Tag: network
-
Government Linux Servers Targeted With SysGoRAT and Suspected AI-Generated Scripts
Cybersecurity researchers have disclosed details of a cyber espionage campaign specifically targeting Linux infrastructure associated with government entities and state-affiliated infrastructure.The activity, observed by Palo Alto Networks Unit 42 between October 2025 and April 2026, has been tracked under the moniker CL-UNK-1211, where “CL” refers to cluster and “UNK” stands for unknown First seen on…
-
Hackers Weaponize Open-Source CyberStrikeAI Framework to Launch AI-Powered Network Intrusions
Hackers are abusing CyberStrikeAI, an open-source penetration-testing framework, to orchestrate network intrusions against educational organizations across Africa and Latin America. The findings illustrate AI moving beyond attack preparation into operational decision-making. Published November 2, Kaspersky’s investigation describes a human-directed operation in which an LLM selects tools, generates commands, interprets results, and determines subsequent actions. The…
-
The first ten lines of a command policy for AI coding agents
In this Help Net Security interview, Vinay Thakker, CTO of KloudStax, explains how to set identity, credentials, and network limits for AI agents. He argues that agents should … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/11/02/vinay-thakker-kloudstax-ai-agent-access-control/
-
Hackers Weaponize ARTEX AI Agents to Automate Network Intrusions and Steal Sensitive Data
Threat actors are weaponizing ARTEX, an autonomous penetration-testing framework, to accelerate network intrusions, escalate privileges, and steal sensitive information. Google Threat Intelligence Group and Mandiant investigations described in the supplied report show attackers delegating substantial portions of post-compromise operations to coordinated AI agents, compressing execution sequences into seconds. Observed since late August 2026, the activity…
-
Hackers Weaponize ARTEX AI Agents to Automate Network Intrusions and Steal Sensitive Data
Threat actors are weaponizing ARTEX, an autonomous penetration-testing framework, to accelerate network intrusions, escalate privileges, and steal sensitive information. Google Threat Intelligence Group and Mandiant investigations described in the supplied report show attackers delegating substantial portions of post-compromise operations to coordinated AI agents, compressing execution sequences into seconds. Observed since late August 2026, the activity…
-
Ransomware gang talked AI agents into doing much of its dirty work
The group behind the Aur0ra ransomware has been using AI agents to move through victim networks, collect credentials and work its way up to domain administrator access, … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/11/02/aur0ra-ransomware-ai-agents/
-
Critical Incus and LXD Vulnerabilities Allow Unauthenticated Attackers to Gain Full Cluster Access
Critical certificate-validation vulnerabilities have been identified in Incus and Canonical LXD, allowing unauthenticated attackers to impersonate trusted identities and compromise management infrastructure. Exploitation of these vulnerabilities requires network access to the HTTPS listener but does not require valid credentials or the private key for a trusted certificate. This LXD vulnerability may expose entire clusters and…
-
Critical Incus and LXD Vulnerabilities Allow Unauthenticated Attackers to Gain Full Cluster Access
Critical certificate-validation vulnerabilities have been identified in Incus and Canonical LXD, allowing unauthenticated attackers to impersonate trusted identities and compromise management infrastructure. Exploitation of these vulnerabilities requires network access to the HTTPS listener but does not require valid credentials or the private key for a trusted certificate. This LXD vulnerability may expose entire clusters and…
-
CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key
A critical flaw in Canonical’s LXD and MicroCloud let an attacker log in as a trusted client without holding that client’s private key. To do it, the attacker had to reach their HTTPS API over the network and have the trusted client’s public certificate.Once in, the attacker would act as that client, with access to…
-
Hackers Exploit PHP2Shell RCE Vulnerabilities to Gain Root Access on Palo Alto Firewalls
Attackers have chained critical PHP2Shell vulnerabilities with the Fragnesia Linux kernel flaw to gain root access on Palo Alto Networks PAN-OS systems. The campaign reportedly compromised 24 internet-facing firewalls before reaching an internal firewall management server, bringing the total to 25 compromised systems. Hunt.io’s investigation cites Dream Research’s campaign analysis and describes a transition from…
-
Cloudflare Reports 18.2 Million Network-Layer DDoS Attacks in Q3, Up 38%
Threat actors are launching about 8,226 network-layer distributed denial-of-service (DDoS) attacks per hour, Cloudflare revealed Thursday.The web infrastructure and security company said it autonomously mitigated 18.2 million network-layer (L3) DDoS attacks and 14.4 trillion HTTP DDoS requests in the third quarter of 2026. That amounts to 197,400 attacks per day, or one attack every 0.44…
-
Cloudflare Reports 18.2 Million Network-Layer DDoS Attacks in Q3, Up 38%
Threat actors are launching about 8,226 network-layer distributed denial-of-service (DDoS) attacks per hour, Cloudflare revealed Thursday.The web infrastructure and security company said it autonomously mitigated 18.2 million network-layer (L3) DDoS attacks and 14.4 trillion HTTP DDoS requests in the third quarter of 2026. That amounts to 197,400 attacks per day, or one attack every 0.44…
-
Palo Alto Networks firewalls compromised in chained attacks using PHP2Shell
The AI-enabled campaign hit two dozen targets, including sites linked to the U.S. government. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/palo-alto-networks-firewalls-compromised-chained-attacks-php2shell/873323/
-
Hackers Target Asian Governments With New NetamLoader Malware Hidden in Windows Update Files
Kaspersky researchers have uncovered NetamLoader, a .NET loading framework built on XAML markup. It appears to be a supply-chain attack on a customized Windows build used only by Asian government bodies. No known APT group has been linked to it. NetamLoader malware Kaspersky Security Network flagged a .config file that used AppDomainManager injection to load…
-
SS7 and Diameter Attacks: How Signaling Flaws Expose Your Phone
Flaws in SS7 and Diameter signaling protocols can allow attackers to track phone locations, intercept calls and SMS verification codes, and impersonate subscribers without compromising their devices. Cape explains how these attacks exploit trust between networks and how its security-focused mobile service helps defend against them. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/ss7-and-diameter-attacks-how-signaling-flaws-expose-your-phone/
-
Cloudflare DDoS Report Shows 18.2 Million Network Attacks in Q3 2026
The Cloudflare DDoS report Q3 2026 reveals 18.2M network attacks, a 208% surge in short-burst floods, and a major shift toward DNS and UDP attacks. First seen on securityonline.info Jump to article: securityonline.info/cloudflare-ddos-report-q3-2026/
-
Trezor Warns of Suspected Hardware Implant in One of Its Wallets Sold by CryptoBilis
A Trezor Safe 5 hardware wallet bought from the reseller CryptoBilis has an extra circuit board that sends out the recovery phrase over a mobile network, a customer has reported.Trezor has not yet examined the device. It is telling everyone who bought a Trezor from CryptoBilis since March 2026 to move their funds to a…
-
Fake Polymarket Scam Network Claims Nearly $11 Million in Cryptocurrency Deposits
Russian-language >>traffer<< teams are selling ready-made fake prediction-market platforms to affiliates. One of them, AtlasCore, claims about $10.97 million in victim deposits. Recorded Future's Insikt Group tracked the campaigns, which impersonate sites like Polymarket and Kalshi. The deposit figures come from the threat actors themselves and are unverified. Fake Polymarket scam Since spring 2026, AtlasCore,…
-
Chinese Actor Compromises US Government Network Via Chained PHP2Shell Exploit
Dream found that a suspected Chinese-nexus actor gained root access to Palo Alto Network firewall servers to target government organizations First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/chinese-us-government-chained-php2/
-
New Kairos DDoS Botnet Hijacks Linux Devices to Overwhelm Servers With Thousands of TCP Connections
Nozomi Networks Labs has documented Kairos, a previously undocumented Go-based DDoS bot for Linux. It turns compromised Linux devices into attack nodes that exhaust a victim’s connection capacity with thousands of idle TCP sessions. Kairos DDoS botnet Honeypot telemetry captured three Kairos builds. They differ only in the hard-coded C2 address and the Go compiler…
-
Hackers Launch Over 18 Million DDoS Attacks in Three Months, Cloudflare Reports
In the third quarter of 2026, Cloudflare successfully mitigated 18.2 million network-layer distributed denial-of-service (DDoS) attacks. This increase indicates a trend among attackers who now favor short, frequent disruptions over large traffic floods. Compared to the same quarter in 2025, this represents a significant 208% rise in the frequency of attacks across Cloudflare’s network. Published…
-
Accenture Employee Allegedly Gave Claude Code AI Agent Administrative Access to Pentagon Systems
An Accenture employee reportedly linked a personal Claude Code account to a secure Department of Defense production environment, granting the AI coding agent administrative access and potentially exposing credentials and sensitive network information to an external service. According to WIRED’s investigation, published October 29, the agent operated on the Pentagon network for approximately two months…
-
Accenture Employee Allegedly Gave Claude Code AI Agent Administrative Access to Pentagon Systems
An Accenture employee reportedly linked a personal Claude Code account to a secure Department of Defense production environment, granting the AI coding agent administrative access and potentially exposing credentials and sensitive network information to an external service. According to WIRED’s investigation, published October 29, the agent operated on the Pentagon network for approximately two months…
-
Critical UEFI Flaw Exposes Systems to Pre-Boot Attacks
Attackers Can Exploit ICMP Error Handling Before Operating System Protections Load. A critical buffer overflow in TianoCore’s EDK II UEFI firmware, tracked as CVE-2026-97631, could let unauthenticated attackers execute code during PXE network boot before OS security checks begin, exposing systems to pre-boot compromise despite an upstream source fix. First seen on govinfosecurity.com Jump to…
-
FireMon CEO Jody Brazil On Why ‘You Can’t Out-Patch’ Attackers In The AI Era
The acceleration of cyberattacks driven by increasingly powerful AI models is providing a major resurgence in the importance of network security”, and creating a massive opportunity for solution providers to help protect their customers against threats that patching can’t address on its own, according to FireMon CEO Jody Brazil. First seen on crn.com Jump to…
-
Volt Typhoon targeted enterprise control planes via ever-changing >>Silent Train<< relay network
Volt Typhoon, a Chinese state-sponsored APT group that’s focused on cyberespionage and United States’ critical infrastructure, has been using a covert, constantly … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/29/volt-typhoon-silent-train-relay-network/
-
Cisco Talos Uncovers KeyDrift Malware Targeting SD-WAN Controllers to Steal Network Encryption Keys
Tags: access, cisco, communications, control, cyber, defense, encryption, framework, malware, network, service, technology, threatUAT-11473, an advanced persistent threat actor deploying KeyDrift, a custom malware framework targeting Cisco Catalyst SD-WAN controllers. The framework embeds inside legitimate control-plane processes to maintain access, intercept decrypted communications, and extract sensitive network encryption material. Observed targets span space and satellite services, defense and aerospace technology, and policy research. Talos assesses with high confidence…
-
Volt Typhoon Used Silent Train to Hide Zero-Day Attacks
Volt Typhoon used disposable relay chains to hide zero-day attacks on critical systems. Lumen linked Silent Train to at least four zero-days. Lumen’s Black Lotus Labs has spent three years tracking a covert network it calls Silent Train, which it ties to Volt Typhoon, the China-linked APT group. The cybersecurity firm says the network hid…
-
Volt Typhoon Hackers Exploit Multiple Zero-Days to Breach U.S. Critical Infrastructure Networks
Tags: access, breach, china, cyber, data-breach, exploit, framework, group, hacker, hacking, infrastructure, network, vulnerability, zero-dayChinese state-sponsored hacking group Volt Typhoon has exploited multiple previously unknown vulnerabilities in enterprise management platforms to penetrate strategically significant organizations. Its investigation exposed Silent Train, a covert access framework built from rapidly rotating chains of compromised devices. Over three years, Black Lotus Labs issued hundreds of victim notifications, helping investigations uncover four confirmed zero-day…
-
Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces
Palo Alto Networks on Wednesday warned that threat actors are exploiting the recently patched PHP2Shell vulnerabilities against publicly-accessible management interfaces.”Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet,” the network security company said in an update to its advisory.The vulnerabilities, tracked as First seen on thehackernews.com Jump to…