CISA has warned of a significant rise in attacks against water utilities and urged operators to remove internet-exposed PLCs and other OT assets immediately. Investigators are examining whether recent disruptions to more than 30 Minnesota community water systems are tied to Iran-linked activity, with incidents causing password changes, PLC reconfiguration, boil…
Category: Cyber Security News
Bitsight uncovered Fuyao, an operation tied to Zhejiang Fengwo IoT Technology Co., Ltd., in which cheap Android TV boxes spoof phone identities and click ads while also relaying traffic as SOCKS5 exit nodes. The campaign uses a custom automation stack with YOLOv8s, Blockly, and ad-network infrastructure to drive fraud, but the…
Adform suffered a supply-chain attack that injected malicious JavaScript into its tracking library, enabling clipboard hijacking to replace Bitcoin, Ethereum, and TRON wallet addresses with attacker-controlled ones. Security researcher Kevin Beaumont exposed the issue after discovering the trojanized script on websites using Adform’s ad platform, and Adform later removed the code and said it had taken protective measures. #Adform #KevinBeaumont #trackpoint-async.js
Arch Linux has temporarily disabled AUR package adoption after a wave of malicious takeovers led to infected packages being pushed through the repository. The campaign, which started with openconnect-sso and may involve over 200 packages, uses a Tor-based two-stage payload to steal credentials, spread via SSH, and maintain persistence. #ArchLinux #AUR #openconnect-sso #IFIN
Amgen said attackers stole corporate data and patient information from multiple third-party cloud environments, and the company detected the unauthorized activity in July 2026. The investigation is still ongoing as Amgen works to determine the full scope of the breach and whether it is linked to ShinyHunters. #Amgen #ShinyHunters
President Donald Trump blamed Minnesota for recent cyberattacks on the state’s water systems, despite U.S. investigators attributing the activity to Iran. Cyber experts and officials pushed back, citing CISA warnings, evidence of Iranian involvement, and the need to protect critical water infrastructure. #Minnesota #CISA #WaterISAC #TimWalz #SolarWinds
Bitsight says the Fuyao operation used cheap Android TV boxes to spoof phone identities, click ads, and sometimes relay other people’s traffic as SOCKS5 exit nodes. The campaign was attributed to Zhejiang Fengwo IoT Technology Co., Ltd., with researchers linking it to a large fraud infrastructure and advising users to check…
Researchers uncovered HollowFrame, a Go-based loader framework, and Matryoshka, a Rust-based malware family used in a multi-stage intrusion against two endpoints at a law firm. The attack used spear-phishing, DLL side-loading, and GitHub-based command-and-control to enable persistence, reconnaissance, file transfer, and follow-on payload delivery. #HollowFrame #Matryoshka #GitHub #BlackpointCyber…
A suspected Chinese-speaking threat actor has launched a new campaign against government-related organizations across Central Asia and the Syrian Arab Republic using the backdoors OctLurk and SilkLurk, alongside the proxying tool LurkProxy. The malware operates largely in memory, supports extensive post-compromise activity, and shows infrastructure overlap with the SilentRaid, MystRodX, and…
Authorities in Minnesota are investigating cyberattacks that hit more than 30 water systems, with officials not yet identifying the culprit. The incidents come as US agencies warn that Iranian hackers have been targeting water and wastewater systems and other critical infrastructure. #MinnesotaITServices #FBI #CISA #IranianHackers…
SecurityWeek’s weekly roundup covers major cybersecurity developments, including the OnTrac breach, Adobe vulnerability patches, SonicWall credential stuffing, and a North Korea-linked supply-chain campaign against popular NPM packages. It also highlights data exposure at the UK Department for Education, flaws in VE Commercial Vehicles’ My Eicher platform, and AI-assisted cryptanalysis research from…
Attackers in H1 2026 are scaling their operations by adapting familiar techniques to new platforms, with AI increasingly used in both attack infrastructure and malware. ESET reported nearly 900,000 AI skills analyzed, the emergence of PromptSpy as the first known Android malware to use generative AI, and continued growth in ClickFix, quishing, and EDR killer use. #PromptSpy #Gemini #ClickFix #quishing #EDRkillers #ESET
CISA is warning that internet-exposed PLCs in water and wastewater systems are being increasingly targeted, with recent attacks disrupting more than 30 Minnesota community water systems. The agency says attackers have changed passwords, altered IP settings, and exploited exposed OT assets, while advising organizations to remove direct internet exposure and secure access through VPNs or gateways. #CISA #Minnesota #RockwellAutomation #AllenBradley #Siemens #SchneiderElectric #MicroLogix1400
A Chinese-speaking threat actor used DeepSeek and the open-source Hermes Agent to run autonomous attacks against exposed servers with minimal human involvement. Unit 42 found the campaign showed a functional end-to-end AI offensive workflow, even though the observed exploit attempts failed to compromise the targets. #DeepSeek #HermesAgent #Unit42 #FOFA #Langflow #n8n #CVE-2026-33017 #CVE-2026-21858 #CVE-2025-68613 #CitrixNetScaler #ApacheTomcat #MarimoNotebook #WindowsIKEVPN
Researchers from Nanyang Technological University uncovered a widespread class of implicit trust errors in 4G and 5G core networks that can lead to denial-of-service and session hijacking attacks. Their study found 84 previously unknown vulnerabilities across open-source and commercial LTE/5G core implementations, including issues in Open5GS, free5GC, OpenAirInterface, SD-Core, eUPF, and…