoE) on a 25GB-RAM consumer machine

    • Mesh LLM: Distributed AI/LLM for the people. Share compute privately or publicly to power your agents and chat

    • CIPHER: A Decoupled Exploration-Selection Framework for Test-Time Scaling of Data Science Agents

    • Adversarial Prompting Framework for AI Safety Assessment

    • MusicMark: A Robust Generative Watermarking Framework for Music Generation

    • AdvNav: Behavior-Guided Black-Box Adversarial Attacks on Vision-Language Navigation

    • Agentic Service-Oriented Computing: A Manifesto for the Next Frontier of Service-Oriented Computing

    • TerraRepair: A Tool-Grounded LLM Agent for Infrastructure-as-Code Repair

  • Applied cyber specific

    • Traccia: An OpenTelemetry-Based Governance Platform for AI Systems

    • Rethinking MCP Security: A Large-Scale Study of Runtime MCP Servers and Security Scanner Reliability

    • Traffic-Aware Randomized Smoothing for LLM-Based Network Intrusion Detection

    • DREA: Decoupled Reasoning and Exploration Agents for Repository-Level Vulnerability Detection

    • Securing LLMs in the Wild: Privacy and Security Challenges at the Edge

    • Baselines Before Architecture: Evaluating Coding Agents for Autonomous Penetration Testing

    • Antiproof: Synthesizing Vulnerability Detectors and Proofs of Exploitability

    • Cross-Cutting Security Analysis of LLM-Generated Code via Metamorphic Testing and Association Rule Mining

    • AutoTrace: From Patches to Triggers via Agentic Interprocedural Exploration

    • PVDetector: Detecting Prompt Injection Attacks on Purpose-Specific LLM Agents through Policy-Violation Concept Analysis

    • Agent Skill Security: Threat Models, Attacks, Defenses, and Evaluation

    • Setup Complete, Now You Are Compromised: Weaponizing Setup Instructions Against AI Coding Agents

    • Routing Ceilings Are Domain-Independent: Structural Prior Injection in Code Security Vulnerability Detection

    • Co-RedTeam: Orchestrated Security Discovery and Exploitation with LLM Agents

    • Automatically Attacking Software Reverse Engineering AI Agents

    • CausalGraphX: A Counterfactual Graph Neural Network Framework for Explainable Systemic Risk Assessment

    • AI in Cyberpsychology: A systematic literature review of Cybersecurity enhancement by using AI for analyzing psychology of Victims, Attackers, and Defenders

    • Bulkhead: Automated Semantic Detection and Remediation of Container Escape Vulnerabilities

    • Understanding the Impact of AI Code Assistants on Security API Usage: An Empirical Study

    • Agent Hacks Agent: Autoresearch for Production-Agent Red-Teaming

    • Mako: A Self-Evolving Agentic Operating System (SE-AOS) for Autonomous Web Exploitation

    • VEXAIoT: Autonomous IoT Vulnerability EXploitation using AI Agents

    • FlowGuard: From Signals to Evidence for MCP Security Detection

    • Fully Automated End-to-End Adversary Emulation from MITRE ATT&CK Based Cyber Threat Intelligence Using LLMs

    • Context Contamination in LLM Analysis of Network Security Logs: Poison with Passive Prompt Injection and Mitigation Evaluation

• Books

  • Digital China - Digital Industries, Industry Digitalization and Digital Society

  • The (Un)Natural History of Malware

• Events

  • CyCon 2027: 19th International Conference on Cyber Conflict: Unified Response - Call for Papers

Finally finally the NCSC’s podcast series.

Unless stated otherwise, linked or referenced content does not necessarily represent the views of the NCSC and reference to third parties or content on their websites should not be taken as endorsement of any kind by the NCSC. The NCSC has no control over the content of third party websites and consequently accepts no responsibility for your use of them.

This newsletter is subject to the NCSC website terms and conditions which can be found at https://www.ncsc.gov.uk/section/about-this-website/terms-and-conditions and you can find out more about how will treat your personal information in our privacy notice at https://www.ncsc.gov.uk/section/about-this-website/privacy-statement.

Operationally this week nothing overly of note.

In the high-level this week:

• Cyber Shield: The path to an agentic AI future for cyber defence - NCSC UK outlines - “The NCSC and the Department for Science, Innovation and Technology (DSIT) are developing this blueprint, which we are calling Cyber Shield. The objective of Cyber Shield is to build a national-scale, collaborative approach to agentic cyber defence, using frontier AI to identify, reduce and resolve our national cyber risk.”

• Cyber Essentials Pathways: from proof of concept to cyber confidence - NCSC UK outlines - “An alternate path to Cyber Essentials Plus certification, without compromising the integrity of the scheme.”

• Britain’s place in the new world order: Foreign Secretary’s Chatham House essay - The Rt Hon Yvette Cooper outlines - “Danger no longer comes only from the battlefield – cyber and hybrid threats now reach us in new and unpredictable ways.”

• Businesses across Britain sign up to Cyber Resilience Pledge as ministers urge firms to strengthen cyber defences - Department for Science, Innovation and Technology, National Cyber Security Centre and The Rt Hon Liz Kendall MP announce - “Signatories will take practical steps to strengthen their cyber resilience, including board-level oversight, use of National Cyber Security Centre (NCSC) tools and stronger supply-chain security”

• UK financial system strengthened with new safeguards for major technology providers - HM Treasury and Rachel Blake MP designate - “As banks, insurers and financial market infrastructures become increasingly reliant on cloud services, disruption at a major supplier could affect multiple firms at the same time, potentially impacting services customers depend on.” … “To help guard against this risk, the Government has designated four major global cloud services and technology providers as Critical Third Parties (CTPs).” - under Requirement 4 there are Technology and cyber resilience requirements

  • UK financial regulators to begin overseeing Critical Third Parties announced by HM Treasury - Bank of England announces

• The Value of Resilience: Cyber Resilience in Financial Services - UK HM Treasury publishes - “Evidence on how cyber resilience can reduce disruption costs, support growth and strengthen financial performance in UK financial services.”

• Defence Readiness Bill - UK Parliament debates - “My noble friend Lord Harris and others mentioned the important point about the changing nature of warfare and the importance of understanding that war is about cyber, climate and information and all the things we have talked about. We need to address those as well in any plan that we bring forward.”

• Public consultation on the draft National Cyber Security Strategy - Ireland consults - “Our third National Cyber Security Strategy provides a path forward for securing our digital infrastructure, enhancing our resilience to cyber security threats, and building capacity at home and abroad to create a safer digital environment.”

  • National Cyber Security Strategy Draft for Public Consultation

• “Modified Narratives” and Government Credibility in Cognitive Warfare: From the Perspective of Social Resilience - Japanese National Institute for Defense Studies think tanks - “For months before the invasion, Russia disseminated justification narratives, and just before the invasion, a cyberattack was carried out on the Ukrainian government's official website displaying a threatening message: "Your personal information has been made public. Fear the worst." This was a combination of cyberattacks and psychological warfare orchestrated by Russia, and it can be said that the war had already begun in the "cognitive realm" before the actual fighting.”

• Unpacking the United Nations Open-Ended Working Group on ICT in the Context of International Security (2021–2025) - United Nations Institute for Disarmament Research publishes - “This report provides an analysis of the evolution of the process and a detailed account of those discussions, including major themes and trends, across the main pillars of the framework: threats, rules, norms and principles, international law, confidence-building measures, capacity-building, and regular institutional dialogue.”

• Reporting on/from China

  • What Happens if China Hacks the US Water Supply? I Went to a Secret War Game to Find Out - WIRED reports - “The scenario modeled by Corman’s war game—5,000 hacked water utilities—would be unprecedented. It also isn’t the most probable outcome of Volt Typhoon’s intrusions, cautions Jen Easterly, who served as director of the Cybersecurity and Infrastructure Security Agency when China’s hacking campaign was first discovered.”

  • There is no room for unintentional mistakes in scientific research - Ministry of State Security warns which the Xinhua News Agency reports - “In today's increasingly competitive technological landscape, technological security has become a crucial area of ​​national security. The leakage of sensitive research data can not only affect the future of researchers themselves but also potentially endanger national security.”

  • Alibaba Bans Staff From Using Anthropic AI Tools Over Security Concerns - Caixin Global reports - “An Alibaba insider confirmed to Caixin on Friday that the Chinese e-commerce giant has added Anthropic’s Claude Code to its high-risk software list. Employees will be required to uninstall Anthropic models and agent products and switch to Alibaba’s in-house AI assistant, Qoder, the person said.” - lets hope they really don’t have Anthropic’s models…

  • China unveils industrial internet road map, with AI, 5G at core of manufacturing upgrade - South China Morning Post reports - “The plan, jointly issued on Tuesday by eight Chinese government agencies led by the Ministry of Industry and Information Technology, included targets for expanding industrial digital infrastructure and data supply, promoting the adoption of AI across factories, and developing world-leading industrial internet platforms.”

  • Shanghai unveils quantum computing hub as China races for tech supremacy - South China Morning Post reports - “The Shanghai Quantum Computing Future Industry Incubation Zone, launched on Tuesday in the city’s Xuhui district, has attracted an initial cohort of 26 quantum firms. The zone would offer resources, talent and subsidies to expedite a shift from laboratory research towards a full-fledged industrial ecosystem for quantum computing, according to a report by the state-backed Jiefang Daily.”

  • India allows four Chinese-linked power equipment firms to bid for government projects - Reuters reports - “Since a 2020 border clash, New Delhi has required Chinese bidders to register with a government panel and secure political and security ​clearances before ​competing for ⁠any state contract. The exemption comes as India accelerates expansion of its ​transmission network to support rising electricity ​demand ⁠and renewable energy additions.”

• AI

  • Mapping of the AI and software security services market - UK Department for Science, Innovation and Technology publishes - “This report presents findings from research with software security and AI security providers. It maps the software security and AI security markets to understand what services and tools they offer, their awareness and the extent to which their services link with the principles in the government’s Software Security Code of Practice, AI Security Code of Practice and ETSI’s AI security global standard, EN 304 223. The requirements in the latter two documents are the same.”

  • Thematic review and gap analysis on AI security - UK Department for Science, Innovation and Technology publishes - “The Department for Science, Innovation and Technology commissioned Lancaster University to conduct a thematic review and gap analysis covering peer-reviewed research on the security of AI from the last five years (January 2021 to January 2026).”

  • SOCBench An Open Benchmark for AI in Cybersecurity Operations - Deep Tempo publish (who make one of the models being measured - “LLMs flag 36% of benign traffic as malicious, released a open-source harness to test.” - turns out there may be better ML/DS/AI approaches to problems..

  • AI Research in Security Operations - Pushing the frontier of AI agents for real security work - Cotool publish

    • BlueBench-Intrusion-002: Real multi-host Windows Active Directory intrusion spanning detection engineering, malware analysis, and open-ended incident reporting - “GPT-5.6 Sol set a new high-water mark at 79%, ahead of Opus 4.7 (76%), Opus 4.8 (74%), GPT-5.5 (73%), and GLM-5.2 (73%). Track wins still rotated: Opus 4.6 topped guided investigation (87%), GPT-5.5 wrote the best IR report (76%), and GPT-5.6 Sol wrote the best threat hunting report (81%). GPT-5.6 Terra reached 70% overall at substantially lower cost, while GLM-5.2 remains the strongest open-weight result at 73%. Claude Fable 5 could not be evaluated because Anthropic's cybersecurity guardrails were triggered on all 40 tasks.”

  • No Security Meter for AI - Berryville Institute of Machine Learning (BIML) - from May but worth a read by cyber luminaries and AI experts - “Let’s say you wanted to make sure that your AI is secure. Can you just maximize the security and privacy benchmark and call it a day? Nope, because benchmarks don’t actually work for measuring AI capabilities (even when they are NOT emergent systemic properties like security). … Will a software security-like measurement move work for AI? Probably. In the meantime we can make real progress in AI security by cleaning up our WHAT piles and managing risk by identifying and applying good assurance processes.”

  • Commission presents EU Action Plan on Cybersecurity and Artificial Intelligence - European Commission outlines - “Building on the EU's unique legal framework for AI and cybersecurity, the Action Plan will bring together Member States, industry and EU-level organisations to strengthen the cybersecurity of our digital landscape against the vulnerabilities posed by advanced AI.”

  • Addressing AI-enabled cybersecurity threats - European Central Bank issues - “The ECB emphasises the importance of addressing, without delay, open supervisory findings and measures related to the ICT areas in focus and security risks that have been identified in previous supervisory activities such as on-site inspections, targeted reviews and the 2024 cyber-resilience stress test. Given the accelerating threat landscape, existing weaknesses that remain unresolved may become increasingly material and pose significant risks to operational resilience.”

  • ENISA’s view on Cybersecurity in the Frontier AI Era - ENISA publish “

    • cybersecurity should be positioned as a strategic use case for European

      investment in AI, as a need exists for the EU-based organisations to have

      access to and develop their own AI models,

    • security fundamentals matter more than ever in the age of AI;

    • resources need to be shifted from discovery to risk-based prioritisation

      of vulnerabilities through higher-speed triage, remediation and risk reduction; “

  • China will likely have its own Mythos-like model around February 2027 - Hamish Low forecasts - “My central estimate for when a Chinese firm will have fully developed a Mythos-like model is around February 2027 (90% CI: October 2026 to September 2027), exactly a year after Mythos itself was ready for internal use in February 2026.”

  • Securing agentic identity - Matthew Garrett opines and outlines - “As is the case for many people working in the security industry, the last few months of my life have been focused on dealing with people wanting to use LLMs everywhere. From an enterprise security perspective that’s not an inherent problem - what’s more of a problem is that people want those agents to have access to resources like their calendar and email and so on”

  • Evolving Windows vulnerability management to meet the speed of AI-powered discovery - Microsoft outline - “The pace of vulnerability discovery is changing with advances in AI making it possible to find more issues, faster, across more code, with new mechanisms that can accelerate both discovery and analysis. The fastest way to reduce customer exposure is to find issues before attackers can use them. Windows is expanding its ability across the platform to find issues earlier, accelerate the engineering work to fix them, strengthen validation and deliver timely, high-quality updates that keep customers protected.”

  • Independent International Scientific Panel on AI - United Nations publishes - “Evidence-based assessment of opportunities, risks and impacts of AI is a first-of-its-kind independent scientific assessment of the capabilities, emerging opportunities and risks of artificial intelligence”

  • When AI Agents Attack: Autonomous Cyber Operations and Europe’s Governance Gap - Carnegie Europe outlines - “Autonomous AI agents are increasingly prevalent in cyberspace. The EU needs a real-time monitoring strategy, to invest in AI defenses, and to reduce its strategic dependence on U.S. frontier models.”

  • Creativity on Trial: The Legal Limits of AI Authorship and the Future of Copyright Protections - Georgia Tech Undergraduate Law Review reviews - “The future of this debate and eventually the precedents that will be set, are largely dependent on how courts continue to interpret and apply the doctrine of fair use in relation to AI training practices. Technology companies developing generative AI systems firmly maintain the position that the incorporation of copyrighted materials into their datasets constitutes fair use since the output works are transformative in nature and do not merely reproduce an original work. However, recent litigation has revealed that this argument is not absolute and that courts are deeming that the legality of training practices depends greatly on the manner in which the materials are sourced and utilized.”

  • AI skills required for 4 out of 10 graduate jobs in China, says recruitment portal - South China Morning Post reports - “In the first five months of this year, nearly four out of every 10 job postings targeting fresh graduates were AI-related, compared with nearly three out of 10 in the same period last year”

• Cyber proliferation

  • Greek wiretapping victims sue spyware firm Intellexa for damages - Reuters reports - “Eight victims of a Greek wiretapping scandal have sued the Athens-based surveillance firm Intellexa SA and individuals believed to be linked to it, seeking €1 ​million ($1.1 million) each for moral harm, their lawyer said on Tuesday.”

    • Eight Predator victims sue spyware firm Intellexa, 13 others, for millions - The Trust Project reports

  • Felons, Fraudsters Flog Offensive Cybersecurity Startup - Brian Krebs reports - “A cybersecurity startup dangling millions of dollars to acquire zero-day security vulnerabilities in popular software .. whose most recent ventures included fake intelligence companies and a now-defunct AI-based lobbying platform they operated under assumed names.”

• Bounty Hunting

  • Florida Ransomware Negotiator Who Extorted and Attacked Multiple U.S. Victims Sentenced to Prison - US Department of Justice announce - “Angelo Martino, 41, of Land O’Lakes, Florida, formerly employed as a ransomware negotiator, was sentenced today to 70 months for his role in conspiring with Blackcat/ALPHV (BlackCat) actors to extort multiple victims, as well as conspiring with other former cybersecurity professionals to attack additional victims in 2023.”

  • Armenian National Extradited to the United States Pleads Guilty to Ransomware Extortion Conspiracy - US Department of Justice announce - ”An Armenian national extradited from Ukraine to the United States pleaded guilty yesterday for his role in Ryuk ransomware attacks and an extortion conspiracy targeting companies throughout the United States, including a technology company operating in Oregon.”

  • The Investigation Bureau has cracked a case involving the Chinese Communist Party’s cyber army - Taiwanese Ministry of Justice Investigation Bureau announce - “An investigation revealed that Li, the head of Ai○ Company, accepted instructions from the Chinese Communist Party's cyber army, "Xiamen Female ○○ Information Technology Co., Ltd.", to collect LINE accounts registered using mobile phone numbers provided by Chinese citizens. These accounts were then rented out to the mainland cyber army for RMB 1,100 each to launch social engineering attacks against Chinese political and academic figures”

  • The National Police have arrested a suspected collaborator of the pro-Russian hacktivist groups CyberArmy of Russia Reborn (CARR) and Z-Pentest - Spanish Policia Nacional announce - “The investigation began last August when, thanks to information provided by the FBI, the National Police investigators were made aware of the alleged involvement of the detainee in actions aimed at providing logistical and support cover to a Ukrainian hacker, located in Ukraine, linked to the pro-Russian hacktivist group CyberArmy of Russia Reborn (CARR), in order to facilitate his escape to Russia, through Poland and Belarus.”

  • Investigation into Odido hack points to possible involvement of the Dutch - Netherlands Politie announce - “In the investigation into the cyberattack on telecom provider Odido, indications have emerged of the involvement of Dutch nationals. The investigation is still in full swing, and the police and the Public Prosecution Service are asking the public for more information about possible suspects: 'Cybercriminals are also vulnerable and leave traces behind.'“

  • Arrest of Iranian Hacker Spotlights Iran’s Movement into Economic Espionage and IP Theft - Kim Zetter reports - “Montenegro police revealed last week that an Iranian-Turkish citizen had been arrested at the request of the US Federal Bureau of Investigation for conducting cyberattacks against US infrastructure — including more than 150 US universities — in order to steal data on behalf of Iran’s Islamic Revolutionary Guard Corps (IRGC) and Iranian universities. In addition to its military corps, the IRGC also conducts surveillance inside Iran and collects intelligence against targets outside the country.”

• Market Incentives

  • CISA expects to finalize key cyber reporting rule by September - NextGov/FCW reports - “The Cybersecurity and Infrastructure Security Agency expects to finalize a bedrock cybersecurity incident reporting rule in September, requiring critical infrastructure providers to report major hacks directly to the cyberdefense agency, according to a regulation document published last week.”
    

The reflections this week are you may have seen these two recent headlines regarding use of AI to offensive operations

• JADEPUFFER: Agentic ransomware for automated database extortion by Sysdig – July 1st

• Inside an AI-Assisted Cloud Attack: Familiar Techniques at Unfamiliar Speed by Sygnia – July 8th

On initial read they appear impressive and potentially a watershed moment – however there is nuance and comparators not conveyed in the reporting which are useful and potentially counterfactual.

To note here:

• The vulnerability exploited in the case of JADEPUFFR was known and a patch available for 14 months - highlighting poor hygiene by the operator which would not have met the bar for Cyber Essentials accreditation.

• The statement in JADEPUFFER that ‘Ransomware is no longer a craft for the highly skilled’ is disingenuous – ransomware affiliate Ransomware-as-a-Service model has had scripted playbooks for less skilled operators to follow since at least 2021

• The statement by Sygnia that 72 hours is impressive (because of AI) does not reflect that we have seen human operated intrusions achieving as quickly as 3 hours and 44 minutes four years ago and 24 hours five years ago.

In short AI is clearly a productivity aid, but:

• Both environments demonstrated poor cyber hygiene which Cyber Essentials / Cyber Assessment Framework address.

• Attack paths and techniques are well understood as reported by Sysdig - the attack relied on familiar cloud techniques rather than novel malware or zero-days.

• Claims of lowering the bar of entry are contradicted given the well-established Ransomware-as-a-Service model and their playbooks.

• Speed of execution should be seen in context when compared to existing human operations.