Welcome to the weekly highlights and analysis of the blueteamsec (and my wider reading). Not everything makes it in, but the best bits do. A community member is doing daily AI generated podcast of the last 24hours of posts.
Operationally this week nothing overly of note.
In the high-level this week:
Water sector example added to the NCSC’s Secure connectivity principles - NCSC UK adds - “The NCSC has published a new fictional worked example demonstrating how organisations can apply the Secure Connectivity Principles for Operational Technology (OT). The example explores how a regional water utility might approach the challenge of standardising digital connectivity across its OT environment while maintaining safety, reliability and cyber resilience.”
How BitLocker PINs help protect your data and devices - NCSC UK outlines - “However, many organisations use BitLocker without a PIN, leaving their devices vulnerable. In this blog we explain why a PIN is so important, and what to do if – for whatever reason – you can’t use a PIN.”
Parliamentary Under-Secretary of State (Minister for Space, Cyber and Regulatory Reform) - Department for Business, Innovation, Science and Trade and Department for Digital, Culture, Media and Sport announce - “Baroness Lloyd of Effra CBE was appointed Parliamentary Under-Secretary of State (Minister for Space, Cyber and Regulatory Reform) jointly in the Department for Digital, Culture, Media and Sport (DCMS) on 23 July 2026 and the Department for Business, Innovation, Science and Trade (BIST) on 22 July 2026.”
Ex-MI6 chief says the biggest risks for CEOs are the threats they already know about - Fortune interviews - “He argues that the biggest risk for companies today isn’t some black swan event that we didn’t see coming. It’s managing systemic risk from cumulative impact of known issues: the layering of COVID-19 plus Ukraine, Iran, China stress, tariffs, and more.”
Expanding Capabilities to Combat Transnational Cyber-Enabled Crime - The White House (not me) announces - “This memorandum expands the fight against TCO-perpetrated cybercrime by incorporating the ingenuity of the private sector.”
Private Sector Cybercrime Disruption: Compatible with Statecraft? - RUSI think tanks - “Arguably, there is a need to do more to make the UK a more hostile target, albeit in a context of constrained public resources. One approach could be through public-private partnerships that leverage the private sector’s capacity to build intelligence on criminal adversaries and, in limited contexts, disrupt their activities.”
Water Cyber Shield Act of 2026 - Senator Schiff introduces - “The Water Cyber Shield Act of 2026 is comprehensive legislation to reform how EPA addresses the vulnerability of water and wastewater systems to cyberattack. Through amendments to the Safe Drinking Water Act and the Clean Water Act, this bill empowers EPA with the authorities it needs as the Sector Risk Management Agency for the water and wastewater sector—a job EPA is statutorily tasked with but lacks the necessary authorities to carry out.”
Germany warns of daily ‘hybrid warfare’ after suspected drone attack - Reuters reports - "We're not at war, but we are the daily target of hybrid warfare," Dobrindt said. "Espionage, sabotage, cyberattacks, or covert operations by foreign powers aimed at destabilising Germany or inflicting direct harm are a constant reality."
Turkey gives presidential cybersecurity agency power to order internet measures before court review - Stockholm Centre for Freedom outlines - “Turkey has given a cybersecurity agency reporting directly to the presidency power to order internet and communications companies to carry out emergency measures before a judge reviews them, as part of a broader transfer of online regulatory powers from the country’s telecommunications watchdog, the TR724 news website reported.”
Discussion on Full-Lifecycle Ransomware Response Measures: “Beyond Prevention to Response and Recovery” - Korea Internet & Security Agency announces - “The Korea Internet & Security Agency (KISA, President Lee Sang-joong) announced on August 12, 2026 (Wednesday) that it will hold the "5th Ransomware Resilience Conference" in collaboration with the Ministry of Science and ICT (Deputy Prime Minister and Minister Bae Kyung-hoon) on September 16 (Wednesday) at the Peace & Park Convention Center in Yongsan-gu, Seoul. The conference will share the latest trends, response technologies, and policies regarding ransomware and discuss measures to strengthen cyber resilience.”
Raise the Cyber Waterline - The Defense Analyses and Research Corporation (DARC) think tanks - “The debate over the risks of AI-enabled cyberattacks has remained academic for far too long. Now, time is short: Our adversaries will soon have access to models that can launch attacks at scale against unwitting defenders. America’s cyberdefense strategy has relied for too long on individual action, without reckoning with the harms caused to citizens by cyberattacks. The time to act to close this defensive gap is now, while we retain a substantial advantage in model capability.”
Reporting on/from China
China-linked hackers hit Taiwan in unprecedented ‘autonomous’ AI cyber attack - Financial Times reports - “Suspected Chinese hackers used publicly available AI tools to compromise government websites in Taiwan in a first-of-a-kind breach, highlighting how artificial intelligence is transforming cyber warfare.” - comment: not sure this first-of-a-kind …
Taiwan says it was targeted last month in AI-driven hacking campaign - Reuters reports - “The investigation results showed the attacks displayed clear characteristics of an "overseas source", with hackers employing a hybrid approach that combined manual operations with AI agent-assisted attacks, such as Open Claw, it said.”
Cutting-edge technologies in encrypted network security (2026) - Journal of Electronics publishes - “However, current defense systems still face the dual pressures of dynamic escalation of adversarial capabilities and computational bottlenecks: attackers use protocol-based concealment and adversarial feature drift to dismantle static models; 100Gbps backbone networks require millisecond-level response times, but the latency of traffic feature representation and deep learning model inference creates a rigid contradiction of "high precision requirements - low resource capacity." To accelerate the seamless integration of technological breakthroughs and scenario implementation, the *Journal of Electronics* has established a special column, "Frontier Technologies for Dense-State Network Security."“
Soliciting Public Comments on the Draft Regulations on the Protection of Personal Information by Large-Scale Personal Information Processors - Cyberspace Administration of China consults - “To regulate the personal information processing activities of large-scale personal information processors, protect the legitimate rights and interests of personal information, and promote the lawful and reasonable use of personal information, in accordance with the "Personal Information Protection Law of the People's Republic of China," the "Regulations on the Administration of Network Data Security," and other laws and administrative regulations, the Cyberspace Administration of China has integrated and improved the previously publicly solicited drafts, namely the "Regulations on the Establishment of Personal Information Protection Supervisory Committees for Large-Scale Online Platforms (Draft for Public Comment)" and the "Regulations on Personal Information Protection for Large-Scale Online Platforms (Draft for Public Comment)," and has now formed the "Regulations on the Protection of Personal Information by Large-Scale Personal Information Processors (Draft for Public Comment)," which is now open for public comment.”
China deploys ‘robot employees’ in Beijing to patrol city parks, curb inappropriate behaviour - The Economic Times reports - “Beijing has deployed seventy-two robot employees in its municipal parks this summer. These robots perform cleaning, patrolling, and visitor guidance duties across the city. Intelligent tour-guide robots answer questions and remind visitors about park rules. Specialised robots also attract and trap mosquitoes, reducing insect density in selected areas. This initiative aligns with China’s national “Robot Plus” strategy for public services.”
AI
Addressing AI-Enabled Cyber Risk: Establishing the AI Cybersecurity Clearinghouse - CISA outline - “Gold Eagle is a software capability that, at scale, enables ingestion, validation, and deduplication of AIenabled vulnerability reporting, amplifying CISA’s ability to triage incoming vulnerability reports for CVD within the VINCE platform. Gold Eagle simplifies the path from vulnerability discovery to remediation by streamlining initial report triage and validation for Coordinated Vulnerability Disclosure (CVD) and avoids duplication of efforts. Gold Eagle augments but does not replace existing private-sector or communitydriven vulnerability management efforts. Reports submitted through Gold Eagle that meet CVD requirements will initiate cases in VINCE”
AI agent hacks gym to get its user a spot in pilates class - BBC reports - “He says he outsourced the “chore” to an AI agent - a tool that can carry out online tasks autonomously…. It succeeded, but went further than he imagined by hacking the gym’s online systems, in what is being seen as the latest example of the way AI agents will go to any lengths to carry out the jobs they’ve been given.“ - comment: this actually happened in April, the company blogged about it, the blog now appears deleted. What the agent found was the API endpoint had no security - there are many non AI tools which would find similar.
GLM-5.3: Frontier Coding with Emergent Cyber Capabilities - Z.ai announce - “As we scaled post-training, cyber capability developed faster than we expected. GLM-5.3 is state of the art on CyberGym for vulnerability discovery, and its gains are largest further up the exploitation chain, where it more than doubles GLM-5.2 on exploitation benchmarks.”
Zhipu launches flagship model GLM-5.3 as China seeks Mythos-level edge in cyber defence - South China Morning Post reports - “Beijing-based Zhipu said GLM-5.3 achieved a success rate of 84.5 per cent on CyberGym, a benchmark that measures whether models can identify and validate security flaws from source code. That was above Anthropic’s Mythos at 83.8 per cent and OpenAI’s GPT-5.6 Sol at 83.6 per cent, according to Zhipu. However, the Chinese model did not match those foreign systems on ExploitBench, which gauges how far AI models climb the exploitation ladder. Its score of 54.4 per cent trailed Mythos’ 78 per cent and GPT-5.6 Sol’s 76.5 per cent.
Shaping the NVD for the Future: We Need Your Feedback on AI-Enabled Vulnerability Management - NIST consults - “As the volume of reported vulnerabilities surges and emerging technologies reshape the threat picture, it is time for traditional vulnerability management practices centered on periodic patching and manual remediation to be transformed toward continuous, automated, and contextual vulnerability management.”
AI-generated vulnerability patches require human review - 1Password quantify - “Across six recently-disclosed CVEs, we produced 6,080 patches using two frontier, cyber-capable reasoning models. The average success rate for generating a patch that fully resolved the vulnerability (without materially changing application behavior) was just 26.0%.“ - comment: ~4.5% introduced new vulnerabilities!
Can AI do novel security research? Meet the HTTP Terminator - James Kettle demonstrates - “We all know AI can find bugs. After a decade of research, I asked a harder question: can an autonomous system invent new attack techniques, and use them to hack live websites at scale? Building this sounded like a bad idea, so I did it.” .. “I'll also share discoveries from beyond the autonomy horizon - some only reachable with a tight human/AI research loop, and others beyond AI's reach entirely.” - comment: novelty comes in part from where techniques are applied and derivates discovered
Security Research in the AI Era - Victor V outlines the journey of a vulnerability researcher being disrupted - “What does the future hold? I don't know. AI may become increasingly powerful, and software products from vendors may have fewer and fewer problems, leaving less and less room for vulnerability researchers, but this remains an unknown”
CyberKimi × ExploitBench — Results & Evidence - Taha Karim publishes - “three-way experiment on the bench's hardest WASM bug: CyberKimi unassisted 8/16 vs stock Kimi K3 4/16 vs CyberKimi + disclosed methodology pack 10/16. Includes the full leaderboard chart (only Mythos 16/15 and GPT 5.5-Codex-AutoNudge 15.0 sit above the pack-assisted run), the capability-by-capability story, and the road to Mythos.”
Cyberwarfare in the AI Age - Foreign Affairs podcasts - “Jen Easterly has spent much of the past 20 years defending U.S. cyberspace against such threats. She has been both a military officer and a top civilian official, most recently running the Cybersecurity and Infrastructure Security Agency. Now, she warns, the danger is about to get much worse”
Agentic profiles for effective AI governance - Google DeepMind publish in nature - “The creation of effective governance mechanisms for artificial intelligence (AI) agents requires a deeper understanding of their core properties and the implications they have for deployment. This paper provides a characterization of AI agents that focuses on four dimensions: autonomy, efficacy, goal complexity and generality. We propose different gradations for each dimension and argue that each dimension raises unique questions about the design, operation and governance of these systems. Moreover, we draw on this framework to construct ‘agentic profiles’ for different kinds of AI agent. These profiles help to illuminate cross-cutting technical and non-technical governance challenges posed by different classes of AI agents, ranging from narrow task-specific assistants to highly autonomous general-purpose systems.”
To Nuke or Not to Nuke: LLMs’ (Missing) Ethical Reasoning and Actions in a High-Stakes Decision-Making Simulation - University of Florida researches - “Across 130 high-tension Civilization V episodes replayed by 13 models under three factorial prompt interventions, no intervention or factorial combination reliably eliminates emergent escalation.” - comment: we’ve seen this movie - War Games
US AI leaders turn to Chinese open-weight models, challenging closed-source safety claims - South China Morning Post claims - “More American titans of artificial intelligence are describing Chinese open-weight models as better for AI safety and security than closed-source models, challenging the long-standing claim by US closed-source AI model developers such as Anthropic that open-source models present a threat to society. “From what I’m seeing, I think open-weight models seem safer to me than closed-weight models,” AI pioneer Andrew Ng, the former head of Google Brain and former chief scientist at Baidu, said at the Agentic AI Summit in Berkeley, California, on Saturday.”
Voltcraft: Industrial Competition in the Age of AI - The American Enterprise Institute think tanks - “Resource availability has long shaped the ability of states to project power, from seabird guano in the 19th century to coal deposits in the 20th. In the age of AI, states need large numbers of devices capable of turning electricity into tokens to reap AI’s strategic and economic rewards. This is why the physical production and custody of computational power—compute—has become an essential element of national strategy and geopolitics.”
America’s Cosmic Bet on AI - The winner takes it all. What happens if the United States loses? - Foreign Policy asks - “Confronting this blizzard of claims and counterclaims about a bedazzling technology, four questions demand our attention. First, is the course that the United States has chosen prudent? Another way to think about this is, would a financial investor with fiduciary responsibility place this large a bet on a single sector? Second, what could go wrong? Could the eye-popping increases in investment and stock prices be another bubble—analogous to the financial wizardry that created the real-estate bubble that burst in the Great Recession of 2008 or the dot-com bubble in 2000? Third, why is the only other AI superpower—China—making such a radically different bet? And finally, if the miracle is delayed or never happens, what will the likely consequences be—not just for the U.S. economy but also for national security?”
Connecticut Court Sanctions Self-Represented Litigant over Prompt Injection in a Court Filing - Law News reports - “A Connecticut Superior Court judge has imposed sanctions for prompt injection in a court filing, ruling that a self-represented plaintiff in Elliott v. New York Bariatric Group, LLC (docket AAN-CV-25-6066141-S) hid machine-readable instructions inside multiple pleadings in an attempt to manipulate any artificial-intelligence tool reviewing the documents.”
Cyber proliferation
Apple sends new ‘Threat Notification’ alerts over mercenary spyware attacks - Bleeping Computer reports - “Apple confirmed to BleepingComputer that it sent a new batch of threat notifications on August 13 to targeted users in 110 countries.”
Bounty Hunting
Bybit Sues North Korea and Lazarus Group, Secures Preliminary Injunction Freezing Stolen Assets in Landmark Crypto Asset Recovery Effort - Bybit litigates - “announced that it has filed a civil lawsuit in the U.S. District Court for the District of Columbia against the Democratic People's Republic of Korea (DPRK), its Reconnaissance General Bureau (RGB), and the Lazarus Group, which U.S. authorities have identified as the DPRK-linked hacking group responsible for the February 2025 cyberattack.”
North Carolina Man Sentenced for Cyber Extortion Scheme that Targeted International Technology Company in D.C. - US Department of Justice announces - “According to filed documents, trial evidence, and witness testimony, Curry was contracted to work as a data analyst for approximately six months with the victim company. In that capacity, Curry had access to the victim company’s data files and other personnel and corporate information. Trial evidence established that Curry misused his position to access the victim company’s personnel and other sensitive corporate records, which he then used to carry out the cyber extortion scheme. Curry hatched his extortion scheme after he learned that his contract was not going to be renewed and that he would no longer be employed by the company.”
FBI investigating North Korean remote IT staffer working for US agency - Federal News Network reports - “The FBI is investigating how an unidentified federal agency was recently swept up in a yearslong campaign involving North Korean remote IT workers fraudulently obtaining jobs at major companies and other organizations.”
Young Portuguese self-taught entrepreneur created a version of ChatGPT that was used for crimes. FBI alerted PJ (Portuguese Judicial Police) - Publico reports - “He started hacking when he was only ten years old and created a program similar to ChatGPT that aided in committing crimes. Honesty and cooperation with the police should help in the trial.”
Market Incentives
ACRO reprimanded following cyber security failings - UK Information Commissioner’s Office reprimands - “The ICO found ACRO had engaged third-party providers to deliver certain security services, including patch management. However, ACRO did not ensure clear responsibility for identifying and monitoring critical CMS security updates, failed to maintain an effective patch management process, and did not adequately investigate security alerts that could have identified the hacker’s activity earlier.”
The End of “As-Is”: Could AI Undermine Software’s U.S. Legal Shield? - Center for Strategic & International Studies think thanks - “Software occupies a privileged legal space that no other consumer product enjoys. A lamp that catches fire, a car with a defective airbag, or a harness that snaps under normal use all fall under strict product liability, a body of tort law that holds manufacturers responsible for defects regardless of fault. Software largely escaped that fate. Courts and legislators treat software as a licensed service rather than a product, letting it hide behind contract law instead. That exceptional treatment was a deliberate policy choice, and it is built on three core justifications that AI now undermines entirely”
Apple Faces Lawsuit Over iCloud Private Relay Vulnerability - CNET reports - “Last week, a blog post by Talal Haj Bakry and Tommy Mysk exposed a vulnerability in how iCloud Private Relay, in some circumstances, doesn’t shield a customer’s IP address, which is the entire purpose of the feature. Even when it’s enabled, their information can be exposed when using a passkey to sign in or when a website uses two methods (DNS prefetching and WebTransport) to load data faster.”
Goodwin Procter Paid around $10 million ransom Luna Month - The Insurer reports.
PPP lawmaker tells U.S. House Coupang data breach action was not discriminatory - Korea JooAng Daily reports - ““The letters were prepared to deliver accurate facts based on the official findings and regulatory actions of the Personal Information Protection Commission [PIPC] in response to claims raised by some U.S. lawmakers that the Korean government has unfairly targeted Coupang,” his office said in a press release."
Reflections this week are around the reality of the forced correction that all organisations are experiencing in cyber security as a result of scaled vulnerability discovery in the AI era and response required.
Firstly, it is important to point our that we have had other forced corrections. Arguably ransomware was a human driven, scaling through affiliates and playbooks, forced correction of technical and operational debt in organisations.
Secondly, when we consider the AI era there are a number of fundamentals to consider when thinking about what is required to achieve cyber resilience in practice.
#1 - We aren’t going to solely patch our way to resilience in the AI era - noting we are in the midst of the patch wave and they should still be deployed.
Expecting to run faster than AI adversaries by solely relying on patching for in perpetuity seems on the face of it challenging as a strategy
#2 - Well run and effective operations are fundamental e.g.
Comprehensive IT operations i.e. comprehensive asset management
Active technical debt management and paydown a key enabler
#3 - Architectures and other primitives are crucial e.g. (there are others).
Memory safety technologies to mitigate memory corruption
#4 - Machine speed coupled with dynamic and resilient operations the measure
Demonstrated recoverability
Dynamic response to a changing environment
Ability to execute quickly and comprehensively
Heather Adkins at Google did an excellent job in the last ten days at conveying the journey that software is going on with regards to its security and the likely impact AI will have and the future sunny uplands.
The nuance is the benefit of this wave is likely to not land evenly for every organisation. For example an organisation that is running on 10 to 15 year old technology is not going to benefit to the same extent as others.
This unevenness is why we say that AI will be a net benefit for cyber defence but the road between where we are and that end state is rocky and uneven.
There are no short cuts to pay down technical debt nor run effective resilient operations in practice - just planful execution.
Not getting this via email? Subscribe:
Think someone else would benefit? Share:
All attribution is by others and not the UK Government unless specifically stated as such, please see the legal text at the end.
Have a lovely Saturday…
Ollie
Cyber threat intelligence
Who is doing what to whom and how allegedly.
Reporting on Russia
Social engineering performed by UAC-0145: compromising in the employment process
CERT Ukraine detail this alleged Russian operation which is noteworthy due the overlap with some North Korean tradecraft.
CERT-UA has received information about the use of advanced social engineering methods by the cyber threat cluster UAC-0145 (subcluster UAC-0002, also known as Sandworm, APT44, Seashell Blizzard). In particular, on job search sites, attackers, having previously studied the candidate's resume, contact a potential victim, usually a system administrator/IT specialist, on behalf of an IT company (for example, ATLAS Business Group).
https://cert.gov.ua/article/6318863
Inside a Russian-Speaking Operator’s Toolkit for Compromising Ukrainian IP Cameras
Hunt.io disclose this alleged Russian operation which is noteworthy due to a focus on IP cameras.
[We] archived an open directory on 89.208.97[.]165:8888, exposing the compromise of a Ukrainian e-commerce site via SQL injection, which the operator then reused as a proxy and launch point for further activity.
The same server’s bash history records Tor-routed intrusion attempts against Ukrainian government and military sites, built with per-target credential lists, though the recovered files do not confirm whether any attempt succeeded.
The same server hosted a Docker project named “camview” in its archive, used to scan, exploit, and maintain a list of internet-exposed cameras using known Dahua and Hikvision vulnerabilities.
Recovered from the operator’s own directory: a catalog of 58 compromised Ukrainian cameras, a saved still from one of them, and a log of live viewing sessions with session lengths, frame counts, and frame rates recorded per stream, access the operator used, not exposure inferred from a scan.
A publicly available scanning tool integrated into camview led to a second, separately operated directory on 213.165.63[.]49, building anonymization proxy infrastructure that scanned routers across 15 European countries, with camera targeting focused on Ukraine.
The second operator’s toolkit relied on chaining multiple router and camera CVE’s using custom Python scripts with additional focus/targeting of servers in Odessa, Burshtyn, and Kherson.
Both operations show similar patterns: use of an open-source scanner to easily find and compromise cameras within specific geographic areas, and reliance on historically weak security on edge devices and internet exposed infrastructure.
https://hunt.io/blog/russian-speaking-operator-ukrainian-camera-toolkit
Reporting on China
Jewelbug: APT Group Runs Espionage and Crypto Fraud Operations Side by Side
Symantec and Carbon Black detail an alleged overlap between Chinese espionage and criminal activities. The scale of the browser cookie theft is also noteworthy.
Jewelbug is a China-based hackers-for-hire group that runs parallel operations: espionage against governments and militaries across the Middle East, Southeast Asia and South Asia, and a for-profit cryptocurrency fraud business.
Both missions are administered from a single control panel, XG-Web, a browser-centric remote-access and information-stealing framework that turns a victim’s browser into a full remote-control channel and reaches from there into the host and the internal network behind it.
At least one of the operators is tied to a registered Hunan company, and we have identified the sole legal representative by name from government-issued identity documents belonging to the operators.
Jewelbug’s main implant is the Antino backdoor. It also operates a malicious Chrome and Firefox extension posing as an application called “PDF Viewer”, paired with a helper disguised as a Microsoft Edge component that gave operators a command shell on the host.
In its largest operation, a single planted script placed a watering-hole on more than 15 government webmail tenants in a Middle Eastern country at once.
Jewelbug’s victim database recorded more than one million implant check-ins and more than 580,000 stolen browser cookies in less than three months of active operations. One set of implants was configured to utilize the internal proxy of a major U.S. aerospace and industrial manufacturer
https://www.security.com/blog-post/jewelbug-crypto-fraud-espionage
PATCHCORD: New malware cluster targets Afghan telecom and South Asian critical infrastructure
Darrel Virtusio, Santiago Pontiroli and Subhajeet Singha detail an alleged Chinese operations against telecommunications. Noteworthy for the sectoral focus, regional focus as well as the capabilities and techniques employed.
[We have] identified an ongoing campaign delivering a previously undocumented custom backdoor against Afghan telecom providers and South Asian critical infrastructure organizations. The backdoor, tracked as PATCHCORD, is a compiled C/C++ implant delivered through sector-specific lures, including fake VPN installers impersonating Afghan Telecom (AFTEL) and telecom management tools. Infrastructure pivoting uncovered SHEETCORD, a Go-based implant that builds on PATCHCORD's capabilities while abusing Google Sheets for C2 communication. The malware was actively distributed through a domain impersonating India's National Informatics Centre (NIC).
Reporting on North Korea
Kimsuky Integrates AI into Attack Operations, From AI-Generated Decoy Documents to a Local LLM
Genians details the further integration of AI into alleged North Korean operations.
Observed indications that the Kimsuky group built and operated local LLM environments using Ollama, GPT4All, and Msty.
Assessed to be in the phase of accumulating technologies and capabilities to integrate AI across its overall attack operations.
Identified indicators exhibiting North Korea-linked characteristics, such as “Arirang”, “싸이트”, “가입리력”, and “로출되였는지”.
Continued targeted attacks against foreign diplomatic missions, as well as the military, security, and virtual asset sectors.
Abused Git-based repositories as C2 infrastructure and distribution channels for encrypted AsyncRAT payloads.
Highlighted the need to strengthen behavior-based EDR detection and threat hunting against the abuse of LNK files, PowerShell, and GitHub.
https://www.genians.co.kr/en/blog/threat_intelligence/kimsuky_ai_llm
Shattering the Dream – When a Job Offer Becomes a Zero-Day Attack
Check Point Research details an aspect of an alleged enduring North Korean operation which is noteworthy for the local privilege escalation vulnerability on Windows apparently exploited.
[We are] tracking a long‑running campaign called Operation Dream Job, targeting organizations worldwide, with a particular focus on the defense sector. The campaign is affiliated to DPRK-linked Lazarus group and its latest wave focuses on the defense sector in Europe and India.
In the latest variant of the Operation Dream Job campaign, the threat actor distributed SecurityPDF, a modified PDF viewer designed to open attacker-crafted PDF documents and execute a new backdoor which we named Troy.
During the intrusion, the threat actor exploited CVE-2026-68820, a zero-day vulnerability in the Microsoft AFD.sys driver, to deploy a new version of FudModule, Lazarus’ kernel-mode rootkit. Following Check Point Research responsible disclosure, Microsoft released a patch as part of their August Patch Tuesday updates.
Lazarus also used CVE-2025-49113 to exploit vulnerable Roundcube webmail servers. The compromised servers were infected with RelayShell, a PHP webshell that repurposes compromised web servers as relay nodes within the attacker’s command-and-control infrastructure.
At least in one case, a compromised organization in Western Europe was leveraged to conduct a spear-phishing campaign, allowing the attackers to abuse the organization’s reputation and trust to target additional victims.
Smile, You’re on Camera. Part 2: Hiring Lazarus APT’s IT Workers in a Fake DeFi Startup
Any.run, BCA LTD and NorthScan push the boundaries with this alleged reverse Yahtzee and turn the tables on an alleged North Korean operation to study them
Researchers created a fake DeFi startup and hired suspected Famous Chollima operatives, providing a rare inside view of a DPRK IT worker operation.
The investigation followed the scheme beyond recruitment, showing how the operatives worked, collaborated, and accessed company resources after being hired.
The findings show that DPRK IT worker schemes are not only a hiring risk. Once inside, operatives can gain legitimate access to code, systems, intellectual property, and trusted business processes.
https://any.run/cybersecurity-blog/lazarus-group-it-workers-investigation-part-two/
Reporting on Iran
Nothing overly of note this week
Reporting on Other Actors
Akira Hits Safe Mode: Ransomware Rebooting Around EDR
James Northey detail this tradecraft shift by a ransomware group to subvert security controls.
After gaining access via an exposed SonicWall VPN, an Akira affiliate rebooted the victim host into Safe Mode with Networking to defeat EDR, a first for this ransomware variant in our telemetry.
Safe Mode is a boot mode that only loads essential drivers and services, disabling most third-party software. As such, the reboot stopped the Huntress agent and disabled Microsoft Defender’s real-time protection; Defender couldn’t quarantine the file until the attacker rebooted back to normal mode. Ransomware families like Snatch and AvosLocker have abused Safe Mode for years, but this is the first reported tie to Akira that Huntress has observed.
In this incident, Safe Mode also broke the ransomware. In its stripped-down memory environment, the Akira process tree hit an out-of-virtual-memory failure seconds after launching.
While the anti-EDR effort backfired and the ransomware did not deploy, the attacker had already exfiltrated credentials and file shares. Even without encrypting anything, they can still extort the victim by threatening to leak the stolen information.
https://www.huntress.com/blog/akira-hits-safe-mode-ransomware-rebooting-around-edr
Dissecting the JWR phishing framework
Chetan Raghuprasad details a phishing framework which detection teams will want to develop tradecraft for.
Cisco Talos recently identified an undocumented phishing framework, internally branded “JWR” by its developer, built to convincingly impersonate checkout and login pages across major payment and shopping platforms.
The client engine of the JWR phishing framework is a real-time, operator-driven system that, rather than merely logging form submissions like a static credential-stealing page, keeps an AES-CTR encrypted WebSocket open to the threat actor so they can steer each victim’s session live.
The victim data targeted by the actor using JWR extends well beyond payment data, encompassing identity documents, Social Security numbers, passport and driver’s license images, website and PayPal credentials, 2FA codes, and full device fingerprints, all committed to the actor’s server once a session ends.
Talos assesses with medium confidence that the JWR phishing framework is a variant of “The Outsider,” a phishing-as-a-service (PhaaS) platform, based on several similarities in the client engine scripts and functionalities of the two PhaaS platforms.
Talos observed a real-world campaign delivering the JWR client via SMS lures impersonating toll authorities, and postal and courier services of several countries in Southeast Asia and the Middle East.
https://blog.talosintelligence.com/dissecting-the-jwr-phishing-framework/
Software Supply Chain Incursions
A reminder we issued guidance a number of weeks ago in Software supply chain attacks: check your dependencies for software developers
Six npm Packages Use Ethereum Transactions to Retrieve Malicious Payloads
2,500+ Companies and 434,000 CI/CD Pipelines Exposed in the Largest AI Supply Chain Breach of 2026
Discovery
How we find and understand the latent compromises within our environments.
Beyond the Userspace Call Stack: Kernel Subsystem Context for Detection Engineering
Nedim Šabić et al bring kernel context enrichment to call stack analysis..
Consider a conventional file operation. The userspace call stack can answer questions such as:
Which process initiated the operation?
Which modules (DLLs or executables) and functions were involved?
Did the operation originate from an unusual execution path, like a floating memory region?
Does the stack pattern resemble malicious or injected code?
The kernel side answers a different question: Which kernel subsystem actually serviced the operation? The userspace stack describes the path into the operating system, while the kernel stack describes the path through the operating system, and together, they provide a much richer behavioral picture.
https://fibratus.io/blog/kernel-call-stack-subsystem-context-detection-engineering
https://github.com/rabbitstack/fibratus
Do local LLMs dream of becoming forensic investigators?
S. Nakano shows the potential of generative model use in forensic investigations.
FORENSIA was created.
It automatically reads artifacts extracted from the surveyed equipment, generates and validates research hypotheses using local LLM, and continuously updates reports.
https://sumeshi.github.io/posts/works/do-localllms-dream-of-forensic-investigator
ATEN: Endpoint Telemetry for AI Coding Agents
Anton Ovrutsky provides an observability super power with this release..
Agent Telemetry & Event Notation. ATEN is a background service that records what AI coding agents — Claude Code and Codex today — do on a host, and writes it out as structured events for a SIEM. It’s the same idea as Sysmon, scoped to agent activity.
https://www.antonlovesdnb.com/blog/aten
https://github.com/Antonlovesdnb/aten
On IP Addresses as Identifiers of Internet Users and Services
Rumaisa Habib, Sudheesh Singanamalla, Marwan Fayed and Zakir Durumeric provide some insight in IP resolution fragility.
Using data collected from a global CDN, historical DNS records, and active DNS measurements, we investigate the extent to which IP addresses uniquely identify users and services on today’s Internet. We find that IP sharing has steadily increased over the past decade, with fewer than 0.2% of domains using a unique IPv4 address and up to millions of domains co-located on single IP addresses. On the client side, traffic is similarly skewed: 5% of client IP addresses account for over half of observed web requests worldwide. We further show that commonly cited explanations for regional differences do not fully explain the observed variation. Our findings have direct implications for Internet policies and practice that depend on IP addresses and risk disproportionate effects on both services and their users. Our results also provide empirical grounding for policymakers and operators to foster precise, accountable, proportionate, and private mechanisms for notions of identity
https://zakird.com/papers/ip_sharing.pdf
Defence
How we proactively defend our environments.
Securing your Amazon S3 buckets: Identifying and remediating over-permissioned access
Hetal Kolekar, Fernando Chiera di Vasco Freitas, and Manonmayi Vedam try and get after this enduring challenge.
This post provides a workflow framework and methodology recommendations for your security team to adapt. The focus of this post is on the what and why rather than a prescriptive implementation. You will need to customize the approach based on your organization’s requirements and existing security tooling.
This solution is intended for security engineers, cloud architects, and DevOps teams managing single- or multiple-account AWS environments with Amazon S3 workloads that require access management.
Project Blacksea (where AI attacks drown)
Dario Pasquini and Michal Bazyli show how to contest in the AI era.
Blacksea is an active honeypot and canary-bait control system built to detect and drown LLM-driven attackers: autonomous AI agents and LLM-assisted operators that scan and exploit systems. Blacksea doesn’t stop at watching LLM attacks. It exploits flaws in the attacker’s LLM judgment to gain arbitrary code execution on their machines, collect intel passive defenses can’t reach, and make sure they don’t come back.
https://github.com/cracken-ai/blacksea
pentestkit
Taha Karim publishes this framework which will be a productivity enabler for some seecurity teams.
A multi-agent, context-accumulating penetration-testing framework built on the Claude Agent SDK. An orchestrator drives a team of specialist agents through a real pentest, proves each finding by exploiting it, scores it with CVSS v3.1, and writes a client-ready report — all while a shared knowledge base grows and every packet that leaves the box passes one scope-guarded chokepoint.
https://github.com/lordx64/pentestkit
Threat Model Generator
Michael Scovetta et al release this AI skill which will provide scalability..
A set of agent skills for producing threat models for open-source projects, including an orchestrator and independently invocable specialists.
The output is a document describing the implicit security contract between a project and its downstream users: what the project assumes about its environment and inputs, which security properties it claims, which it explicitly disclaims, and which threats are left to the integrator. It is written to serve two readers at once: the downstream integrator deciding what they are now responsible for
https://github.com/alpha-omega-security/threat-model
AgentSweep
Ishan releases this sanitiser to reduce the proliferation of secrets around agentic systems.
Claude Code (and every other AI coding CLI) stores your full conversation history as plain-text JSONL on disk, under
~/.claude/projects/for Claude Code and~/.codex/sessions/for OpenAI Codex. Anything you paste, whether an AWS key, a.envfile, or a database URL, sits in clear text indefinitely. A typical dev’s history accumulates dozens of secrets over months, usually unnoticed.
agentsweepscans that history, tells you what leaked, and can redact the secret values in place while preserving the JSONL structure byte-for-byte. It also tells you which keys to rotate, with the right revocation URL for each provider.
https://github.com/Ishannaik/agent-sweep
PerspectiveGraph
Luigi Iacuaniello releases this excellent use of graphs in cyber defence to real-world and real-time benefit in a development pipeline.
On every pull request, PerspectiveGraph (open source, Apache 2.0) answers one question against a graph of your real environment - built from the scanners you already run (Trivy, Semgrep, Cloud Custodian, Falco):
Does this change open a path from the internet, through excessive privilege, to something valuable?
When it does, the PR check goes red - a required status you can block the merge on - and you get the fix as its own one-click pull request. The reachable attack path is caught and closed in code review, where it's cheapest, not months later in production. This is shift-left attack-path analysis: not a scanner bolted onto CI, not a runtime CNAPP you log into after the fact - the reachability question, answered in the developer's workflow.
https://github.com/luiacuaniello/perspectivegraph
NoiseHound
Jared Perry releases this operational security enabling use of graphs.
BloodHound (and PlumHound on top of it) finds a path to the objective. NoiseHound ingests the same graph data and re-ranks paths by expected detection cost instead of hop count, so an operator can ask “what is the quietest way to Domain Admin” instead of just “what is a way”.
https://github.com/warpedatom/noisehound
Incident Writeups & Disclosures
How they got in and what they did.
Updated GPG key for signing Firefox and Thunderbird Releases
Mozilla disclose and mitigate.
Today, we moved to a new GPG signing subkey used to sign certain Firefox and Thunderbird artifacts (namely Linux tarballs, RPM packages, checksums files) after an unencrypted copy of the previous subkey was inadvertently committed to a private GitHub repository.
Our review of available audit records found no evidence that the key was accessed by an unauthorized party while it was present in the repository. Access to the repository was limited to a small group within Mozilla, all of whom already had authorized access to the key through other means.
Vulnerability
Our attack surface.
Spectre on RISC-V Silicon: Attacks and Defenses on Commercial Out-of-Order Processors
Lukas Gerlach, Marton Bognar, Daniel Weber, Michael Schwarz and Jo Van Bulck show that RISC-V does share this vulnerability class.
Speculative execution attacks have been extensively studied on mainstream x86 and ARM architectures. However, on RISC-V, research has mostly concentrated on open-source academic designs. Commercially available RISC-V silicon is widely perceived as too simple to be vulnerable, and as a result, no end-to-end attacks have been demonstrated on real hardware to date and essential software such as the Linux kernel remains unmitigated. In this paper, we challenge that assumption. We systematically assess all commercially available out-of-order RISC-V processors (SiFive P550 and T-Head Xuantie C910/C920), finding them vulnerable to a range of Spectre attacks, and demonstrate the first Spectre attack leaking arbitrary kernel memory on real RISC-V hardware.
..
Our analysis shows that the SiFive P550 and Xuantie C910/C920 are vulnerable to all major Spectre variants, and we demonstrated a Spectre exploit on RISC-V hardware that leaks kernel memory via BPF.
https://zenodo.org/records/20759985
SLAC: Access-Driven CPU-to-GPU Side-channel Attacks via System-Level Cache on Apple Silicon
Tianhong Xu, Saion K. Roy, Ruyi Ding, Aidong Adam Ding, and Yunsi Fei detail that side channels do exist here.
Building on these findings, we construct the CPrime+CProbe SLC side-channel technique, which monitors GPU victim activity from the CPU at cache-set granularity. We then introduce an accelerated variant, GPrime+CProbe, in which an adversary leverages the GPU for faster SLC priming, yielding a 6.4x increase in the covert-channel throughput. Lastly, we demonstrate two end-to-end privacy attacks using the new side-channels: a graph-edge reconstruction attack on Graph Neural Networks (GNNs) that achieves 90% edge accuracy across five datasets, and an LLM privacy attack that recovers input keywords with up to 94.8% accuracy and model responses with up to 88.9% accuracy across TinyLlama and GPT-2 Medium models. Our results reveal a new class of microarchitectural vulnerabilities in Apple Silicon and call for secure system cache designs for heterogeneous SoCs.
https://arxiv.org/abs/2608.09075
You’re Back In The Room (Citrix NetScaler Pre-Auth RCE CVE-2026-8452(?))
Sina Kheirkhah walks through the exploitation of this vulnerabilty.
https://labs.watchtowr.com/youre-back-in-the-room-citrix-netscaler-pre-auth-rce-cve-2026-8452/
CSS:the bomb inside your inbox
Gareth Heyes pulls off a spectacular feat with this release..
It's quite common for webmail clients to render untrusted CSS in a trusted UI. They attempt to make this safe using CSS sanitization. In this paper I'm going to show you how to break out of trust boundaries, exfiltrate tokens, compromise 3rd party websites and even steal passwords.
..
You should block select menus in your HTML sanitizer. It was still possible to construct a keylogger in “allow listed” HTML/CSS in Outlook. Blocking select would have prevented that.
https://portswigger.net/research/css-the-bomb-inside-your-inbox
Hunting Exchange Server 0day like a detective
Jang drops a truth bomb and pushes on..
The raise of AI is painfully killing the vuln research community industry. Most of medium-quality 0-day are easily found by AI in oneshot. And other novel 0day, art of exploit are also found by the assist of frontier model.
https://testbnull.medium.com/hunting-exchange-server-0day-like-a-detective-3fd5e0dc9779
IP and DNS Leaks in WebKit Affecting Proxy Browsers and Apple iCloud Private Relay
Talal Haj Bakry and Tommy Mysk disclose..
WebKit-based browsers on iOS and macOS can be configured to route all web traffic through proxy servers, which is how Tor browsers on iOS and our own Psylo work. We found three WebKit features — DNS prefetching, WebAuthn Related Origin Requests, and WebTransport — that bypass the configured proxy and send traffic directly from the device, which exposes the user’s real network. The same leaks also affect Apple’s iCloud Private Relay. All three are fixed in Psylo 1.3.1.
https://mysk.blog/2026/08/04/webkit-proxy-icloud-private-relay-ip-leak/
Offense
Attack capability, techniques and trade-craft.
Design and Implementation of a Physical Implant Attack on the Boeing 737
Sam Crow, Pat Pannuto, Stephen Checkoway, Stefan Savage, Patrick Mercier and Aaron Schulman deliver the seminal work which will lead to a likely regulatory re-think in time.
We explore a new kind of threat model for aviation cybersecurity—one in which an adversary has temporary physical access to an airframe. We argue why such attacks are practically feasible and explain how the design of existing avionics systems, their interconnects, and their maintenance architecture make such threats of particular concern. Using the Boeing 737 as an example, we develop and demonstrate a small, programmable hardware implant that can be quickly inserted into an existing maintenance socket with roughly 60 seconds of access on the ground. By carefully manipulating physical ARINC 429 bus signals, this device can create an undetected “attacker-in-the-middle” (AITM) capability between the aircraft’s flight management computer (FMC) and multipurpose control display unit (MCDU). We explore the options for addressing this class of attack and, in particular, show why transformer-coupled buses such as MIL-STD-1553, are far more challenging to manipulate in this manner.
https://cseweb.ucsd.edu/~savage/papers/UsenixSec26-429.pdf
Weaponizing Windows Updates with NotWSUSpicious
Beyviel David reminds why we should all protect our update servers..
NotWSUSpiciousis a tool repo to aid in creating custom updates after gaining access to a WSUS database server. TheTurning Enterprise Update Servers Into Backdoor Factories (0_o)series covers how the database takeover works.
https://specterops.io/blog/2026/08/05/weaponizing-windows-updates-with-notwsuspicious/
TrustMeBro
Kriyos releases this work aid which will surface no doubt expected presents for all. Also worth detection teams understanding if its use has any signatures.
Authenticode signature manipulation toolkit for Red Team operations and security research. Covers signature stealing, metadata cloning, SIP hijacking across 19 file types, WinVerifyTrust FinalPolicy bypass, PKCS#7 payload embedding, SIP execution surface implants, and analyst-triggered persistence via OID handlers.
https://github.com/KriyosArcane/TrustMeBro
Digital Forensics: Attacking SAM and Extracting Hashes With 7z
Co11ateral shows how this is done..
Today we’re using 7z to find and pull the hives. It’s very common to find and it has raw disk access to fetch what we need without triggering the EDR. You can basically call it a living off the land technique due to its widespread presence. There are other ways to extract hashes, but most of them are well known and monitored. Some hackers rely on VSS and it works fine in some environments, but detecting VSS abuse isn’t hard. It’s a beginner level of complexity. VSS leaves very specific traces in the logs when you use it. Native Windows binaries get blocked outright and finding forensic tools already sitting on an endpoint is uncommon.
https://hackers-arise.com/digital-forensics-attacking-sam-and-extracting-hashes-with-7z/
Exploitation
What is being exploited..
Nothing overly of note this week…
Tooling and Techniques
Low level tooling and techniques for attack and defence researchers
Orchestrate AI agents to find real vulnerabilities in code
Harel Rom et al bring this harness to the world to find vulnerabilities…
Open-source, self-hosted AI vulnerability research tool that orchestrates agents to find and validate security issues in code.
https://github.com/Kritt-ai/open-kritt/tree/main
Bypassing Android Hardware Attestation from the Analyst’s Chair
Eric Le Guevel highlights a gap that will need to got after..
Hardware key attestation lets an Android app prove to its backend that a key lives in secure hardware on a locked, verified device. It is also the wall that stops a security analyst working on a rooted phone. This article opens the mechanism from the analyst’s chair, from the certificate chain and the attestation extension down to the root of trust, then shows a simple bypass that never touches the secure hardware. We relay the attestation to a clean device and splice a genuine chain back into the target app with a Frida hook. A companion repository ships the validation backend, the demo apps and the instrumentation, so the whole setup can be run and inspected rather than taken on faith.
https://blog.quarkslab.com/bypassing-android-hardware-attestation.html
skitter-creek-bath-salts
Christopher Domas drops this capability against an aging CPU but which unlocks it as a research platform.
Developed and tested on AMD Family 16h CPUs, the last generation whose datasheets document the DRAM controller's translation registers — and show that they can't be locked. 17h and beyond simply leave this information out.
..
Unlocking everything on the CPU with DRAM scrambling — PSP, C6, microcode, SMM, and anything else the specs left out.
..
Poke the DRAM controller and an address can be made to land wherever you want in memory.
skitter-creek-bath-saltsmodifies the bottom layers of the memory hierarchy to rewire the physical DRAM address translations. This scrambles platform memory, exposing protected regions of DRAM — carveouts invisible even to the kernel. When the address translations break, so do the security primitives built on them, and we unlock everything.
https://github.com/xoreaxeaxeax/skitter-creek-bath-salts
Footnotes
Some other small (and not so small) bits and bobs which might be of interest.
Annual, quarterly and monthly reports
Nothing overly of note this week, but keep an eye on the Awesome Annual Security Reports 2026 collection and APT report collection
Due diligence in early practice, the International Law Commission agenda and cyberspace
PQC in Plaintext: Google Cloud’s post-quantum cryptography roadmap
AIDC Microgrid Vulnerability Assessment Under Computing-Power Coordinated Attacks
Artificial intelligence
if you are a big arxiv.org user - out of China there is alphaxiv.org which is an AI powered incarnation / overlay
Fundamental
Applied non-cyber
Applied cyber specific
The Evolving Role of the Red Team in the Era of Agentic Security
Engineering the Impossible: Adding Safety to Autonomous Agents
Models built for BugTraceAI, an agentic web pentesting framework
Activation Probes Surface Code-Security Signals that the Model's Output Misses
Governing the KV Cache: Preventing Timing Side-Channel Leakage in Multi-Tenant LLM Inference
Analyst - “An agent that answers questions about cybersecurity conference research using an agent curated knowledge base. UI is via Jupyter notebook or command prompt.SQL queries can also be used to search for researchers, talks, or tools.”
The energetic cost of mitigating AI attacks in cellular networks
KeyTAR: Practical Keystroke Timing Attacks and Input Reconstruction - “This paper bridges this long-standing gap in the literature and performs a comprehensive study on the feasibility of reconstructing typed input from inter-keystroke timings. We model input reconstruction as a machine translation task and fine-tune open-source Large Language Models (LLMs) with a curriculum learning strategy, leveraging their ability to utilize contextual information and incorporate semantic understanding into the reconstruction process.”
Books
Nothing overly of note this week
Events
Blackhat 2026 - slides etc.
USENIX Security ‘26 Technical Sessions - slides/papers etc.
Blackhat 2026 - videos
x33fcon 2026 - videos
Video of the week part I - Cybercom 2.0
Video of the week par II - How North Koreans Secretly Infiltrate U.S. Companies
Video of the week part III - The Shadow War: How Freelance Sleuths Are Beating North Korea’s Cyber Syndicate
Finally finally the NCSC’s podcast series.
Unless stated otherwise, linked or referenced content does not necessarily represent the views of the NCSC and reference to third parties or content on their websites should not be taken as endorsement of any kind by the NCSC. The NCSC has no control over the content of third party websites and consequently accepts no responsibility for your use of them.
This newsletter is subject to the NCSC website terms and conditions which can be found at https://www.ncsc.gov.uk/section/about-this-website/terms-and-conditions and you can find out more about how will treat your personal information in our privacy notice at https://www.ncsc.gov.uk/section/about-this-website/privacy-statement.