Cyberattacks (8)

The Cl0p ransomware gang has publicly named more than 40 organizations it claims to have breached through a vulnerability in PTC's Windchill and FlexPLM platforms. The flaw, CVE-2026-12569, allows unauthenticated remote code execution and was added to CISA's KEV catalog in June after active exploitation began.

High-profile alleged victims include Shell, Philips, Fiserv, Zebra Technologies, Ingersoll Rand, and Apple lens supplier Largan Precision. GE was listed but has been removed from C10p's website— possibly signaling ransom negotiations. Stolen data ranges from 1 GB to several terabytes per organization, covering databases, engineering blueprints, and corporate documents. None of the named companies have confirmed a significant breach.

Source: SecurityWeek

A Gambit Security report has revealed one of the most detailed real-world cases of AI being weaponized inside an active ransomware operation. A suspected affiliate of The Gentlemen ransomware-as-a-service group used Anthropic's Claude Code to breach VPN appliances, steal domain credentials, and exfiltrate SQL databases across at least eight organizations — including an Australian energy utility and a Mauritius financial firm.

The attacker used Claude Sonnet 4.6, an older, less-restricted model, interactively refining commands based on live output. Claude executed a sophisticated LDAP pass-back attack, created hidden backdoor VPN accounts, and ranked databases by business value before dumping them. At one point, Claude accidentally knocked a firewall offline, then logged: "Yeah, I screwed up."

This marks a clear shift — AI isn't just drafting phishing emails anymore. It's running live attacks.

Source: Cybersecurity News

U.S. agencies including the NSA, CISA, FBI, and the Energy and Environmental Protection Agency issued a joint warning Wednesday about hackers using AI-generated scripts to attack critical infrastructure — water, food, energy, chemical, and manufacturing sectors.

The attackers are targeting Siemens S7 Series programmable logic controllers, using AI to rapidly develop exploitation tools that once required significant technical skill. The agencies called it an "active threat," not a theoretical one. Attacks could disrupt industrial processes, trigger safety incidents, or expose sensitive data.

Experts flagged this as the first known CISA advisory explicitly citing AI-generated scripts targeting operational technology systems.

Source: CyberScoop

Taiwan's Ministry of Digital Affairs says the attack on government agencies began on 20 July, and Israeli firm Dream, which detected the intrusion, calls it a first-of-a-kind breach. Attackers used open-source AI agents — OpenClaw and Hermes — to build what Dream calls an autonomous hacking tool, one that behaved like a coordinated cyber team.

It compromised at least 85 government accounts, extracted more than 2,500 personnel records, then expanded to Taiwan's nuclear safety agency and at least seven energy companies. Not everyone is sold on the autonomy: Semgrep's Cris Thomas points out that someone still picked the target and set the objective — "it's not totally 100% autonomous."

While Taiwanese officials stopped short of blaming China, Dream said the use of Simplified Chinese in internal communications meant a high probability the operator was connected to China. China's Taiwan Affairs Office did not respond to a request for comment.

MDA says the attack combined manual operations with AI agents, that sources, methods and scope have been fully investigated, and that affected units have completed their handling. New protective guidelines and strengthened monitoring are now in place.

Source: The Guardian

A supply chain attack that exposed more than 2,000 organizations traces back to a compromised Trivy build — not LiteLLM, as initially reported. SOCRadar identified 2,188 organizations with attributable records and found 95% had their data collected before March 24, when the two poisoned LiteLLM releases appeared on PyPI for just 40 minutes.

The real damage started March 19, when TeamPCP force-pushed malicious commits to 76 of 77 trivy-action version tags, using access it had kept after an incomplete credential rotation — Aqua Security's own systems were never breached. Their Shai-Hulud worm harvested credentials, tokens, and API keys, then used stolen developer secrets to spread itself across accessible packages.

It all falls under CVE-2026-33634 — 8.8 high on CVSS v3.1, 9.4 critical on v4.0 — covering Trivy v0.69.4, trivy-action 0.0.1 through 0.34.2, setup-trivy 0.2.0 through 0.2.6, LiteLLM 1.82.7 to 1.82.8, and telnyx-python 4.87.1 to 4.87.2. CISA added it to KEV on March 26, with an April 9 deadline.

Six CI/CD platforms were hit — GitHub Actions, GitLab CI, Jenkins, Bitbucket, CircleCI, and Buildkite — with Germany, Brazil, and France most affected. Stolen data is already up for sale on Telegram.

Source: SecurityWeek

A teenage member of the notorious Scattered Spider cybercrime group has surrendered to authorities in Las Vegas, facing charges including identity theft, extortion, and computer crimes. The arrest comes as the group, along with Lapsus$ and Shiny Hunters, announced they're shutting down operations in a farewell letter posted on hacking forums.

Scattered Spider, known for targeting major companies like MGM Resorts and Caesars Entertainment in 2023, has faced a string of arrests over the past year. The FBI has charged multiple members, including alleged ringleader arrested with $27 million in bitcoin.

Security experts remain skeptical of the shutdown claims, noting continued activity and warning that other threat actors will likely fill any void left behind.

Source: Dark Reading

Cybercriminals are increasingly attacking industrial control systems (ICS) using malicious JavaScript and fake vendor websites. In Q2 2025, 6.49% of ICS computers blocked these web-based threats, making them the top danger to industrial networks.

Attackers send phishing emails with links to cloned vendor portals. When workers click these links, malicious scripts automatically download and create backdoors into critical systems. The criminals then steal credentials and can directly control programmable logic controllers and SCADA systems.

Several attacks caused real damage—one altered chemical processing temperatures, triggering emergency shutdowns. Another disabled safety systems after stealing privileged accounts through fake support portals. Africa and Southeast Asia saw the most attacks, while Northern Europe faced fewer attempts.

Source: Cybersecurity News

Tenable confirmed hackers accessed customer contact details and support case information through a sophisticated supply chain attack exploiting Salesforce-Salesloft Drift integrations. The breach exposed business emails, phone numbers, and support ticket descriptions but didn't compromise Tenable's core products.

This wasn't an isolated incident—the same campaign hit major tech companies including Palo Alto Networks, Zscaler, Google, Cloudflare, and PagerDuty. Attackers specifically targeted vulnerabilities in the integration between Salesforce and the popular sales platform Salesloft Drift.

Tenable responded by revoking compromised credentials, disabling the Drift application, and hardening their Salesforce environment. The company found no evidence the stolen data has been misused yet.

Source: Cybersecurity News

CISA issued an urgent alert Thursday about a high-severity Android zero-day vulnerability (CVE-2025-48543) being actively exploited by attackers. The use-after-free bug in Android Runtime allows hackers to escape Chrome's security sandbox and gain elevated device permissions, potentially installing malware or accessing sensitive data.

The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on September 4, 2025, confirming real-world attacks are underway. Federal agencies must patch by September 25 or stop using affected products.

Google addressed the flaw in its September 1 security bulletin. All Android users should immediately check Settings > System > System update and install available patches to protect against this serious threat.

Source: Cybersecurity News

Jaguar Land Rover has told factory workers to stay home until at least September 9 following a devastating cyber attack that hit the company Sunday. Production has stopped at major facilities in Halewood, Solihull, and Wolverhampton, affecting the UK's biggest car manufacturer during peak sales season.

The hack has severely disrupted global operations, forcing JLR to shut down systems as a precaution. While no customer data appears stolen, thousands of customers can't get new vehicles and repairs are stalled since dealerships can't order parts online.

English-speaking hackers linked to recent UK retail attacks claimed responsibility Wednesday. The same group previously cost Marks & Spencer £300m during a six-week shutdown.

Source: The Guardian