17 casos · pág. 1/1
Threat actors are abusing the open source AI platform Cairn, an agent-coordination engine usable as an autonomous penetration testing tool, to automate attacks on hundreds of websites worldwide. AI security firm Norforge found the activity after threat actors left their Cairn panels exposed, following a Gambit Security report on attackers…
A Chinese-speaking operator used the open-source AI agent framework Cairn to run autonomous attacks against more than 1,200 sites, reaching websites of over 100 companies, including Deere, SharkNinja and Cummins. Researcher Snorre Fagerland of NorForge found the operation around 2 October 2026 by scanning for about two dozen exposed Cairn…
A Chinese-speaking operator used autonomous AI agents on the open-source Cairn platform to compromise the websites of more than 100 companies. NorForge tracks the most active campaign as AIA0001: over 1,100 attack projects across 14 dashboards, and more than 1,200 break-in attempts overall. Targets were e-commerce businesses in the United…
On 24 September 2026, GreyNoise observed a malicious actor using 149.104.78.141 to attempt pre-disclosure zero-day exploitation of a Citrix NetScaler Gateway on a Project Swarm participant sensor. No CVE-specific detections existed at the time, but behavioral detections labeled the activity malicious within seconds. The attempt failed to …
This SentinelOne weekly roundup covers law enforcement wins and two major breaches. A federal court sentenced former U.S. Army soldier Cameron John Wagenius to 70 months for attacks on technology and telecom firms, and former U.S. Air Force members Chijioke Timothy Odimegwu and Harafat Mogaji received a combined 189 months for business em…
The Rank Math PRO WordPress SEO plugin was hit by a supply chain attack. Some packages of version 3.0.123 contained malware that could let attackers take over websites once the plugin was activated. Users who downloaded or updated the plugin between October 15, 2026 20:02 UTC and October 16, 2026 07:12 UTC may be infected. Rank Math remov…
A supply-chain attack compromised Rank Math PRO (WordPress SEO plugin) version 3.0.123, downloaded from the vendor's official website between October 15 20:02 UTC and October 16 07:12 UTC. The trojanized package planted persistent, self-recreating hidden backdoors on sites where it was activated, and exposed database credentials, API keys…
Rank Math disclosed that copies of Rank Math PRO, the paid WordPress SEO plugin, downloaded from rankmath.com or delivered as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16, 2026 contained malware. Any site that installed and activated an affected copy should be treated as compromised. The malware can recreate its hid…
TeamUpdraft, developer of UpdraftPlus, detected unauthorized access to teamupdraft.com over the weekend of 17-18 October 2026 and believes the attacker accessed its customer database. The database held customer and billing details, order history, two-factor authentication settings, and connection keys for UpdraftCentral, UpdraftVault and …
This weekly recap covers several concurrent incidents. ConnectWise disabled seven application identities and suspended Cloud Backup after unknown actors abused them to compromise Microsoft 365 tenants. China-nexus Armory Castle (UNC5221 / Warp Panda) exploited BeyondTrust Remote Support flaw CVE-2026-102764 (CVSS 9.3) as a zero-day in lat…
Google warns that Armory Castle, a suspected PRC state-sponsored espionage actor, exploited the critical BeyondTrust Remote Support vulnerability CVE-2026-102764 (CVSS 9.3) in August 2026, well before BeyondTrust disclosed it on October 15. The actor escalated privileges to root and established persistent access on compromised appliances.…
Cloudflare published defensive guidance following the disclosure of actively exploited Citrix NetScaler vulnerabilities. CVE-2026-88771 allows unauthenticated command execution on affected appliances, including in the default configuration. CVE-2026-88772 affects configurations using DTLS. Citrix's September 27, 2026 bulletin reported obs…
Mandiant and GTIG attribute exploitation of the critical BeyondTrust Remote Support zero-day CVE-2026-102764 to Armory Castle (formerly tracked as UNC5221), a likely Chinese government-backed espionage group. BeyondTrust dates the first known exploitation to Aug. 29 and says it detected and contained the activity Sept. 28. Only a small nu…
Microsoft Threat Intelligence reports active exploitation of CVE-2026-73570, a command injection flaw in Zimbra Collaboration Suite that allows unauthenticated, zero-click compromise of internet-facing email servers. Attackers deployed webshells, escalated privileges, harvested authentication secrets and staged mailbox data across organiz…
Kaspersky GERT reports that the NightEagle APT (also tracked as APT-Q-95), active since at least 2023 and previously focused on Asia, is now attacking businesses in Russia. The attackers usually gain access through compromised valid credentials on corporate VPNs, connecting from Russian IPs tied to Cloudflare WARP tunnels and from Europea…
GreyNoise reports that a single malicious cyber actor, tracked since 7 May 2026, is a suspected Chinese speaker working in UTC+8 and is the same as or related to Red Heron (reported by Acronis), based on the shared C2 domain, malware family, Gitea exploitation and other TTPs. The actor exploited the wp2shell WordPress chain (CVE-2026-6303…
Unit 42 reports a campaign, tracked as CL-UNK-1211, that targeted government entities and state-affiliated infrastructure between October 2025 and April 2026. The cluster has not been attributed to a nation-state or to cybercrime. The attackers focused on Linux servers for reconnaissance, persistence and intelligence collection, including…
