Suspected AI-driven zero-day attack hits German municipality Tangerhütte via Innocon software
The German municipality of Tangerhütte (Saxony-Anhalt) was hit by a cyberattack that its software provider Innocon believes was carried out with artificial intelligence. Attackers exploited a previously unknown vulnerability in Innocon software behind the municipality's digital town hall, according to an MDR investigation. A municipal IT employee spotted the irregularities the next morning, isolated the affected server and took it offline, which made the digital town hall unavailable. If confirmed, this would be the first publicly reported AI-driven attack on a German municipality, but the claim currently rests on the provider's own analysis and has not been independently verified.
Detalhes técnicos
- Innocon CEO Hagen Woecht described the flaw as a zero-day: it was unknown to the company and its testers, and no patch existed at the time of exploitation. No CVE is cited.
- The attack began overnight.
- Innocon classified the attack as AI-driven after reviewing server logs on an isolated machine. Commands ran too fast to be manual, even by copy-pasting prepared commands. The attack code also appeared to be written and modified during the intrusion, suggesting it adapted to the target environment rather than running a static script.
- Researchers interviewed by MDR called the explanation plausible but had not examined the logs themselves. The Saxony-Anhalt State Criminal Police Office could neither confirm nor deny AI use while its investigation continues.
- According to Innocon, the attackers accessed only test accounts and obtained no real citizen data. Police are still investigating suspected data spying.
- Four other municipalities took their digital town halls offline as a precaution after Innocon notified customers. Innocon found no sign they were attacked.
- BSI Vice President Thomas Caspers warned that AI can speed up vulnerability discovery and exploitation, potentially hitting hundreds or thousands of systems at once, and may let less skilled attackers run more sophisticated operations.
Remediação
The article describes only containment: the affected server was isolated and disconnected from the internet, and other Innocon customers took their digital town halls offline as a precaution. It does not mention a patch.
Linha do tempo
-
Suspected AI-driven zero-day attack hits German municipality Tangerhütte via Innocon software
ler a análise desta fonte ocultar
The German municipality of Tangerhütte (Saxony-Anhalt) was hit by a cyberattack that its software provider Innocon believes was carried out with artificial intelligence. Attackers exploited a previously unknown vulnerability in Innocon software behind the municipality's digital town hall, according to an MDR investigation. A municipal IT employee spotted the irregularities the next morning, isolated the affected server and took it offline, which made the digital town hall unavailable. If confirmed, this would be the first publicly reported AI-driven attack on a German municipality, but the claim currently rests on the provider's own analysis and has not been independently verified.
Technical Details
- Innocon CEO Hagen Woecht described the flaw as a zero-day: it was unknown to the company and its testers, and no patch existed at the time of exploitation. No CVE is cited.
- The attack began overnight.
- Innocon classified the attack as AI-driven after reviewing server logs on an isolated machine. Commands ran too fast to be manual, even by copy-pasting prepared commands. The attack code also appeared to be written and modified during the intrusion, suggesting it adapted to the target environment rather than running a static script.
- Researchers interviewed by MDR called the explanation plausible but had not examined the logs themselves. The Saxony-Anhalt State Criminal Police Office could neither confirm nor deny AI use while its investigation continues.
- According to Innocon, the attackers accessed only test accounts and obtained no real citizen data. Police are still investigating suspected data spying.
- Four other municipalities took their digital town halls offline as a precaution after Innocon notified customers. Innocon found no sign they were attacked.
- BSI Vice President Thomas Caspers warned that AI can speed up vulnerability discovery and exploitation, potentially hitting hundreds or thousands of systems at once, and may let less skilled attackers run more sophisticated operations.
Remediation
The article describes only containment: the affected server was isolated and disconnected from the internet, and other Innocon customers took their digital town halls offline as a precaution. It does not mention a patch.