Welcome to the weekly highlights and analysis of the blueteamsec (and my wider reading). Not everything makes it in, but the best bits do. A community member is doing daily AI generated podcast of the last 24hours of posts.
Operationally this week a continued focus on Operation Technology and Industrial Control Systems connected to the internet. We released a note on Disruptive cyber activity highlights risk from internet-exposed systems and edge devices.
In the high-level this week:
Disruptive cyber activity highlights risk from internet-exposed systems and edge devices - UK National Cyber Security Centre warns - “Targeting of operational technology reinforces the need for organisations to understand what is exposed to the internet, address avoidable vulnerabilities, and build long-term cyber resilience.”
Five Country Ministerial Communiqué 2026 - Home Office publishes - “We, the Home Affairs, Interior and Security Ministers of Australia, Canada, New Zealand, the United Kingdom, and the United States (the ‘Five Countries’) convened under Australia’s Chairmanship, in Sydney on 25-26 August 2026, for the Five Country Ministerial (FCM). In a period marked by heightened global uncertainty, the Five Countries reaffirm our unwavering commitment to promoting shared values, and acting decisively to protect our borders, our economies, and the safety of our communities. In 2026, the Five Countries have driven coordinated action and practical cooperation on several key national security challenges, including the following national security priorities” - “We have committed to deepen collaboration with industry on shared national security priorities and public safety, including enabling timely access to frontier models to support secure innovation and strengthen cyber security. We will work together to ensure the safe, secure and responsible application of artificial intelligence to the benefit of our communities.”
Cyber Security and Resilience (Network and Information Systems) Bill - Parliament updates - comment: various amendments being suggested and published
Accelerating adoption of quantum enabled sensing and PNT - Innovate UK announces - “UK registered businesses can apply for a share of up to £14.3 million to accelerate the adoption of quantum enabled position, navigation, and timing (PNT) and sensing technologies by addressing specific technical and commercial barriers.” - comment: PNT is a critical enabler to modern resilient systems with reliable timing often underbaked.
Declaring a National Emergency to Secure the United States Bulk-Power System - The White House (not me) announces - “During my first term, I found that the bulk-power system could be a target of those seeking to commit malicious acts against the United States, including malicious cyber activities, because of the significant risks that a successful attack would have on our economy, human health and safety, and national defense. Since my first term, the threat to the United States regarding foreign supply of bulk-power system electric equipment has become even more acute: The rapid growth of advanced manufacturing, data centers, artificial intelligence, and defense production has increased the Nation’s dependence on abundant, reliable electricity and magnified the consequences of a successful attack or supply disruption on the bulk-power system.”
Treasury Announces the Quantum-Readiness Task Force - US Treasury announces - “This Task Force will help ensure our financial system remains strong, secure, and competitive as new technologies reshape the global landscape.”
Defending American Information; US Communications Security Policy since 1945 - National Security Agency detail history - “Since the end of World War II, the United States has contended with the growing vulnerabilities and capabilities of an increasingly interconnected world. Maintaining the security and confidentiality of government communications has been a joint effort since 1945, and the fact that it is addressed through the President indicates an understanding of how critical information security is. In another sense, it also stands as an example of the interplay between communications intelligence and security.”
New Zealanders urged to take care as cyber security incidents become more complex - NZ National Cyber Security Centre warns - “Of those reports, 92 incidents were triaged for specialist technical support due to their potential national significance, an increase from the 77 incidents recorded in the previous quarter. The remaining 1,037 reports did not require specialist technical support.”
State-backed hackers targeted EU officials on WhatsApp, document shows - Politico reports - “The presentation, given to officials from EU national governments in July, lists “account takeover targeting high-ranking officials” as one of the top threats facing the bloc this year.”
Why defence network visibility is increasingly critical to UK resilience - Moody’s opines - “As governments seek to reduce exposure to vulnerabilities and strengthen domestic or allied supply chains, they may discover that dependencies are often more complex than they first appear. Consider a defence procurement team evaluating a supplier for a strategically important programme. The supplier itself may appear low risk, but resilience challenges can emerge when ownership structures, critical subcontractors, financing arrangements, or technology dependencies are examined more closely and found to span multiple jurisdictions.”
Worth a try: the US will authorise some companies for cyber counterattacks - Australian Strategic Policy Institute supports - “The White House is wisely not just outsourcing to privateers but creating an entire institutional framework. The co-executive directors (policymakers from the departments of Justice and Homeland Security) will vet and contract with companies and approve and retain operational control of their activities. Companies will have to report their activities to the government and can be ejected from the program if they fail to live up to standards.”
Blue House Officials’ Personal Information Leaked, 102 Locations Including Media Attacked… Korean Computer Network Becomes a ‘Hacker Playground’ - Munhwa Ilbo reports - “The police are investigating the possibility that the North Korean hacking group 'Lazarus' is involved in the case handled by the Seoul Metropolitan Police Agency. In 2023, Lazarus hacked 207 computers across 61 domestic institutions, including eight media outlets. However, the security industry points out that the Blue House personnel scandal could also be the work of Lazarus.”
Reporting on/from China
China Axing Microsoft Windows From State Agencies Ahead of Plan - Bloomberg reports - “China has been pushing the use of homemade technologies in sectors handling sensitive data, including military and state-owned firms. Several Chinese companies, including Kylin Software Co. and Tongxin Software Technology Co., have introduced their own versions of operating systems for computers to replace Windows.”
Chery’s robot affiliate AiMOGA eyes IPO, targets overseas market - Reuters reports - “Incubated by Chery in January 2025, AiMOGA has delivered more than 3,000 robots globally, with 2,000 overseas, and operates in more than 60 countries and regions.”
Who is really buying China’s humanoid robots? - Financial Times asks - “China’s humanoid robot makers are generating much of their revenue from selling machines to government-backed training centres — which then collect and sell training data back to the robot makers, raising concerns about actual demand in an industry Beijing is keen to promote. The widely adopted model, reminiscent of Nvidia’s “circular financing” of AI data centres, has fuelled China’s so-called embodied AI industry.”
China accelerates 6G development - People's Daily Online reports - “China is currently working to build “six networks,” including a next-generation communication network. This involves not only building new networks based on new technologies, but also upgrading existing networks.”
Implementation Plan for Deepening Technological Innovation and Integrated Application of Internet Protocol Version 6 (IPv6) (2026-2030) - Jiangsu Cyberspace Administration publishes - “New networks will be given priority in providing IPv6 addresses by default, accelerating the evolution to IPv6 single-stack, creating more new “IPv6+” applications, models, and business forms, and promoting the formation of a network service and application system dominated by IPv6.” - comment: IPv6+ is a Chinese specific flavour of IPv6
Chinese AI chips fall short on coding, forcing firms to stretch scarce Nvidia supply - South China Morning Post reports - “Chinese AI companies are optimising software to cope with surging demand for inference, as part of that workload still relies on computing power from a limited pool of high-end chips amid restricted access to Nvidia processors.”
AI
A call for collective action on cyber defense - 100 organisations sign - comment: see reflections this week on this.
Brief independent investigation of agents’ behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident - METR and Redwood Research publish - “~1200 agents sent >70,000 messages and files on an unsanctioned message board, and ~700 attacked Hugging Face” - comment: thus likely very apparent if under observability and monitoring.
Assessing Kimi K3 Against Offensive Security Benchmarks - Irregular assesses - “Kimi K3 demonstrated strong performance on Atomic Tasks, solving several challenges involving cryptographic attacks, certificate forgery, browser exploitation, memory corruption, protocol manipulation, and multi-host compromise. It was particularly effective at turning partial access into complete attack chains by adapting public exploit techniques to constrained environments, building custom tooling, diagnosing implementation failures, and validating each stage before proceeding.”
We burned 11.7bn tokens to find the best cyber AI model - Aikido burns tokens - “
DeepSeek V4 Pro 0813 finds the most vulnerabilities. Pooling three runs reaches 28 of 32 vulnerabilities.
The most expensive model is not required. Three DeepSeek Pro runs cost about $295 and outperform Opus 5, Grok 4.6, or Sol. Three Flash runs cost $108 and reach 24 matching Grok’s best individual pass for less than a quarter of the cost.
Models are inconsistent at recall; repetition remediates it. Single runs miss the breadth of findings, but pooling across runs fills this gap. DeepSeek Pro finds 17 vulnerabilities on its first pass but 28 across three.
Open-source models now outperform the public frontier. DeepSeek V4 Pro topped every public closed model we tested on pooled vulnerability recall. Qwen, Kimi, and GLM-5.3 followed with strong consistency of findings without losing recall. Harnessed correctly, open models can now compete directly with the closed frontiers.”
Snyk VulnBench JS 1.0: Can LLMs Find the Same Bugs Twice? - Snyk product market - “Across 250 model runs, 80 of 161 unique unmatched findings appeared in only one of five identical repetitions, while only 22 appeared in all five.” - “By contrast, when Claude matched a Snyk Code reference finding, the behavior was much more stable: 134 of 158 unique reference-matched findings appeared in all five repetitions.”
From Code to Chain: Why WP2Shell Stayed Out of Reach - Zeddy Lu researches -”This paper compares the long-term code auditing capabilities of three major models by reproducing the wp2shell vulnerability chain discovery process: Under the same harness, GPT 5.6 Sol / GLM-5.2 / Qwen 3.8-Max-Preview were run 11 times, each lasting 6–10 hours, on the complete WordPress codebase, and their exploration process was recorded and reconstructed using full-chain hooking. “ - comment: demonstrates the reality and limitations of AI in finding certain vulnerabilities and thus showing that not all vulnerabilities become shallow - yet.
Scaling Memory Safety: AI-Assisted Rewrites of C/C++ Dependencies to Rust - Google detail - “This experiment described in this post demonstrates that AI-assisted migration can be a viable and effective strategy for structural risk reduction. By combining the speed of LLM-driven translation with the rigor of differential testing, plus human-expert review of safety boundaries and existing test cases, we can rapidly eliminate entire classes of vulnerabilities from our dependencies.”
Zhipu AI’s answer to Project Glasswing marks shift for Chinese cyber safety: researcher - South China Morning Post reports - “The model’s most sensitive offensive capabilities would be “reserved exclusively for verified users” under a restricted access plan dubbed “Cybersecurity Trusted Access”, Zhipu said.”
Fears of AI-induced armageddon are overdone - Ciaran Martin via The Economist writes - “One news outlet, capturing the growing sense of foreboding, called it “the start of a dangerous AI cyber era”. So is it different this time? Or does the uneasy equilibrium between attack and defence still hold? Mostly, and thankfully, it does, for two reasons.”
More Criticals, Less Dopamine - Ananda Dhakal opines - “Am i trying to say vuln research is dead? Definitely not. The number of vulnerabilities being found right now is at an all-time high. And if you look around, all the people finding these massive bugs are the same people who were doing exceptional work before the current AI boom.”
From the Frontier AI Arms Race to AI-enabled Defense-in-Depth: Qi An Xin Chief Outlines His Vision - Natto Team summarises (we covered this talk previously) - “Rather than arguing that AI merely creates new risks, Qi stressed that AI has exacerbated the imbalance between offense and defense, enabling automated, high-frequency attacks that render traditional, static protections obsolete. To counter these threats, Qi favored a defense-in-depth model, a “three-in-one vertical defense upgrade framework,” rather than advocating that China build a domestic “Mythos-equivalent” offensive-capability model. Qi emphasized that this integrated approach requires moving away from a compliance-driven security posture toward a more realistic path of accelerated, incremental security upgrades — not wholesale reinvention, but a comprehensive, self-evolving defense system capable of real-world combat readiness.”
‘We are hitting a different chapter’: OpenAI leader warns of threat of ‘persistent’ AI cyber-attacks - The Guardian reports - “Lehane renewed calls for the US government to legislate to create rules for frontier AI safety, and said the fact that the most cutting-edge and unreleased AI models appear to be improving cyber offence faster than defence, was “among the reasons why I think it’s absolutely imperative that this country passes a national law that creates mandatory required safety standards, and within that the pause element would be inherent and endemic to that process” - comment: am interested in their data here to support the assertion.
AI agent shared responsibility model - Microsoft outlines - “As with the cloud and AI shared responsibility models, the division of responsibility shifts with the deployment model that you choose.” - comment: the cloud’s shared responsibility model for cyber security has shown that words can be said but the actions may not follow on either or both sides always.”
Private Equity Is Deploying an Army of AI Wonks to Embed in the Firms They Back - Wall Street Journal reports - “Blackstone and Hellman & Friedman have formed a roughly 160-person team of artificial-intelligence experts with Anthropic to deploy at businesses, starting with their own portfolio companies. The push is part of a $1.5 billion joint venture between the AI giant and Wall Street firms, which also includes Apollo, General Atlantic and Goldman Sachs among the backers.”
OpenAI-backed legal tech firm pivots to Chinese Kimi K3 open-weight model - South China Morning Post reports - “A US artificial intelligence start-up backed by OpenAI has built its first in-house model on Chinese lab Moonshot AI’s Kimi K3, highlighting a growing shift by Western tech firms towards Chinese open-weight systems amid soaring development costs. San Francisco-based legal tech provider Harvey, whose high-profile backers also include Sequoia Capital and Andreessen Horowitz, said on Thursday that its new model, Harvey Tenet, was post-trained on top of the open-weight Kimi K3 base.”
Cyber proliferation
A Real-World Law-Enforcement Hack: The Case of Encrochat - King's College London, New York University, Georgia Institute of Technology and University of Waterloo detail - “In this work, we give the most detailed public account to date of Encrochat’s infrastructure and how it was compromised”
Bounty Hunting
Justice Department and FBI Seize Platforms Operated and Used by China State-Sponsored Hackers to Target U.S. Critical Infrastructure - US Department of Justice announces - “The Justice Department and FBI announced court-authorized domain seizures today to deny malicious cyber actors access to two complementary hacking platforms known as “QScan” and “QTRouter,” used to target U.S. critical infrastructure and other sensitive networks. As described in court documents unsealed in the Southern District of California, a People’s Republic of China (PRC) state-sponsored group known as “QTFY,” employed by China-based Nanjing Xinjiuwei Network Technology Company (南京鑫玖维网络科技有限公司), created and operated QScan and QTRouter.”
Chinese national gets 20 years for hacking accounts of BTS’ Jungkook, others - Yonhap News Agency reports - “The Seoul Central District Court handed down the sentence to the Chinese national, surnamed Chun, on charges of fraud and violating the information network act, in connection with the theft of more than 38 billion won (US$27.2 million) from the victims.”
Two WA men charged following AFP-FBI-WAPF disruption of alleged global cybercrime syndicate - Australian Federal Police announce - “Police will allege the men were part of a highly organised syndicate involved in large-scale cybercrime offending, including data intrusion, identity crime, and cryptocurrency-based money laundering.”
Treasury Launches Unprecedented Campaign Against Iranian Regime on Economic D-Day - US Treasury announces - “Today’s actions target:” .. “A malicious cyber group directed by Iran’s Ministry of Intelligence and Security (MOIS) that is responsible for extensive compromises of U.S. critical infrastructure and financially motivated cyber theft;”
Market Incentives
Playing whack-a-mole is losing - David Adrian opines - “Producing an endless stream of findings is not a good use of security expertise, human or AI. If all you do is play whack-a-mole, you’re going to lose. We should not view security as an endless supply of mysteries to solve because being a detective is the valued identity. Instead, the role of defenders is to turn failures into new, broader, and stronger invariants, and to encode these invariants into the system so that engineers (and agents) don’t have to constantly rediscover the same class of problems. If that outcome feels like a loss, it’s because identity has displaced security as the goal.”
Pixel 11 doesn’t meet the GrapheneOS security standards and may be skipped - GrapheneOS warns - “We have a partial port of GrapheneOS to the Pixel 11 series after a week of work on it. We're unable to complete the port due to lack of support for ARM hardware memory tagging [MTE] in software, firmware and near certainly hardware. It appears Google cut an important security feature to save money.”
OpenAI’s rogue AI agents expose a gap in cyber coverage - Insurance Business Mag highlights - “A Willis Towers Watson research paper on AI-related liability described what the authors called "silent coverage" - AI-related liability risks sitting implicitly inside existing policies because the policies were never specifically written to include or exclude them. The parallel is to the early years of cyber risk, when property and liability policies had no explicit cyber position and courts were required to determine coverage case by case until the market developed affirmative cyber wordings. The OpenAI incident is precisely the kind of event that begins converting that silence into adjudicated precedent. For brokers placing tech E&O for clients in the AI sector, the question of whether existing wordings adequately address autonomous agent liability - both as potential defendants and as potential victims - is no longer theoretical.”
Reflections this week are around the open letter led by a frontier AI company on A call for collective action on cyber defense which was co-signed by 100 organisations and what it says and does not say about incentives and realities.
Clearly frontier AI is an era defining moment for cyber security which brings home the lack of historic prioritisation and investment. This moment has the opportunity to galvanise and make cyber security non optional and enduring - thus it is a seminal one. But there are no magic cheap quick wins - there is instead investment, time and diligent execution.
No one can argue against the need for collective action. But as regular readers will note success is in part driven by enduring corporate incentives for both technology producers as well as consumers and operators along with corresponding appropriate levels of investment.
A number of signatories will be alive to this fact having had very serious security vulnerabilities in their technology, products and services over the years - including those who produce security products. The flipside for organisations who adopt technology is that some will not know what their digital estates are in totality nor have them under comprehensive management and observability whilst carrying end of life.
AI is a super power to some. But again organisations leveraging AI for vulnerability discovery are already finding they are displacing the point of constraint from finding to patching, to testing, to functional testing, to deployment, to need to find budget for tokens or similar.
No organisation or government has limitless budget and there will never be zero risk. We can only spend each £/$/€/¥ once so knowing when AI will yield a better cyber security resilience return (i.e. reduced risk) versus replacing end of life equipment/legacy system or deploying a robust architectural response is going to be one of those questions executives rightly expect an answer to - which the video of the week by Dr Daniel Woods does an excellent job on.
It is also important to remember AI is not the cause of vulnerability outside of systems it is integrated into or which has vibe coded insecurely. It can and does surface technical and process debt at a greater scale to actors both good and bad causing a painful forced correction due to increased visibility and knowledge i.e. what is being found today was already present and latent.
As David Adrian says above stronger invariants are the goal as are immutable properties of cyber security solutions - be they cross domain, privileged access workstations, passkeys or operational capabilities such as being able to effectively hunt.
We know how to build and operate cyber resilient systems but now is the time to pay down technical debt, invest in strong architectures, eradicate classes of vulnerability through technology choices, have operational excellence and address the imbalance…
… Finally this week I got to guest co-host the Risky Business podcast which you can listen to/watch here:
Not getting this via email? Subscribe:
Think someone else would benefit? Share:
All attribution is by others and not the UK Government unless specifically stated as such, please see the legal text at the end.
Have a lovely Sunday…
Ollie
Cyber threat intelligence
Who is doing what to whom and how allegedly.
Reporting on Russia
UAC-0099 utilizes a novel multi-stage malware chain to carry out attacks
The 360 Advanced Threat Research Institute (in China) caught this alleged operation by Russia against Ukraine. The tradecraft is well understood - but the particular mix has some unique elements thus noteworthy.
The attackers primarily targeted Ukraine, focusing on government agencies and organizations involved in critical infrastructure. They used phishing emails to send malicious compressed files as attachments. The files contained WSF scripts disguised as Word documents with double extensions. The email content was disguised around topics of interest to the target, enticing users to unzip and run the files, thus infecting them. After execution, the WSF script was redirected via a shortened link to a file server to download subsequent payloads. The attack chain combined DLL sideloading, multi-stage conditional execution, and code virtualization protection to evade security detection and covertly implant remote control capabilities.
https://mp.weixin.qq.com/s/WjjZYriiZl7-waw6Cjy1DQ
BlueDelta Targets Defense and Diplomacy with HOOKEDGE
Insikt Group® detail this alleged Russian operation against a range of defence industrial base. Tradecraft is well understood but the victimology is noteworthy.
Between late September 2025 and early April 2026, BlueDelta conducted a series of initial access campaigns against defense manufacturing and diplomatic organizations in Romania, Spain, and Türkiye. BlueDelta used macro-enabled Word documents to deploy HOOKEDGE, a lightweight batch-script backdoor that shares significant code and tradecraft overlap with BlueDelta’s earlier implant, HEADLACE.
The campaigns employed both diplomatic-themed and generic lures. Early activity impersonated Spanish government material, while later campaigns adopted generic macro-enablement lures. One diplomatic lure was created shortly after a meeting between Spanish and Moldovan officials, potentially reflecting an effort to collect intelligence relevant to Russia ahead of Moldova’s September 2025 parliamentary elections.
BlueDelta continued to refine HOOKEDGE between September 2025 and April 2026, introducing changes to lure documents, execution methods, and beaconing intervals while maintaining the malware’s core functionality and infrastructure model.
For targets assessed as having higher intelligence value, BlueDelta deployed a second-stage HOOKEDGE payload with a much shorter beaconing interval. This gave operators more responsive tasking and follow-on activity, while keeping the webhook endpoints used for initial access from being exhausted.
BlueDelta has historically demonstrated a preference for legitimate internet services (LIS) to facilitate C2, payload staging, and data exfiltration, with webhook[.]site’s free tier serving as the group’s exclusive choice across these campaigns.
https://www.recordedfuture.com/research/bluedelta-targets-with-hookedge
University Leak Exposes Russia’s Military Cyber Training Pipeline
DomainTools alleged links between a Russian university providing a talent pipeline for government.
Recently leaked records show that Bauman Moscow State Technical University’s Department No. 4 operated as a long-term training pipeline for Russian military intelligence and cyber operations. The department served several elements of the Russian General Staff and trained roughly 250 career and reserve students across three specialties: special intelligence (“Служба специальной разведки”), operational information-technical effects (“Применение сил и средств информационно-технического воздействия и защиты от информационно-технического воздействия”), and information-technology protection (”3ащита информационных технологий”). The curriculum combined both offensive and defensive techniques for cyber defense, as well as offensive doctrine for active measures campaigns and GRU activities. Field placements then moved students from classroom instruction into military units and academies aligned with their specialties, giving them supervised exposure to intelligence operations and preparing them for military and government operations careers.
…
The collection also includes malware-analysis and cyber threat intelligence research, manpower-planning documents, and a financial-sector cybersecurity specialization feeding into VUS 093400 (SIS). It further connects Bauman to Russian military research institutes, academies, and operational structures. Although the analyzed files do not provide every final graduate assignment, they expose the personnel, training, doctrine, and administrative system behind a durable Russian military cyber and technical-intelligence pipeline.
Reporting on China
NSA Joins FBI in Issuing Warning about Chinese Hacking Group QTFY Cyber Activity
The National Security Agency details around the technical capabilities of this alleged Chinese state private sector enabler.
QTFY actors have developed branded products that work in conjunction with each other and include the vulnerability scanning and exploitation platform “QScan” to conduct reconnaissance, exploit vulnerable Internet of Things (IoT) devices and identify vulnerabilities in networks, an obfuscation network named “QTRouter” to blend in with legitimate users, and at least three major platforms that can manage botnets of compromised IoT devices and include them as obfuscation network nodes (“Proxy Platform Management,” “Proxy Pool Management System” and “QTBotnet”).
The infrastructure quartermaster: inside a China-nexus state enablement model
Black Lotus Labs provides further technical details on this alleged Chinese capability. Noteworthy for its age, complexity and the fact it was provided as a service by a commercial company.
The quartermaster model depends on four connected components that work together to identify targets, route traffic and obscure operator activity. Each plays a different role in the broader enablement layer, turning reconnaissance, proxy access and traffic management into a repeatable service for downstream threat actors.
The quartermaster’s four main components are:
“QScan”: Conducts reconnaissance to identify and profile high-value targets; networks discovered or profiled by QScan later appear in bidirectional communications through “Fast Labyrinth.”
“Fast Labyrinth”: Provides the operational layer by co-opting commercial proxy infrastructure into an encrypted relay network that obfuscates traffic to and from target entities.
“QTRouter”: Provides a preconfigured physical access device that manages operator and customer access to the proxy infrastructure and proxy node management system.
“QTProxy”: Manages Fast Labyrinth operational nodes, allowing operators to use preconfigured relays or tailor unique paths to target entities.
Together, these components streamline target discovery, communication routing and operational access, allowing Chinese espionage operators to conduct activities more efficiently while hiding their tracks.
Chinese Implants in the Supply Chain
Jacob Baines details a device that came backdoored for which the DNS domain ownership had lapsed. Welcome to contemporary supply chains in 2026..
The implant beacons hit the sinkhole as soon as we stood it up. Hundreds of routers, almost all in China, beaconing home to a forgotten domain. We found the domain obfuscated in the firmware of a router we bought on Amazon from a small company in New York. Now, we own the domain. We own the implants.
https://www.vulncheck.com/blog/zbt-darklantern-speakingstone
Carry-On Compromise: TA4922 Packs PackClient
Kyle Cucci, Rob Kinner and Tony Robinson detail an alleged Chinese criminal campaign which is noteworthy for targeting Indian victims along with some of the multi file format tradecraft.
Proofpoint identified a command and control (C2) framework called PackClient sold on Telegram.
It is being used by at least one threat actor, Chinese-speaking TA4922.
With this new payload, TA4922 is expanding its arsenal of initial-access malware, much of which originates in the Chinese-speaking cybercrime ecosystem.
Since the initial identification of PackClient in the May 2026 campaign, Proofpoint researchers have observed at least two additional TA4922 campaigns delivering the malware. In mid-July 2026, the actor targeted organizations in India using Hindi-language tax enforcement lures that impersonated the Indian Income Tax Department. The emails claimed recipients had underreported income and failed to disclose foreign assets and threatened financial penalties. Unlike the earlier China-focused activity, the messages delivered a ZIP archive ("Tax_Notice_23665.zip") containing an IMG disk image ("Tax_Notice_23665.img "). When mounted, the image contained an executable and malicious DLL that leveraged DLL sideloading to execute Donut Loader and ultimately install PackClient.
https://www.proofpoint.com/us/blog/threat-insight/carry-compromise-ta4922-packs-packclient
Reporting on North Korea
Inside Kimsuky’s Abuse of Legitimate Remote Control Tools Across Northeast Asia
ENKI WhiteHat details this alleged North Korean operation which uses initial access tradecraft that is very well understood. The Chrome extension is noteworthy along with the fact it was in part potentially vibe coded.
We identified several Kimsuky spear phishing campaigns against South Korean and Japanese targets in the first half of 2026.
The threat actor spread LNK malware through phishing emails carrying OneDrive share links. Running the file sets up a scheduled task that fetches a PowerShell script from the C&C server and runs it at regular intervals.
Those scripts stole data from the host, profiling the system, pulling mail out of Thunderbird and Outlook, and logging keystrokes.
The threat actor also installed legitimate remote control software such as Chrome Remote Desktop and AnyDesk to slip past antivirus detection and open up several routes for remote access.
A malicious Chrome extension that automatically siphons Gmail data showed numerous signs of having been written with generative AI, with Korean comments, debug strings and Unicode emoji running throughout the code.
Reporting on Iran
Tortoiseshell: New Toolset and Operational Infrastructure Exposed
Mansour Alhmoud and Mohamed Emam expand on prior reporting of this alleged Iranian operation. Noteworthy is the potential expansion in scope of targeting.
Enrichment of the Mirage Kitten reporting uncovered extensive Tortoiseshell infrastructure spanning Europe and the Middle East.
Identified further malicious components, including an SSH-based tunnelling utility and a backdoor mirroring the TWOSTROKE family previously observed by GTIG in late 2025. This C++ backdoor possesses capabilities for executing shell or file commands, uploading and exfiltrating files, and conducting reconnaissance.
The discovered Tortoiseshell infrastructure potentially suggests an expanded targeting profile, focusing on Middle Eastern countries, alongside European countries.
https://www.group-ib.com/blog/tortoiseshell-apt-toolset-infrastructure/
Reporting on Other Actors
SLEEPWALKER: A Passive Backdoor With Its Own Command Language
Dominik Reichel details a rather novel implant which is unattributed and shows a degree of complexity and novel technical elments.
What makes it worth writing up is what that packet carries: not a readable command, but a short program written in a command language of the backdoor’s own design. Its 23 instructions cover scheduling, several ways to move data, staged file delivery and running code directly in memory. Recovering the encryption key is not enough to understand one of these programs. The internal command language must be reverse engineered as well. From a reverse-engineering perspective, SLEEPWALKER has a cool design. Still, the implementation has several weaknesses and is not top-notch malware engineering. This could be an early version, however. Newer and improved builds may exist.
https://r136a1.dev/2026/08/24/sleepwalker-a-passive-backdoor-with-its-own-command-language/
Aurora ransomware targets ESXi, abuses Cursor Agent for exploitation
Eyal Sela details a ransomware campaign which leveraged AI Software-as-a-Service which is interesting in that the malicious use was potentially not detected by the model service provider.
In some victim networks the operator used Cursor Agent with
claude-4.5-sonnet-thinking. In these cases the agent was given credentials or an existing route into the victim organisation. Then it was tasked with various exploitation activities.The chart below plots Cursor Agent sessions between 8 April and 21 May 2026, one row for each target or victim organisation. Circle area is the number of commands the Agent ran in that session.
Software Supply Chain Incursions
A reminder we issued guidance a number of weeks ago in Software supply chain attacks: check your dependencies for software developers
The State of Open Source Supply Chain Attacks - “56 supply chain attacks in 12 months”
Prompting the Payload: How an npm Supply Chain Attack Delivers the RedC2 AI-Powered Linux Implant
Discovery
How we find and understand the latent compromises within our environments.
Chromium Extension Persistence VQL
Matt Green shows how Velociraptor can be used to hunt for malicious Chrome extensions.
Hunts Chromium profiles for enabled unpacked extensions and Native Messaging Host registrations associated with Chromium extension persistence.
This is intended to identify extension persistence techniques such as the SilentChrome-BOF technique described by SpecterOps. SilentChrome writes an unpacked extension entry under extensions.settings.<extension_id>, enable developer mode, and repairs Chromium preference integrity metadata so theextension is accepted at next browser start.
https://github.com/mgreen27/DetectRaptor/blob/master/vql/ChromiumExtensionPersistence.yaml
Detecting (Evil) Dylibs
Patrick Wardle shows how some aftermarket repurposing of Apple’s Endpoint Security framework can be used for detection tradecraft.
In this blog post, we’ll first highlight examples of attackers abusing dylibs for persistence, payloads, and even exploits. Then, we’ll show how we can programmatically enumerate dylibs statically on disk, at runtime in a remote process, and as they are being loaded. Better yet, using Apple’s Endpoint Security framework, we’ll show how we can register for memory-mapping events associated with dylib loads, granting us the ability to examine and even block, if needed, libraries before they fully load in the first place.
https://objective-see.org/blog/blog_0x89.html?v=1
Threat Hunting using Pair Probabilities
Stamatis Chatzimangou brings statistics in threat hunting to the masses with this post.
Upon digging around Microsoft’s documentation for user-defined functions I stumbled on the function pair_probabilities_fl(). This function calculates probabilities and some additional metrics for a pair of categorical variables, A and B. In this blog post, we are exploring the possibility of using the pair probabilities function for threat hunting.
..
Overall, pair probabilities should be best viewed as a way of identifying unusual behaviour for further investigation, rather than as a standalone detection mechanism. The strongest results are likely to come from using the probability metrics as a baseline and in combination with occurrence counts, and additional security context.
https://detect.fyi/threat-hunting-using-pair-probabilities-55194ddb8309
Online False Positive Reduction via Statistical Process Controls
Nikolas Bielski drops some truth bombs on running an effective SOC.
The SOC isn’t a unique problem child. It’s a screening operation, thousands of continuous tests, rare true positives, a fixed budget of expert hours, a high cost for anything missed.
Other industries solved this by measuring the cost of the noise against the risk of the miss. Security chased “FP reduction” instead, which is a target with no risk articulated, so set your eyes on optimising to risk.
GUIDE data gives us a prior for risk. TPs arrive in tight clusters, so the cost of parking a detector is function you can read off the data. 40% of future TPs if you cut it forever, 1.3% if you patch inside 4 hours, 0.3% inside one hour.
DIRE is just the stats engine that spends the cost deliberately to get 96% of the FPs of a naive cut, at 5% of the TP loss. That’s an informed case for any for-profit-SOC.
https://detect.fyi/online-false-positive-reduction-via-statistical-process-controls-8609e682c8af
AWS EKS forensics: data sources and investigation tooling
Théo Letailleur provides practical advice on how so stick things together in an AWS EKS ivnestigation.
Investigating a compromise in Amazon EKS means piecing together evidence spread across three layers: the managed Kubernetes control plane, the worker nodes, and the surrounding AWS services. This article maps the data sources an EKS cluster exposes for digital forensics and threat hunting, and the tooling used to correlate them, from the Kubernetes audit log down to the AWS identity of the nodes.
https://www.synacktiv.com/en/publications/aws-eks-forensics-data-sources-and-investigation-tooling
Detection primitives for eBPF rootkits
Lorenzo Susini and Matt Muir show what quality detection engineering looks like with this work.
They also defeat common tracing primitives like
ptrace. LinkPro, VoidLink, and the more recent Atomic Arch campaign all use these approaches.Rather than describe each malware family in full, we picked one instructive feature from each and went deep, looking at how the technique works, what data defenders should focus on, and what detections we built from it. We start with VoidLink, which found an unexpectedly clean way to hide active connections from
ssby turning a debug helper into a precise memory editor...
The load-time fingerprint translates directly into detection rules. Because the WP sensor captures the helper bitmap before the program can act, a rule checking for
BPF_PROBE_WRITE_USERfires the moment VoidLink's buffer-tampering program is submitted to the kernel
https://securitylabs.datadoghq.com/articles/detection-primitives-for-ebpf-rootkits/
Defence
How we proactively defend our environments.
Internet Exposure Reduction Guidance
CISA highlight once again and guide on the value of attack surface management through reduction.
Many organizations unknowingly leave common vulnerabilities and weaknesses exposed to the internet, making them easy targets for exploitation. Threat actors can use internet-based search and discovery platforms to identify publicly accessible systems with misconfigurations, default credentials, and outdated software that they can exploit to gain unauthorized access. By following the guidance below, organizations can proactively identify internet exposures, remove those that are unnecessary, and secure those that are necessary, strengthening their cybersecurity posture.
https://www.cisa.gov/resources-tools/resources/exposure-reduction
Defending Against an Active Threat to Siemens S7 Series PLCs
CISA provide practical advice on how to mitigate this active threat.
This advisory relates to an active threat to Siemens S7 Series programmable logic controllers (PLCs). However, ongoing PLC targeting activity is broader than Siemens PLCs. All PLC owners and operators should apply relevant mitigations to reduce the risk to their devices and systems. The Siemens-specific content in this advisory should be understood and applied as one subset of the wider threat landscape.
https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-231a
Auditing Microsoft Defender and Intune Configuration Changes
Jeffrey Appel details how to do this in practice during an incident investigation where you suspect or what to verify if configuration changes have occured.
Defender audit activities are stored in the Unified Audit Log. Some of the audited activities include:
Assign user to an incident
Changes to data retention settings
Changes to advanced features
Creation of indicators of compromise
Isolation of devices
Add\edit\deletion of security roles
Create\edit custom detection rules
Microsoft Defender uses the Microsoft Purview auditing solution. Before you can look at the audit data in the Microsoft Defender portal, you need to turn on auditing in the Microsoft Purview portal, or sometimes it works directly from the Defender portal.
For a list of all the audit log activities, see: Audit log activities. The audit log is not only focused on Defender for Endpoint. It includes other sources, like Defender for Identity, to report when sensors are getting removed/ disabled, or the deployment key is downloaded. All of the audit log activities are explained on the above page.
https://jeffreyappel.nl/auditing-microsoft-defender-and-intune-configuration-changes/
SDLC in the AI Agent Era: How to Implement Security Engineering
Chinese view on how to do this.
This article discusses the SDLC (Software as a Service) of agents after software delivery, not the lifecycle of the AI/ML model itself, nor how to develop an agent product. The term is occasionally used
Agentic SDLCas a descriptive tag.…
existing security engineering principles still hold true; what has changed are the implementing entities, boundaries, and speed.
https://mp.weixin.qq.com/s/QYQ2XDBeXbIXgSmsDMNkFw
MadHatter — Qwen Token Perturbation Lab
Allloy Secure Group show a deep understanding of AI have how token perturbation can be used as a defensive disruption layer against an offensive Qwen-based AI agent. It works by introducing small, targeted token changes that push the agent away from its intended decision path.
MadHatter is a local Qwen research demo for gradient-guided discrete token perturbations, embedding-space PGD, and LoRA post-training. It now includes a second, independent clean Qwen validator so a perturbation found in the lab can be tested against an unmodified base checkpoint.
https://github.com/AlloySecureGroup/MADHATTER/
Time as a Key: Breaking Rhysida Ransomware with the Attacker’s Own Ciphertext
Adam Taguirov shows the value of cryptologic skills in the response to ransomware.
Rhysida is a ransomware-as-a-service operation active since May 2023 that has claimed more than 250 victims across education, healthcare and professional services. Its Windows encryptor seeds the C library pseudo-random number generator with srand(time(0)), and every per-file secret produced during a run derives from that single value. The encryption timestamp, a 32-bit counter of seconds, is the only unknown input, and recovering it regenerates the AES-256 key and initialisation vector of every file the run touched. The encryptor wraps each per-file key and IV under a hardcoded RSA public key using OAEP padding, and it draws the OAEP seed from the same generator, so the RSA blob appended to every encrypted file is reproducible byte for byte by anyone holding the sample. We use that blob as a validation oracle: a candidate key is confirmed by re-running the encryptor’s own RSA step and comparing the result against the stored bytes
https://sigreturn.com/papers/time-as-a-key/
neEDRe
Sunlife3 releases the foundations of a Linux EDR they are building which will be of interest to some studying how to do such things.
Self-made toy EDR project using AYA the Rust eBPF library
https://github.com/sunlife3/needre
Incident Writeups & Disclosures
How they got in and what they did.
A Tale of Two SOCs: Insights From Two Red Team Assessments
CISA’s red team detail the experience of going up against two security operations centres. Whilst highlighting recommendations which would have frustrated their success.
Untuned detection tools lead to missed threats. Without well-defined baselines and alert filtering, false positives and routine alerts overwhelm network defenders.
Organizational silos and bureaucratic hurdles prevent effective incident response. Detection tools are only as effective as the people, processes, and procedures supporting them; fragmented communication, unclear responsibilities, and limited defender authority hinder effective incident response.
Cloud environments are often an underestimated risk. Organizations often lack security controls for cloud environments and processes for responding to a cloud compromise.
…
Establish and continuously maintain a baseline and reduce alert noise by fine tuning.
Break down silos and empower network defenders.
Implement Conditional Access policies for workload identities and monitor for excessive or unused permissions.
Establish and regularly review comprehensive procedures for detecting, remediating, and revoking access/refresh tokens in the event of a cloud compromise.
https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-237a
Supply chain attack on arrayref
Manish Goregaokar details the incident and provide details of what organisations needs to get assurance of across their developer estate which feels easier said than done for a lot.
We recommend you check your local dependencies to ensure these crates were not pulled in. Here are the malicious versions that we deleted from crates.io:
append-only-vec@0.1.9: published at2026-08-20T07:37:49Z, deleted at2026-08-20T09:25:24Z. Online for 107 minutes.
arrayref@0.3.10: published at2026-08-20T07:15:00Z, deleted at2026-08-20T08:41:40Z. Online for 86 minutes.
internment@0.8.7: published at2026-08-20T07:34:07Z, deleted at2026-08-20T09:04:11Z. Online for 90 minutes.
proc-macro1,proc-macro-en,aovine,arone,aronenao,tinymember(any versions).
https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/
Vulnerability
Our attack surface.
768 Leaked Corporate AWS Keys Held Full Admin Rights
Truffle Security show the scale of hygiene challenge in practice - no AI required here.
We re-verified 10,616 leaked AWS keys on August 10, 2026. They surfaced publicly between August 2022 and August 2026. 88% still authenticate. 768 of the live ones belong to a company and carry full control of its AWS account: 526 root keys plus 242 IAM users holding
AdministratorAccess. The median live leaked key is five years old and has never been rotated.
https://trufflesecurity.com/blog/leaked-corporate-aws-keys-held-full-admin-rights
SMAP is Pre-Disarmed: How a Stack Pivot That Shouldn’t Work Revealed a Kernel-Wide Design Compromise
Youssef Charfeddine highlights the ghost of compatibility here and the impact of SMAP effciacy on Windows.
The three experiments proved that SMAP is not bypassed by an attacker trick. It is pre-bypassed by the operating system itself. The normal syscall entry path on Windows 11 delivers kernel code an execution context where AC=1 is already set.
This means any kernel-mode attacker who gains execution through a standard syscall path (whether via a vulnerable driver, a signed driver with dangerous IOCTLs, or any other mechanism) inherits a kernel context where SMAP is muted.
https://sibouzitoun.tech/articles/smap-is-pre-disarmed/
From Code to Chain: Why WP2Shell Stayed Out of Reach
Zeddy Lu demonstrates the reality and limitations of AI in finding certain vulnerabilities and thus showing that not all vulnerabilities become shallow - yet.
This paper compares the long-term code auditing capabilities of three major models by reproducing the wp2shell vulnerability chain discovery process: Under the same harness, GPT 5.6 Sol / GLM-5.2 / Qwen 3.8-Max-Preview were run 11 times, each lasting 6–10 hours, on the complete WordPress codebase, and their exploration process was recorded and reconstructed using full-chain hooking. None of the 11 runs completely reproduced the pre-auth RCE vulnerability chain, but the failure patterns differed: GPT identified REST request misalignment (Vuln A) four times and completed one local verification, but missed SQL injection (Vuln B) all four times; Qwen was the only model to identify Vuln B, but prematurely excluded it due to the lack of a pre-auth entry point; GLM read the core code multiple times but failed to identify any vulnerabilities. In a comparative experiment where only short vulnerable code snippets were provided, all three models were able to find the corresponding vulnerability mechanisms. Overall, the bottleneck in reproducing wp2shell lies not in understanding local code, but in the ability to search source code, retain candidate vulnerabilities, and connect to cross-layer vulnerabilities during long-term exploration.
https://zeddyu.github.io/p/from-code-to-chain-why-wp2shell-stayed-out-of-reach/
Compromising Signal’s Contact Discovery Enclave
Nihal Talur shows what world class vulnerability looks like in 2026.
We found two critical object-lifetime vulnerabilities that allow the untrusted host server to break the enclave boundary. The first vulnerability gives the host an arbitrary enclave memory read. The second gives the host full control over the enclave’s register context, enabling code execution within the enclave. We exploited both vulnerabilities on real SGX hardware matching the Azure machines used by Signal’s production deployments, demonstrating full compromise of the enclave. Our proofs of concept extract the Noise private key from enclave memory, allowing the host to impersonate the enclave and decrypt queries.
Penetrating the Vulnerable with Invisible Thickness: CodeBuddy Security’s Vulnerability Discovery Approach and Practice
Tencent outline their approach which shows what industrialised verified vulnerability discovery looks like in 2026.
CodeBuddy Security views vulnerability discovery as a "search" process, with the core concept being that intelligence is the segmentation of the search space—the more detailed the intelligence, the higher the AI's detection probability. The system is divided into two parts: the first part constructs intelligence and narrows the search space through four pathways: patch location, threat intelligence, external intelligence, and attack surface analysis; the second part uses an AI Agent to conduct audits at the module level, confirming the results after independent review and PoC verification. Since its launch, it has driven 4.4 million model calls, generating over 2,100 automatically reproduced vulnerabilities; the end-to-end detection rate is 73.2%, reaching 90.2% after providing module-level intelligence.
https://mp.weixin.qq.com/s/9RkpfwzQivCgEAKIiiiKDw
GPUThor
Chris S. Lin, Joyce Qu, Aditya Rajeev, and Gururaj Saileshwar show that it turns out physics don’t change when used in a different use case and thus vulnerabilities read across.
GPUThor is the first Rowhammer attack on NVIDIA GPUs to break through error-correcting codes (ECC), NVIDIA's defense against this threat. Rowhammer is a DRAM flaw: repeatedly hammering a memory row flips bits in its neighboring rows, causing data corruptions. By reverse-engineering how GPUs merge repeated memory requests and when the memory's built-in defense kicks in, GPUThor hammers its target 6.6× harder than prior GPU attacks, producing 500×–23,500× more bit flips. This corrupts multiple bits at once and overwhelms the ECC, enabling the first GPU denial-of-service attacks and root-level privilege escalation on ECC-protected GPUs.
UniBLEed: Unauthenticated Root RCE on Any Unitree G1 Humanoid Robot Within Bluetooth Range
Olivier Laflamme writes the business case for memory safety technology in robotics with this vulnerability. But also how the integration of AI not being done always in Secure by Design manner.
Root on a $20,000 humanoid robot from Bluetooth range. One chain crossing Bluetooth, Unitree’s cloud, mobile, and the firmware running the G1 itself. Here’s the complete technical breakdown of the $6,700 bounty and two CVEs it produced: CVE-2026-76639 / CVE-2026-76640.
…
A path traversal in the robot's AI chatbot knowledge base that leaks the binary's load address. And a 1050-byte BSS buffer overflow that corrupts the event loop into calling system() as root.
https://boschko.ca/g1-ble-rce/
WatchGuard Agent improper authentication allows unauthenticated remote code execution
WatchGuard warn the call can come from inside the house.
Improper authentication in the WatchGuard Agent allows an unauthenticated attacker with network access to cause the agent to execute arbitrary code with elevated privileges.
https://psirt.watchguard.com/CVE-2026-57910/
Offense
Attack capability, techniques and trade-craft.
I’m in your logs now: deceiving analysts and blinding EDRs
Olaf Hartong demonstrates an offensive strategy that various red teams have employed in the past.
what if I can create enough telemetry, or enough broken telemetry behavior, that the product relying on those logs does not see the real activity anymore?
https://falconforce.nl/in-your-logs-now/
Tag, You’re Managed - Executing Code via Google’s Own Signed Installer
Richard Warren highlights this attack surface.. it will be interesting to see if this was used other by red teamers when the threat hunting crews go to work.
in this post we show how an attacker can take a legitimately signed Google Chrome Enterprise MSI and modify it to execute arbitrary commands on the victim’s machine, without breaking the Authenticode signature. The modified installer remains validly signed by Google throughout, passing SmartScreen and signer-based AppLocker/WDAC rules.
ditto
Airbus release this which teams will want to ensure doesn’t break their detection logic.
Ditto is a Powershell and JavaScript obfuscator base on tree-sitter-powershell and tree-sitter-javascript.
https://github.com/airbus-cert/ditto
NachoMDM - Weaponising Windows MDM for UAC Bypass and SYSTEM Execution via Malicious Enrollment
David Cash causes questions to be raised on where this has worked in production.
The bonus is that this enrolment process can be triggered from a web page via the
ms-device-enrollmentURI handler. There’s a video demo further down the post that shows it in action.Who is NOT vulnerable:
If the device is already enrolled in MDM, it cannot be enrolled again.
If the user is not a member of the local administrators group, the auto elevation will fail
https://blog.amberwolf.com/blog/2026/august/weaponising-windows-mdm/
https://github.com/AmberWolfCyber/NachoMDM
lldp
Lav shows the lengths some red teams will go to avoid implant detection.
Mythic C2 profile for peer-to-peer communication over IEEE 802.1AB (LLDP). C2 data is carried inside Organizationally Specific TLVs (Type 127) with a configurable OUI so that frames blend with vendor-specific LLDP extensions on the wire.
LLDP is Layer 2 only. Both agents must share a broadcast domain. An egress agent (HTTP/HTTPX) bridges LLDP-linked agents back to the Mythic server, same as the SMB and TCP P2P profiles.
https://github.com/Whispergate/lldp
Tailcat
Brad Fitzpatrick et al release this tool which you can see how it might be misused and thus warrant attention on the the ability to detect.
Tailcat is a remix of Tailscale open source pieces to act like netcat, but over Tailscale's data plane, without Tailscale's control plane. Tailscale's data plane (
magicsock, internally) gives you point-to-point WireGuard®-encrypted tunnels between two machines with DERP as the NAT-hole-punching communication side channel and the ultimate relay-of-last-resort if NAT traversal fails. Instead of using the Tailscale control plane, alltailcatconnection metadata is exchanged out of band, however you want.
https://github.com/tailscale/tailcat
Exploiting SMTP with Unicode Bidi Override Spoofing: The Gap Between Auth & Render
Anna Breeva highlights a gap which detection teams will want to get after.
a new email spoofing technique that abuses Unicode bidirectional (Bidi) controls together with
SMTPUTF8to make an attacker-controlled email address visually appear to belong to a trusted domain.Unlike traditional email spoofing, the attacker does not need to forge the sender’s domain or bypass SPF, DKIM, or DMARC. The message can legitimately pass all three authentication mechanisms while the recipient is shown a visually reordered sender address belonging to an entirely different organization.
The issue stems from a gap between how email infrastructure authenticates an address and how email clients render that address to a human. In our testing, an attacker-controlled address belonging to
31337p.comcould be visually rendered as an address belonging tobigcorp.com- while the underlying authenticated domain remained31337p.com.
Exploitation
What is being exploited..
Tooling and Techniques
Low level tooling and techniques for attack and defence researchers
Natural Language Nmap (nmap-nl)
Steve makes everyone who could remember optimised nmap command lines feel slightly on the verge of redundancy.
A lightweight, local command-line interface tool that translates natural language requests into raw Nmap commands and executes them in real-time, utilizing a locally hosted fine-tuned Gemma-3-270M model
https://github.com/evets007/natural-language-nmap
Rogue Framework
Mohammad Hossein Aghaee released this framework which lays the foundation for AI augmentation.
Rogue Framework is a desktop workbench for AFL++, cross-architecture QEMU fuzzing, harness development, lightweight Ghidra headless analysis, custom mutators, and patch comparison. It is intentionally an auditable workbench rather than a button-only wrapper: every generated AFL++ command is visible before execution, and generated harnesses are ordinary source files that the researcher can edit. It suppose to be "The BurpSuite of exploit developers"
https://github.com/ThisIsTFS/Rogue-Framework
GhostDebug
VollRagm provides a power tool again showing how the cyber security community can and should learn from the game cheat community.
GhostDebug is a Windows x64 debugger prototype composed of a native debugging DLL and a .NET Framework command-line client. It is intended for debugging targets that use debugger-detection checks.
https://github.com/VollRagm/ghostdebug/
Microsoft Paint and Photos Embed Server-Issued GUIDs as Invisible Watermarks in Locally-Generated Images
Xusheng Li highlights these watermarks exist.
Microsoft Paint supports both local and cloud image generation
Paint and Photos also ship local AI models
The two apps send the prompt to a remote server for moderation
The server returns a GUID along with the moderated prompt
The GUID is embedded into the locally generated image as an invisible watermark
A separate visible-watermark setting does not control this invisible watermark
On Copilot+ PCs, image generation is local but prompt moderation remains remote
Microsoft discloses that Paint adds C2PA metadata to AI-generated images
AI-generated image saves limited to C2PA-preserving formats: PNG, JPEG, GIF, and
.paint
https://xusheng.dev/posts/reversing/mspaint_invisible_watermark/main/
Closing a Critical Internet Privacy Gap for Billions of Users: Android 17 Rolls Out ECH Support
Maddy Hoffman details the role out - be interesting to see the impact on threat hunting where SNI inspection is used a lot in enterprises and especially for mobile devices where telemetry isn’t where it needs to be.
Starting with Android 17, ECH GREASE will be enabled by default
To help app developers leverage this new capability, OkHttp, the open-source HTTP client powering millions of Android apps, has integrated ECH support into its core library.
Footnotes
Some other small (and not so small) bits and bobs which might be of interest.
Annual, quarterly and monthly reports
Nothing overly of note this week, but keep an eye on the Awesome Annual Security Reports 2026 collection and APT report collection
SONIC: Concurrent Oblivious RAM & Data Structures for Low-Latency and High-Throughput
Equivocation-resistant multiparty digital signature for quantum networks
Quasipolynomial Cryptanalysis of the McEliece Cryptosystem (or: PIR Meets McEliece)
Lessons from the Hardware Hacking Competitions: Verification Techniques, Findings, and Insights
Artificial intelligence
if you are a big arxiv.org user - out of China there is alphaxiv.org which is an AI powered incarnation / overlay
Fundamental
Applied non-cyber
Applied cyber specific
LLMs for Agentic Hardware Design and Security - Teax A&M University new training course
Blood MERIDIAN: LLM cryptanalysis of a blockcipher that is isn’t a blockcipher
Scaling Memory Safety: AI-Assisted Rewrites of C/C++ Dependencies to Rust
FuzzingBrain-Bench V1: Evaluating Open-Ended Bug Discovery by LLMs
LLMscope: Extracting LLM Assets from Edge AI Chips via Optical Probing
Evaluating and Preventing Security Smells in AI-Generated Ansible Code
When Context Gets Root: Privilege Escalation in LLM Harnesses
PLCBench: Can Autonomous LLM Agents Turn PLC Access into Sustained Physical Impact?
Unsaid, Unsafe? Implicit Security Obligations in LLM-Based RTL Code Generation
SkillShield: Prompt-Space Security Skills for LLM Coding Agents
When “Do Not” Is Not Deny: Security Rules in CLAUDE.md vs Built-In Controls
InjecMEM: Memory Injection Attack on LLM Agent Memory Systems
On Predicting Vulnerability Severity Using In-Context Learning: An Industrial Case Study
Books
Nothing overly of note this week
Events
Nothing overly of note this week
Video of the week is from CyberUK ‘How to justify security investments with actual evidence’ by Dr Daniel Woods
Finally finally the NCSC’s podcast series.
Unless stated otherwise, linked or referenced content does not necessarily represent the views of the NCSC and reference to third parties or content on their websites should not be taken as endorsement of any kind by the NCSC. The NCSC has no control over the content of third party websites and consequently accepts no responsibility for your use of them.
This newsletter is subject to the NCSC website terms and conditions which can be found at https://www.ncsc.gov.uk/section/about-this-website/terms-and-conditions and you can find out more about how will treat your personal information in our privacy notice at https://www.ncsc.gov.uk/section/about-this-website/privacy-statement.