Tag: threat
-
China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE
A Chinese threat actor has been attributed to a spear-phishing campaign that exploits recently patched security flaws in Google Chrome and Microsoft Windows to deliver a malicious JavaScript backdoor called GRIMWEDGE.Volexity, which is tracking the threat cluster under the moniker UTA0560, said the activity targeted multiple non-governmental organizations (NGOs) on September 1, 2026.”The First seen…
-
China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE
A Chinese threat actor has been attributed to a spear-phishing campaign that exploits recently patched security flaws in Google Chrome and Microsoft Windows to deliver a malicious JavaScript backdoor called GRIMWEDGE.Volexity, which is tracking the threat cluster under the moniker UTA0560, said the activity targeted multiple non-governmental organizations (NGOs) on September 1, 2026.”The First seen…
-
No UK Regulators Can Stop Risky AI Models, Panel Warns
Lawmakers Find AI Security Institute Has No Power to Compel or Block Model Releases. British lawmakers are calling for new legislation to address the threat AI may pose to human rights, including demands that the riskiest systems clear regulatory hurdles before deployment – and warning that no U.K. regulator can currently stop a model from…
-
‘Sandworm’ Chains Cisco Vulnerabilities to Deploy Cyclops Blink
The notorious Russian threat group is spreading an upgraded version of the botnet malware, which the FBI disrupted in 2022. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/sandworm-chains-cisco-vulnerabilities-cyclops-blink
-
Iran, Yemeni Cell Used Claude in Developing Weapons, Threats: Anthropic
An Iranian-sponsored threat group and a likely Houthi engineering cell used Anthropic’s Claude and other AI tools to gather information on U.S. naval operations and to develop software for missile systems. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/iran-yemeni-cell-used-claude-in-developing-weapons-threats-anthropic/
-
3BB Attacker Used MeshCentral Backdoor for Root Access, Targeted Subscriber Credentials
An attacker was operating inside the network of 3BB, one of Thailand’s largest broadband providers, and maintained remote control of internal machines using a legitimate management tool called MeshCentral, threat intelligence firm Hunt.io said.The company uncovered the intrusion by examining a server the attacker had left open on the internet, which held the attacker’s own…
-
Red Heron Exploits Gitea RCE to Compromise 13 Organizations Across Six Countries
A Chinese threat actor tracked as Red Heron has been attributed to the rapid exploitation of a recently disclosed security vulnerability in Gitea to compromise internet-facing instances as part of a multi-national campaign.”Red Heron scanned 1,386 Gitea instances across seven countries and maintained a separate dataset of 477 Taiwan-based systems,” Acronis Threat Research Unit (TRU)…
-
Using AI for Weapons Development
Last week, Anthropic released a long and detailed document describing current misuses of their Claude models. I’m still reading it, but I wanted to flag this: We identified a cell of threat actors based in northern Yemen running three weapons… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/using-ai-for-weapons-development/
-
Red Heron nutzt kritische Gitea-Lücke für internationale Cyberangriffe
Die Acronis Threat Research Unit hat eine internationale Angriffskampagne auf öffentlich erreichbare Gitea-Server aufgedeckt. Die Gruppe Red Heron automatisierte die Ausnutzung einer kritischen Schwachstelle, um Quellcode, Zugangsdaten und interne Konfigurationen zu stehlen. Im Visier standen unter anderem Organisationen aus dem Energie- und Industriesektor sowie Systeme mit Bezug zu Wahlen. Ein neu entdecktes Linux-Rootkit ermöglichte den…
-
SpiderSilk Hunts External Threats With AI-Based Scanner
The Dubai-based threat detection startup uses artificial intelligence tools to scan billions of IP addresses to find exposed assets, leaked data, and zero-day vulnerabilities. First seen on darkreading.com Jump to article: www.darkreading.com/endpoint-security/spidersilk-hunts-external-threats-ai-scanning
-
Cyber Threat Landscape: Real Attack Alerts and Recent Incidents
The Current Threat PictureThe supplied Seceon overview presents a clear picture of a modern enterprise threat landscape. Credential attacks, suspicious cloud authentication, VPN brute force, data-loss events, and major external campaigns can occur alongside one another. The most important operational… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/cyber-threat-landscape-real-attack-alerts-and-recent-incidents/
-
Hackers Exploit Maximum Severity Flaw in GitLab
CISA warns that threat actors are exploiting a vulnerability with a CVSS score of 10.0 First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/hackers-exploit-maximum-severity/
-
Revolut discloses data breach exposing financial info, passports
Fintech company Revolut has disclosed a data breach after sharing data from an undisclosed number of customers with a threat actor impersonating a government agency. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/revolut-discloses-data-breach-exposing-financial-info-passports/
-
China-Linked Hackers Exploit Sogou One-Click RCE to Deploy GRAYRABBIT Backdoor
China-linked threat actors tracked as UNC3569 have exploited a critical one-click remote code execution vulnerability in Tencent’s Sogou Input Method for Windows to deploy the GRAYRABBIT backdoor on targeted systems. Tracked as CVE-2026-51990, the vulnerability chains an insecure custom protocol handler, unrestricted embedded-browser navigation, and an obsolete Chromium build running without sandbox protections. Tencent addressed…
-
Hackers exploit Tencent app flaw to deploy GrayRabbit malware
Threat actors linked to a China-aligned espionage group are exploiting a critical vulnerability (CVE-2026-51990) in Tencent’s Sogou Input Method for Windows to deploy the GrayRabbit backdoor. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-exploit-tencent-app-flaw-to-deploy-grayrabbit-malware/
-
Purple-team validation of detections against MITRE ATTCK
Purple-team validation is the practical bridge between a threat model and a detection that actually works in production. For UK SMEs, it is one of the most useful ways to answer a simple question: if an attacker uses a known… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/purple-team-validation-of-detections-against-mitre-attck/
-
China-Linked Hackers Chain Chrome Zero-Day With Windows Kernel Flaw in Attacks
China-linked threat actors UTA0560 and JungleBamboo chained a Google Chrome zero-day with a Windows kernel privilege-escalation flaw in phishing campaigns targeting NGOs and other victims. Volexity documented the operations, detected on September 1, 2026, as using identical browser-to-kernel exploit components but ultimately installing separate espionage payloads: the GRIMWEDGE JScript backdoor and the LONGTALE credential-stealing Chrome…
-
Threat Actors Use Claude AI Agents to Automate Cyberattacks and Steal Sensitive Data
Threat actors are increasingly using Claude-based AI workflows to automate cyberattacks, accelerate data theft, and reduce the technical expertise needed to run complex intrusions. Anthropic’s report details cyber espionage, financially motivated extortion, supply-chain compromise, and hacktivist activity disrupted between December 2025 and August 2026. Rather than using an AI chatbot only for occasional coding assistance,…
-
Your AI Keys Are The Loot Now
Anthropic published its September 2026 threat intelligence report this week. It runs 154 pages and documents activity disrupted between December 2025 and August 2026 across seven harm areas, from state espionage to weapons development to a network of fake dating… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/your-ai-keys-are-the-loot-now/
-
Anthropic Says AI Is Lowering the Bar for Sophisticated Attacks
Threat Report Finds Multi-Agent Tools Let Less-Skilled Actors Scale Complex Operations. Anthropic’s Threat Intelligence team identified a series of attempted attacks using its AI systems by malicious actors. The report focuses not on how fast AI systems develop exploits at scale, but on how broader, deeper attacks can emerge with just a few resources. First…
-
Anthropic Says AI Is Lowering the Bar for Sophisticated Attacks
Threat Report Finds Multi-Agent Tools Let Less-Skilled Actors Scale Complex Operations. Anthropic’s Threat Intelligence team identified a series of attempted attacks using its AI systems by malicious actors. The report focuses not on how fast AI systems develop exploits at scale, but on how broader, deeper attacks can emerge with just a few resources. First…
-
Anthropic Says AI Is Lowering the Bar for Sophisticated Attacks
Threat Report Finds Multi-Agent Tools Let Less-Skilled Actors Scale Complex Operations. Anthropic’s Threat Intelligence team identified a series of attempted attacks using its AI systems by malicious actors. The report focuses not on how fast AI systems develop exploits at scale, but on how broader, deeper attacks can emerge with just a few resources. First…
-
Hackers abused Claude to extract secrets from 1.8M Android apps
Anthropic says multiple threat groups, including the financially motivated and state-sponsored espionage groups linked to Russia and China, tried to abuse its Claude AI model for malicious purposes. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-abused-claude-to-extract-secrets-from-18m-android-apps/
-
Threat Actor Generates 1M Personalized Fraud Emails in 3 Days
Cybercriminals behind malicious email campaigns no longer have to compromise volume for credibility, or vice versa, thanks to AI. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/1m-personalized-fraud-emails-3-days
-
Surface SaaS and AI Threats
Surface SaaS and AI Threats Know who has access to your data before attackers do. CHALLENGE Threat actors target new attack vectors every day. Every SaaS and AI app your organization adopts expands your attack surface. Threats such as stolen… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/surface-saas-and-ai-threats/
-
Microsoft sees some new wrinkles in invoice-scam emails
Researchers analyzed a flood of fraudulent business emails and found that the threat actors had doubled-up on tactics to make them appear legitimate, including help from AI. First seen on therecord.media Jump to article: therecord.media/invoice-scam-emails-new-features-microsoft-researchers
-
Artifactory flaws chained in attacks deploying backdoor malware
Threat actors are exploiting critical and high-severity vulnerabilities in JFrog Artifactory to bypass authentication, gain administrative privileges, and deploy a Rust backdoor on vulnerable self-hosted servers. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/artifactory-flaws-chained-in-attacks-deploying-backdoor-malware/