Tag: attack
-
U.S. Agencies: AI-Based Attacks Threaten Water, Manufacturing, Other CI Sectors
CISA, the EPA, and other U.S. agencies are warning that unnamed threat groups are using AI to help breach Siemens S7 Series PLCs in attempts to attack critical infrastructure systems in such sectors as water, agriculture, manufacturing, and chemicals. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/08/u-s-agencies-ai-based-attacks-threaten-water-manufacturing-other-ci-sectors/
-
ToxicPanda 2.0 and GoldDigger Expand Android Banking Attacks with On-Device Fraud
Cybersecurity researchers have shed light on an updated version of ToxicPanda (aka TgToxic) that comes with “significant enhancements,” including a set of 167 remote commands and expands its targeting footprint globally.Zimperium zLabs, in a Wednesday report, said the Android malware also features a PIN harvesting workflow targeting more than 140 banking and cryptocurrency applications. First…
-
ICS Operators Warned of AI-Driven Attacks on Siemens PLCs
A US government advisory warned that attackers are deploying AI-generated exploitation scripts against exposed Siemens S7 Series PLCs First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/ics-ai-attacks-siemens/
-
Critical Zimbra RCE flaw now actively exploited in attacks
CERT Polska, the Polish Computer Emergency Response Team (CERT), warned that attackers have begun exploiting a critical vulnerability in Zimbra Collaboration Suite (ZCS). First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/critical-zimbra-rce-flaw-now-actively-exploited-in-attacks/
-
UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations
Cisco Talos discovered a Chinese-speaking cybercrime group, tracked as UAT-10147, that targets a wide range of vulnerable web servers. This is an overview of the campaign, examining the countries affected, potential impact of BadIIS infections, the attack chain, and post-compromise tactics. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/
-
Geopolitical DDoS Attacks: What Cybersecurity Teams Need to Know
Geopolitical tensions are increasingly spilling into the cyber domain, with DDoS attacks becoming a common form of retaliatory hacktivism. Unlike financially motivated attacks, these campaigns can be triggered by events such as military escalation, elections, sanctions, or other geopolitical developments”, and can begin within hours. For security teams, the challenge is not only understanding who…
-
US agencies warn of AI-powered attacks on Siemens industrial controllers
Threat actors are using AI to write exploit scripts targeting internet-exposed Siemens S7 Series programmable logic controllers (PLCs) used across water, energy, … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/08/20/usa-ai-attacks-siemens-s7-plcs-critical-infrastructure/
-
CyberPanel Pre-Auth RCE Flaws Let Attackers Gain Remote Server Access
Tags: access, ai, attack, authentication, cve, cyber, data-breach, flaw, Internet, jobs, rce, remote-code-execution, vulnerabilityResearchers have revealed a pre-authentication remote code execution (RCE) vulnerability chain in CyberPanel that could allow an internet-based attacker to execute commands on vulnerable servers without any credentials. This attack combines exposed AI Scanner interfaces, an authentication flaw tracked as CVE-2026-41473, stored cross-site scripting (XSS) tracked as CVE-2026-41472, and CyberPanel’s built-in cron-job functionality. CyberPanel is…
-
CyberPanel Pre-Auth RCE Flaws Let Attackers Gain Remote Server Access
Tags: access, ai, attack, authentication, cve, cyber, data-breach, flaw, Internet, jobs, rce, remote-code-execution, vulnerabilityResearchers have revealed a pre-authentication remote code execution (RCE) vulnerability chain in CyberPanel that could allow an internet-based attacker to execute commands on vulnerable servers without any credentials. This attack combines exposed AI Scanner interfaces, an authentication flaw tracked as CVE-2026-41473, stored cross-site scripting (XSS) tracked as CVE-2026-41472, and CyberPanel’s built-in cron-job functionality. CyberPanel is…
-
Detecting DCSync attacks using directory replication event logs
DCSync is one of the more important identity abuse techniques to understand if you run Active Directory. It does not rely on malware on the domain controller itself, and it can be carried out using legitimate directory replication interfaces if an attacker has the right permissions. That makes it especially relevant for defenders who want……
-
Security Analytics in NetFlow Analyzer: Spot Behavioral Threats Early Respond With Context
Your network is already being mapped. You just can’t see it yet. Modern attacks don’t make a sound. They don’t kick down the door. They find an unlocked window, slip through, and spend weeks quietly mapping your network before making a move. By the time your monitoring tool fires an alert, the attack is already..…
-
Rogue ransomware affiliate poses as recovery firm to steal payments
A suspected ransomware affiliate is posing as a ransomware recovery service called “Ransom Busters,” contacting the victims before the attacks become public and claiming to be able to provide decryption keys and delete stolen data for a fee. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/rogue-ransomware-affiliate-ransom-busters-poses-as-recovery-firm/
-
Rogue ransomware affiliate poses as data recovery firm to steal payments
A suspected ransomware affiliate is posing as a ransomware recovery service called “Ransom Busters,” contacting the victims before the attacks become public and claiming to be able to provide decryption keys and delete stolen data for a fee. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/rogue-ransomware-affiliate-ransom-busters-poses-as-data-recovery-firm/
-
AI-backed campaign targeting vulnerable Siemens S7 devices, CISA and FBI warn
Hackers are developing scripts disguised as legitimate software in attacks aimed at multiple industries, including energy and water. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/ai-hackers-siemens-s7-devices-cisa-fbi/828321/
-
The ‘Industrial Accidents’ Behind Rogue AI Agent Attacks, and the Sandbox Failures Exposed
Rich Mogull, chief analyst with the Cloud Security Alliance, joins the Dark Reading News Desk with what defenders need to take away from AI agents escaping their environments to launch attacks. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/industrial-accidents-rogue-ai-agent-attacks-sandbox-failures
-
AI-fueled attacks pose ‘active threat’ to water, other sectors, U.S. agencies warn
The agencies said the hackers are taking aim at Siemens S7 Series programmable logic controllers in what could be a first. First seen on cyberscoop.com Jump to article: cyberscoop.com/hackers-use-ai-target-siemens-plcs-critical-infrastructure/
-
Cloudflare Workers Spectre Attack Leaks JWT From Co-Located Worker at 12 Bits/Second
Cybersecurity researchers have disclosed details of a remote Spectre attack against Cloudflare Workers that leaked a JSON Web Token (JWT) from a co-located Worker in the production environment at up to 12 bits per second, 360 times the rate of an earlier attack demonstrated in 2021.The end-to-end experiment used an attacker Worker and a victim…
-
Bluesky Hit by Second Major DDoS Attack in Months
Bluesky suffered its second major DDoS attack in months, causing hours of disruption as a threat group claimed responsibility for the outage. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/news-bluesky-second-ddos-attack-outage/
-
Microsoft Links More Than 30 Domains to MacSync Stealer
Microsoft linked more than 30 rotating domains to MacSync Stealer by correlating endpoint and network behavior across the malware’s attack chain. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/news-microsoft-macsync-stealer-30-domains/
-
US warns of AI-powered attacks on Siemens PLCs in critical infrastructure
U.S. cybersecurity agencies warn that threat actors are using AI-generated scripts to exploit Siemens S7 Series programmable logic controllers (PLCs) in U.S. critical infrastructure. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/us-warns-of-ai-powered-attacks-on-siemens-plcs-in-critical-infrastructure/