Researchers Detail DifyTap Flaws in Dify That Could Expose AI Chats Across Tenants

Cybersecurity researchers have disclosed details of four vulnerabilities in Dify, an open-source agentic workflow platform with more than 146,000 GitHub stars, that could allow attackers to stealthily read artificial intelligence (AI) conversions from other customers' applications without requiring authentication.

The vulnerabilities have been collectively codenamed DifyTap by Zafran Security.

"Two were critical severity, two required no authentication, and three carried cross-tenant impact on Dify's multi-tenant cloud service, allowing one customer's data to be exposed to another," researchers Ido Shani and Gal Zaban said.

The security defects could have allowed attackers to read private AI chats from other customers' applications, creating a covert exfiltration channel for every message and model response.

They also made it possible to traverse Dify's internal Plugin Daemon API from unauthenticated requests and trigger cross-tenant internal API calls, as well as preview documents uploaded by other tenants and leak files across users within a tenant by attaching another user's file unique identifier.

Separately, Zafran said it also discovered that Dify's file parsing stack relied on a version of PDFium, an open-source C++ library for PDF rendering, that was vulnerable to CVE-2024-5846 (CVSS score: 8.8), a two-year-old use-after-free bug that could allow a remote attacker to potentially exploit heap corruption via a crafted PDF file.

The remaining vulnerabilities are listed below -

• CVE-2026-41947 (CVSS score: 9.1) - An authorization bypass vulnerability that allows authenticated editor users to set and enable trace configurations for any application regardless of tenant ownership.
• CVE-2026-41948 (CVSS score: 9.4) - A path traversal vulnerability that allows authenticated users to manipulate requests forwarded to the Plugin Daemon's internal REST API by exploiting insufficient URL path sanitization and access internal, private endpoints.
• CVE-2026-41949 (CVSS score: 7.5/5.9) - An authorization bypass vulnerability in the file preview endpoint ("/console/api/files/{file_id}/preview") that allows any authenticated user to read up to 3,000 characters of any uploaded document across all tenants and workspaces using only the file's UUID.
• CVE-2026-41950 (CVSS score: 6.5) - An authorization bypass vulnerability that allows authenticated users to read the full contents of files uploaded by other users within the same tenant by supplying an arbitrary file UUID in the files array of a chat-messages request.

The missing tenant ownership checks can be exploited to redirect all messages and responses from victim applications to an attacker-controlled LLM trace provider. It's worth noting that anyone can freely register for a Dify account.

"Consequently, an attacker can configure their own tracing for any application they can access as a client, which includes all publicly accessible applications," the researchers explained. "This allows an attacker to create a persistent exfiltration channel for all messages and responses sent in the application."

Following responsible disclosure, all vulnerabilities barring CVE-2026-41948 have been addressed in version 1.14.2, which was shipped last month. A fix for the pending flaw is expected to be made available in the next release of Dify.

"DifyTap demonstrates where the challenge lies in vulnerability visibility, particularly in container images, where differences between deployments can create visibility gaps that traditional scanners cannot detect," the company said.

from The Hacker News https://ift.tt/di1I2At
via IFTTT

One intrusion, two cyberattackers: Uncovering parallel threat activity

What began as a routine ransomware investigation quickly revealed something far more complex. In this ninth cyberattack series report, DART details how a single intrusion uncovered parallel activity from two unrelated threat actors operating simultaneously—blending tactics, obscuring signals, and challenging traditional assumptions about how multi-stage intrusion campaigns unfold across hybrid environments. Read on to learn more or access the full report.

Read the full cyberattack report

What happened?

The investigation revealed a multi-stage intrusion that blended familiar ransomware activity with quieter, more deliberate techniques designed to establish deep and lasting access. DART found that Storm-2603 had been targeting on-premises SharePoint servers since mid-2025, exploiting known vulnerabilities while simultaneously probing for additional entry points through reconnaissance activity—such as requests for sensitive configuration files often used to validate local file inclusion weaknesses. In this case, initial access was likely attempted through a separate vulnerability, with requests for files like win.ini and web.config, indicating probing for local file inclusion. While exploitation wasn’t confirmed, the timing and activity suggest reconnaissance for entry points.

Once inside, the threat actor shifted focus to persistence and control. Using legitimate tools to blend in, they deployed Velociraptor with SYSTEM-level privileges to map the environment, then established multiple remote access channels through Cloudflare tunneling, Zoho Assist, and Secure Shell (SSH) connections configured through Visual Studio Code. Velociraptor, a legitimate forensic and incident response tool, was deployed by the threat actor to map the environment and operate with high-level privileges—blending malicious activity with trusted administrative behavior. Privilege escalation followed, with new local and domain administrator accounts created to maintain access, while defense evasion techniques—including the use of a vulnerable driver to tamper with memory and disable protections—helped reduce their visibility.

As DART correlated activity across the environment, investigators uncovered signs of a second, unrelated threat actor operating in parallel. Malicious dynamic link library (DLL) sideloading and custom backdoors—techniques not associated with Storm-2603—introduced an additional layer of complexity, obscuring attribution and complicating detection. Together, these overlapping activity streams enabled sustained access while masking the full scope of the intrusion.

Dynamic link library (DLL) sideloading is popular with threat actors because it can be misused to hide behind trusted software (execution looks legitimate), to evade detection by running inside known applications, and to execute payloads, install backdoors, or maintain persistence.

How did Microsoft respond?

DART moved quickly to contain the active intrusion involving multiple threat actors and stabilize the environment, activating a structured response playbook focused on limiting threat actor impact and restoring control. By correlating telemetry across identities, endpoints, and cloud resources, responders established a unified view of the intrusion, enabling them to detect abnormal behavior, uncover credential misuse, and track threat actor activity as it evolved. Continuous coordination with the customer, including daily briefings, ensured that containment actions were timely, aligned, and effective in reducing further threat actor movement.

At the same time, collaboration with Microsoft Threat Intelligence provided critical context that reshaped the investigation. By connecting incident data with broader intelligence, DART identified two distinct threat actors operating simultaneously within the same environment—each masking the other’s activity and complicating detection. Beyond containment, the team delivered targeted guidance to strengthen the organization’s security posture, helping close visibility gaps and improve resilience against future identity compromise and ransomware-driven attacks.

What can customers do to strengthen their defenses?

This case underscores the importance of closing common gaps across exposure, identity, and visibility. Organizations should prioritize rigorous patching and vulnerability management—especially for internet-facing systems—to reduce the risk of initial access. At the same time, strengthening identity security is critical to limiting threat actor escalation and persistence. At a high level, customers can avoid similar cyberattacks by focusing on ways to:

• Establish broad, continuous visibility:
  Deploy endpoint protection widely and retain telemetry centrally to support detection, investigation, and correlation.
• Monitor and restrict trusted tools:
  Validate and oversee the use of remote access, tunneling, and administrative tools that threat actors may exploit for persistence and lateral movement.
• Prepare for rapid, coordinated response:
  Maintain tested incident response playbooks and ensure teams can quickly isolate compromised users, devices, and access paths to reduce dwell time.

Today’s modern cyberattacks can quickly evolve beyond a single incident-blending tactic, spanning environments, and even involving multiple threat actors operating in parallel. For security teams, the takeaway is clear: isolated signals rarely tell the full story. Organizations that invest in connected telemetry, coordinated response, and operational preparedness will be better positioned to detect adversary activity such as credential abuse and lateral movement earlier, contain active intrusions faster, and limit their overall impact.

What is the Cyberattack Series?

In our Cyberattack Series, customers discover how DART investigates unique and notable attacks. For each cyberattack story, we share:

cyberattack series no. 8

Read the report ›

• How the cyberattack happened.
• How the breach was discovered.
• Microsoft’s investigation and eviction of the threat actor.
• Strategies to avoid similar cyberattacks.

DART is made up of highly skilled investigators, researchers, engineers, and analysts who specialize in handling global security incidents. We’re here for customers with dedicated experts to work with you before, during, and after a cybersecurity incident.

Get the full cyberattack report

Learn more

To learn more about DART capabilities, please visit our website, or contact your Microsoft account manager or Premier Support contact. To learn more about the cybersecurity incidents described above, including more insights and information on how to protect your own organization, download the full report.

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity.

The post One intrusion, two cyberattackers: Uncovering parallel threat activity appeared first on Microsoft Security Blog.

from Microsoft Security Blog https://ift.tt/8yHMYm6
via IFTTT

⚡ Weekly Recap: Browser Bugs, EDR Killers, TV Botnet, OpenBSD Flaw, Android Trojan, and More

It’s Monday again.

This week’s threat list looks painfully familiar: abused integrations, fake tools, poisoned websites, ransomware crews trying to shut down security tools, and mobile malware asking for way too much control.

The annoying part is how little of this feels new. Weak credentials, sketchy downloads, browser extensions with too much access, and WordPress sites are used to push more attacks. Nothing clever. Just sloppy, cheap, and effective.

Here’s the Monday recap. Let’s get into the week’s mess.

⚡ Threat of the Week

FortiBleed Campaign Identifies Over 80K Targets — A large-scale campaign codenamed FortiBleed has systematically targeted and compromised Fortinet FortiGate firewall and SSL VPN gateway devices worldwide. According to SOCRadar, it has been running since at least February 2026, with over 80,000 devices identified with working usernames and passwords that have been tested by suspected Russian-speaking threat actors using automated tools running around the clock. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged Fortinet customers with FortiGate appliances to take steps to secure against ongoing malicious activity aimed at thousands of internet-accessible devices. Fortinet also said the campaign likely involves the threat actors reusing credentials from previous incidents, such as CVE-2026-24858, CVE-2025-59718, and CVE-2025-59719, along with employing brute-force techniques against devices with weak password hygiene and no multi-factor authentication (MFA).

🔔 Top News

• Salesforce Disables Klue App Integration After New Extortion Campaign — Salesforce revealed that it disabled the Klue Battlecards app integration within its platform in response to a security incident impacting the competitive intelligence company on June 11, 2026. "Salesforce took this action because our security teams recently detected unusual activity involving the app that may have resulted in unauthorized access to a subset of customer data via the app's connection to Salesforce," the company said. "This issue is limited to Klue's app connection and does not arise from a vulnerability within the Salesforce platform." The development comes as an extortion group dubbed Icarus compromised and exfiltrated data from customers of Klue after obtaining access through a compromised legacy credential associated with an integration service. A number of companies have publicly acknowledged the incident, but noted the impact is limited.
• The Gentlemen RaaS Develops GentleKiller EDR Killer Suite — The Gentlemen ransomware-as-a-service (RaaS) operation is actively developing and maintaining a suite of endpoint detection and response (EDR) killers that it hands out to affiliates for shutting down endpoint detection and response (EDR) products before deploying the encryptor. The centerpiece of the group's EDR-disabling capability is GentleKiller, an in-house developed framework that comes in eight different variants, each one impersonating a different legitimate product and abusing a different vulnerable or malicious kernel driver. GentleKiller targets over 400 processes belonging to 48 security products, including CrowdStrike, SentinelOne, Microsoft Defender, Sophos, Kaspersky, and ESET itself.
• Splunk Flaw Actively Exploited in the Wild — Splunk's Product Security Incident Response Team (PSIRT) said it became aware of "limited exploitation" of CVE-2026-20253, a critical flaw in Splunk Enterprise that could be exploited to conduct unauthenticated file operations and even remote code execution. "In Splunk Enterprise versions below 10.2.4 and 10.0.7, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint," Splunk said. "The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials." In an analysis of the flaw, Resecurity said it's "particularly dangerous" as it can be exploited remotely without authentication or user interaction. "By chaining multiple weaknesses together, an attacker can progress from unauthenticated access to arbitrary file operations and ultimately Remote Code Execution (RCE)," it said. "A successful compromise may expose sensitive logs, credentials, security alerts, and operational data while providing attackers with a foothold for persistence, defense evasion, and lateral movement within the environment."
• Unpatchable 'usbliter8' Exploit Targets Apple A12 and A13 Chips — Security researchers at Paradigm Shift released details of a working exploit dubbed usbliter8 that could be abused to achieve arbitrary code execution inside the SecureROM of Apple's A12 and A13 chips. The vulnerability is classified as a hardware bug residing in the Synopsys DWC2 USB controller, meaning the issue can never be patched. That said, a successful exploitation requires an attacker to have physical access to a vulnerable device. A proof-of-concept for usbliter8 has been made publicly available.
• Operation Endgame Disrupts SocGholish Servers — Dutch law enforcement authorities, along with counterparts from Canada, Germany, and the U.S., have disrupted malicious infrastructure associated with SocGholish and cleaned up nearly 15,000 infected WordPress websites. The takedown is part of Operation Endgame, an ongoing international law enforcement initiative to combat botnets and associated criminal infrastructures. It was launched in 2024. As part of the effort, 106 servers linked to SocGholish have been taken down, and 14,971 WordPress sites have been rid of the infections. Website owners have been notified to update their content management system (CMS), change their credentials, and delete any suspicious accounts.
• Malicious Campaign Fakes Popularity to Deliver Crypto Clipper — A cryptocurrency-stealing malware campaign has been targeting cryptocurrency asset holders and online gamblers by faking its own popularity, dressing up booby-trapped sniper bots and crash-game predictors with bogus GitHub stars, inflated download counts, and artificial intelligence (AI)-narrated YouTube tutorials. The activity has been traced to a Rust-based clipper malware targeting Windows and macOS users. The lures are "edge" tools that promise easy money, crypto sniper bots, and "predictors" that claim to forecast crash-gambling games, aimed at traders and gamblers chasing shortcuts, while a WordPress phishing page acts as the hub, funneling victims to the downloads.
• Rokarolla Android Trojan Combines Banking Fraud with Screen Surveillance — A new "invasive" Android trojan dubbed Rokarolla is being distributed via malicious websites, while masquerading as popular applications like TikTok or Google Chrome. It's designed to target 217 distinct cryptocurrency and banking applications by serving fake overlay login screens, in addition to leveraging 137 commands that grant it complete control of a compromised device. It can harvest lock screen credentials, exfiltrate sensitive contact lists and SMS data, monitor the screen to capture WhatsApp data, take screenshots by abusing Android's accessibility services, redirect cryptocurrency transactions, and utilize keyloggers to continuously record user input. The malware also actively hides its presence from the launcher screen and disrupts user intervention by blocking incoming calls, deploying fraudulent screen overlays, suppressing device audio, and deactivating Google Play Protect. "The infection process begins when a dropper misleads users into installing a secondary payload containing the core malware," Zimperium said. "By masquerading as Google Play Protect, the dropper facilitates the installation of this payload. This strategy allows the malware to evade Android restrictions and exploit Accessibility services."

🔥 Trending CVEs

Bugs drop weekly, and the gap between a patch and an exploit is shrinking fast. These are the heavy hitters for the week: high-severity, widely used, or already being poked at in the wild.

Check the list, patch what you have, and hit the ones marked urgent first — CVE-2026-20262 (Cisco SD-WAN Manager), CVE-2026-54420 (LiteSpeed cPanel Plugin), CVE-2026-48907 (Widget Factory Joomla Content Editor), CVE-2026-4020 (Gravity SMTP WordPress Plugin), CVE-2026-47101, CVE-2026-47102, CVE-2026-40217, CVE-2026-49468 (LiteLLM), CVE-2026-24190 (NVIDIA Display Driver for Windows and Linux), CVE-2026-48558 (SimpleHelp), CVE-2026-39449 (Contact Form to Any API WordPress plugin), CVE-2026-39849, CVE-2026-44693 (Pi-hole FTL), CVE-2026-49980, CVE-2026-41179, CVE-2026-41176 (Rclone), CVE-2026-54157 (@lobehub/lobehub), CVE-2026-48746 (vllm), CVE-2026-48519 (Langflow), CVE-2026-38329 (Bludit CMS), CVE-2026-39949 (Cacti), CVE-2026-8444 (WP Review Slider Pro WordPress plugin), CVE-2026-52697 (Taskbuilder WordPress plugin), CVE-2026-52700 (WCMultiShipping WordPress plugin), CVE-2026-3326 (XStore WordPress theme), CVE-2026-2418 (Login with Salesforce WordPress plugin), CVE-2026-6379 (WP Photo Album Plus WordPress plugin), CVE-2026-2446 (PowerPack for LearnDash WordPress plugin), CVE-2025-15445 (Restaurant Cafeteria WordPress theme), CVE-2026-8443 (WP Review Slider Pro WordPress plugin), CVE-2026-6933 (Premmerce Dev Tools WordPress plugin), CVE-2026-9848 (WP Ticket Customer Service Software & Support Ticket System WordPress plugin), CVE-2026-52707 (Kastell WordPress theme), CVE-2026-52703 (FastDup WordPress plugin), CVE-2026-52706 (JetEngine WordPress plugin), CVE-2026-27429 (Nifty WordPress theme), CVE-2025-69129 (WordPress & WooCommerce Scraper WordPress plugin), CVE-2026-27400 (BookPro WordPress plugin), CVE-2026-8713 (Avada Builder WordPress plugin), from CVE-2026-12437 through CVE-2026-12443 (Google Chrome), CVE-2026-12326, CVE-2026-12327, CVE-2026-12328 (Mozilla Firefox), CVE-2026-8049, CVE-2026-8050 (SignalRGB kernel driver), CVE-2026-20266 (Splunk AI Toolkit), CVE-2026-41293, CVE-2026-43512, CVE-2026-42579, CVE-2026-42584, CVE-2026-43515 (Atlassian Confluence Data Center and Server), CVE-2026-20181, CVE-2026-20190 (Cisco Identity Services Engine and ISE Passive Identity Connector), CVE-2026-48933, CVE-2026-48618 (Node.js), CVE-2026-9862 (Fortra Core Privileged Access Manager), and multiple vulnerabilities in Crawl4AI Docker API (no CVEs).

🎥 Cybersecurity Webinars

• Your Company Is Using More AI Than You Can See. Here’s How to Secure It → AI bots are actively accessing your company’s sensitive data—often without a clear human owner to hold accountable. Join this webinar to learn how to uncover hidden AI tools, lock down their permissions, and safely take back control of your network before a blind spot becomes a massive data breach.
• Machine-Speed Attacks are Here: How to Stop AI-Powered Hackers → Hackers are now using AI to launch lightning-fast, highly convincing attacks that easily slip past traditional security. If your defenses rely on old, 'human-speed' tools, you're already falling behind. Join this critical webinar to see exactly how AI-powered threats operate—and get a clear, practical blueprint to lock down your network and stop machine-speed attacks in their tracks.

📰 Around the Cyber World

• Flaws in SiderAI and MaxAI — Critical vulnerabilities have been disclosed in SiderAI (Spyder) and MaxAI (MaXSS) agentic side-panel Chrome extensions that can allow malicious websites to take screenshots of arbitrary websites or run arbitrary code by taking advantage of the add-ons' permissions. "Abusing these vulnerabilities allows attackers to compromise all browser sessions across any website, leading to the leakage of sensitive information, the invocation of arbitrary commands, and even account takeover," Rebora said. "Furthermore, there was a potential risk of stealing files from the underlying operating system." Both extensions have a "Featured" badge and have been collectively installed nearly 7 million times. Given that the issues remain unpatched, users are recommended to remove them until fixes are in place.
• Israeli Company Linked to Popa Android TV Box Botnet — The Popa Android TV box botnet, which has been used for residential proxy traffic in ad fraud and website scraping, has been attributed to NetNut, operated by publicly traded Israeli company Alarum Technologies. Qurium, along with the Nokia Deepfield Emergency Response Team and Synthient, has found that Popa is a "residential proxy software family that turns consumer devices into internet relay nodes" by means of a software development kit. It's worth noting that Popa was first flagged by QiAnXin XLab in March 2025 as an Android component of the Vo1d botnet. "So Popa is not a traditional downloader or banking trojan, the ultimate goal of the code is just to implement a persistent communications layer capable of registering a device, maintaining long-lived encrypted connections, and opening tunnels on demand," according to the report. "Not differently from many other types of malware, Popa does not connect directly to a fixed command-and-control server. The compromised device starts by connecting a limited set of domain names to later learn where to register and tunnel the traffic." The botnet has impacted millions of consumer TV boxes over the last four years. Alarum, which also maintains RoboVPN, a commercial VPN service that includes a residential-proxy SDK that turns the user's machine into an exit node for third-party traffic. In a statement shared with cybersecurity journalist Brian Krebs, NetNut and Alarum have disputed the allegations, calling them "demonstrably inaccurate assertions and flawed deductions rather than verified facts," adding "the SDKs at issue are designed to facilitate bandwidth-sharing functionality and do not transform user devices into malware-controlled systems or otherwise compromise the devices on which they operate." The development comes weeks after another report from Include Security found that an iOS SDK that Bright Data embeds in consumer apps can turn devices, including always-on smart TVs, into exit nodes that relay web-scraping traffic with users' consent.
• Prinz Eugen Encrypts Recent Files — A new Go-based ransomware called Prinz Eugen has been observed targeting recently modified files for encryption. "It performs recursive encryption, prioritizes recently modified files, uses ChaCha20-Poly1305 with integrity checks, and leaves no ransom note on disk," Malwarebytes Threatdown said. It's suspected that the attackers gain initial access through compromised RDP credentials. The ransomware binary also takes steps to frustrate forensic analysis and recovery. The ransomware has been attributed to an actor called ROOTBOY, who has a track record of selling stolen data on cybercrime forums.
• Okendo Reviews Widget Compromised in SmartApeSG Supply Chain Attack — Okendo Reviews widget, a popular customer review platform used by more than 18,000 brands, is said to have been compromised as part of attacks designed to deploy malware via embedded malicious JavaScript code. The activity, detected on May 14, 2026, has been tied to SmartApeSG, which was previously observed using ClickFix and FakeUpdates lures to distribute NetSupport Manager. "The injected JavaScript used obfuscation, environment checks, and staged execution," Zscaler said. "The SmartApeSG injected JavaScript behaved as a staged loader, and did not attempt to execute every action immediately. Instead, the JavaScript focused on control, reconstruction, and retrieval, which reduced the visibility of the script and gave the operator more flexibility." The end goal of the attacks is to serve bogus ClickFix prompts that lead to malware deployment. In the past, SmartApeSG has also relied on command-and-control (C2) servers hosted on Russian infrastructure providers to communicate with hosts infected with Remcos RAT through fake CAPTCHA prompts injected into websites that instructed users to execute commands copied to the clipboard. Okendo has since addressed the issue and restored the widget script to a clean state.
• AI-Generated Websites Used to Deliver SmartRAT — Typosquatting domains hosting malicious content generated with AI-powered website creation tools are being used to deliver a PowerShell-based malware called SmartRAT (aka Banana RAT). The web page impersonates a Brazilian bank and a ClickFix lure to trick victims into running a PowerShell command that downloads the malware. "Threat actors are leveraging website builders to create convincing lures quickly and at scale, with capabilities ranging from basic credential theft to a ClickFix campaign that delivers remote access trojans (RATs)," Zscaler said. "SmartRAT supports encrypted C2 communications, remote control (screen/keyboard/mouse), credential theft (keylogging and banking overlays), and persistence via scheduled tasks and a Windows service."
• ClickFix Delivers GuLoader — Another ClickFix has been observed using a combination of ClickFix and EtherHiding to deliver malware called GuLoader using a compromised WordPress site as an entry point. "The attack chain combines four distinct components, compromised WordPress, EtherHiding via BSC Testnet, ClickFix social engineering, and GULoader delivery via UNC path, into a single intrusion sequence where every traditional defensive layer has a structural reason to remain silent," Sicuranext said.
• UnregStealer Targets Brazilian Banks — A new purpose-built trojan called UnregStealer has been targeting Latin America (LATAM) financial institutions. Described as a human-operated credential theft campaign, it was first discovered by IBM X-Force in May 2026. "Most LATAM banking trojans rely on automated infection chains and compiled malware, UnregStealer is different," the company said. "trojans rely on automated infection chains and compiled malware, UnregStealer is different. This trojan involves a real operator, who watches each victim's session live and pulls the trigger manually. This variation makes the campaign nearly invisible to sandboxes and behavioral detection systems that never see the payload activate." Attack chains begin with social engineering lures that masquerade as mandatory SSL certificate updates to deliver a PowerShell stager, ultimately resulting in the deployment of a malicious Chrome extension named "Certificado SSL Chrome" that's responsible for data theft and exfiltration. In recent months, LATAM financial institutions have been targeted by a JavaScript adversary-in-the-middle (AitM) framework called OverlordMX that also makes use of a human operator, who monitors victims in real time and manually triggers the necessary overlays to capture credentials. The campaign is assessed to be the work of a Spanish-speaking threat actor. "The attack operates in two stages: a web-inject layer that intercepts sensitive information from the victim, followed by a socially engineered RAT delivery that grants the operator full remote control of the victim’s device," IBM said.
• Pushka Android Malware Detailed — An Android malware called Pushka is equipped to carry out on-device fraud, while granting remote access trojan (RAT) capabilities to the operators by abusing accessibility services. "Pushka can use fake overlay tactics to phish victims' credentials on their mobile devices and can further steal and exfiltrate data from their devices," IBM X-Force said. "Pushka's RAT capabilities can perform actions on behalf of the user, including entering the user's login credentials, and clicking buttons." Pushka was first spotted in September 2025 across different European countries. It uses fake TV apps as decoys to trick users into installing them. The app acts as a dropper, and uses Android's PackageInstaller.Session API to silently install its main payload while bypassing Android 13’s Restricted Settings. "This method replaces the traditional use of Intent.ACTION_INSTALL_PACKAGE and is specifically used to mimic the legitimate installation flow used by the Play Store, allowing the malware to evade the OS-level restrictions introduced in newer Android versions," IBM said.
• Ransomware Ecosystem Consolidates in Q1 2026 — Data from Flare shows that the ransomware ecosystem is "reconsolidating around fewer, more capable operators after a fragmented stretch," led by brands like LockBit, Qilin, and The Gentlemen. The top 10 groups account for 71% of all Q1 2026 victims, with LockBit 5.0 logging 163 victims.
• Australian Bank Accounts Targeted by Extension-Based Trojan — A highly sophisticated browser extension-based banking is targeting Australian banking customers. "This is not a traditional virus designed to crash systems or cause visible disruption," IBM said. "Instead, it is specifically engineered to function as an invisible threat, embedding itself within the browser and operating directly inside the victim's trusted, authenticated session." It comes with capabilities to alter displayed balances, transaction history, and transfer limits; intercept one-time passwords (OTP) before submission; steal active banking session cookies; track visited pages and transaction patterns; and maintain a persistent WebSocket C2 connection for real-time commands. Exactly how the extension is distributed is unclear. "Because the attack runs within a legitimate, authenticated session, it inherits the user’s trust context and security controls, effectively neutralizing traditional protections," the company added.
• Chinese and Russian Influence Operations Use AI to Bypass Bot Detection — In a new report, Two Six Technologies said Russian and Chinese inauthentic accounts are likely using AI to enhance content quality rather than to increase content volume and exhibit fewer bot-like behaviours. "AI is enabling and motivating adversaries to craft better content and more human-like accounts," the company said. "Inauthentic accounts are using AI to add visual appeal to their content. To reach broader audiences, they are probably also using it for translation. Pro-Russia and pro-China accounts now have slower posting speeds, and more pro-Russia accounts are inactive for a long stretch each day, mimicking a human who sleeps."
• Operation Escaneo Targets Mexican Federal and Financial Orgs — A sophisticated campaign targeting Latin American governments and financial institutions has come to light, thanks to an exposed attacker server ("62.171.185[.]97") that revealed the custom tools, exploitation chain, and persistence tactics adopted by the threat actors. "The campaign is characterised by a proprietary distributed reconnaissance engine (Kimera), a curated exploit armory targeting enterprise perimeter devices (Fortinet, Ivanti, Cisco), portable lateral movement toolkits, and layered command-and-control infrastructure using Neo-reGeorg webshells, Chisel reverse tunnels, and compromised Cisco routers with persistent GRE tunnels," CloudSEK said. "The threat actor demonstrated capability to operate across Windows and Linux environments, compromise SAP ERP and Oracle database systems for command execution, extract cryptographic material and Active Directory datasets, and maintain long-dwell access through multiple redundant persistence mechanisms." The activity has been attributed medium confidence to a group called PanchoVilla (aka MexicanMafia).
• GNU Savannah Security Flaw Fixed — The Free Software Foundation (FSF) said it has addressed an exploit demonstrated by Hacktron, alongside additional security issues. "After thorough review, we have found no reason to believe that sensitive project data or credentials were accessed, nor that there has been any compromise of Savannah's software supply chain," the FSF said. "Though the initial security issue was reported to us in early May, the vulnerabilities were discovered in software that was published approximately two years prior. We will be communicating directly with Savannah-hosted projects about steps they can take to review and strengthen the security of their projects."
• 27-Year-Old Authentication Bypass in OpenBSD — Argus said it discovered a 27-year-old authentication bypass flaw in OpenBSD's PPP stack that could be used to sidestep Password Authentication Protocol (PAP) entirely. "OpenBSD's sppp_pap_input function used attacker-controlled length fields as the bcmp comparison length for credential validation," the company said. "Sending zero-length name and password fields caused bcmp to return 0 unconditionally, bypassing PAP authentication entirely." The flaw was introduced in July 1999. A fix was issued on June 14, 2026.
• Abusing AI Features in SQL Server 2025 for C2 — SpecterOps has revealed that it's possible to weaponize native AI features in Microsoft SQL Server 2025, such as sp_invoke_external_rest_endpoint, CREATE EXTERNAL MODEL, and AI_GENERATE_EMBEDDINGS as a practical channel for data exfiltration and C2, assuming an attacker has compromised an account with the sysadmin role in the database. To counter the threat, it's essential to review SQL Server database logins, audit and alert usage of xp_cmdshell, SQL Agent Jobs, and CLR Assemblies, and set up notifications for any changes to sys.external_models or when sp_invoke_external_rest_endpoint is enabled.
• ErrTraffic TDS Exposed — A traffic distribution system (TDS) known as ErrTraffic is being operated under a malware-as-a-service (MaaS) model for bad actors to direct users to ClickFix lures. ErrTraffic is a JavaScript framework that's injected into compromised WordPress sites. It employs the EtherHiding technique as a dead drop resolver to hide its C2 infrastructure within the blockchain. Sekoia's analysis of the framework has identified two distinct clusters of activity: Analytics and Beer. While Analytics interacts with the Polygon blockchain to fetch Vidar Stealer, the Beer cluster distributes several stealer families, including Vidar, Stealc, Remus and Salat. Alternatively, malvertising lures impersonating AI tools like Google Antigravity and OpenAI ChatGPT have also been used by the Analytics cluster to propagate DanaBot and Hijack Loader. A threat actor using the name LenAI has advertised and sold the ErrTraffic framework, with a one-month subscription costing $380. The attackers have also been found to use credential stuffing attacks to gain initial access to WordPress accounts and install PHP backdoors on the sites by masquerading as a must-use plugin.
• Malicious Resumes Lead to Xctdoor Malware — AhnLab has disclosed details of a new campaign that uses malicious Windows Shortcut (LNK) files disguised as resumes that, upon execution, display decoy documents, while dropping additional scripts which then employ DLL side-loading to deploy Xctdoor, a Go-based backdoor previously attributed to North Korean threat actors. "This attack is a method of executing an LNK file disguised as a normal document, using a task scheduler and a startup program to ensure persistence, and then exploiting the normal executable to execute backdoor malware," AhnLab said.
• Bypassing Microsoft Entra Conditional Access Policies — NetSPI said it found a way to bypass Microsoft Entra Conditional Access Policies by abusing Nested App Authentication to return access tokens for the Microsoft Graph API. "It was possible to use certain Nested App Authentication (or BroCI) flows to bypass any Conditional Access policy," security researcher Thomas Byrne said. "This vulnerability served mainly as a persistence mechanism as it would have required a successful phishing attack to return an initial refresh token before the vulnerable authentication flows could be carried out." A fix for the issue has since been rolled out by Microsoft.
• Mexican Financial Sector Targeted by GitBait — At least a dozen Mexican banks have been targeted by a modular phishing infrastructure dubbed GitBait that abuses GitHub-hosted Pages and employs obfuscated scripts and a centralized credential exfiltration via SheetBest API. Per Group-IB, the large-scale campaign has been active for three years. The activity is "built on a fully serverless architecture that abuses GitHub Pages for hosting and the SheetBest API for credential exfiltration — eliminating the need for any dedicated backend infrastructure." It's believed that victims are reached through common phishing delivery channels such as SMS, messaging apps, email, or social media platforms. In all cases, the victim receives a fraudulent URL that directs them to a phishing page impersonating a trusted financial institution. The phishing pages harvest user credentials, payment card details, client identifiers, and passwords through a multi-stage flow that mimics legitimate banking authentication workflows. In some cases, the captured data is exfiltrated to a Telegram bot, marking a deviation from the SheetBest-based mechanism. More than 100 domains associated with the campaign have been identified.
• Email Bombing Leads to Deno-Based Proxy and RAT — A large-scale email flooding campaign is being used as a pretext to target employees with bogus Microsoft Teams calls from an attacker impersonating internal IT support. Victims are then persuaded to download and execute a malicious archive from a fake self-service portal. The archive contains a modular Deno-based Remote Access Trojan and a TCP proxy framework spanning four different JavaScript files. "The JavaScript files implement a Deno-based remote access and tunneling agent," InfoGuard Labs said. "The main backdoor connects to a CloudFront-hosted WebSocket C2 endpoint, registers victim identity metadata, receives commands, and brokers traffic through local helper services." The proxy turns the compromised host into a pivot point for internal network access, allowing the attacker to route traffic through the victim machine.

• Aether → Because advanced malware often evades standard antivirus software by executing directly in a system's RAM, security teams need tools to inspect live memory. Aether is an open-source Windows threat-hunting tool that scans active, running processes for hidden payloads, code injections, and malicious behaviors, using a layered validation model to minimize false alarms during incident response.
• AzureRedOps → It is an open-source offensive security toolkit designed to streamline Microsoft Entra ID and Azure red teaming. It unifies complex workflows—such as multi-flow token management, directory enumeration, and post-exploitation Microsoft Graph actions—into a single command-line interface.

Disclaimer: This is strictly for research and learning. It hasn't been through a formal security audit, so don't just blindly drop it into production. Read the code, break it in a sandbox first, and make sure whatever you’re doing stays on the right side of the law.

Conclusion

This week’s lesson: most attacks do not need a genius move. They need one trusted app, one stale login, one noisy plugin, or one user chasing a shortcut.

The fix starts in the dull places. Cut access. Clean old sites. Question helper tools. Watch the small cracks, because that is where the week usually starts leaking.

from The Hacker News https://ift.tt/ThLmHX0
via IFTTT

AI, VDI and GPUaaS: Rethinking Infrastructure with Apache CloudStack

Organisations are increasingly required to support AI and VDI workloads as part of their infrastructure strategy. This demand is being driven by a combination of factors, including the growth of AI and machine learning workloads, the continued relevance of virtual desktop infrastructure (VDI), and the need to support graphics-intensive applications such as CAD, rendering, and simulation.
Many of these workloads rely on GPUs and other AI accelerators – such as NPUs and FPGAs – which provide the specialised processing capabilities required for parallel computation, inference, and graphical rendering.

At the same time, service providers are exploring GPU-based offerings as a way to expand their portfolios, introducing new consumption models such as GPU-as-a-Service.

In parallel, many organisations are already undergoing infrastructure modernisation. Changes in virtualisation licensing, cost structures, and vendor strategies are forcing a reassessment of existing platforms. This often leads to broader initiatives aimed at improving flexibility, reducing operational complexity, and avoiding vendor lock-in. As a result, infrastructure teams are not only evaluating how to support new workloads, but also how to redesign their platforms to support them more efficiently.

These two trends are converging. AI and VDI workloads are frequently introduced into environments that are already in transition, and are often treated as a separate requirement with dedicated platforms and tooling. While this approach can address immediate needs, it introduces additional layers of complexity and fragmentation over time.

This article examines an alternative approach: treating GPU resources and AI accelerators as part of a unified infrastructure model. Instead of building separate stacks for AI, VDI, and graphics workloads, organisations can integrate these resources directly into their IaaS platform. This enables a consistent operational model across different workload types and deployment environments, including both datacenter and edge scenarios.

The Deeper Problem: Fragmentation at the Resource Layer

The fragmentation of infrastructure is not limited to the use of multiple platforms. It also exists in the way resources are modelled and managed within those platforms.

In many environments, different types of hardware are treated using separate abstractions and operational models. GPUs, for example, are often handled differently from CPU and memory resources, requiring dedicated tooling, specialised configuration, or vendor-specific integrations. The same applies to AI accelerators.

In some architectures, these resources are managed through separate services or control planes, each introducing its own APIs, configuration models, and operational requirements. This creates an additional layer of complexity that goes beyond platform fragmentation.

As a result, infrastructure teams are not only required to manage multiple platforms, but also to operate different resource models for different types of hardware within the same environment.

This leads to a loss of consistency at the infrastructure level. Provisioning, allocation, and lifecycle management are no longer uniform processes. Instead, they vary depending on the type of resource being used, increasing operational overhead and reducing predictability.

A Consistent Resource Model

A more effective approach is to treat all infrastructure resources using a consistent model, regardless of their type.

From this perspective, GPUs and AI accelerators should not be handled as exceptions. They should be integrated into the same resource model used for CPU, memory, and storage.

This requires a consistent approach to device discovery, resource allocation, and lifecycle management across all resource types within the infrastructure.

This approach is implemented in Apache CloudStack by extending its existing IaaS architecture to include these resources as part of the standard framework. Rather than introducing separate services or abstractions, CloudStack integrates them directly into the core platform.

GPUs and AI accelerators are discovered at the Host level and exposed through standard constructs such as Compute Offerings. This allows workloads that depend on these resources to be provisioned using the same mechanisms as traditional virtual machine instances.

At the service level, this model enables GPU resources to be defined as part of standard infrastructure offerings. Service providers and enterprise operators can create Compute Offerings that include specific GPU configurations, making these resources consumable in a controlled and repeatable way.

This is particularly relevant in multi-tenant environments, where resource consumption needs to be standardised, metered, and exposed through clearly defined service tiers. GPU-enabled offerings can be presented alongside traditional compute offerings, enabling consistent provisioning across different workload types.

As a result, there is no need for separate control planes, dedicated orchestration layers, or different operational models depending on the type of resource being used.

This approach enables a consistent infrastructure model where CPU, memory, storage, and GPU resources are managed in a unified way, and where resource consumption is exposed through standardised service offerings. Workloads that require these capabilities can be deployed, scaled, and managed using the same workflows already established for other workloads.

This reduces operational complexity and improves consistency across environments, including both datacenter and edge deployments.

Business Impact: From Infrastructure Capability to Service Delivery

A consistent infrastructure model is not only a technical improvement. It directly impacts how services are designed, delivered, and consumed.

By integrating GPU resources and AI accelerators into the same model used for compute, organisations can move from managing hardware as a special case to exposing it as part of their standard service portfolio.

For CSPs and MSPs: Service Expansion and Monetisation

For service providers, GPU resources represent both a technical capability and a commercial opportunity.

When these resources are integrated into the same infrastructure and service model, providers can extend their portfolio with GPU-enabled virtual machine instances, offer GPU-as-a-Service using existing provisioning and billing models, standardise service definitions through Compute Offerings, and apply quotas, metering, and multi-tenant isolation consistently.

This enables providers to introduce new services without deploying separate platforms or creating parallel operational models.

In practice, this reduces time to market and simplifies ongoing operations. Instead of building and maintaining dedicated platforms, providers can extend their existing cloud infrastructure to support these workloads.

For Enterprises: Standardisation and Operational Efficiency

For enterprise environments, the impact is primarily operational.

Organisations often introduce GPU resources in an ad hoc manner, resulting in isolated environments and inconsistent management practices. Over time, this leads to fragmentation and increased complexity.

By adopting a unified infrastructure model, enterprises can standardise how GPU resources are provisioned and consumed, integrate AI, VDI, and graphics workloads into existing platforms, apply consistent governance and access control, and reduce dependency on specialised or isolated environments.

This improves predictability and simplifies operations, particularly in environments with multiple teams and workload types.

A Shared Outcome: Reduced Complexity and Increased Flexibility

Despite different objectives, both service providers and enterprises benefit from the same underlying outcome: a single platform for multiple workload types, a consistent operational model, reduced infrastructure fragmentation, and greater flexibility in how resources are allocated and consumed.

This allows organisations to evolve their infrastructure without introducing additional layers of complexity.

Takeaway

AI and VDI workloads are often introduced as separate infrastructure challenges, leading to fragmented architectures and increased operational complexity. In practice, these workloads share a common requirement: access to GPU resources and AI accelerators within a consistent and controlled environment.

By integrating these resources into the core infrastructure model, organisations can avoid the need for multiple platforms and specialised operational layers. This enables a unified approach where different workload types are provisioned, managed, and consumed using the same mechanisms.

The result is a more consistent and scalable infrastructure, capable of supporting both current and emerging workload requirements without increasing complexity.

The post AI, VDI and GPUaaS: Rethinking Infrastructure with Apache CloudStack appeared first on ShapeBlue.

from CloudStack Consultancy & CloudStack... https://ift.tt/k3zixVX
via IFTTT

Canada’s Spy Agency Used First-of-Its-Kind Warrant to Clean Botnet-Infected Devices

Canada's spy service got a judge's permission to reach into infected servers, home routers, and IoT gear sitting on Canadian soil and neutralize two foreign-run botnets.

The Federal Court released a public version of the ruling on June 15. It is the first time the Canadian Security Intelligence Service has used its threat reduction warrant powers this way.

The warrant let CSIS alter, degrade, and destroy botnet data on the infected machines and cut the devices loose from the networks.

The targets were Canada-based servers, small office and home office (SOHO) routers, and Internet of Things devices: Ring doorbells, security cameras, TVs, and other Wi-Fi-enabled appliances.

Justice Catherine Kane granted the warrant on May 1, 2024, renewed it that August, and issued the confidential reasons in February 2026. The warrant stayed out of public view for more than two years, until this month's redacted release.

CSIS needed the order because the cleanup would likely have been a crime without it. Reaching into someone else's device and wiping data is computer mischief under the Criminal Code, so the Service needed a judge's sign-off before touching the machines.

The court found the threat to Canada clearly established and imminent, and the measures necessary, reasonable, and proportional. It stressed the operation went after devices, not people: no user identities sought, no content intercepted, any personal data swept up incidentally destroyed.

The two botnets ran the standard relay playbook. A command tier issued the orders; a layer of infected devices relayed the traffic. By routing through hijacked Canadian hardware, a foreign state can look like an ordinary connection, a home worker, or an ISP customer, while it probes critical infrastructure, government, and military networks.

The owner of the infected doorbell gets left looking responsible for traffic they never sent. The court flagged the energy sector among the targets and warned that the adversaries could direct the botnets to probe and potentially disrupt Canadian infrastructure.

The public ruling settles the what: two foreign adversaries, a threat to Canada's security, the court found clearly made out. What it strips is the who. The timing and the technique match a specific moment in early 2024, but The Bureau, which surfaced the ruling, says it cannot tell from the redacted reasons whether Canada's two botnets were both Chinese, both Russian, or one of each. The foreign-state hand is a finding. The flag is the redaction.

Same Tactic, a Different Authority

That moment was a run of court-ordered botnet cleanups in the United States. In a December 2023 operation, the FBI used the botnet's own command channel to delete the KV-botnet malware from hundreds of U.S. SOHO routers, mostly end-of-life Cisco and NetGear boxes that the China-linked Volt Typhoon was using to hide access it had planted ahead of a possible crisis inside American communications, energy, water, and transportation systems.

Weeks later, it ran a near-identical operation against a separate network of Ubiquiti routers that Russia's GRU, the APT28 group, had turned into an espionage relay.

Canada's cyber centre had joined the allied warnings about state actors abusing SOHO and IoT gear. Same court-ordered shape both times: neglected consumer gear, a state operator, a judge signing off on remote disinfection.

The difference is who holds the warrant. The U.S. operations were law enforcement, FBI, and DOJ acting under search-and-seizure authority.

Canada's is an intelligence service using threat reduction measures, the CSIS's power to actively disrupt a threat rather than just collect intelligence on it, written into the CSIS Act years ago and reworked in the National Security Act, 2017, which took effect in 2019. CSIS had never reached for it like this until now.

It Still Comes Down to Old Routers

The lesson for defenders is the boring one. The botnets feed on the gear nobody maintains: end-of-life routers still wired into the network, IoT kits that never took their last firmware update, anything sitting on default credentials with a management panel facing the internet.

A government cleanup does not touch that. In the U.S. operations, the malware came off, but the weaknesses stayed, and a reboot or factory reset could undo the fix and reopen the door to reinfection. Retiring the dead hardware and locking down what stays is on the owner, not the agency that cleaned up after them.

One loose end the public ruling does not close: the application, by The Bureau's account, leaned on IP addresses CSIS had collected without a warrant, weeks after the Supreme Court of Canada held in R. v. Bykovets that an IP address carries a reasonable expectation of privacy.

Whether that squares with CSIS's collection authorities, and whether the owners of the disinfected devices were ever told, stay open.

from The Hacker News https://ift.tt/aFZDcTk
via IFTTT

AryStinger Malware Infects 4,300 Legacy Routers to Build Reconnaissance Proxy Network

A new malware family is turning forgotten home routers into a distributed reconnaissance and proxy network, not the DDoS botnet these devices usually end up in. QiAnXin's XLab calls it AryStinger and counts at least 4,300 infected routers, a total it says is still rising.

The distinction matters. AryStinger exists for the stage of an attack that comes before the break-in. Infected devices scan the internet, fingerprint services, enumerate subdomains, tunnel traffic, and run commands on demand, then ship the results back to the operator.

Each router becomes a footprinting node and a relay that hides where the real attacker is.

Old chips, older bugs

The campaign goes after routers built on Realtek's RTL819X chips, hardware that was current around 2012 to 2015. XLab first saw it on March 12, 2026, spreading from a single IP, 107.150.106.14.

The binary it pushed was a Linux ELF that no engine on VirusTotal flagged, exploiting two flaws from another era: CVE-2013-3307 in Linksys models and CVE-2016-5681 in D-Link ones.

The infected pool is mostly D-Link, with the DIR-850L alone making up about 75 percent. By geography, it skews to South Korea (around 48 percent) and China (around 32 percent), then Sweden, Malaysia, and Singapore.

A second strain appeared on April 26, aimed at QNAP NAS boxes through CVE-2025-11837, a code injection flaw in QNAP's Malware Remover. The bug was shown at Pwn2Own Ireland 2025 and patched in November 2025, months before this strain began using it.

The way in is the appliance's own malware-removal tool. XLab hasn't measured the NAS infections, so the 4,300 figure covers RTL819X routers only.

Two builds, same job

One build is lean, and one is fuller. The router build is written in C and kept light, because the old hardware can't run more, so it sticks to mass DNS scanning and traffic tunneling. The NAS build is written in Go and does much more. It scans internal and external networks and runs recon tools like fscan, ksubdomain, and httpx. A "ScriptWork" task executes attacker-supplied Go, Java, or Python source code on the box, so the operator never has to compile a binary per target.

Each infected node, which XLab calls an Executor, talks to its C2 over HTTP/HTTPS, with Protobuf-encoded traffic obfuscated by a simple XOR (the Go build adds gzip). The operator splits a large scan into chunks and spreads them across the fleet, footprinting in parallel.

XLab says the same DNS scanning can be aimed at resolvers to generate denial-of-service traffic. Persistence comes from a Dropbear SSH server on a fixed port, 2332 on routers, or gs-netcat on NAS. The hardcoded key, sh_#@!_2024_secret, carries a "2024" that may point to a 2024 start, though XLab can't confirm it.

Where this fits

The shape is familiar. In May 2025, the FBI and Justice Department tore down the 5socks and Anyproxy services, which had turned years-old Linksys and Cisco routers running TheMoon malware into residential proxies sold by the month. The espionage version looks much the same.

Mandiant has tracked operational relay box networks, or ORBs: meshes of compromised end-of-life routers and IoT that state actors use to scan and relay while staying hard to trace. Recent router ORBs like LapDogs farm devices through n-day bugs the way AryStinger does.

AryStinger isn't pinned to anyone yet, and XLab says it's still working on who is behind it. What's clear is the model: forgotten hardware, ancient CVEs, turned into quiet infrastructure for the opening moves of an intrusion.

What to do

If you run any of the affected gear, the checks are simple. Look for outbound connections to AryStinger's C2 and download domains (the ajb8.com and related hosts in XLab's IOC list), check /tmp/bin for binaries you didn't put there, and look for processes named syswapd0h or syswapd0w.

The durable fix is the one everyone keeps repeating: retire end-of-life routers that no longer get firmware, and turn off remote administration on anything exposed. A box that stopped getting patches in 2016 is not going to start now.

from The Hacker News https://ift.tt/MWLVP49
via IFTTT

INTERPOL Warns Phishing, Ransomware, and AI Scams Are Rising Across Asia-Pacific

A new report from INTERPOL has revealed a "dramatic increase" in cybercrime in Asia and the South Pacific, fueled by rapid digitalization, internet penetration, new technologies, organized criminal networks, and a disparity in cybersecurity maturity.

According to INTERPOL's 2025/2026 Asia and South Pacific Cyberthreat Assessment Report, phishing has emerged as the most widespread and financially damaging form of cybercrime, with a third of countries in the region reporting more than 10,000 cases between January 2024 and March 2025. In all, over half of INTERPOL member countries have reported that cybercrime accounted for no less than 30% of all crimes recorded nationally.

"The findings in this report highlight a rapidly evolving cyber threat landscape across Asia and the South Pacific, where cybercriminals are leveraging artificial intelligence, ransomware-as-a-service models and sophisticated social engineering techniques on an industrial scale," Neal Jetton, INTERPOL Cybercrime Director, said in a statement.

"As digital adoption accelerates across the region, strengthening operational cooperation, information sharing, and cyber resilience remains essential to protecting communities and critical infrastructure."

The growing sophistication of cybercriminal tradecraft has led to a surge in ransomware attacks, as well as deepfake and artificial intelligence (AI)-driven scams that involve impersonating business executives to authorize fraudulent transactions. The region is estimated to have registered more than 135,000 ransomware-related attacks in 2024. A vast majority of the incidents impacted the real estate, manufacturing, and financial services sectors.

This has been complemented by the industrialization of cyber-enabled scams by transnational organized crime syndicates in countries like Cambodia, Laos, Myanmar, and the Philippines, who have set up extensive scam centers that make use of forced labor to carry out investment scams, preying on people across the world after building friendly or romantic relationships with them.

"Organized crime in Myanmar, Cambodia, and Laos used deepfakes in 'romance baiting' scams, blending AI personas and social engineering to fuel $37 billion in regional cybercrime losses," INTERPOL said.

Some of the other regional trends captured by the report include the following - 

• Banking trojans and information stealers materialized as the second most prevalent type of cybercrime, with malware families like RedLine, Lumma, LokiBot, Negasteal, and ZBot taking up the top spots.
• 5.5 out of every 1,000 individuals in the Asia and South Pacific region clicked on phishing links monthly, nearly double the global average of 2.9 per 1,000.
• Distributed denial-of-service (DDoS) attacks surged by 92% in 2024 compared to the previous year.
• System intrusions accounted for approximately 80% of all data breaches in 2024.
• Use of deepfake technology for sexual exploitation, blackmail, or coercion.
• Exploitation of misconfigured systems, weak encryption, insecure APIs, and insufficient monitoring to breach target networks.
• Ransomware groups weaponize companies' regulatory obligations to intensify pressure during extortion attempts.

"In response, law enforcement organizations across the region – supported by INTERPOL – are scaling up joint efforts to combat cybercrime," INTERPOL said. "These include the coordination of operations against cybercriminal infrastructure, collaborative investigations, specialized training initiatives, and the creation of policies to improve cyber resilience."

from The Hacker News https://ift.tt/4yn2lxG
via IFTTT

Focus on what you can control

SUMMARY: On Father's Day, how would you explain some of the volatility of the AI market to your father? What advise might he give you to navigate the ups and downs and uncertainties?

SHOW: 1038

SHOW TRANSCRIPT: The Enterprise AI Show #1038 Transcript

SHOW VIDEO: 

SHOW SPONSORS:

• ShareGate - ShareGate Protect. Microsoft 365 Governance, we got this!
• Nasuni - Activate your data for AI and request a demo
• OutShift by Cisco - “Scaling Out Superintelligence”  The Internet of Cognition architecture

SHOW NOTES:

• Leaked documents show OpenAI is losing billions
• Anthropic’s Fable and Mythos models banned from non-US foreign nationals
• The AI layoff wave is becoming a powder keg
• Professors says AI-related job losses are inevitable

THESIS: On this Father’s Day, with an AI market that often times doesn’t make any sense, I thought about the type of advice that my father gave me over the years and how it would apply to this time of significant change.  

• Show up, keep up and shut up
• Make yourself invaluable
• Focus on what you can control
• Be an expert in something
• When in doubt, get closer to people and how money is made
• When things don’t make sense, focus on fundamentals
• Markets can be irrational way longer than you can be solvent
• Try and think a couple steps ahead

FEEDBACK?

• Email: show @ the enterprise ai show dot come
• Bluesky: @TheEntAIShow.bsky.social
• Twitter/X: @TheEntAIShow
• Instagram: @TheEntAIShow

from The Cloudcast (.NET) https://ift.tt/2MwgtdX
via IFTTT

The Gentlemen RaaS Uses GentleKiller EDR Framework Targeting 400 Security Processes

The Gentlemen ransomware-as-a-service (RaaS) operation is actively developing and maintaining a suite of endpoint detection and response (EDR) killers that it hands out to affiliates for impairing system defenses before deploying the encryptor.

This mature portfolio of EDR-terminating tools is centered around a framework that's known as GentleKiller.

"They also incorporate third-party or leaked tools such as HexKiller, ThrottleBlood, and HavocKiller," ESET security researcher Jakub Souček said in a report shared with The Hacker News. "These tools are standardized through a shared defense-evasion layer, impersonating predominantly security vendors using fake version information, and copied legitimate certificates and icons."

The Slovakian cybersecurity company also called out the ransomware crew for its ability to "unusually quickly operationalize" newly disclosed proof-of-concept (PoC) exploits related to an attack technique called the bring your own vulnerable driver (BYOVD) technique, in many cases within days of their public release.

Since its emergence in March 2025, The Gentlemen has swiftly risen up the ranks and made a name for itself as one of the most active ransomware groups. Per data from Ransomware.live, the group has claimed 504 victims to date, with most of them located in Southeast Asia, South America, and Western Europe.

Recent reports from cybersecurity journalist Brian Krebs and PRODAFT have revealed that a 36-year-old Russian national named Alexander Andreevich Yapaev (aka hastalamuerte) has been leading the operation, after acting as an affiliate for other ransomware schemes, including Qilin.

ESET has described The Gentlemen as one of the most technically agile RaaS groups, using a set of techniques to ensure that the compiled EDR killer samples sidestep detection. This includes binary protection using Enigma or Themida and using file names that resemble well-known cybersecurity vendors, right down to their version information, digital signatures, and icons.

The most prevalent of them is GentleKiller, which comes in eight different variants, each mimicking a different legitimate product and abusing a different vulnerable or malicious driver as part of the BYOVD attack. GentleKiller specifically looks for 400 processes associated with 48 distinct security programs from a number of vendors.

The list of drivers exploited by each of the variants is as follows -

• Kaspersky ("eb.sys")
• FACEIT Anti-Cheat ("nseckrnl.sys")
• Valorant ("GameDriverX64.sys")
• Javelin ("stpm_old.sys" or "stpm_new.sys")
• WatchDog ("dmx.sys")
• Network Blocker ("360netmon_wfp.sys")
• Cleaner ("IMFForceDelete.sys")
• G11 ("PoisonX.sys")

It's worth noting that the abuse of "PoisonX.sys" has been recorded in recent months in connection with various BYOVD attacks, one of which was used to kill CrowdStrike Falcon EDR. A second campaign, detailed by Huntress, involved an intrusion in which unknown threat actors leveraged BeyondTrust Remote Support to successfully deploy ransomware on the network, but not before terminating security tooling via "PoisonX.sys" and "hrwfpdrv.sys."

"When abstracting away the impersonation layer and the specific drivers used, the underlying code reveals numerous structural and behavioral commonalities that strongly suggest the use of a shared development template," Souček said.

"This design prioritizes ease of deployment and operational flexibility for affiliates, while minimizing development effort for the operators. It allows The Gentlemen operators to integrate abused drivers into their toolset very soon after an EDR killer PoC is disclosed."

The third-party, BYOVD-based EDR killers employed by the group are below -

• HexKiller ("googleApiUtil64.sys"), a tool previously assumed to be exclusive to the Warlock ransomware gang
• ThrottleBlood ("ThrottleBlood.sys"), a tool observed in attacks mounted by MedusaLocker and DragonForce affiliates 
• HavocKiller or HwAudKiller ("havoc.sys")

ESET said it also detected a Rust-based credential stealer codenamed OxideHarvest (aka buildx641) that's capable of harvesting data from popular web browsers, including Google Chrome, Microsoft Edge, Torch, Comodo, Epic Privacy Browser, Vivaldi, Brave, Opera, OperaGX, Mozilla Firefox, Waterfox, BlackHawk, and IceCat.

"While most ransomware gangs continue to delegate EDR killing to affiliates, Gentlemen has chosen to centralize this function by offering affiliates a ready-to-use, standardized EDR-killer suite," ESET said. "This decision makes Gentlemen an attractive operator for affiliates as it materially lowers the entry barrier for them, making their job consequently easier."

The disclosure comes as the CERT Coordination Center (CERT/CC) issued an advisory about multiple vendor-signed UEFI applications being vulnerable to Secure Boot bypass via a BYOVD attack. ESET researcher Martin Smolár has been credited with researching and reporting the vulnerability. The impacted applications are from Acer, AMD, ASUS, ECS, Getac, GIGABYTE, Toshiba, and Uniwill.

"If a target system trusts the affected vendor's certificate, an attacker [with administrative privileges or physical access] can exploit these applications to execute arbitrary code during the early pre-boot phase before the operating system initializes," CERT/CC said.

"To mitigate this risk, system administrators should apply updates to the UEFI Forbidden Signature Database (DBX) that revoke trust in the affected vendor-signed binaries, preventing these vulnerable applications from executing during the boot process."

from The Hacker News https://ift.tt/l9x3oFG
via IFTTT

AutoJack Attack Lets One Web Page Hijack AI Agent for Host Code Execution

Microsoft researchers have detailed an exploit chain, named AutoJack, that turns an AI browsing agent into a delivery vehicle for remote code execution.

Steer the agent to load an attacker's web page, and that page's JavaScript can reach a privileged local service on the same machine and spawn a process on the host.

No credentials, no sign-in screen, and no further user interaction once the agent loads the page. The attacker only has to get the agent to open it, and a planted link, a URL field, or a prompt injection will do.

The flaw sits in AutoGen Studio, the open-source prototyping interface for Microsoft Research's AutoGen multi-agent framework. This is not a bug that hits everyone who installs the package, and the packaging detail is worth getting right.

A plain pip install autogenstudio pulls the current stable release, 0.4.2.2, the build Microsoft inspected, and it has no Model Context Protocol (MCP) route at all.

That is the basis for Microsoft's statement that the vulnerable MCP WebSocket surface "was never included in a PyPI release." It holds for the stable build. But the vulnerable handler did ship to PyPI, in two pre-release builds, 0.4.3.dev1 and 0.4.3.dev2.

The Hacker News downloaded and inspected both. The MCP WebSocket route is present, the handler takes the command to run straight from the request, and it does not authenticate the caller. Neither build has been yanked.

pip does not install pre-releases unless you pass --pre or pin the version, so a plain install was never exposed. Anyone who installed one of those pre-releases was. There is still no PyPI build carrying the main-branch hardening for them; the fixed code is in GitHub main at commit b047730.

How the chain works

AutoJack chains three weaknesses in the MCP WebSocket.

First, the socket trusted localhost, a check meant to block a normal browser pointed at a malicious site. But a browsing agent running on the same box is localhost, so anything it loads inherits that localhost identity and passes the check.

Second, the authentication middleware skipped MCP paths on the assumption that the handler would verify tokens itself. It never did, so the socket accepted unauthenticated connections regardless of the configured auth mode.

Third, the endpoint took a command straight from a request parameter and ran it, with no allowlist on which executable could launch.

Put together, a page on the open internet, rendered by a local agent, could run an attacker-chosen command under the account running AutoGen Studio.

Microsoft describes this as research, not an active campaign, and reported no exploitation in the wild. The proof of concept used a "Web Content Summarizer" agent that, when fed an attacker URL, pops calc.exe on the developer's desktop, launched by the AutoGen Studio process.

Microsoft reported the behavior to the Microsoft Security Response Center, and the maintainers hardened the main branch in commit b047730 (PR #7362). The fixed handler no longer reads the command from the URL; parameters are stored server-side behind a one-time session ID, and unknown IDs are refused. MCP routes now run through the normal authentication path. That hardening has not landed in a PyPI release yet.

What to do

A plain pip install autogenstudio gives you 0.4.2.2, which has no MCP route, so you are not affected.

If you installed a pre-release, you have the vulnerable handler and no patched PyPI build to move to. Pull from GitHub main at or after commit b047730. That is the real fix.

Until there is a release, separate the pieces the attack needs. Do not run AutoGen Studio on the same machine as a browsing or code-execution agent that touches untrusted content, because the chain only works when both share the same localhost. If they have to run together, isolate them in separate containers or VMs and run AutoGen Studio under a low-privilege account.

The AutoGen Studio bugs are patched in the source. The pattern is not. Microsoft expects the same shape in other agent frameworks: a local service with too much power, a localhost check treated as security, and an agent that opens untrusted pages.

THN saw it last month in ChatGPhish, where ChatGPT's page summaries became a phishing vector. Microsoft made a similar localhost argument in its Semantic Kernel RCE research, tracked as CVE-2026-26030 and CVE-2026-25592.

Another localhost check is not enough. Authenticate the control plane, keep process execution behind an allowlist, and give the agent an identity that is not the developer's own session. Once an agent can browse the open web and reach privileged local services, localhost is no longer a trust boundary.

from The Hacker News https://ift.tt/YM49lCT
via IFTTT