Welcome to the weekly highlights and analysis of the blueteamsec (and my wider reading). Not everything makes it in, but the best bits do. A community member is doing daily AI generated podcast of the last 24hours of posts.
Operationally this week getting Operational Technology / Industrial Control Systems off the Internet continues to be a focus.
In the high-level this week:
FSB Chair’s letter to G20 Finance Ministers and Central Bank Governors: August 2026 - Financial Stability Board publishes - “Firms and authorities should be prepared for a threat environment characterised by a higher volume of vulnerabilities and a faster pace of patching, recognising that these dynamics could themselves create operational and resilience challenges if change, testing and recovery processes are unable to adapt safely.”
Preparing for the Post-Quantum Era: A Call to Action - CISA, NCSC UK and the G7 publishes - “CISA and the Group of Seven (G7) Cyber Security Working Group released Preparing for the Post-Quantum Era: A Call to Action highlighting the urgent need for organizations and governments to begin transitioning to post-quantum cryptography (PQC) to protect sensitive data, authentication systems, and critical assets from emerging quantum computing threats.”
Communicating under pressure: Best practices for service providers - ASD’s ACSC publishes - “This publication was prepared by the CISA with contributions from the FBI, NCSC-UK, Cyber Centre, NCSC-NZ, and ASD’s ACSC. It reflects best practice within the United States, not Australia.”.. “Effective communication during IT and operational technology (OT) service outages is as critical as technical remediation in limiting harm and operational impact. A disruption at one organization (whether from natural hazards, human error, equipment failure, or malicious activity) can cascade across interconnected systems. Speculation and uncertainty from end users regarding the nature of the disruption can make things worse.”
Establishment of Cyber Security Policy Division, Foreign Policy Bureau - Japan announces - “The Ministry of Foreign Affairs (MOFA) established the Cyber Security Policy Division under the National Security Policy Division in the Foreign Policy Bureau on September 1, 2026” .. “As the importance of cyberspace has increased, cyber threats are rapidly growing. Against this backdrop, MOFA established the new division in order to play an active role in promoting the rule of law in cyberspace and in international rule-making in line with Japan’s fundamental principles, further strengthening coordination with its allies, like-minded countries, and partners.”
Wyden Calls on NSA to Update Federal Cybersecurity Guidance for VPNs - U.S. Senator Ron Wyden requests - “I am writing to request the National Security Agency (NSA) update existing public guidance to address an important cybersecurity gap that leaves U.S. government officials, businesses, journalists, and activists vulnerable to surveillance by foreign adversaries. While commercial Virtual Private Networks (VPNs) are recommended by federal agencies and widely marketed as shields against online spying, standard consumer VPNs do not sufficiently protect users from sophisticated adversaries. Other, more secure alternatives are widely available.”
National Defense Authorization Act for Fiscal Year 2027 - Congress publishes - “In general.--Not later than March 1, 2027, the Secretary may establish a pilot program under the operational authority of the Commander of United States Cyber Command, to assess the feasibility and advisability of conducting cyber operations limited to access generation and maintenance through contractor owned, contractor operated means, subject to the limitations in subsection (b)"
How the Russians Got Inside My Phone - Michael Isikoff alleges and details - “So how did the Russians do it? In my case, it began with a message that popped up on my Signal account on May 29 stating it was from “Signal Support” with the blue-rounded circle that is Signal’s signature logo. “We found logging in to your account from a new device,” it read. “If it wasn’t you, write, ‘it’s not me’ in the chat and follow the further recommendations.” These included instructions on how to enter my “recovery key”— a long hodgepodge of random letters and numbers that are apparently unique to each users’ account. At first, I didn’t respond. But then, four days later, on June 3, I got a follow up “Signal Support” message that got my attention. “Warning,” it read. “You did not enter your recovery key. Your account will be deleted.” Not wanting to lose access to an account I believed to be secure and regularly use, I stupidly did what the bogus Signal Support team recommended, including the final step: “Paste the key here immediately to keep your account.”
ELI Approves Groundbreaking Model Rules on Succession and Access to Digital Remains - European Law Institute approves - “The newly approved Model Rules offer an innovative and practical solution by recognising that not all digital content should be treated alike. Rather than forcing all digital remains into traditional succession law or data protection law, the Rules establish a dual legal framework:
Digital assets with economic value are transferred through the ordinary law of succession.
Personal digital remains, closely connected to the deceased’s identity, privacy, and dignity, are governed by a carefully safeguarded right of access rather than inheritance.”
Persistent Engagement and the Illusion of Cyber Equilibrium - Jason Healey and Jack Snyder opine - “We are skeptical. Enthusiasm for this concept—and the accompanying “cyber persistence theory”—may be based more on its success in describing the past few years of cyber conflict than on any ability to stabilize cyberspace. Persistent engagement is one thing if it attempts to establish a balanced equilibrium, but quite another when one or both sides are seeking dominance over cyberspace, which they see as an increasingly existential necessity amid a period of rising international turmoil. This article briefly examines constant contact and persistent engagement, then discusses concepts of strategic equilibria from other contexts, and proposes recommendations.”
Reporting on/from China
China-Singapore security team claims breakthrough in hacking Starlink terminals - South China Morning Post reports - “A team of cybersecurity experts has announced they successfully compromised the latest Starlink user terminals, crossing the security boundaries of the world’s largest satellite constellation. In a post on its social media account on Tuesday, Darknavy, an independent cybersecurity research institute headquartered in Singapore and Shanghai, said it had used sophisticated hardware attacks to gain full administrative control over the terminals, allowing it to run any custom code on the devices.”
US Warns Over Huawei’s AI Data Center Offer to Egypt for Military and Surveillance Uses - Modern Diplomacy reports - “Since 2023, shipments of AI chips to Egypt have been subject to US approval, giving the Trump administration leverage to impose conditions through export licenses. This is in addition to US legal warnings against using Huawei’s Chinese accelerators and technologies, which are banned in the US. The Trump administration has warned that using certain Huawei accelerators without Washington’s approval could expose users to legal penalties.”
India stalls Alipay+ payments link over security, data concerns, sources say - Reuters reports - “The Indian government's concerns about Alipay+'s proposal stem from its Chinese links, data-security risks and the potential misuse of customer data, the three sources said.”
Serbia begins serial production of humanoid robots with Chinese firm - Xinhau Net reports - “A humanoid robot factory jointly built by Serbia and the Chinese company Minth Group officially commenced serial production Saturday in the western Serbian city of Sabac.”
China can build kung fu-fighting robots. But it can’t get them to do factory work - Reuters reports - “The humanoids are slow and awkward. a novice trainer might get them to produce one usable movement in 300 attempts; an experienced trainer, one in 50. robot maker Ubtech won an $18 million tender from the Guangxi regional government last october to supply the training facility with humanoids and related hardware. The mission: to produce training data for socalled embodied ai – robots able to perceive, decide and act in the physical world. The trainers use headsets to see from the robots’ perspective and handheld controllers fitted with sensors to translate their own movements into the robots’ actions.”
How China’s Yttrium Curbs Threaten Data Centers - IEEE Spectrum warns - “Erbium is used in the amplifiers that boost optical signals in the fiber-optic cables that crisscross the planet. Yttrium is a key component of the thermal barrier coatings that protect turbine blades and other structures from blistering heat in jet engines and in the combustion turbines so in demand to power new data centers.”
China’s Next Infrastructure Push Is Bigger — and More Complicated - Caixin Global reports - “The National Development and Reform Commission (NDRC) held a meeting on Tuesday to refine financial, fiscal and pricing support policies for the six networks, including water networks, new-type power grids, computing power networks, next-generation communications networks, urban underground pipeline networks and logistics networks. The meeting followed an Aug. 19 meeting in which the commission established a coordination mechanism involving grid operators, telecoms companies and computational resource suppliers.”
AI
Booz Allen Cyber Weapon Index - Booz Allen assert - “Leading models are across the threshold. Our CWI testing observed one true leader—Anthropic’s Claude Mythos—that is 100% capable of executing the full cyber kill chain today. When armed with a foothold like a stolen employee credential, the model successfully penetrated its target network and gained administrator-level control in every attempt;” - comment: assumed breach as a starting point
The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution - Unit42 truth bomb - “Approximately 97% of AI-enabled malware samples exist only in research repositories, sandbox environments and security validation platforms.“
AI Isn’t Causing a ‘Vulnpocalypse.’ CVE Volume Is the Real Problem - Bill Brenner reports - “The company's new Vulnpocalypse Report analyzed 253,912 CVEs published between Jan. 1, 2018 and July 15, 2026, then traced 3,769 vulnerabilities with confirmed exploitation in the wild. Its central finding is difficult to square with much of the industry's prevailing narrative: Vulnerability publication is exploding, but attacker behavior has not accelerated along with it.” - “Only 1.48% of the vulnerabilities published during the period have confirmed exploitation in the dataset. And 81.1% of those exploited vulnerabilities already had a patch available before attackers were observed exploiting them.” - comment: but the patch wave is real.
PatchBench: Evaluating AI Agents for Vulnerability Patching University of Maryland benchmarks - “Across 11 state-of-the-art agents, including the top three AIxCC agents, the original PoC-only validation inflates the patching task solve rate of agents by 1.83× on average. Our results reveal key limitations of current patching agents and point to future research directions for more reliable vulnerability repair.”
Getting Agents to tell on themselves - Haroon Meer outlines - “Last year, Rebecca Lynch from NVIDIA’s Red-Team said, “[If] an attacker is able to get their untrusted data in front of your agent, you should assume they can control anything downstream from the model”: - “We’ve been playing with AP and testing, and on our internal ranges with multiple servers and targets, across a host of open and frontier models, agents trip over these Canaries 100% of the time (we have a follow-up post in the works describing the range we use, and introducing an implementation of the A2A protocol as an alternative to AP). This interaction can be further encouraged by deploying breadcrumbs1 that point attackers to the Agent Provocateur service.”
Global Artificial Intelligence Asset Mapping and Analysis Insight Report - Zhongguancun Laboratory, National University of Defense Technology, Information Engineering University and Institute for Network Science and Cyberspace Studies, Tsinghua University and Yuanjiang Shengbang Security Technology Group Co., Ltd detail - “Traditional mapping models based on IP addresses and port fingerprints are no longer adequate for these new types of assets; the mapping paradigm is shifting toward semantic-level capability identification and privilege profiling. Comprehensive semantic mapping of AI assets enables the effective mitigation of emerging security risks and the analysis of the global AI industry landscape, thereby supporting AI security governance and high-level decision-making.”
Two DGX Sparks, 33 Local Models, One Question: Can Local AI Actually Red Team? - Roei Sherman answers - “Run Qwen3.6-35B-A3B (FP8) as your day-to-day workhorse. It matched the 120B-class models on correctness across every task - all three real BloodHound paths, correct false-positive call, the best cross-task narrative awareness of the bunch (it tied its BloodHound findings back to the phishing persona unprompted) - at a fraction of the footprint, on a single node, at ~193 tok/s. It leaves the second Spark completely free. Nothing I tested since beat it decisively enough to change the default.”
ICANN in the Age of AI Internet Identifiers, Agentic Systems, and the Next Policy Agenda - Khaled Koubaa organises - “The paper organizes the intersection between AI and Internet identifiers into five domains: identifier integrity, abuse at machine speed, agent identity and accountability, multistakeholder integrity, and inclusive and universal access. It maps these domains to existing ICANN institutions and policy instruments and proposes a time-limited scoping process to distinguish matters requiring policy development from those better addressed through technical research, implementation guidance, contractual mechanisms, or community-process rules.”
Tencent Unveils Larger AI Model in Bid to Close Gap With Rivals - Caixin Global reports - “Tencent has positioned Hy4 Preview as a model “built for productivity.” Its AI team worked with the company’s software-engineering, gaming, finance and cybersecurity specialists to develop training data and designed the model alongside applications including WorkBuddy, its desktop workplace agent.”
China promotes coordinated development of data industry, artificial intelligence - People’s Daily Online reports - “China's data industry hit 6.78 trillion yuan (about 1 trillion U.S. dollars) last year. Now, as the 2026 China International Big Data Industry Expo gets underway, one question emerges: how does data become the "new oil" of the AI era?”
Cyber proliferation
Pegasus Spyware Infection of Serbian Pro-Democracy Student Activist - Citizen Lab report - “Our analysis confirmed that an iMessage zero-click exploit was used to infect the device with NSO Group’s Pegasus spyware. We found high-confidence indicators of infection from a period across December 2025 – January 2026, however this does not preclude the possibility of additional infections. We believe that the zero-click exploit used in this attack targeted Apple iMessage, and has subsequently been patched by Apple as of iOS 18.4.1.”
Bounty Hunting
FBI investigation leads to five Venezuelan nationals pleading guilty to attempting to jackpot Kansas ATMs - US Attorney's Office announces - “According to an FBI report released in February 2026, crimes involving ATM jackpotting are increasing across the country. The FBI reports 1,900 incidents since 2020. In 2025 alone, there were over 700 incidents with more than $20 million in losses.” - “In December 2025, the defendants traveled from Indiana to Kansas to attempt to steal cash from ATMs in Wamego and Manhattan through jackpotting. Their plan was for one conspirator to physically install the malware into the ATMs then later for the group to remotely activate a command causing the ATMs to dispense cash that they would go collect. The conspirators were unsuccessful in installing the malware on the ATM in Wamego, but their attempts at installing the malware triggered the alarm causing law enforcement to respond, and the culprits didn’t return to the site”
Sality Malware Disrupted in International Cyber Takedown US Attorney’s Office announces - “As part of the international operation, the Department of Justice, FBI, and DCIS seized Sality-linked domains in the United States. International law enforcement partners in Bulgaria, Hungary, and Romania took action against additional Sality-linked domains hosted in Europe.”
Russian National Indicted For Exploiting Online Platform Used For Freelance Employment And Distributing Malware To Thousands Of Victim Users Worldwide For Financial Gain - US Attorney’s Office announces - “According to the indictment filed June 1, 2021, and unsealed yesterday, Aktulaev, 40 years old, and a national of the Russian Federation, conspired to exploit the online message platform of a well-known freelance employment technology company, located in the Northern District of California, to spread malware to approximately 80,000 of their freelance users between at least June 2016 through November 2017. The messages, which were sent from approximately 255 fake user accounts, contained malicious Microsoft Excel attachments. When opened, the attachments prompted users to run a macro, which then downloaded malware from the Internet.”
American Citizen who Worked as an Agent for the PRC Sentenced to Two Years in Prison - US Attorney’s Office announces - “Pauken also sold reports to a group of Chinese individuals from Wuhan who sought information about technology and the U.S. Department of Justice. The Wuhan clients wanted Pauken to find an expert to help them engage in cyber espionage.”
Amir Yaryab – Rewards For Justice bounties - ”a senior official in Iran’s Islamic Revolutionary Guard Corps Cyber-Electronic Command (IRGC-CEC). Yaryab leads the IRGC-CEC’s Cyber Operations Command.”
Taiwan man wins lawsuit but gets jailed for using robot vacuum to record wife’s affair - South China Morning Post reports - “A man in Taiwan who used a robot vacuum cleaner to gather evidence of his wife’s affair won a civil lawsuit but was subsequently sentenced to prison for invading her privacy.” … “Three months later, he remotely activated the home’s robot vacuum cleaner via its mobile application, planning to use its built-in audio feature to communicate with his wife.” … “However, the live feed captured his wife in an intimate encounter with another man. Seeking evidence for a legal claim, he began recording the footage.”
Market Incentives
Cyber Insurance at a Crossroads: AI Reshapes Risk as Market Growth Stays Steady - Risk and Insurance reports - “Swiss Re report finds premium growth holding at 5% CAGR even as AI-driven threats and a widening protection gap push insurers to rethink coverage adequacy”
New ABI publications outline path to stronger cyber resilience - Association of British Insurers publishes - “Drawing on insurers’ experience and claims data, it identifies practical measures that can help organisations prevent attacks, reduce harm and recover more quickly when incidents occur.” - comment: evidence bases of control efficacy are valuable - be interesting to understand over time if this is one.
Dispelling the Myth That ‘Cyber Insurance Doesn’t Pay Claims’ - Coalition dispels - “It’s easy to dismiss this myth as ignorance. Cyber insurance pays out billions of dollars in claims every year, and policies provided by Coalition paid more than $315 million in claims in 2025 alone.”
Why Are Rising Cyberattacks Reshaping the Commercial Insurance Market Worldwide? - Imarc Group quantifies - “Cyberattacks specifically are reshaping demand at a pace few other risk categories can match. The average cost of a data breach reached USD 4.88 Million in 2024, up 10% from 2023, and corporate cyber insurance attachment rates among U.S. public companies rose from 47% to 68% between 2021 and 2024 following SEC rules requiring material cyber incident disclosure within 96 hours.” … “Cyber liability insurance is the fastest-growing product line at an estimated 18%+ CAGR (2026–2034), with global cyber premiums projected to exceed USD 35 billion by 2028.”
Reflections this week are around the objective of assuring and ensuring that an agentic AI system will not result in an adverse cyber security outcome in practice.
If we look at the AI challenge at a high level it can be described as the model (within its harness and potentially integrated into a wider system) should do what the human instructed it to do (important: not intended so as to decouple to the second order challenge).
The second order challenges then include but are not limited to:
Model training and algorithmic approaches and alignment
Quality of the human instruction i.e. the input/prompt etc.
Ability to parse, translate/interpret and apply to meet the (human) instruction during the inference/reasoning processes.
Ability to parse, translate/interpret and apply additionally a base set of assumptions/rules (e.g. be legal by the laws of these countries) during the inference/reasoning processes.
Ability to test/verify that a probabilistic/stochastic generated action/sequence/activities/strategy do not deviate from the instruction and the base set of assumptions
Harness quality
Environment controls
Given the variables/complexity of:
Parsing
Translation
Interpretation
Application
Situation specific considerations
… and potentially a much longer list …
With the objective of:
Training a model to be fully aligned to not cause cyber security harm in every situation
Whilst:
Testing in aggregate a collective set of actions over the course of a session and if these actions collectively satisfy the original operator intent and these actions do not violate the base set of assumptions
We can see that this objective appears on the face of it is an inherently exponential challenge (read: costly and complex) across various spoken languages, ambiguities/quality of prompting and inherent properties e.g. the jail break challenge / context windows / drift etc.
This is a long way of saying this is why we do not rely on alignment of a model to be able to constrain adverse AI outcomes in cyber security. In part due to the complexity and significant cost overhead. So whilst alignment clearly should play a role it is also why AI Control Monitors now exist (e.g. models/agents judging other models/agents along with other approaches) and why further controls are also needed for diversity and resilience reasons.
Thus in our advice on Managing the cyber risk of agentic AI and the advice from our Australian counterparts on Careful Adoption of Agentic AI Services we outline what is in reality a number of layered compensating controls … or defence in depth….
We have learnt it is expensive and hard to produce perfect software, hardware and systems for the most part- thus over the course of the last forty/fifty/sixty years have developed various compensations for various failures e.g. formal verification, exploit mitigations, memory safe architectures and languages, logical separation e.g. sandboxes, physical separation e.g. air gaps, logging and monitoring etc.
It is these compensating approaches in aggregate which give us the assurance and the AI era is no different..
Not getting this via email? Subscribe:
Think someone else would benefit? Share:
All attribution is by others and not the UK Government unless specifically stated as such, please see the legal text at the end.
Have a lovely Sunday…
Ollie
Cyber threat intelligence
Who is doing what to whom and how allegedly.
Reporting on Russia
Nothing overly of note this week
Reporting on China
Fire Ant Evolves: From Hypervisors to Trusted Infrastructure
Sygnia Team detail an alleged Chinese operation which is noteworthy due to face the network layer was targeted but also the operational security on show.
First reported in 2025, Fire Ant remained active into 2026, expanding from hypervisor-level compromise into the trusted infrastructure layer that routes, authenticates, connects, and manages high-value environments.
The compromise impacted both the direct and third-party environments. Its trusted infrastructure relationships created potential reachability into connected external environments, including high-value networks and critical infrastructure. Fire Ant appeared to use this trusted position to explore access paths beyond the initially compromised environment. Compromised routers became operational platforms. Fire Ant used router infrastructure for covert connectivity, traffic collection, command-output manipulation, and suppression of logging.
Fire Ant targeted authentication chokepoints. The actor compromised TACACS infrastructure to intercept authentication flows, collect credentials, and weaken confidence in administrative audit trails.
Fire Ant built a resilient access layer. The actor deployed long-lived implants across Linux management infrastructure, including Medusa-related components, custom SSH backdoors, Zabbix-masquerading malware, and packet-triggered backdoors.
Fire Ant manipulated the evidence layer itself. Across routers, TACACS servers, and Linux hosts, the actor modified or bypassed telemetry sources defenders normally rely on, reinforcing the need to validate logs against memory, disk, network, authentication, and configuration evidence.
The investigation began with an anomaly that appeared, at first, to be a configuration inconsistency: a tunnel interface became operational on a Cisco IOS XR router even though no corresponding running configuration or commit history could explain its creation. The interface was associated with a specific VRF and used GRE encapsulation, but standard configuration review did not provide a reliable explanation for how it appeared.
https://www.sygnia.co/blog/fire-ant-evolves-from-hypervisors-to-trusted-infrastructure/
Chinese-Speaking Operator Uses AI Agents to Target Government and Education Systems Across Asia
Hunt.io details the integration of AI into an alleged Chinese workflow. This should not be a surprise but it does serve as an evidence point - also of note is that the vulnerabilities were n-days so this was about scale not novelty for initial access.
Five open directories, one campaign. The exposed directories map to an AI orchestration host, a Java/CAS exploitation workspace, a fake MySQL deserialization service, a Shellshock and credential-testing node, and a payload-distribution store.
AI workers with swappable models. SecFlow split reconnaissance, exploitation, collection, and reporting among specialist workers. The runtime could switch between Claude, Qwen, and DeepSeek profiles without changing the task interface.
Operator infrastructure under one handle. Private niestools.com endpoints proxied model traffic while target-facing requests used authenticated SOCKS relays. The username Nie appears across the model-service namespace and proxy accounts.
Fake MySQL as an initial access vector. The service selected serialized Java objects from the connecting username and directed vulnerable clients to a Linux second stage on 129.211.184[.]149. Delivery logs tie the two workspaces directly.
Eight CVEs in active workflows. Shellshock, Spring4Shell, Ghostcat, Shiro deserialization, Log4Shell, Grafana and Nexus path traversals, and a Nacos authentication bypass.
AI amplified a false positive. An unsupported Shiro success claim carried into later tasks. More than 27 follow-up tests failed, yet workers continued receiving GLUTTON assignments based on the earlier claim.
Confirmed compromises. Fengtai command execution and credential collection, education AI-platform data access, and root database plus Grafana admin access to a university campus-card environment.
https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia
Reporting on North Korea
DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors
Rapid7 Labs details an alleged North Korean operation which shows a degree of sophistication for their edge persistence. Shows the value immutable edge nodes.
A new Linux toolkit, identified by Rapid7 Labs, has been targeting organizations across South Korea’s automotive and media industries with minimal detection. The campaign made use of a HAProxy instance named “ted backdoor”, alongside trojanized versions of crond, agetty, atd, sshd, and polkitd. This previously undocumented framework enabled threat actors to execute remote commands on compromised servers, inject malicious scripts into web traffic, perform credential harvesting, and engage in long-term surveillance.
The standout feature of this toolkit is its depth of integration with the target environment. The ted backdoor is compiled as part of the victim’s existing HAProxy version 2.8.12. It uses its native filter API, internal memory pools, event scheduler, and process management infrastructure to intercept traffic and hide from monitoring, while genuine load balancing traffic operates as expected.
Reporting on Iran
Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set
Omar Amin details a alleged Iranian operation which has surfaced a novel impact. The insights into victimology is also of note.
While monitoring Mirage Kitten activity, we uncovered a previously undocumented malware family that we dubbed NodeRabbit. We identified the first sample on a system in Afghanistan. Further threat hunting revealed two additional, more advanced, variants: one on a system in Egypt and another on a system in Ethiopia.
NodeRabbit is a cross-platform remote access trojan (RAT) built with Node.js. It targets Windows, Linux, and macOS. Its operators deliver it through spear-phishing messages on LinkedIn and other job search platforms that contain trojanized coding challenge archives.
During the same investigation, we discovered another previously undocumented malware family that we dubbed PollCat. Like NodeRabbit, PollCat is a cross-platform RAT, but it is written in obfuscated JavaScript also distributed through trojanized coding challenge archives.
Mirage Kitten has historically relied on native malware written in languages such as C, C++, and Go, often deploying it through DLL search-order hijacking. NodeRabbit and PollCat represent the first publicly documented use of Node.js- and JavaScript-based malware by this APT group.
https://securelist.com/mirage-kitten-new-backdoors-noderabbit-pollcat/121244/
Reporting on Other Actors
ASCII smuggling crosses over from AI prompt injection to phishing evasion
Noam Kochavi and Sarah Wolstencroft detail the AI red teaming community rediscovering previously seen techniques and then playing forward to an AI world. Once again demonstrating what is old is destined to be new again in the cyber security sphere.
Microsoft researchers observed a high-volume phishing campaign using invisible Unicode tag characters, a technique popularized in AI prompt injection research as ASCII Smuggling. Instead of using these characters to hide instructions from people while exposing them to AI models, the attacker used them to split financial lure words such as ‘funding’ to prevent email filters from parsing them.
TerminalFix campaign deploys a reverse tunnel through multistage intrusion
Sagar Patil, Suriyaraj Natarajan and Parasharan Raghavan detail a variant of this technique being used. The improvements which Apple made in macOS around internal instantiation along with copy & paste warnings other can likely learn from.
Microsoft Threat Intelligence has observed a TerminalFix campaign, a variant of ClickFix, targeting organizations across multiple industries. The campaign uses compromised websites to display a fake Cloudflare CAPTCHA verification overlay that tricks users into copying and executing a malicious PowerShell command.
Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams
Unit42 detail this campaign from the start of year which gives a sense of scale both in terms of organisations as also targets per organisation. Should help inform threat models.
Between January and April 2026, we uncovered a coordinated social engineering operation that leveraged external Microsoft Teams accounts to masquerade as IT help desk personnel. Our telemetry reveals that this operation targeted more than 150 employees across at least 10 companies in various industries. We call this activity Spring Ring.
https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/
ValleyRAT masquerading as adware
Pavel Bukhtenko highlights a novel distribution mechanism being used to laydown malware which may result it in being code signed.
a well-known backdoor distributed under the guise of adware. The attackers may have chosen this distribution method because the adware was signed by the developer. On top of that, users often manually add these apps to exclusions, so their useful features don’t get blocked.
https://securelist.com/valleyrat-backdoor-adware/121175/
Gryxa: The AI-Built Toolkit That Watches How You Remove It
ReliaQuest also provides evidence of vibe coding in criminal circles. Of note here however is the the defensive elements of implant to ensure persistence.
ReliaQuest has identified a new toolkit, dubbed “Gryxa,” used by a financially motivated threat actor across 324 listed hosts. We assess that substantial portions were almost certainly built with a commercial AI coding agent, which appears as co-author on most commits in the actor’s public repository. This marks the first time ReliaQuest has observed a threat actor use AI to help build and execute an entire operation to this extent.
After defenders remove the visible remote monitoring and management (RMM) implant, a surviving Gryxa component collects Windows logs and host artifacts and uploads them to the threat actor, so the attacker effectively sees the remediation.
Partial containment triggers countermeasures. If the actor’s relay becomes unreachable, Gryxa attempts to disable and uninstall any endpoint protection agent within roughly 10 minutes.
Contain in the right order: Block the actor’s infrastructure first, then remove every persistence mechanism in one pass.
https://reliaquest.com/blog/threat-spotlight-gryxa-ai-built-toolkit/
Daisy-Chaining Trust: Investigating Faronics Deploy Abuse
Chad Hudson details an campaign where actors are socially engineering to deploy a remote monitoring and management solution along which how to detect etc.
Threat actors are abusing Faronics Deploy, a legitimate endpoint management platform, to execute attacker-controlled PowerShell after phishing victims install the software.
During a one-month period, Huntress saw more than 457 endpoints encountering Faronics-related lures.
In observed cases, threat actors chained Faronics Deploy to ScreenConnect, blending malicious remote access activity into trusted software workflows.
Faronics artifacts, such as
ScriptRunner.logand theckdeployment identifier, may help defenders investigate incidents.
https://www.huntress.com/blog/faronics-deploy-abuse
Software Supply Chain Incursions
A reminder we issued guidance a number of weeks ago in Software supply chain attacks: check your dependencies for software developers
Discovery
How we find and understand the latent compromises within our environments.
vol-rs
Muhammad Daffa ports to Rust - be interesting to see if this gets picked up / promoted due to performance gain.
A port of the Volatility 3 memory forensics framework from Python to Rust. It reads the same memory images, runs the same plugins with the same options, and prints the same output, byte for byte, a good deal faster.
https://github.com/daffainfo/vol-rs
Incident response guide for AWS CloudTrail investigations
Oscar Diaz, Jennifer Paz, and Steve de Vera walk us through this practical guide…
This guide walks you through real-world scenarios, showing you how to analyze CloudTrail events to uncover cross-account unauthorized access, cryptocurrency mining operations, and AI service abuse. You’ll learn the investigative techniques our Security Incident Response Team (SIRT) team uses to handle threats, with practical methodologies you can apply to your own investigations.
Defence
How we proactively defend our environments.
Visa Vulnerability Agentic Harness
Visa release this AI pipeline - interesting the limitations here i.e. there are likely improvements through execution etc. Also note they say - No published accuracy numbers yet. Precision and recall have not been published.
VVAH is Visa’s open-source harness for autonomous vulnerability discovery, remediation, and validation using large language models, built on learnings from Project Glasswing (Anthropic’s initiative for AI-assisted vulnerability research).
VVAH runs as a four-phase pipeline: an S0 static seed plus eleven stages, S1–S11, from code ingest to validated fix. The shipped
default.yamlandfull.yamlprofiles derive that seed from the model;taint.yamluses rules mode, which needs operator-supplied source/sink YAML. The four phases:
Phase 1 — Discovery & Modeling (S1–S3): map the attack surface and build a threat-aware plan.
Phase 2 — Deep Dive & Verification (S4–S6): run multi-lens analysis and adversarial verification to assess likely exploitability.
Phase 3 — Synthesis & Reporting (S7–S9): deduplicate, chain, and emit structured findings (Markdown + SARIF).
Phase 4 — Remediation & Validation (S10–S11): propose candidate fixes and adversarially validate them before adoption.
https://github.com/visa/visa-vulnerability-agentic-harness
Windows 365 – Placing a Cloud PC Under Review
Jörgen Nilsson details this feature which will be of use to operational teams.
There is a feature in Windows 365 called “Place Cloud PC under Review” which allows administrators to create a snapshot of a Cloud PC and export it directly to an Azure Storage Account for forensic analysis. We can place up to 10 Cloud PC’s under review at the same time.
https://ccmexec.com/2026/08/windows-365-placing-a-cloud-pc-under-review/
New Entra role - Entra SOC Identity Responder
Microsoft have introduced this new role which will help contain blast radius in the agentic era.
This is a privileged role. Assign the Entra SOC Identity Responder role to users who need to do the following tasks from the Microsoft Defender portal:
Disable and enable user accounts during active security incidents
Revoke active sign-in sessions for compromised users by invalidating their refresh tokens
Reset passwords for compromised user accounts
Ephemora Cell
Michael Soppa releases this containment approach for AI generated code which provided defence in depth.
Fast, capability-based WASM execution with explicit CPU, memory, time, I/O, and filesystem limits — sub-millisecond warm execution with signed execution records.
Built for AI agents, MCP tools, plugins, code interpreters, and other untrusted workloads.
Agent-generated code is different from application code: it can be buggy, computationally unbounded, unexpectedly expensive — or hostile. The runtime must enforce boundaries, not document them. Every Cell run does:
Enforced, not promised — fuel metering (CPU), memory caps, epoch-based wall-clock timeouts, output caps and I/O budgets are enforced per execution; the effective posture is attested in a signed execution record.
Measured isolation advantage — of the attack vectors that succeed against a stock Docker container (shell, fork, socket, host filesystem, symlink escape, …), all 8 are blocked here (live-verified, script in the repo).
Sub-millisecond warm execution — 0.16 ms guest / 0.46 ms end-to-end (pooled, measured) makes sandboxing every call affordable instead of exceptional.
https://github.com/MichaelS1011/ephemora-cell
Incident Writeups & Disclosures
How they got in and what they did.
Security Incident – BGP Hijacking
Virtualizor detail this incident..
We have confirmed that a malicious Virtualizor update package was delivered to a small number of installations that checked for updates while their traffic was being diverted. This affected a handful of servers rather than the general Virtualizor user base. Because the malicious responses were served by the attacker’s system and never reached our own logs, we cannot produce a definitive list of affected servers, so every Virtualizor operator should carry out the checks in the If you run Virtualizor section.
https://www.virtualizor.com/blog/security-incident-bgp-hijacking/
BGP Horizon provide some further detail..
Between 28 and 30 August 2026, a block of Hetzner address space used by Softaculous and Virtualizor was hijacked. Traffic for those addresses was pulled toward an attacker’s server for roughly 33 hours across two waves. It was also reported that the attacker obtained a technically valid TLS certificate for the affected domains, and that a small number of Virtualizor installations received a malicious update package while their traffic was diverted.
https://bgphorizon.com/blog/virtualizor-bgp-hijack-august-2026
As do Kentik..
This address range included IP addresses used for Softaculous’s software update endpoint as well as its client and billing site. It was a more-specific hijack of the 162.55.0.0/16 normally originated by Hetzner Online (AS24940). The route likely originated with the penultimate AS in the path, NexonHost (AS62390), either through a compromise or a customer who took advantage of gaps in their security.
The hijack also included an AS path with a forged origin. Because the attacker appended 24940 as the rightmost ASN in the path, it was considered RPKI-valid for two reasons: the ROA required the origin to be AS24940 but also because it allowed the prefix length to be anywhere between 24 and 16. As a result, this route was RPKI-valid and would not be at risk of being dropped by ASes that reject RPKI-invalid routes.
https://www.kentik.com/blog/latest-bgp-hijack-targets-hosting-software-vendor/
Update on Security at METR
METR discloses their own incident.
In March 2026, attackers stole an API key for inference on public models and consumed a substantial amount of credits. In May 2026, we observed attackers systematically probing our publicly accessible infrastructure, including an unsuccessful attempt to access internal data via an inadvertently exposed endpoint. Although these incidents had limited consequences, we considered them near-misses, and increased our security investment in response.
https://metr.org/blog/2026-08-31-security-update/
Vulnerability
Our attack surface.
CVE-2026-82329 - Potential authentication bypass leading to administrative access in Artifactory
Patch patch patch..
JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.
SonicWall SMA1000 Series Appliances Affected By Multiple Vulnerabilities
SonicWall further evidencing the business case for vendors to implement our Guidance on digital forensics and protective monitoring specifications for producers of network devices and appliances - for device vendors
A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and perform unauthorized operations..
…
Post-authentication Improper Neutralization of Special Elements used in an OS Command (’OS Command Injection’) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016
From Patch to Exploit; Using Claude Code to reverse engineer a zero-day in Papercut NG
Kev Breen walks through how this worked in practice..
10 prompts, 293 tool calls, 224million tokens, 90 minutes*, one guardrail and Claude Opus was able to take a patch for a zero day, identify 3 critical vulnerabilities and create a full chain proof of concept resulting in unauthenticated code execution on a Papercut NG. Before then finding a bypass for the patches that had been released.
Offense
Attack capability, techniques and trade-craft.
Mythic Ornn
Adrian Medero shows is the future of offensive operations where diversity cost is low for some aspects and elements.
Mythic agents are tedious to write by hand: every one re-implements the same wire protocol, payload-type scaffolding, and C2 plumbing. Mythic Ornn skips the boilerplate by turning the official Mythic developer docs into the retrieval layer of a generation pipeline. An LLM consults a local, pruned copy of those docs and emits agents that match the documented message format out of the box.
https://github.com/n0qword/mythic_ornn
iwa-tools
Pkilla and Michael Zhmaylo release this capability which is of note to threat hunting teams to see if Chrome has been configured to enabled these capabilities.
Chrome has an experimental API called Direct Sockets that gives raw TCP/UDP to “Isolated Web Apps” — signed, installed web apps that live under
isolated-app://<key>/. It exists so people can build things like SSH clients and databases inside the browser without a native shim. It also happens to be perfect for offensive AD tooling.This is a bunch of pentesting utilities on top of that. Everything runs inside a signed
.swbnthat Chrome installs, and speaks SMB / LDAP / DCE-RPC / WinRM / Kerberos / MSSQL / ADWS from a browser tab.
https://github.com/CICADA8-Research/iwa-tools
Similar but apparently unrelated:
https://github.com/Ethan1431/iwa-tools
logtotal-sanitizer
Mykola Zapeka releases this work aid for when shipping logs between organisations with confidence
Framework-agnostic log sanitizer for browsers and Node.js. It’s designed to sanitize log files before they are sent to third-party platforms for processing, analysis, or troubleshooting. The sanitizer redacts secrets, identifiers, and PII and replaces each value with a stable HMAC token to reduce the risk of accidentally exposing sensitive or confidential information contained in logs.
https://github.com/socprime/logtotal-sanitizer
VHF Monitor RF Transmitter (TEMPEST / EMI Side-Channel Morse Generator)
Efe provides a lovely TEMPEST example to highlight the risk.
The VHF Monitor RF Transmitter is a browser-based experimental tool that converts an ordinary computer display into a short-range VHF Morse code transmitter.
Remarkably, this project operates without any radio hardware, RF transmitters, SDRs, or external modems. By controlling the precise pixel output on your screen using an optimized HTML5 Canvas render engine, it manipulates the display’s internal video processing unit (GPU/Scaler) and transmission interfaces (HDMI/DisplayPort) to radiate modulated electromagnetic signals directly through side-channel emissions (TEMPEST).
https://github.com/TA1EEI/vhf-morse-transmitter-monitor
Modern Adventures in Azure Privilege Escalation
Thomas Elling and Karl Fosaaen provide evidence once more cloud complexity continues to challenge the hyper scalers in terms of defence.
Azure ABAC is becoming more common in built-in roles and should be evaluated during privilege escalation mapping.
Mapping techniques to Azure RBAC permissions provides a more thorough review of privilege escalation vectors in both built-in and custom roles.
A specific version of an ARM API endpoint can be used to help map permissions to roles.
Identifying important permissions combined with this API can give a more thorough map of privilege escalation vectors.
This allowed us to discover a built-in role that could have allowed arbitrary privilege escalation to Owner through unconstrained role assignment.
Exploitation
What is being exploited..
PaperCut Actively Exploited: A Pre-Auth RCE Chain
John Hammond and Andrew Brandt detail the in the wild exploitation of this vulnerability.
In an August 27 security advisory, PaperCut said attackers are actively exploiting a pre-authentication remote code execution vulnerability against PaperCut NG and PaperCut MF, with confirmed customer incidents.
Huntress has found evidence of exploitation in two customer environments. Observed activity focused on system discovery. We have not observed secondary malware, further command-and-control traffic, or additional persistence or post-exploitation from the recovered payload.
Huntress reproduced a full pre-authentication RCE chain against a vanilla PaperCut NG
25.0.11.75758server. We have reached out to PaperCut to coordinate with them on continued vulnerability analysis.
https://www.huntress.com/blog/papercut-actively-exploited
Tooling and Techniques
Low level tooling and techniques for attack and defence researchers
VRIG - Fuzzillai
Zia (Kamdin), Dudcom (Tanush) and Oleg bring industrial AI augmented fuzzing to V8.
Fuzzillai was a research endeavor by the Vulnerability Research Interest Group (VRIG) at RIT during the 2025-26 school year. We modified Fuzzilli to expose V8 feedback-vector and optimization-pipeline signals, built a PostgreSQL-backed distributed fuzzing infrastructure, integrated three multi-agent systems for template generation, crash analysis, and plateau recovery, and tested adaptive mutator scheduling through Thompson Sampling.
https://blog.ritsec.club/posts/vrig-fuzzillai/
Lych
Rabindra K. M releases a novel operating system which due to its memory safety properties will be of interest to some.
Lych is an open-source ARM64 operating system written in Rust. This repository contains the kernel, the platform bootstrap code, and the tooling and documentation needed to build, run, and debug the system.
The kernel is developed in self-contained subsystems — boot, exception handling, memory management, and, as development continues, timing, processes, userspace, and drivers. Each subsystem belongs to a documented phase and is kept small enough to follow and structured enough to extend.
https://github.com/rabindra789/lych
Everything I own, owned
Chaz Schlarp shows what AI applied can do in achieving persistence on embedded devices.
My process was pretty much the same for each of these devices: grab a copy of the device’s firmware and associated update tool from the manufacturer, throw it into my reverse engineering environment, tell Claude Opus 5 what my goals are, and let it churn.
https://schlarp.com/posts/everything-i-own-owned/
Adopting Memory-Safety and Fine-Grained Compartmentalisation with CHERI
David Chisnall shows why CHERI is so valuable as an approach..
David Chisnall discusses how the CHERI hardware architecture redefines pointer safety to solve isolation and sharing challenges. He explains how CHERI enables spatial and temporal memory safety for C/C++, scales down to microcontrollers with CHERIoT, and replaces costly OS-level RPC mechanisms with lightweight, auditable compartmentalization - all without requiring massive codebase rewrites.
https://www.infoq.com/presentations/cheri-memory-safety-compartmentalization/
How Forza Horizon 6 Breaks Your IDA
Radulf details how a Forza Horizon attempts to break IDA..
What we notice here is, that this function, creates a mutex named
$ IDA registry mutex $and performs WaitForSingleObject withINFINITEas second parameter. This is most likely for synchronizing and protecting registry when multiple IDA instances launch at the same time. The mutex is something that is supposed to be held for a very short amount of time. So, what exactly breaks?That’s when I wondered whether the game could take advantage of this unbounded wait. I found out, that the game creates both named objects as NT mutants with InitialOwner=TRUE, performs another zero-timeout recursive wait on each, marks their handles as protected from closing, and retains those handles. System Informer also shows the handles in the game’s handle table. While the game retains ownership, affected IDA instances block indefinitely when they attempt to acquire the same objects.
https://iretq.com/how-forza-horizon-6-breaks-your-ida/
Footnotes
Some other small (and not so small) bits and bobs which might be of interest.
Annual, quarterly and monthly reports
Nothing overly of note this week, but keep an eye on the Awesome Annual Security Reports 2026 collection and APT report collection
Telecom Argentina’s View of Autonomous Networks and the Road to Level 4
Rethinking Vulnerability Remediation as a Capacity Allocation Problem
Artificial intelligence
if you are a big arxiv.org user - out of China there is alphaxiv.org which is an AI powered incarnation / overlay
Fundamental
Applied non-cyber
Applied cyber specific
A SoK for SoCs: Reading the TI Leaves on AI for Cyber Threat Intelligence Generation and Sharing
SENTINEL-RL: Offloading Topological Reasoning from LLM Agents in the Security Operations Center
CodePoisonRAG: Knowledge Poisoning Attacks on Retrieval-Augmented Code Generation
Towards Behavior Tree-Guided Vulnerability Detection with Lightweight LLMs
JITterFlip: Uncovering Fault Attack Surfaces in JIT-Compiled LLM Serving
Books
Nothing overly of note this week
Events
Nothing overly of note this week
Video of the week Linux in the Land of LLM
Finally finally the NCSC’s podcast series.
Unless stated otherwise, linked or referenced content does not necessarily represent the views of the NCSC and reference to third parties or content on their websites should not be taken as endorsement of any kind by the NCSC. The NCSC has no control over the content of third party websites and consequently accepts no responsibility for your use of them.
This newsletter is subject to the NCSC website terms and conditions which can be found at https://www.ncsc.gov.uk/section/about-this-website/terms-and-conditions and you can find out more about how will treat your personal information in our privacy notice at https://www.ncsc.gov.uk/section/about-this-website/privacy-statement.