Welcome to the weekly highlights and analysis of the blueteamsec (and my wider reading). Not everything makes it in, but the best bits do. A community member is doing daily AI generated podcast of the last 24hours of posts.
Operationally this week software supply chains continue on as you will see in the reporting below - in response at NCSC we have released advice and guidance in the guise of Software supply chain attacks: check your dependencies.
In the high-level this week:
Software supply chain attacks: check your dependencies - NCSC UK publish - “This blog helps cyber defenders to better understand, mitigate and more effectively respond to the new open source software risks.”
Five Eyes Joint Bulletin - Safeguarding Our Secrets - MI5 publish - “On 3 June 2026, members of the Five Eyes intelligence partnership (ASIO, CSIS, FBI, MI5 and NZSIS) released a joint bulletin, Safeguarding our Secrets, warning of the threat posed by China's military intelligence services on Western professional networking sites and online job platforms.”
Draft Revised Telecommunications Security Code of Practice - Department for Science, Innovation & Technology publish - “The technical content of this Code of Practice is based on draft guidance developed by experts in the National Cyber Security Centre (NCSC). That guidance was produced following an extensive and detailed analysis of the security of the telecoms sector. It contained a set of technical and procedural measures designed to ensure that security risks are appropriately managed by the providers of PECN and PECS”
Proposals to update the Telecommunications Security Code of Practice 2022: what we are consulting on
Proposals to update the Telecommunications Security Code of Practice 2022: government response
Explanatory memorandum to the revised Telecommunications Security Code of Practice 2026 (accessible)
Draft Revised Telecommunications Security Code of Practice: change log
Cyber Essentials management information January 2026 to March 2026 - Department for Science, Innovation & Technology publish - ”The latest figures show 59,090 Cyber Essentials certificates have been awarded over the past year (April 2025 to March 2026); 44,608 at CE level and 14,482 at CE+.” - an increase of just over a 1,000 in the 3 months period
G7 Digital and Technology Ministerial Declaration: 29 May 2026 - Department for Science, Innovation & Technology publish - “We also acknowledge the work of the G7 Cyber Working Group, which is looking this year at AI, post-quantum cryptography, micro, small and medium-sized enterprises (MSMEs) and telecoms, whose outputs informed the Digital and Technology Track’s discussions on AI.”
Creation of a commission of inquiry into cyberattacks - Senator Nathalie Goulet tables - “commission of inquiry into cyberattacks and data leaks undermining France's digital sovereignty"
2025 Report on major ICT-related incidents - European Banking Authority et al publish - DDoS and ransomware the largest cause of incidents.
2025 Report on major ICT-related incidents published under Joint-ESA report under Article 22 of DORA. Do you know what it says? - Ratiofy report - “Cybersecurity (10%): Primarily concentrated in the credit sector, featuring Distributed Denial of Service (DDoS) attacks (33%) and data exfiltration/manipulation (31%).”
ENISA NIS360 - ENISA Publishes - “Three sectors, including trust services, aviation, and financial market infrastructures (FMIs) moved into the high maturity band. In addition, four sectors strengthened their maturity within the moderate band: gas, road, maritime, and health”
Codification, Technology Absorption, and The Globalization of the Industrial Revolution - Réka Juhász , Shogo Sakabe and David E Weinstein shed light - “Our findings shed new light on the frictions associated with technological diffusion and offer a novel explanation for why Meiji Japan was unique among non-Western countries in successfully industrializing during the first wave of globalization.”
BMW says humanoid robots are the future of car production - BBC reports - “If you have a humanoid form, you can pretty much set it to any workplace where a human is working today because it has the same size and the same capabilities,” says Nikolaides. .. “The cost of robots has fallen while it remains expensive to redesign the assembly line. As a result, it’s more cost-effective to use robots that fit in with existing human processes.”
Reporting on/from China
How China’s Cyber Operations – and the Contractors Behind Them – Target Critics Abroad - Eugenio Benincasa alleges - “State agencies and an ecosystem of private contractors use cyber capabilities and social engineering to locate, monitor, and harass critics living outside China”
China’s new rules on protection of trade secrets become effective on June 1, including data and algorithms - Global Times reports - “The Provisions on the Protection of Trade Secrets will come into effect in China on Monday, with data, algorithms, and other important items being included in the scope of trade secret protection, according to a statement on the website of the State Administration for Market Regulation (SAMR). "The provisions also list specific technical confidentiality measures for scenarios such as remote work and cross-border collaboration, and clearly specify digital circumstances under the "improper means" of trade secret infringement, according to a report by the Xinhua News Agency. “
China to give every humanoid robot a digital ID in push to boost industry standards - South China Morning Post reports - “The national initiative will give every bipedal humanoid a unique code, like a national ID but for robots”
China has approved the world’s first invasive brain-computer chip—here’s what’s next - MIT Technology Review reports - “Dong’s brain implant is a coin-size device called NEO. It was developed by Neuracle Technology, a Shanghai-based startup, together with researchers at Tsinghua University in Beijing. During a procedure that took just over an hour and a half, the device’s sensors, which collect Dong’s brain signals, were placed on his dura mater, the tough outer layer of tissue that covers and protects the brain. The signals are transmitted to a computer by an implant placed on Dong’s skull. The computer then translates the signals into commands for a soft robotic glove Dong wears during the 2.5-hour training sessions he completes each day to help him learn to grab.”
AI
Promoting Advanced Artificial Intelligence Innovation And Security - The White House (not me) executively orders - “Within 60 days of the date of this order, the Secretary of the Treasury, the Secretary of War, through the Director of NSA, and the Secretary of Homeland Security, through the Director of CISA, in consultation with the White House Chief of Staff, through the National Cyber Director, the Assistant to the President for Science and Technology (APST), and the Secretary of Commerce, through the Director of the National Institute of Standards and Technology, and in coordination with other agencies, as appropriate, shall: (a) develop and maintain a classified benchmarking process to assess the advanced cyber capabilities of AI models and determine the threshold at which an AI model should be designated a “covered frontier model” for the purposes of this order, sharing such assessments with AI developers and researchers as appropriate.”
Hackers Used Meta’s AI Support Bot to Seize Instagram Accounts - KrebsonSecurity reports - “The Instagram accounts for the Obama White House and the Chief Master Sergeant of the U.S. Space Force were briefly defaced with pro-Iranian images and messages over the weekend, after instructions began circulating on Telegram showing how to trick Meta’s “AI support assistant” bot into resetting account passwords.”
Iran Turns Western AI Models Into a Sanctions Workaround - Marcus Schuler reports - “Iran is using Western AI services to help with phishing, malware support and military research while building a domestic platform at Sharif. Google and OpenAI say the tools add productivity, not novel capability.”
System Over Model, Tested: Reproducing Mythos’s FreeBSD Find on Local Open-Weight Models - John McIntosh details - “The real problem with the local models is noise: the pipeline graduates a pile of false positives and buries the real one. So I changed the system, not the model. One extra reachability stage drops the false positives from 30 to 5, the CVE still standing. The scaffolding does the work, and it’s a lever you can pull on your own model.
Mapping AI-enabled cyber threats: Insights from the LLM ATT&CK Navigator - Anthropic publish - this is the graph to read - this is not autonomous end to end operations, this is work aids.
Let’s talk about encrypted reasoning - Matthew Green talks - “I reported both results to OpenAI and Anthropic via their bug bounty programs. OpenAI said my report was unreproducible. I sent them my scripts, but too late. Anthropic quite reasonably told me they don’t see any security implications in side channels or replays, but they might alter their developer documentation to warn application developers to be more careful”
Demystifying the Mythos or Disrupting Bugonomics? From Zero-Day Asymmetry to Defender Remediation Throughput - University College London / Bynario research - “Using public data from Anthropic’s Mythos Preview and Mozilla Firefox collaborations, together with public exploit-market price anchors, vulnerability reward programs, and incident baselines, we argue that the near-term shift is not simply “more zero-days.” It is a move from zero-day asymmetry toward broader defender remediation throughput: low-signal candidates become cheaper, evidence-rich remediation packages become more important, and scarce capacity shifts toward maintainer review and release work.”
How Reliable Are AI Attackers Against a Fixed Vulnerable Target? A 400-Run Empirical Study of LLM Penetration Testing Consistency - Galip T. Erdem researches - “Claude achieved full exploitation in 61 of 100 runs; Gemini 2.5 FlashLite in 85; GPT-4o-mini in 56 while deploying 98 unique attack strategies; qwen2.5-coder:14b in 25. Failure modes are model-distinctive” - caveat of full exploitation is the real-world translatability
Can LLMs Hack Enterprise Networks? Autonomous Assumed - TU Wien Faculty of Informatics, Vienna, Austria publish - “We perform our empirical evaluation using five LLMs, comparing reasoning to non-reasoning models as well as including open-weight models. Through comprehensive quantitative and qualitative analysis, incorporating insights from cybersecurity experts, we demonstrate that autonomous LLMs can effectively conduct Assumed Breach simulations” - caveats here are labs which the models could have learnt about.
Lessons from Penetration Tests on Large-Scale Agent Systems - IBM Research research - “The two penetration tests conducted in 2025 demonstrate that proprietary agent applications, despite undergoing stricter development and review processes, continue to exhibit security weaknesses similar to those observed in opensource agent frameworks.”
Pwning Coding Agents 70 Times With The Same Bugs - Palo Alto Networks detail - "
We had 81+ reports before we stopped counting.
Not everyone agrees Prompt Injection == popping endless calcs is a severe issue.
18 CVEs (including reserved). Many more fixes and acknowledgements.”
New legal questions: agentic pen testing - British Computer Society publish - “In the meantime, the industry is writing the first draft of its own case law, in engagement letters and terms of service. The firms, and the jurisdictions, that get the architecture right first will have the most durable advantage. Cybersecurity has always lived with legal uncertainty. The difference is that the uncertainty is now being baked into the tools themselves, and we will find out what that means in litigation rather than in policy.”
The Agentic Economy: Humans, AI Agents, Robots, and the Measurable Transition toward Distributed Economic Action - Business & Technology University, Georgia publish - “This article develops the concept of the agentic economy and empirically diagnoses its measurable preconditions: an emerging transition in which economic action is increasingly distributed among humans, AI agents, industrial robots, executable protocols, compute infrastructures and energy systems. The paper argues that classical categories such as labour, capital, firm, market, productivity and trust remain essential, but are no longer sufficient when technologies do not merely raise productivity but also prepare decisions, coordinate workflows, support or execute tasks, verify transactions and reshape responsibility”
Unlawful by design: Exposing the human rights costs of generative AI - Amnesty International outlines - “This briefing examines how standalone generative AI systems, based on unlawful web scraping, are in conflict with international human rights law (IHRL) and standards through their design, development and deployment. While these technologies promise sophisticated automation and efficiency, they rely on data collection and model training practices that abuse privacy rights, enable discrimination, and threaten freedom of expression and thought.”
Prioritization of Risks from Artificial Intelligence: A Delphi Study of 272 International Experts - MIT AI Risk Initiative studies - “Experts assessed at least 10% probability of catastrophic harm (e.g., more than 1 million human deaths or more than USD $100B loss) from 18 of 24 AI risk domains under business-as-usual trajectories over the next 5 years” - assessed or asserted?
MiniMax debuts AI model built for long and complex coding tasks - South China Morning Post reports - “The Shanghai-based company said on Monday that the model’s redesigned architecture reduced computational requirements to as little as one-twentieth of previous levels, slashing inference costs while boosting response speeds.”
OpenAI’s Altman says AI unlikely to lead to ‘jobs apocalypse’ - Reuters reports - “OpenAI CEO Sam Altman said on Tuesday the rapid development and adoption of AI would not lead to a global "jobs apocalypse" and the technology had not claimed as many white-collar jobs as he had feared.” - the reality is cost, reliability and business value are still variables here today which many organisations are wrestling with.
EU civic engagement: The use of digital tools and AI to promote citizen participation in EU policymaking - European Parliament think tanks - “Building on a comprehensive landscape analysis, the study clusters 94 distinct tools from around the world and selects 11 representative cases for in-depth empirical assessment. This approach distinguishes between theoretical potential and practical utility, identifying the preconditions for successful engagement and how tool functionalities can support this. It also gives empirical insights into the current usage of digital tools, their associated advantages and limitations, and the trade-offs that need to be considered when conducting participatory processes”
Cyber proliferation
One click—and you’re spied on: GFF files criminal complaint alongside journalist Trung Khoa Lê following spyware attack - The Society for Civil Rights (Gesellschaft für Freiheitsrechte e.V. or "GFF") details - “The Society for Civil Rights (GFF) today filed a criminal complaint against persons unknown, together with German-Vietnamese journalist Trung Khoa Lê, regarding an attempted spyware attack. Lê is the editor of the important Vietnamese news site Thoibao.de, which he runs from Germany. The attackers, who are believed to be operating from abroad, unsuccessfully attempted to install spyware on his laptop and cell phone via Platform X.”
Tracking The Trackers: Commercial Surveillance Occurring on U.S. Army Networks - Army Cyber Institute detail - from Feb but a good warning - “21.2% of the top 1,000 Internet resources accessed on Army CONUS unclassified networks during the study period were tracker domains – domain endpoints used exclusively for analytics or collection of user data. This is a conservative estimate of total Internet tracking activity, as another 10.4% consisted of websites with embedded tracking code.”
Bounty Hunting
American Citizen Pleads Guilty to Working as an Agent for the People’s Republic of China - US Department of Justice announces - “Pauken also sold reports to a group of Chinese individuals from Wuhan who sought information about technology and the U.S. Department of Justice. The Wuhan clients wanted Pauken to find an expert to help them engage in cyber espionage.”
Market Incentives
IBM, AT&T Accused by Whistleblower of Covering Up Breaches - Bloomberg alleges - “International Business Machines Corp. and AT&T Inc.’s computer systems were repeatedly breached by foreign hackers, and the companies concealed those intrusions from the US government in violation of the law, according to a lawsuit from a former IBM cybersecurity official. William Barlow, IBM’s former vice president of threat intelligence, alleged in the complaint that the companies failed to disclose multiple breaches over years by attackers linked to foreign governments and made false assurances about the security of their systems in order to win and keep federal contracts.”
Cybersecurity (CYBER); Cyber Resilience Act (CRA); Cybersecurity requirements for routers, modems intended for the connection to the internet and switches - ETSI publishes - “The present document specifies vulnerability handling activities, technical requirements and corresponding assessment criteria for routers, modems intended for connection to the internet, and switches related to cybersecurity.” … “The present document covers those products to demonstrate compliance with the essential cybersecurity requirements 321 of Regulation (EU) 2024/2847”
Insurance of Agentic AI - Quanyan Zhu proposes - “The paper further proposes an actuarial framework based on exposure assessment, scenario analysis, dependency mapping, and accumulation-risk management, drawing parallels to the evolution of cyber insurance. Finally, we present a coordinated insurance architecture that integrates cyber, technology errors and omissions, product liability, performance-warranty, and affirmative AI-liability coverages through explicit allocation mechanisms and dedicated AI aggregates. The analysis suggests that the future of agentic-AI insurance lies not in a single monoline product but in a layered ecosystem of complementary coverages supported by improved governance, transparency, telemetry, and regulatory clarity.”
Reflections this week are two fold…
The first is from a discussion this week with delivr.to and the insight they provided that click-fix continues the single biggest challenge they see in terms of initial payload delivery. They highlighted where vendors make changes to terminal instantiation and use (such as in macOS Tahoe 26.4) it really does move the dial.
The second is it is clear that AI supported vulnerability discovery is displacing constraint to downstream pinch points in patch development, testing etc. for a majority. We should expect this trend to continue down the full stack and every level but also not be surprised where AI is not reliable enough today to address some of these downstream bottlenecks. Maybe code fixing will help - but functional regression testing will be the next bottleneck etc. until we get assured micro patching or otherwise reasoned (e.g SMTs etc.) fixes etc.
Finally you might find interesting the opinion piece - The unintended consequences of vulnmaxxing - The only way to fix vulns at AI scale is to use AI. Coincidence or cash grab?
Not getting this via email? Subscribe:
Think someone else would benefit? Share:
All attribution is by others and not the UK Government unless specifically stated as such, please see the legal text at the end.
Have a lovely Saturday…
Ollie
Cyber threat intelligence
Who is doing what to whom and how allegedly.
Reporting on Russia
FSB’s matryoshka
Amaury G. details this alleged Russian capability which is noteworthy for the relative technical sophistication.
Gamaredon is a cyberespionage group specialized in long-term and persistent intrusion operations targeting Ukraine. Officially operated by Russia’s FSB, the group is focusing government, military, and critical infrastructure networks, and is still actively operating at the time of this publication.
This report analyses over a decade of malware families and establishes a unified naming taxonomy to cut through the fragmented nomenclature.
The infection chain is designed to be invisible: by hiding inside legitimate Windows features and abusing trusted platforms like Telegram, Cloudflare, and standard cloud storage, Gamaredon leaves almost no trace on infected machines.
Once inside a network, malware spreads physically, infecting USB drives to jump across air-gapped systems and steals documents whether they are stored, being transferred, or actively edited in real time.
Every step of the infection chain doubles as a backdoor, giving operators the ability to push new commands, update configurations, or deploy additional payloads, ensuring permanent access to compromised hosts
https://blog.sekoia.io/fsbs-matryoshka-2-3-gamaredons-gifts-that-keeps-unpacking-gammaload/
https://blog.sekoia.io/fsbs-matryoshka-3-3-gamaredons-gifts-that-keeps-unpacking-gammasteel/
Tracking APT28 PixyNetLoader: Evolutions from 2024 to 2026
ExaTrack track of the evolution of this alleged Russian capability for a two year timeframe. Noteworthy for the continued investment and PNG for payload delivery..
Analysis of ~90 PixyNetLoader samples and grouping them into 4 sub-families using code similarities sharing
Enabling unified detection through a single YARA rule
Exposing the latest steganography mechanisms used in the 2026 March-April versions
Providing PNG payload extraction script, IOCs, detection guidance and samples list
https://blog.exatrack.com/Tracking_APT28_PixyNetLoader/
Reporting on China
VerdantBamboo: Just Another BRICKSTORM in the Firewall
Damien Cash, Paul Rascagneres, Steven Adair, and Tom Lancaster further detail this alleged Chinese operation which is noteworthy for apparently deploying a fallback implant for resilience purposes.
While BRICKSTORM was the primary implant used by VerdantBamboo, Volexity identified two previously undocumented (at the time of discovery) malware families:
PLENET, a malware family written in .NET Core and compiled to native code using the Native AOT features added in .NET 7. The analyzed sample was written for Linux target systems. This malware was referred to as “GRIMBOLT” by Google Cloud.
AGENTPSD, a malware family written in Python that was deployed to Linux systems. This malware was compiled to a binary using PyInstaller. It has limited functionality, and Volexity assesses with high confidence that it served as a fallback should VerdantBamboo’s primary backdoor no longer function.
https://www.volexity.com/blog/2026/06/04/verdantbamboo-just-another-brickstorm-in-the-firewall/
Operation Dragon Weave : Uncovering a China-Linked Campaign Targeting Czech Republic and Taiwan Using Azure Cloud C2
Priya Patel details this alleged Chinese operation which isn’t overly noteworthy other than for the victimology.
[We have] been actively tracking threats across the globe. During our recent analysis, we identified a spearphishing campaign targeting officials and citizens in the Czech Republic and Taiwan. We observed a single lure document along with multiple supporting artifacts that strongly suggest the campaign is specifically targeting these regions, as the files closely mimic official communications.
The attack begins with a ZIP attachment. When extracted, the archive contains multiple files that appear legitimate but are actually part of a structured infection chain designed to execute malicious payloads in the background.
TA4922: The Suspected Chinese Crime Group is Going Global
The Proofpoint Threat Research Team detail this alleged Chinese criminal group which is noteworthy given the fact it can operate without the state taking action. Which is somewhat surprising..
TA4922 is a highly sophisticated threat actor demonstrating a rapid operational tempo and continually evolving malware arsenal.
The group has been observed using multiple malware families including Atlas RAT, RomulusLoader, SilentRunLoader, and ValleyRAT (Winos4.0), among others.
TA4922 relies on localized lures often themed around HR, payroll, tax, and invoicing to convince targets across multiple regions. In recent months, the actor’s activity has spread to more countries globally, including in Europe and Africa.
The actor combines malicious activity with legitimate tools, trusted software, and cloud hosting services, making detection and defense more challenging.
https://www.proofpoint.com/us/blog/threat-insight/ta4922-suspected-chinese-crime-group-going-global
Reporting on North Korea
Sapphire Sleet Targets macOS in Multi-Stage Intrusion Campaign
LevelBlue detail this alleged North Korean campaign which is noteworthy for the platform targeting and method of initial access.
Initial access relied on targeted social engineering in which victims were instructed to execute a fake Zoom SDK update component, leading to user-assisted execution and follow-on payload delivery.
Analysis of APT-C-26 (Lazarus) group’s attack activities using CVE-2025-55182 and the Copperhedge component
360 Threat Intelligence Center detail an aspect of an alleged North Korean operation which will be of note to cyber defenders. CVE-2025-55182 is React2Shell…
During routine monitoring, we observed that the Lazarus group used malicious components related to the CVE-2025-55182 vulnerability, supplemented by the internal network lateral movement tool MultiRelay, a User Account Control (UAC) bypass tool, and traces of the Copperhedge malware family.
Reporting on Iran
The Server Seizure That Affects Also Iran’s Cyber Operations
Check Point detail the impact on alleged Iranian cyber operations from the server seizures which occurred due to sanctions violations. Alleged Russian hosting supporting alleged Iranian cyber operations..
On May 22, 2026, Dutch financial-crime investigators walked into data centers in Dronten and Schiphol-Rijk and seized approximately 800 servers. The target was WorkTitans B.V., a hosting provider that, on the surface, looked like any other internet infrastructure company. What investigators uncovered, however, was something far more significant: a ghost operation built on sanctioned infrastructure, quietly serving as the backbone for some of Iran’s most active cyber espionage campaigns.
…
Based on our tracking of threat actor infrastructure, the WorkTitans takedown likely had an impact on Iranian cyber operations. Three separate Iranian threat actor groups, each running their own campaigns against different targets, were observed using WorkTitans infrastructure for core operational purposes.
https://blog.checkpoint.com/security/the-server-seizure-that-affects-also-irans-cyber-operations/
Reporting on Other Actors
Operation XENOFISCAL: SideCopy deploying persistent XenoRAT targeting the MoF, Afghanistan
Dixit Panchal details an alleged Pakistani campaign which is noteworthy for its victimology as opposed tradecraft..
Seqrite Labs has been actively monitoring spear phishing campaigns across the globe and has a well-established history of tracking the SideCopy APT cluster — a Pakistan-linked threat group operating under the broader Transparent Tribe / APT36 umbrella. In continuation of that tracking effort, we identified a targeted campaign directed at the Ministry of Finance, Afghanistan, with TTPs that overlap with SideCopy at medium-to-high confidence.
…
The campaign opens with a spear phishing delivery — a ZIP archive containing a malicious LNK file bearing a carefully crafted Pashto-language filename:
Dissecting an Undocumented Lua-Wrapped Loader: The BoldTealLayer Campaign
The One Eyed Argus pops up out of no where to detail a previously unseen loader
In early 2026, while investigating unexplained high memory usage on my Windows 11 system, I discovered a plaintext debug log file (
lua_traceback.log) left in theC:\tempdirectory. The log detailed the real‑time actions of a previously undocumented malware loader. Despite being actively executed, the threat evaded detection by multiple up‑to‑date antivirus engines, including Microsoft Defender, Malwarebytes, and ESET.The loader employs a multi‑stage attack chain. It uses a legitimate, digitally signed executable (
active_desktop_launcher.exe) to side‑load a malicious DLL (active_desktop_render_x64.dll). This DLL then loads a Lua scripting engine to execute an obfuscated script that systematically dismantles Windows security mechanisms—patching Event Tracing for Windows, restoring a clean copy ofntdll.dllto remove user‑mode hooks, and employing a rare hardware breakpoint to bypass the Antimalware Scan Interface (AMSI). With all defences neutralised, a .NET assembly is injected directly into memory and executed.
https://theoneeyedargus.github.io/
Espionage Campaign Targeted Stock Exchange Executive for Five Months
Threat Hunter Team detail an unattributed campaign which is noteworthy for the intent and victimology.
A five-month espionage campaign targeted the email account of a senior figure at a major global stock exchange. For an espionage actor, a senior executive’s mailbox is a high-value intelligence target. An Outlook profile may yield details of external negotiations, internal deliberations, the executive’s calendar, travel pattern, and their contacts. Organizations such as exchanges and regulators may hold non-public information about listings, enforcement actions and market-moving events. Months of unfettered access to that mailbox lets an attacker build a near-complete picture of the target’s working life and the organization’s near-term direction without ever having to move laterally elsewhere on the network.
…
The attackers took multiple steps to try and conceal their activity. They used legitimate cloud services (Dropbox and OneDrive) for exfiltration and their command and control (C2) infrastructure. They also used a variety of public tools, and named tools and services to blend in with legitimate traffic. The use of public tools and cloud infrastructure means the attackers did not leave many clues to their identity, so this activity cannot be attributed to a known attack group. However, the commands used by the attackers do point to the motivation for this attack being espionage.
https://www.security.com/blog-post/stock-exchange-espionage
Meet DriveSurge: A New Threat Actor Using ClickFix and Fake Update Drive-By Attacks in Thousands of Compromised Sites
SilentPush detail some of the underlying business model of this criminal campaign which is noteworthy due to it performance incentives.
Based on our research, we suspect DriveSurge uses a Pay-Per-Install (PPI) model, where it is paid each time a victim’s device is successfully infected, with those leads then sold downstream to other threat actors.
[We] recently observed several drive-by attack clusters developed by a threat actor to automate malware delivery at scale. We named the primary driver behind an extensive surge in ClickFix and FakeUpdates campaigns: DriveSurge.
Current activity suggests DriveSurge operates as a specialized Initial Access Broker (IAB), using a Pay-Per-Install (PPI) model to supply downstream threat actors with high-quality victim leads.
DriveSurge has compromised thousands of websites that set zTDS domains to traffic victims to ClickFix and Fakeupdates websites.
Our research uncovered a series of eight technical fingerprints that map DriveSurge’s malicious infrastructure.
https://www.silentpush.com/blog/drivesurge/
Impersonation, Click Hijacking, and TDS: Inside a Malware Distribution Ecosystem
Alexey Bukhteyev details similar capability which further highlights the scale, complexity and service model of initial access.
Check Point Research investigated a large-scale operation that impersonates open-source and freeware projects to capture search traffic, including lookalikes for researcher and security tooling such as Ghidra, dnSpy, and SpiderFoot. The sites are well-designed and often look like legitimate project portals at a glance, sometimes referencing real upstream resources. The deception is not in the page content alone, it’s in what happens when a user interacts.
Our analysis shows these pages load a CloudFront-hosted JavaScript staging layer that converts a click on a “download” button/link into a handoff to a Traffic Distribution System (TDS). The TDS enforces strict gating: first-visit state, mandatory click confirmation, anti-bot/anti-analysis logic, VPN/datacenter filtering, and frequency capping.
The observed ecosystem appears to be built primarily for traffic acquisition and monetization, likely leveraging legitimate ad-tech and monetization tooling, while downstream redirect chains repeatedly led selected users to malware delivery infrastructure.
The downstream branches we analyzed led to multiple malware families, including RemusStealer, AnimateClipper, and the SessionGate framework, which we observed delivering PUA (Potentially Unwanted Applications), suggesting this was not an isolated malicious redirect.
The HazyBeacon Protocol – How Malware Weaponizes Amazon Web Services (AWS) Lambda Function URLs
Aniket Harne details an unattributed campaign which is noteworthy for its novel C2 which defensive teams will want to be alive to.
HazyBeacon (CL-STA-1020) targets Southeast Asian government networks by abusing AWS Lambda Function URLs configured with AuthType: NONE as stealth command-and-control relays.
Attackers use stolen IAM credentials to deploy Lambda functions that proxy malware communications through trusted AWS domains.
Organizations can reduce exposure by enforcing identity-centric access controls, enabling global CloudTrail logging, enabling VPC flow telemetry, and implementing Service Control Policies that restrict Lambda Function URL exposure, all supported by continuous configuration monitoring.
Supply Chain attacks this week
A reminder we issued guidance this week we issued advice in Software supply chain attacks: check your dependencies.
Malicious npm packages abuse dependency confusion to profile developer environments - https://www.microsoft.com/en-us/security/blog/2026/05/29/33-malicious-npm-packages-abuse-dependency-confusion-profile-developer-environments/
Typosquatted npm packages used to steal cloud and CI/CD secrets - https://www.microsoft.com/en-us/security/blog/2026/05/28/typosquatted-npm-packages-used-steal-cloud-ci-cd-secrets/
183 npm Packages Target Cloud and Finance via oob.moika.tech -
https://safedep.io/oob-moika-tech-dependency-confusion-campaign/
PCPJack Hijacked 230 AWS, GCP, and Azure Servers to Run a Hidden SMTP Relay Network - https://hunt.io/blog/pcpjack-230-cloud-servers-smtp-proxy-network-sliver-chisel
Discovery
How we find and understand the latent compromises within our environments.
C2 Frameworks - Threat Hunting in Action with YARA Rules
Resecurity release these Yara rules which will help detection teams hunt..
For educational purposes, Resecurity has developed sample YARA rules for various C2 frameworks to assist network defenders. This information may also be useful for red team specialists in planning potential evasion tactics when conducting vulnerability assessments and penetration testing (VAPT).
Airstrike C2
Alan Framework
AM0NEye
Atlas C2
BruteRatel
C3 (Custom Command and Control)
Callidus
DBC2
Deimos C2
GrimReaper C2
FlyingAFalseFlag C2
Mike C2
Nimbo C2
NorthStar C2
Petaq C2
Pickle C2
Posh C2
Reddit C2
Sharp C2
Trevor C2
SQLC2
https://www.resecurity.com/blog/article/c2-frameworks-threat-hunting-in-action-with-yara-rules
Aether
Mr.Z releases this which will act as inspiration for techniques to apply.
Aether is a Windows memory-forensics and threat hunting tool that scans live process memory for malicious pattern, detect injection techniques, implant signatures, reflectively loaded .NET assemblies. it works with a multi-layer confidence model that dramatically reduce the false positive rate and hunt for malicious behaviour. Aether has good capabilities in detecting Hollowing, APC, thread hijacking techniques. Security analysts can use it to scan,hunt and snapshot suspicious region for offline analysis.
https://github.com/0xsp-SRD/aether
Defence
How we proactively defend our environments.
MXC Internals: How Microsoft’s eXecution Containers Actually Isolate Agent Code
Tyler Holmwood documents how these containers work in practice which will similarly hopefully inspire others on how to approach such problems.
We usually have to reverse engineer what we write about here, but this time Microsoft is putting it all out in the open. This is a tour of what the source does: one dispatcher binary, a JSON policy model, and ten containment backends. The backends get the most attention, because that is where policy turns into real enforcement, from AppContainer capability SIDs and Job Object UI limits to Hyper-V micro-VMs and macOS Seatbelt profiles. There are also newly documented Windows API functions and some sneak-peeks into upcoming Preview build functionality.
https://www.originhq.com/research/mxc-execution-containers-internals
Package Proxy
Jacob Torrey releases this work aid for those wrestling with the supply chain issues and developer security.
It relies on Cloudflare Workers so it is very tied to Cloudflare, but similar ideas can be implemented elsewhere. The released Package Proxy implements these checks out the box:
Ensures packages are at least 10 days old (PyPI, npm, cargo)
Where the package upload mechanism is visible, check that it has not regressed (PyPI, npm)
Bypass for explicit audit fix steps (npm)
Block list (PyPI, npm, cargo)
Allow list (PyPI, npm, cargo)
DriverSentinel
404: Sleep not found releases this tool which will support hunt teams wrestling with bring your own vulnerable drivers.
DriverSentinel is a security tool developed in Go that detects malicious and vulnerable drivers on Windows systems by comparing them against the LOLDrivers.io database.
https://github.com/bI8d0/DriverSentinel
pydepgate
Ikari releases a set of heuristics which will help catch some of the open source supply chain capabilities.
A zero dependency lightweight static analyzer designed for adversarial-shape code in python to detect supply chain attacks before they reach your interpreter.
https://github.com/nuclear-treestump/pydepgate
SkillSpector
NVIDIA release
Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, and security risks before installing agent skills.
AI agent skills (used by Claude Code, Codex CLI, Gemini CLI, etc.) execute with implicit trust and minimal vetting. Research shows that 26.1% of skills contain vulnerabilities and 5.2% show likely malicious intent.
https://github.com/nvidia/skillspector
Prempti
Falco bring observability to to coding agents.
Prempti brings Falco to the world of AI coding agents. It gives you guardrails that can deny or ask for confirmation on unwanted behaviors, plus real-time visibility into every tool call your coding agent makes — shell commands, file writes, reads, API calls. Both are driven by Falco rules you can customize to fit your workflow.
By default, Prempti runs in guardrails mode: rules produce verdicts that shape what the agent does. When a tool call is blocked or flagged, the agent receives an LLM-friendly explanation of why and adapts — the policy guides behavior through feedback. If you prefer pure observation without intervention, switch to monitor mode: every tool call proceeds while rules still evaluate and log the activity.
https://github.com/falcosecurity/prempti
Operationalising Post Quantum TLS Automated Configuration Profiling and Hybrid PQC Deployment in Financial Infrastructure
Harish Balaji, Aarav Varshney, Prasanna Ravi, Sripal Jain, Robin Foe, Jorden Seet, Huaxiong Wang, Kwok-Yan Lam, and Anupam Chattopadhya give a hint as to an approach which can be used to accelerate real-world deployment of PQC where robust implementations and protocols exist.
This paper presents a configuration parsing methodology that automatically extracts and normalises TLS cryptographic posture across dominant enterprise web server stacks, producing a unified, provenance traced cryptographic inventory as a foundation for migration and compliance. We demonstrate the approach on 8,443 real world Nginx configurations from public repositories and in a proof of concept deployment at a financial institution, where MLKEM and hybrid MLKEM key exchanges at TLS termination points (web server and API gateway) securing an internal application, with zero application layer changes and manageable performance overhead.
https://arxiv.org/abs/2605.17955
Incident Writeups & Disclosures
How they got in and what they did.
RHSB-2026-006 Supply chain compromise of @redhat-cloud-services npm packages
Redhat details..
Preliminary analysis indicates that a compromised GitHub account was used to push unauthorized commits to repositories in the RedHatInsights GitHub organization. Red Hat engineering removed compromised versions from npm following disclosure. Red Hat is continuing to conduct build system and dependency tracking analysis to confirm no product builds contained compromised package versions. Based on current findings, no actions from customers are required.
https://access.redhat.com/security/vulnerabilities/RHSB-2026-006
You do surprise me.exe: An unexpected executable in Hola Browser
Sophos detail this supply chain incident.
[We] recently identified an unexpected executable delivered alongside Hola Browser (version 1.251.91.0). The executable, me.exe, was not listed as a certified component, and appears to be a crypto-miner.
After the issue was reported through the certification program, Hola reported that they had fixed their delivery pipeline, removing the condition that led to the undeclared component being bundled with Hola Browser.
https://www.sophos.com/en-us/blog/you-do-surprise-me-exe-an-unexpected-executable-in-hola-browser
Vulnerability
Our attack surface.
Signal macOS Desktop App Doesn’t Actually Delete Messages When it Should
Fria Reyes summarises Harry Sintonen’s work..
Security researcher Harry Sintonen disclosed that the macOS desktop Signal app doesn’t actually delete messages when they’re deleted in the UI of the app.
Sintonen explains that the macOS Signal app uses an SQLcipher database, essentially a SQLite database with encryption, meaning it inherits features from SQLite.
All transactions are written to a log file, which is then merged into the actual database once a certain threshold of pages is reached in the log file.
The default threshold in Signal is 1000 pages, a number that Sintonen says can take potentially several days to reach, depending on how busy your Signal app is.
CVE-2026-0257 PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities
Palo Alto Networks details..
Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection.
https://security.paloaltonetworks.com/CVE-2026-0257
When “Moderate” Means “Sometimes”
Andrew Schwartz details an unpatched vulnerability which can lead to NTLM leakages.
Same bug class. No CVE. No fix. The NTLM leakage primitive in the Windows search: URI handler is technically identical to CVE-2026-33829 in the Snipping Tool. Same severity rating, same mechanism, same potential impact. Microsoft closed it without a CVE or a patch, describing its triage process as “case-by-case.”
A CVSS score of 4.3 doesn’t capture the real-world risk. This bug requires no malware and no complex exploit chain. A single link click can leak a user’s NTLMv2 hash to an attacker-controlled server before Windows even renders an error message. The victim may never download anything malicious at all.
https://www.huntress.com/blog/unpatched-ntlm-leak-windows-search-uri-handler
How OLTs may have exposed entire ISP networks
Mathieu Farrell detailed this in early May, but I missed it at the time and it highlights ISP attack surfaces..
An Optical Line Terminal (OLT) is the central device in a Fiber-To-The-Home (FTTH) network that connects and manages all customer connections, making it a critical control point in an ISP's infrastructure for delivering high speed Internet. This article uncovers how unauthenticated access to OLTs can lead to a full network takeover starting by exploiting exposed vulnerable devices, showing how to pivot into the cloud-based fleet manager using other vulnerabilities, and then compromising an ISP's entire infrastructure.
https://blog.quarkslab.com/how-olts-may-have-exposed-entire-isp-networks.html
Offense
Attack capability, techniques and trade-craft.
Adversarial Oracles: LLM-Guided EDR Signature Reduction
Michael Weber details how they applied AI to attempt to evade EDR signatures which will be of interest to vendors and blue teams alike.
Bigger profiles consistently beat smaller ones, and the gap was larger than we expected. Moving from a moderate-sized profile to a substantially larger one cut Microsoft Wacatac ML detection by several multiples on the same payload. The “useful enough to disguise a Go runtime” threshold sits well above what most off-the-shelf open-source projects produce, which turned suitable-candidate hunting into a research task in its own right.
Building larger candidates from source didn’t always help. Hoping to brute-force the problem, we built profiles from kubectl, kube-apiserver, and a handful of other Cloud Native Computing Foundation heavyweights. The symbol tables came back smaller than we’d guessed. Kubernetes is broad horizontally, but most of its packages are thin and dependency-driven. The projects that produced the densest symbol tables were the ones with heavy plugin or backend-implementation patterns, where a single core type spawns dozens of method receivers per backend. Volume of code matters less than volume of distinct typed methods.
Stripping the names entirely was the worst option. Just to confirm the direction, we also ran a small batch with -ldflags=”-s -w”, the same conventional binary-shrinking advice that lit up CrowdStrike on the goffloader experiment up top. It produced the same result here: CrowdStrike and Symantec hit immediately. ML treats the absence of expected debug data as suspicious in its own right.
https://www.praetorian.com/blog/llm-edr-signature-reduction/
AzureRedOps
Mr.Un1k0d3r released this capability which should act as a good corpus to ensure log coverage and detection.
AzureRedOps is a offensive security toolkit for assessing the security posture of Microsoft Entra ID and Azure tenants. It wraps the most common red-team workflows — authentication, token management, directory enumeration, privilege checking, password spraying, and post-exploitation actions against Microsoft Graph — behind one consistent
--activitydriven CLI.
https://github.com/Mr-Un1k0d3r/AzureRedOps
Visual Studio Extensions Revisited
Dominic Chell walks through how to build malicious VSIXs..
The most likely infection vector for extensions compromise of either an existing, legitimate extesion, as was the case of GitHub’s infection, or introduction of a new extension to the marketplace to gain installs over time. Both of these are potential avenues for supply chain attack. However, they may be more complex to detect, given the additional detection flexibility. This is more often given to developer environments and is a common place for this type of extensions where privileged access is needed for running, debugging, scripting and other means of reflective code execution.
https://www.mdsec.co.uk/2026/05/visual-studio-extensions-revisited/
Bring Your Own RWX Region DLL (BYORWXDLL)
S12 - 0x12Dark Development details this technique..
The core idea is simple: if a target process already has one of these DLLs loaded, or if we can force it to load one, we get a writable and executable memory region without calling
VirtualAllocExorVirtualProtectEx, two of the most monitored API calls in modern EDR detection pipelines. This reduces the syscall noise of a classic shellcode injection
https://medium.com/@s12deff/bring-your-own-rwx-region-dll-byorwxdll-0283951d34e9
NuGet Code Execution As A Service
Jim Rush details there is a mark of web gap …
https://tierzerosecurity.co.nz/2026/06/02/nuget-code-execution.html
Exploitation
What is being exploited..
Observed Exploitation of PAN-OS GlobalProtect Authentication Bypass Vulnerability (CVE-2026-0257)
Rapid7 show they detect exploitation within 4 days..
On May 13, 2026, Palo Alto Networks published a security advisory for CVE-2026-0257, a medium severity authentication bypass affecting PAN-OS and Prisma Access when a specific configuration is present. Successful exploitation of this vulnerability allows a remote unauthenticated attacker to successfully establish a VPN connection through the GlobalProtect gateway of an affected appliance.
Rapid7 MDR identified successful exploitation across numerous customers, however we did not observe any indication of successful lateral movement from the devices. The earliest date for observed exploitation was May 17, 2026.
Tooling and Techniques
Low level tooling and techniques for attack and defence researchers
Defending Code Reference Harness
Eugene Yan and Michael Molash release this harness..
A reference implementation for autonomous vulnerability discovery and remediation with Claude, based on our learnings from partnering with security teams at several organizations since launching Claude Mythos Preview. For a write up of these learnings along with best practices, see the accompanying blog post (also available in
blog-post.md).
https://github.com/anthropics/defending-code-reference-harness
Footnotes
Some other small (and not so small) bits and bobs which might be of interest.
Annual, quarterly and monthly reports
Nothing overly of note this week, but keep an eye on the Awesome Annual Security Reports 2026 collection
On the adoption of software bill of materials in open-source software projects
Artificial intelligence
Fundamental
Nothing overly of note this week…
Applied non-cyber
Applied cyber specific
Cybersecurity AI (CAI) Dataset
the data sets - https://aliasrobotics.com/datasets.php
CyberGym-E2E: Scalable Real-World Benchmark for AI Agents’ End-to-End Cybersecurity Capabilities
Honeyval: A Comprehensive Evaluation Framework for LLM-powered HTTP Honeypots
Security of OpenClaw Agents: Fundamentals, Attacks, and Countermeasures
Dissecting the Black Box: Circuit-Level Analysis of LLM Vulnerability Detection
Detecting Offensive Cyber Agents: A Detection-in-Depth Approach
Relevance as a Vulnerability: How Web Retrieval Degrades Safety Alignment in LLM Agents
Turning Bias into Bugs: Bandit-Guided Style Manipulation Attacks on LLM Judges
Harness Engineering Evolution, Defense, and My Reflections on AI Penetration Testing Agent
Hijacking Agent Memory: Stealthy Trojan Attacks Through Conversational Interaction
HunterAgent: Neuro-Symbolic Attack Trace Reconstruction under Anti-Forensics
AI Agent Isolation Model and Security Boundary from a System Perspective
CyberStrikeAI - CyberStrikeAI is an AI-native security testing platform built on Go. It integrates over 100 security tools, an intelligent orchestration engine, role-based testing with preset security testing roles, a skills system with professional testing skills, complete test lifecycle management capabilities, and built-in lightweight C2 (Command & Control) capabilities for authorized scenarios (listeners, encrypted communication, sessions and tasks, real-time events, REST and MCP collaboration).
Books
Nothing overly of note this week…
Events
OSCW 2026: Open Source Cryptography Workshop - slides etc
The Real World Crypto Symposium - videos
Finally finally the NCSC’s podcast series.
Unless stated otherwise, linked or referenced content does not necessarily represent the views of the NCSC and reference to third parties or content on their websites should not be taken as endorsement of any kind by the NCSC. The NCSC has no control over the content of third party websites and consequently accepts no responsibility for your use of them.
This newsletter is subject to the NCSC website terms and conditions which can be found at https://www.ncsc.gov.uk/section/about-this-website/terms-and-conditions and you can find out more about how will treat your personal information in our privacy notice at https://www.ncsc.gov.uk/section/about-this-website/privacy-statement.